Yahoo Email compromised?

[kas]

My mom found out just today that all her Yahoo emails were deleted and so were her contacts. I suspected she was hacked and got her in touch with an online Yahoo representative to get her emails and contacts back. However she lost all her emails (were not able to retrieve them as they ask for what date to retrieve from so we said the last day she checked the email which was 2 days ago and said 1pm. However we do not know at what times or how often Yahoo saves a back up so after that didn't work and it was time to try to get back the contacts I typed in Wed for her (5 days ago instead of 2) and the contacts were able to be retrieved.

Now doing research I ran across this:

But today its Yahoo turn and the group of hackers succeeded in it by exploiting an SQL injection vulnerability found on a Yahoo subdomain.
The leaked information includes MySQL server variables, names of database tables and columns, as well as a list of 453,492 email addresses and passwords in plain text.

and this from the same article:

“At Yahoo! we take security very seriously and invest heavily in protective measures to ensure the security of our users and their data across all our products. We confirm that an older file from Yahoo! Contributor Network (previously Associated Content) containing approximately 400,000 Yahoo! and other company users names and passwords was stolen yesterday,July 11. Of these, less than 5% of the Yahoo! accounts had valid passwords. We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo! users and notifying the companies whose users accounts may have been compromised. We apologize to affected users. We encourage users to change their passwords on a regular basis and also familiarize themselves with our online safety tips at security.yahoo.com.”

www.latestonnet.com/2012/07/14/yahoo-hacked-450000-passwords-stolen-check-if-your-credentials-leaked.html


What the Yahoo representative told us is that we should ALWAYS have a back up copy of all our emails we want to keep including the attachments because they can't guarantee they can get back all our emails and contacts ... especially when it is only a FREE account.


Well now you know and I wanted to post this so that other know.

More suggestions:

Change your password and secret questions often
and have a different set of those for each email and any other websites.

Also do NOT use public computers (this problem only happened for my mom after she used a new public computer at work .. it was fast and new so she assumed it was safe but it was IE).

Now I am not saying that Internet Explorer is bad but you can't depend on the default settings or public computers being set up the most secure .. especially when many people use it and people sometimes do not know how to log out properly (my mom only "clicked the red X" in the browser to close the email - she did not log out).

[kas]

List of 400,000 passwords compromised here:

d33ds.co/archive/yahoo-disclosure.txt

Alt mirror: prawksy.com/sites/prawksy.com/downloads/yahoo-disclosure.txt

"Some 450,000 email addresses and associated unencrypted passwords have been dumped online by the hacking collective 'D33Ds Company' following the compromise of a Yahoo subdomain. The attackers said that they managed to access the subdomain by leveraging a union-based SQL injection attack, which made the site return more information that it should have. According to Ars Technica, the dump also includes over 2,700 database table or column names and 298 MySQL variables retrieved during the attack."

Update: 07/12 20:03 GMT by T :Reader techfun89 adds this update: "Yahoo has confirmed that the usernames and passwords of more than 400,000 accounts were stolen from their servers earlier this week and that data was briefly posted online. The information has since been removed but it wasn't just credentials for Yahoo, but also Gmail, AOL, Comcast, Hotmail, MSN, SBC Global, BellSouth, Verizon and Live.com as well."

it.slashdot.org/story/12/07/12/1243217/nearly-half-a-million-yahoo-passwords-leaked-updated

Nice Top 10 Yahoo Passwords

lynx --dump d33ds.co.nyud.net/archive/yahoo-disclosure.txt | awk -F':' '/^[0-9]*:/ {print $3}' | sort | uniq -c | sort -n | tail
202 princess
205 sunshine
208 12345678
222 123456789
250 abc123
333 ninja
437 welcome
780 password
1667 123456
10655

pastebin.com/JyMtFjsA

[kas]

How this happened:

www.hackerfactor.com/blog/index.php?/archives/495-Just-Another-Yahoo.html

Friday, July 13. 2012
News broke last Wednesday about a huge password compromise affecting Yahoo! users. Basically, someone calling themselves "D33Ds Company" posted 453,491 passwords for Yahoo! accounts. The accounts were reportedly compromised through an SQL vulnerability.

The best write-up I have seen came from CNet. Although the compromised list was reportedly old and only about 5% of the passwords were valid, and it came from one type of Yahoo! service, we really don't know the full extent of the compromise.

[/b]

[li]Change passwords. If you have a Yahoo! account, including Flickr, then change your password now. Make it very different than any of your other passwords. And don't even make it a variation of your old password. Choose something new.

[/li][li]Change associated passwords. Yahoo! requires a registered email address in case they need to contact you or you need a password reset. If you registered your Gmail account with Yahoo! and you use the same password for Gmail, then change your Gmail password now. Same with users who registered their "@comcast.net", "@qwest.net", "@msn.net" or any other email address. Whatever address you registered, change your password there too. And don't make it the same as your Yahoo! password.
[/li][/ul]

Everyone should do this, not just people who have passwords exposed in the compromised system. (Basically, if you don't know if your account was compromised, then assume it was and change passwords now.)

I managed to find a copy of the password file leaked by D33Ds. There's a bunch of things that really bother me about the compromise, reporting, data, and more.

