Slashdot Mirror
Yahoo Says Forged Cookie Attack Accessed About 32 Million Accounts (cnet.com)
It looks like Yahoo has yet to reach its lowest point. The company revealed today via a regulatory filing that about 32 million user accounts were accessed by hackers in the past two years using forged cookies that allowed them to log into their accounts without passwords. According to Yahoo, the attack is likely connected to the "same state-sponsored actor believed to be responsible for the 2014 [breach]," which resulted in the theft of user information from 500 million user accounts. CNET reports: "Based on the investigation, we believe an unauthorized third party accessed the company's proprietary code to learn how to forge certain cookies," Yahoo said in its annual filing to the Securities and Exchange Commission. The company went on to say that forged cookies have been invalidated to prevent further use on accounts. Yahoo revealed the attack in December but the news was largely overlooked because the company announced at the same time it had identified a separate security breach that took place in 2013 in which hackers stole information on 1 billion Yahoo accounts. Yahoo CEO Marissa Mayer also revealed today that she is giving yahoo employees her annual bonus to make up for the massive hacks.
So Yahoo had a backdoor that allowed them to get into any account from anywhere? Session data should expire and if you're encrypting a password and putting that into a cookie you still need the password to do it, so this is a backdoor since you don't need the password to do it?
Om nom nom ...
I know for sure I am safe, because I haven't logged in to Yahoo in a while...
that Yahoo! took so long to figure out this was happening...
32 million...to put that into perspective, that's more than the population of Texas, not quite as many as the population of California.
Or, put another way, that's about the combined populations of Illinois and Pennsylvania.
Way to go, Yahoo.
Just cruising through this digital world at 33 1/3 rpm...
These vulnerabilities were of course in Yahoo's major service, not some minor service few people used or thought about. In other words, Yahoo mail is probably the number one thing Yahoo should have been thinking about when it comes to security. It also appears likely that these vulnerabilities were simple enough that a dedicated security professional reviewing their systems full time would or should have caught the mistakes, or at least mitigated the risks by pointing out that passwords weren't properly salted and hashed (for the 1 billion hack). It really looks like they could have prevented these by hiring one good security professional; and somebody working remote would have cost them $150K/year, someone in California maybe $300K.
So essentially they chose to lose $350 million in value rather than prevent the losses by spending $150K-$300K on a competent security person.
to be a nonissue. That just shows how bad their security is. They're almost as bad as Microsoft.
You're being too harsh. This isn't even close to as bad as Microsoft.
I think I have an account or two, can't remember.
This is what happens when you run software designed to spy on people and then expect the agency to clean up the mess without a trace when they're done. If you've ever seen a search and seizure, it's no different in the tech world. Instead of clothes thrown everywhere, it's holes in security. Yahoo really fucked up with that. They should of said "no, get a warrant," or whatever legal procedures there are. I'm referring to this: http://reuters.com/article/idUSKCN1241YT. You know damn good and well this wasn't just "grep" being used on a Yahoo admin level. They tore shit up and left like agencies always do. Even for arguments sake, let's say the agency has suffisticated tech (they do; Prism) with very little fingerprint, you can't expect Yahoo to hold the same standards, especially with that many accounts. Data will break and cookies will leak. Do they not have SSL at Yahoo or did that not hold either?
For a struggling company, every ounce of effort goes to getting customers because if you don't succeed in that area the company dies anyway. Effort expended on security is not noticed by the customer unless some pesky security researcher comes by and makes a fuss about it.
They're like 1990's Microsoft
I have one Yahoo account I still use for junk and 1 or 2 more that I don't use.
Keep the Classic Slashdot.
> If you give 32 million people (that is, each Texan) a Chevy Bolt each
That would be Californians who a) drive tiny electric cars and b) expect someone to give them a car. Texans buy their own pickup trucks.
They *should* have had a good security team as you describe.
There is a reason I pointed out these are simple, obvious mistakes on their primary service - including not hashing passwords properly, and doing authentication cookies wrong. These are things we check for if a customer orders a $500 security assessment. (Which is basically Nessus + our own scripts + an hour of manual investigation). Problems of this level are the things one engineer should find in a cheap assessment that takes just a couple hours. One decent professional hired by Yahoo would probably find in their first week on the job.