Garden-Variety Cybercrooks Breached Yahoo, Says Security Firm

...

The hackers who stole the data of hundreds of millions of Yahoo users two years ago were two cybercriminal gangs, InfoArmor reported Wednesday.

That finding contradicts the notion that state-sponsored actors were behind the attack, which Yahoo suggested earlier this month when it disclosed the breach.

Further, the number of users' records stolen is closer to 1 billion than to the 500 million Yahoo acknowledged, according to InfoArmor.

However, much of the data is useless, the firm said.

Someone with the handle "Peace_of_Mind" had offered data on 200 million Yahoo users for sale on the black market, but "the data previously published by Peace_of_Mind is fake," said Andrew Komarov, chief intelligence officer at InfoArmor.

"This has been confirmed by us and Yahoo," he told the E-Commerce Times.

The confusion around Peace-of-Mind's offering came about because some of the decrypted passwords offered were legitimate, Komarov explained.

After extensive analysis and cross-referencing against its own data breach intelligence systems, InfoArmor determined the dump was based on multiple third-party data leaks unrelated to Yahoo.

InfoArmor found the real data dump earlier this month and validated it, but this "is a new and different dataset that was distributed through closed sources," Komarov said.

All the data in the new dump received earlier this month is validated and legitimate, he added, although it "also includes disabled accounts and bots."

Two criminal gangs, Hell Forum and Group E, were involved in the Yahoo breach, InfoArmor found. The two gangs are linked through a proxy with tessa88, a middleman reselling data stolen from LinkedIn and other companies.

The hackers took data from about 1 billion Yahoo users, based on InfoArmor's analysis of several high-profile breaches of files containing Yahoo and other accounts, Komarov said.

"Group E was responsible for the attack ... and sold the stolen data for about (US)$300,000," Komarov disclosed. "Hell Forum is an underground forum."

One of Hell Forum's members, ROR[RG], previously hacked Ashley Madison, AdultFriendFinder and the Turkish National Police database, according to InfoArmor.

There are more than 100 different parts to the data Group E had, and the files are organized alphabetically by the names of user accounts, InfoArmor noted. Group E obtained the whole database at once and parsed it to proxies.

"We were able to obtain a sample of the database," Komarov said, but he declined to provide further details "so as not to jeopardize this and other investigations."

One of the buyers of the Yahoo data was an Eastern European state-sponsored group, he revealed. Two others were spammer groups.

InfoArmor is certain the data was stolen before December 2014.

However, the hack still poses some risk to consumers, the firm warned, because many people reuse passwords for multiple accounts.

Far from being a hacker, Peace_of_Mind is really a middleman who put up the fake Yahoo data for sale on the underground marketplace The Real Deal.

Peace_of_Mind is currently on the outs with tessa88, who in turn has been banned from several underground forums because of the poor quality of the data provided, Komarov said.

"It seems like the relationship is strained at the moment. However, this doesn't mean they won't cooperate with one another in the future. These are cybercriminals."

It's likely Yahoo blamed state sponsored attackers because "it's nearly impossible to defend against a state-sponsored hack and it becomes a State Department or Defense Department issue and typically doesn't carry the stigma of negligence," suggested Rob Enderle, principal analyst at the Enderle Group.

"A criminal attack doesn't have these protections and you're assumed to have been part of the cause," he told the E-Commerce Times.

Yahoo top management, including CEO Marissa Mayer, refused to fund security initiatives, which may have led to the departure of security czar Alex Stamos, according to The New York Times.

The Yahoo case might trigger an SEC investigation, Enderle speculated, "and those typically don't end well."

Richard Adhikari has written about high-tech for leading industry publications since the 1990s and wonders where it's all leading to. Will implanted RFID chips in humans be the Mark of the Beast? Will nanotech solve our coming food crisis? Does Sturgeon's Law still hold true? You can connect with Richard on Google+.

Categories
Guide
0 Comment

Leave a Reply

Captcha image


RELATED BY

  • 5300c769af79e

    Sci-fi sandbox game Planetoid Pioneers debuts on Steam Early Access

    The game from independent developer Data Realms is sort of like Minecraft in space, and it is counting on users to help make the game into a viral success.Instead of creating a modding community, Data Realms is fostering a contributor community.
  • 5300c769af79e

    F-Secure Internet Security (2017)

    Compare Similar ProductsCompare Kaspersky Internet Security (2017) %displayPrice% Bitdefender Internet Security 2017 %displayPrice% Trend Micro Internet Security (2017) %displayPrice% Webroot SecureAnywhere Internet Security Plus (2016) %displayPrice% McAfee Internet Security (2017) %displayPrice% Symantec Norton Security Deluxe (2017) %displayPrice% McAfee LiveSafe (2017) %displayPrice% Symantec Norton Security Premium (2017) %displayPrice% Bitdefender Total Security Multi-Device 2017 %displayPrice% Comodo Internet Security Complete 8 %displayPrice% Webroot SecureAnywhere Internet Security Complete %displayPrice% Kaspersky Total Security (2017) %displayPrice% McAfee Total Protection (2017) %displayPrice% Trend Micro Maximum Security (2017) %displayPrice% For $69.Bitdefender Internet Security 2017 and Kaspersky cost $10 more for three licenses, but both are significantly richer in features than F-Secure.
  • 5300c769af79e

    BlackBerry Quits Making Smartphones

    Once the gold standard at the dawn of the smartphone era, BlackBerry dominated the mobile market.28, BlackBerry CEO John Chen restated what he has previously, specifically that the company's future lies in software, mobile management, and security.
  • 5300c769af79e

    IT Investment Uptick Triggered By Productivity Goals

    Specifically, these firms are using IT to increase productivity while they focus on technologies such as cloud and analytics.Increased productivity ranked first of all the reasons companies have for investing in technology, and half of the respondents picked increased productivity as the biggest change technology would foment within their organizations.