Slashdot Mirror

← Back to Stories (view on slashdot.org)

Hacker Selling Data For 200 Million Yahoo Users On The Dark Web (softpedia.com)

Posted by BeauHD on from the personal-details dept.

An anonymous reader writes from a report via Softpedia: A listing was published today on TheRealDeal Dark Web marketplace claiming to be offering data on over 200 million Yahoo users, sold by the same hacker that was behind the LinkedIn, Tumblr, MySpace, and VK data dumps. In statements to Softpedia, Yahoo said it was investigating the breach, but based on the seller's reputation, it is very likely the data is authentic. The data is up for sale for 3 Bitcoin (approximately ~$1,800), and based on the sample the hacker provided, the data dump includes details such as usernames, MD5-hashed passwords, and dates of birth for all users. For some records, there is also a backup email address, country of origin, and ZIP code for U.S. users. The hacker, called Peace, has also told Softpedia that he previously made $50,000 from the LinkedIn breach alone, and over $65,000 in total from all breaches.

6 of 65 comments (clear)

  1. MDWhat? by cloud.pt · · Score: 4, Insightful

    You gotta be kidding me, they're storing passwords as MD5 hashes... There goes my spam Yahoo mail account. Anyone got good alternatives that aren't Google bound?

    1. Re:MDWhat? by TFlan91 · · Score: 3, Interesting

      I was thinking the same thing... How is the world is a company the size and age of Yahoo still using MD5 to store passwords...

      It takes at most 2/3 hours to setup some type of blowfish hashing scheme.

      Rule #1 when dealing with encryption: someone else has done it before and has done it better. Never rewrite the wheel. (Unless you are an actual expert in the field)

    2. Re:MDWhat? by hcs_$reboot · · Score: 3, Funny

      No, they're actually clear text passwords. Yahoo users just enjoy having 32 random hex chars passwords.

      --
      Slashdot, fix the reply notifications... You won't get away with it...
    3. Re:MDWhat? by geekmux · · Score: 5, Insightful

      You gotta be kidding me, they're storing passwords as MD5 hashes... There goes my spam Yahoo mail account. Anyone got good alternatives that aren't Google bound?

      And you're concerned here why exactly?

      Being worried about how to secure your spam hole is kind of like putting a lock on the outhouse door to protect your shit.

      Literally.

  2. Re:What? by mwvdlee · · Score: 5, Funny

    I just think it's nice somebody will be using my account again.

    --
    Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
  3. One word: Subsidiaries by ZorinLynx · · Score: 2

    If you use Flickr, that's Yahoo. And Flickr is a pretty good service for photographers.

    That's just one example; these big companies usually own "smaller" sites that you might use without even knowing it's the big company behind the scenes.