Experts __have attacked Yahoo’s weak security after the revelation it suffered a hack in 2013, which exposed the personal data of 1 billion users, just months after revealing a 500-million-user data breach from 2014.
The hack saw the potential theft of login details, personal details and any confidential or sensitive information contained within email correspondences. Yahoo provided the email services for BT and Sky customers, as well as other services.
Bruce Schneier, a cryptologist and one of the world’s most respected security experts, said: “Yahoo badly screwed up. They weren’t taking security seriously and that’s now very clear. I would __have trouble trusting Yahoo going forward.”
Not only did Yahoo fail to prevent the breach, it also failed to detect the breach when it happened in 2013, only realising the intrusion and data theft after recently being notified by a third party. That left users unknowingly compromised for at least three years, vulnerable to identify theft among many other potential criminal uses of their personal data and passwords.
John Madelin, CEO at RelianceACSN and a former vice president responsible for the Verizon Data Breach Investigations Report, said: “We thought the previous breach of 500 million user accounts was huge, but 1 billion is monumental.”
Tyler Moffitt, senior threat research analyst at Webroot, said: “All of the data stolen, including emails, passwords and security questions, make a potent package for identify theft. The main email account has links to other online logins and the average user likely has password overlap with multiple accounts.”
Moffitt takes little comfort from Yahoo’s efforts to secure user accounts. He said: “These accounts have been compromised for years and the sheer number of them means they have already been a large source of identity theft. No one should have faith in Yahoo at this point.”
Failing to prevent a breach is just one aspect of Yahoo’s fiasco. Given the sheer number of user accounts and the volume of data each one contained, data security was crucial. Unfortunately Yahoo’s disregard for the safety of user data led to the use of out-dated security techniques.
For instance, Yahoo stored user passwords using a hashing algorithm called MD5, which was first published in 1992 but has inherent weaknesses that meant it was discounted as an effective method for security data from the mid–2000s.
Jonathan Care, research director at analysts Gartner, said: “MD5 hashing is vulnerable to an attack type called ‘collision attacks’ which means that an attacker can find a string of characters that will resolve to the same hash as a hashed password. MD5 is strongly deprecated and this points to troubling software development security practices in Yahoo or its suppliers.”
The latest data breach revelation from Yahoo – after a 500-million-user-account hack from 2014 revealed in September – paints a picture of an ageing, creaking company, failing on all counts. And with its acquisition by Verizon looming on the horizon, yet another failure on this scale will surely impact the deal in cost at the very least.
Madelin said: “If Verizon were seeking a billion-dollar discount from the agreed $4.8bn takeover [as a result of the last breach], then logically a breach twice the size should shave off a further $2bn.
The extensive list of hacks and data breaches revealed this year points to a worrying trend. Hackers are no longer targeting corporate networks for gain, instead going after sensitive data hiding in plain sight within personal information and correspondence.
“Think about all of the highly sensitive files that could be lurking in these breached Yahoo email accounts: incredibly sensitive tax or financial statements, personal healthcare data, even banking or credit card information,” said Kevin Cunningham, president and founder at identify firm SailPoint.
Cunningham said hacks of this nature, particularly of firms with weak security but obvious data stores such, will likely feature heavily in 2017.
- Millions of BT and Sky Broadband customers could be affected by Yahoo hack
- Eight things you need to do right now to protect yourself online
