Garden-Variety Cybercrooks Breached Yahoo, Says Security Firm

...

The hackers who stole the data of hundreds of millions of Yahoo users two years ago were two cybercriminal gangs, InfoArmor reported Wednesday.

That finding contradicts the notion that state-sponsored actors were behind the attack, which Yahoo suggested earlier this month when it disclosed the breach.

Further, the number of users' records stolen is closer to 1 billion than to the 500 million Yahoo acknowledged, according to InfoArmor.

However, much of the data is useless, the firm said.

Someone with the handle "Peace_of_Mind" had offered data on 200 million Yahoo users for sale on the black market, but "the data previously published by Peace_of_Mind is fake," said Andrew Komarov, chief intelligence officer at InfoArmor.

"This has been confirmed by us and Yahoo," he told the E-Commerce Times.

The confusion around Peace-of-Mind's offering came about because some of the decrypted passwords offered were legitimate, Komarov explained.

After extensive analysis and cross-referencing against its own data breach intelligence systems, InfoArmor determined the dump was based on multiple third-party data leaks unrelated to Yahoo.

InfoArmor found the real data dump earlier this month and validated it, but this "is a new and different dataset that was distributed through closed sources," Komarov said.

All the data in the new dump received earlier this month is validated and legitimate, he added, although it "also includes disabled accounts and bots."

Two criminal gangs, Hell Forum and Group E, were involved in the Yahoo breach, InfoArmor found. The two gangs are linked through a proxy with tessa88, a middleman reselling data stolen from LinkedIn and other companies.

The hackers took data from about 1 billion Yahoo users, based on InfoArmor's analysis of several high-profile breaches of files containing Yahoo and other accounts, Komarov said.

"Group E was responsible for the attack ... and sold the stolen data for about (US)$300,000," Komarov disclosed. "Hell Forum is an underground forum."

One of Hell Forum's members, ROR[RG], previously hacked Ashley Madison, AdultFriendFinder and the Turkish National Police database, according to InfoArmor.

There are more than 100 different parts to the data Group E had, and the files are organized alphabetically by the names of user accounts, InfoArmor noted. Group E obtained the whole database at once and parsed it to proxies.

"We were able to obtain a sample of the database," Komarov said, but he declined to provide further details "so as not to jeopardize this and other investigations."

One of the buyers of the Yahoo data was an Eastern European state-sponsored group, he revealed. Two others were spammer groups.

InfoArmor is certain the data was stolen before December 2014.

However, the hack still poses some risk to consumers, the firm warned, because many people reuse passwords for multiple accounts.

Far from being a hacker, Peace_of_Mind is really a middleman who put up the fake Yahoo data for sale on the underground marketplace The Real Deal.

Peace_of_Mind is currently on the outs with tessa88, who in turn has been banned from several underground forums because of the poor quality of the data provided, Komarov said.

"It seems like the relationship is strained at the moment. However, this doesn't mean they won't cooperate with one another in the future. These are cybercriminals."

It's likely Yahoo blamed state sponsored attackers because "it's nearly impossible to defend against a state-sponsored hack and it becomes a State Department or Defense Department issue and typically doesn't carry the stigma of negligence," suggested Rob Enderle, principal analyst at the Enderle Group.

"A criminal attack doesn't have these protections and you're assumed to have been part of the cause," he told the E-Commerce Times.

Yahoo top management, including CEO Marissa Mayer, refused to fund security initiatives, which may have led to the departure of security czar Alex Stamos, according to The New York Times.

The Yahoo case might trigger an SEC investigation, Enderle speculated, "and those typically don't end well."

Richard Adhikari has written about high-tech for leading industry publications since the 1990s and wonders where it's all leading to. Will implanted RFID chips in humans be the Mark of the Beast? Will nanotech solve our coming food crisis? Does Sturgeon's Law still hold true? You can connect with Richard on Google+.

Categories
Guide
0 Comment

Leave a Reply

Captcha image


RELATED BY

  • 5300c769af79e

    Windows Holographic Expanded, SQL Server 2016 Ready: Microsoft Roundup

    Join InformationWeek and a team of industry experts on June 15 for a unique virtual event where yo Microsoft this week expanded Windows Holographic and Windows Hello to partner devices, launched a new Windows 10 Mobile build, and released SQL Server 2016.The past few days have delivered several updates on Windows 10, Windows Holographic, HoloLens, SQL Server 2016, and Microsoft's approach to startup investment.
  • 5300c769af79e

    Tech Futurist Vivek Wadhwa: Let There Be Disruption

    That's the message Vivek Wadhwa delivered at the InformationWeek Elite 100 Conference.Faces around the room followed Wadhwa as he delivered a speech that contained the seeds of a transformation that's well under way and getting nothing but faster.
  • 5300c769af79e

    AT&T Launches First US 5G Business Trial

    AT&T has launched the first US 5G business customer trial using millimeter wave (mmWave) technology.Together, they will test Internet access, VPN, Unified Communications applications, and 4K video streams; the trial also showcases the potential of 5G VoIP over the 15GHz and 28GHz spectrum bands, and promises to hit transfer speeds as high as 14.
  • 5300c769af79e

    Facebook Cuts Ribbon on New Online Marketplace

    If you're interested in an item, you can let a seller know by sending a direct message via Marketplace.After that, you're on your own.