Yahoo Data Breach Questions

Yahoo recently revealed that 500 million of its customers’ accounts have been compromised following a major data breach. What happened?

So far, so unsurprising; barely a month passes these days without one of the world’s biggest companies confessing that the personal data of millions of its customers has been stolen or otherwise exposed.

What is striking about the Yahoo breach, however, is that it happened in 2014. The company’s CISO, Bob Lord, has issued advice on how users can reduce their exposure, but given that the announcement comes two years after the fact, the words ‘stable’, ‘door’, ‘horse’ and ‘bolted’ seem pertinent.

 

  Yahoo CEO Marissa Mayer

Here are the key details about the breach as explained by Yahoo CISO Bob Lord: “A recent investigation by Yahoo has confirmed that a copy of certain user account information was stolen from the company’s network in late 2014 by what it believes is a state-sponsored actor. The account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (the vast majority with bcrypt) and, in some cases, encrypted or unencrypted security questions and answers. 

The ongoing investigation suggests that stolen information did not include unprotected passwords, payment card data, or bank account information; payment card data and bank account information are not stored in the system that the investigation has found to be affected. Based on the ongoing investigation, Yahoo believes that information associated with at least 500 million user accounts was stolen and the investigation has found no evidence that the state-sponsored actor is currently in Yahoo’s network.” Yahoo CISO Bob Lord.

A number of cyber security experts have issued their take on the revelations. The scariest thing in this case is that as yet, neither Yahoo nor its users are sure about what information has been compromised

The Yahoo hack serves as the greatest warning yet that personal email accounts are easy targets for hackers, putting their users at considerable risk of being subjected to cybercrime. The wider public is only just becoming wise to the fact that the more we use our personal webmail accounts for sending information about ourselves, the more information exists on the open internet that can be used against us by cyber criminals. This hack highlights how cyber criminals aren’t just after big companies, but individuals.

The scariest thing in this case is that as yet, neither Yahoo nor its users are sure about what information has been compromised. We need greater awareness to the threats that consumers face and education about what solutions exist to best protect ourselves by keeping our personal data safe.

The fact that Yahoo has now confirmed the breach is no surprise, the scale, however, is. The sad reality is this is the latest in a long list of organisations that have been caught napping when it comes to protecting customers’ data. 

In fact as technology infiltrates every facet of our lives, we are only opening the door for these types of events to be both more frequent and by all likelihood more impactful.

Yahoo users should be particularly concerned that the stolen information includes security questions and answers as this could leave them open to far more than just their Yahoo email account being compromised. It raises the potential for accessing other accounts, including those with sensitive personal and financial information. Identity theft is a very valid concern for all the victims.

Keeping customers’ data secure should be a top priority for all enterprises. A determined hacker can be quite difficult to detect but organisations need to commit to hardening themselves to these types of attacks. This breach serves as a stark warning to all organizations that no company is too big or too small a target.

Yahoo users should change their passwords immediately and monitor activity closely. Also, they need to make sure they are using a new password that is complex, lengthy and, most importantly, ‘unique’. Since we know that password reuse across multiple accounts is very common, Yahoo users need to also ensure they are not using the same password as their Yahoo account on other accounts as well.

One of the most concerning aspects of this breach is the fact that the security questions and answers were unencrypted

With the complex, data rich, IT environments organisations run today, there is always a high possibility of yet another breach with customer data making its way onto the dark web. As we continue to add more technologies to our networks and as attackers become more sophisticated, it’s important that organisations have a rapid process for determining the impact of the breach and a robust approach in addressing the ensuing post-breach fallout.

If you have a Yahoo account and have reused the password anywhere, it would be wise to create new ones now to stop any further personal data from being exposed. To reduce the impact from the next inevitable breach of this type, users should protect themselves by having individual passwords per service rather than the one or two most use now.

Despite many warnings, millions of users will still use very simple passwords like ‘1111’, ‘qwerty’ or their own names. According to Positive Technologies research, the password ‘123456’ is quite popular even among corporate network administrators: it was used in 30% of corporate systems studied in 2014. Hackers use the dictionaries of these popular passwords to ‘brute-force’ user accounts, so perhaps now is the time to employ a little creativity.

Yahoo does offer additional protection in the form of ‘account key’ and it would be prudent for users who continue using its service to employ this as a matter of urgency.

That this 2014 breach is only now coming to light raises serious concerns for Yahoo customers.

IFSEC Global

 

« Encryption Gives Malware a Perfect Place to Hide
What To Do About Zero-Day Hacks »

Quartz Conference
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Veracode

Veracode

Veracode delivers the most widely used cloud-based platform for securing web, mobile, legacy and third-party enterprise applications.

International Organization for Standardization (ISO)

International Organization for Standardization (ISO)

ISO is an independent, non-governmental international standards organization. The ISO/IEC 27001 is the standard for information security management systems.

tunCERT

tunCERT

TunCERT is the National Computer Emergency Response Team of Tunisia.

Green Hills Software

Green Hills Software

Green Hills Software is the largest independent vendor of embedded secure software solutions for applications including the Internet of Things.

AFCERT

AFCERT

AFCERT is the national Computer Emergency Response Team for Afghanistan.

Cybersecurity Philippines CERT (CSP-CERT)

Cybersecurity Philippines CERT (CSP-CERT)

Cybersecurity Philippines CERT is the national Computer Emergency Response Team for the Philippines.

Mitchell Sandham

Mitchell Sandham

Mitchell Sandham is an, independent insurance and financial services brokerage. Business products include Cyber/Privacy Liability insurance.

ESTsoft

ESTsoft

ESTsoft Securedisk is an enterprise-wide file security solution that stores and manages all data in a central file server.

NetGuardians

NetGuardians

NetGuardians is a leading Fintech company recognized for its unique approach to fraud and risk assurance solutions.

S2T

S2T

S2T builds cyber intelligence solutions based on deep expertise in diverse domains such as intelligence, machine learning and AI, big data processing, statistics and linguistics.

Arkose Labs

Arkose Labs

Arkose Labs' Fraud and Abuse Platform combines Telemetry and adaptive Enforcement Challenges to break down the ROI of fraudsters and protect digital businesses.

Resistant AI

Resistant AI

Resistant AI protects against evolving online fraud. We connect the dots to provide a new layer of trust and performance for our clients’ systems.

CoursesOnline

CoursesOnline

CoursesOnline.co.uk is a database listing IT security courses from providers across the UK.

Sunartek Labs

Sunartek Labs

Sunartek are equipped with expert resources and advanced technology to identify cyber threats and prevent any breach, bypassing the security network of your organization.

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection Conference (HIP)

Hybrid Identity Protection (HIP) is the premier educational forum for identity-centric cybersecurity practitioners charged with defending hybrid cloud environments.

Flatt Security

Flatt Security

Flatt Security is a cyber security startup based in Japan providing security assessments and other cyber security services.