The Compromise

Using an SQL exploit (I won't give details here), D33Ds retrieved the list of user passwords. It appears that the passwords were stored by Yahoo! in plain text. According to Yahoo!, these came from "an older file from Yahoo! Contributor Network (previously Associated Content)". As CNet pointed out, many of the email addresses contain the word "writer" in it, so this is consistent with accounts related to this service.

Yahoo! says that they have evaluated the data and know where it came from. (I have no doubt about this.) They say that they have also patched the vulnerability. (Good!) However, they also say that this data likely included other personal information. They are not saying what, but it is likely related to the account. (Possibly your name, phone, and other information you provided to Yahoo!.)

But there's something that bothers me... Yahoo! reported that many of the passwords were old/obsolete. CNet quotes them as saying "fewer than 5 percent of the Yahoo passwords disclosed are currently valid". This strikes me as odd. A file with over 450,000 passwords and only about 22,000 were valid? Even if this is an old file, few people change their passwords. What would cause over 420,000 users to change their passwords? Maybe a previous compromise where users were told to change passwords? (Yahoo! hasn't had one of those in years.) Maybe users who independently suspected a compromise? I'm curious how old this data file is, and why did Yahoo! have it on one of their front-end servers anyway?

I'm also very concerned that the passwords were stored in plain text. Does Yahoo! have a good reason for storing passwords in plain text? I mean, Yahoo!'s user interface makes a big deal about choosing a strong password. Yet a strong password stored in plain text really offers no protection from password theft -- either via an external exploit or from an internal, disgruntled employee.

I can't help but think that D33Ds is either taking credit for a very old compromise, or that they stole "real-world test data" and not something more valuable. (It's common for companies to take a small subset of account data and use it to test a new system. They may reuse the same test data for years.)

The Disclosure

At the end of the file containing the passwords is a short explanation as to why D33Ds decided to publicly disclose this information:

 We hope that the parties responsible for managing the security of this
 subdomain will take this as a wake-up call, and not as a threat. There have been
 many security holes exploited in webservers belonging to Yahoo! Inc. that have
 caused far greater damage than our disclosure. Please do not take them lightly.
 The subdomain and vulnerable parameters have not been posted to avoid further
 damage.

So D33Ds claims that this is a "wake-up call". And they want responsible security. I say this is bullshit. I've worked with enough big companies to know that a single email to Yahoo!'s security group (aptly called the "Paranoids") would have evoked the proper attention. There was no need to publicly disclose these passwords. This was a publicity stunt by some wanna-be k1dd13z and not a serious attempt at online security reform.

(If this was PayPal or eBay, then I'd believe it would be an ineffective wake-up call. But every other big online company takes security seriously. They are very risk adverse and very receptive to potential exploit reports. They might even pay you a bounty or give you a gift for reporting it responsibly.)

The good news is, D33Ds did make a name for themselves. And they listed their associates -- none of whom are very hard to find. Even if they don't accomplish security reform, at least they will become good examples.
[/size][/quote]

Article CONTINUED at: www.hackerfactor.com/blog/index.php?/archives/495-Just-Another-Yahoo.html

[kas]

More info:

security-kitchen.blogspot.ca/2012/07/yahoo-hacked-passwords-leaked.html

arstechnica.com/security/2012/07/yahoo-service-hacked/

kyrionhackingtutorials.com/2012/01/url-based-sql-injection/

Introduction: SQL injection is an attack in which malicious code is inserted into strings that are later passed to an instance of SQL Server for parsing and execution.

Finding Sites: When talking to find a vulnerable site for SQL Injection you will hear the term Dork a lot, this refers to a google search term targeted at finding vulnerable websites. An example of a google dork is inurl:index.php?id=, entering this string in google search engine would return all sites from google cache with the string news.php?id= in their URL.

Ex:

www.site.com/news.php?id=4

To be a SQL injection vulnerable a site has to have a GET parameter in the URL.
In www.site.com/news.php?id=4, id=4 is the GET parameter as it is getting the id=4 from the backend database.

Checking Vulnerability: To check if the site is vulnerable to SQLi the most common way is to just add an apostrophe( ‘ ) after one of the parameter in the URL.
Ex:

www.site.com/news.php?id=4′

Now if the site is vulnerable it will show error like:

You have an error in your SQL Syntax

Warning: mysql_num_rows()
Warning: mysql_fetch_assoc()
Warning: mysql_result()
Warning: mysql_fetch_array()
Warning: mysql_numrows()
Warning: mysql_preg_match()

If you see any of these errors when entering ‘ after the number or string of parameter then the chances are the site is vulnerable to SQLi attacks to some extent.

[kas]

Yahoo passwords, emails hacked: How to check if your Yahoo account information was leaked

Read more: www.wptv.com/dpp/news/national/yahoo-passwords-emails-hacked-how-to-check-if-your-yahoo-account-information-was-leaked#ixzz23TPgmpZO

[kas]

help.yahoo.com/kb/index?locale=en_US&page=content&y=PROD_ACCT&id=SLN2551&impressions=true

Resolution

There are several ways your Yahoo! ID or Yahoo! account can be placed at risk. Here are a few:

• Responding to a fraudulent "phishing" email that pretends to be from Yahoo!, asking for your user name and password.
  
• Having a type of malicious software called a "key logger" on your computer.
  
• Allowing third parties access to your account.
  
• Leaving your account signed in at a public location.
  
• Utilizing the same password across multiple online services or applications