Attacks/Breaches
1/31/2014
09:40 AM
Connect Directly
RSS
E-Mail
100%
0%

Yahoo Mail Passwords: Act Now

Yahoo suffers hack attack, eyes third-party database and reused credentials as likely culprits, may enforce two-factor authentication to help users recover accounts.

9 Notorious Hackers Of 2013
9 Notorious Hackers Of 2013
(Click image for larger view and for slideshow.)

Yahoo said it reset passwords for an unspecified number of accounts after detecting an unfolding hack-attack campaign.

"Recently, we identified a coordinated effort to gain unauthorized access to Yahoo Mail accounts. Upon discovery, we took immediate action to protect our users, prompting them to reset passwords on impacted accounts," said Jay Rossiter, who's in charge of Yahoo's platforms and personalization products, in an "important security update for Yahoo Mail users" blog post. Some related notifications, however, have yet to be made.

To help users recover their accounts, Yahoo said it may force users to employ second sign-in verification -- its version of two-factor authentication -- which sends a six-digit code via SMS to a user's registered mobile phone number, provided they have one on file.

According to Litmus email analytics, Yahoo Mail comprises 5% of the world's email clients. In terms of market share -- across desktops, mobile clients, and webmail -- that makes Yahoo Mail the world's eighth most popular email client, trailing iOS Mail clients (38%), Outlook (14%), Android (12%), Apple Mail (8%), Gmail (6%), and Outlook.com (6%), but placing it ahead of Windows Live Mail (3%) and Windows Mail (2%).

[Can you protect your data on the road? Data Security: 4 Questions For Road Warriors.]

Yahoo said there's no evidence that the recent account-hijacking campaign resulted from attackers stealing credentials from Yahoo itself. Rather, whoever's behind the attack appears to have harvested the usernames and passwords from another site, meaning that Yahoo victims likely reused usernames and passwords across multiple sites. "Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise," Rossiter said. "Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts. The information sought in the attack seems to be names and email addresses from the affected accounts' most recent sent emails."

He added: "We are working with federal law enforcement to find and prosecute the perpetrators responsible for this attack."

Who hijacks email accounts? Criminals may hack into accounts to harvest legitimate names and email addresses to target with phishing attacks or to run scams. One well-worn ruse involves an urgent appeal for funds sent under an email account owner's name to everyone in his or her address book. The message claims, for example, that the account owner was mugged in London and a hotel is holding his or her passport ransom until the bill is settled in cash. "Kindly help me send the money via Western Union Money Transfer to my name and hotel address below," the message reads.

Yahoo's account-takeover warning is thus a heads-up, not just for users to beware account takeovers, but for anyone who receives an email sent via Yahoo. "I'd... recommend being wary of any odd email messages from friends with Yahoo accounts that send you links or attachments in the next few days," said Chris Mohan at the Internet Storm Center.

How can Yahoo users better avoid account takeovers altogether? According to Yahoo's tips for safeguarding its accounts, the company recommends that all account users "add an alternate email address and mobile number to your account," which can be used to receive a password reset, in the event that the account has been compromised.

Also never reuse the same password across multiple sites. "If you do make the mistake of reusing passwords, you are running the risk of having your password compromised in one place -- perhaps via a phishing attack or keylogger -- and then hackers using it to unlock your other online accounts," said Graham Cluley, an independent security researcher, in a blog post.

Instead, use a password manager to generate strong passwords -- think long and random -- and then store those passwords. Modern password managers will keep your password database synchronized across PCs, mobile devices, and the cloud.

So many people still reuse passwords, however, that some companies, such as Facebook, have begun testing public dumps of usernames and passwords to see if they unlock any of their users' accounts. If so, the company can lock affected accounts and force users to pick a new password.

Beyond never reusing passwords, for optimum account security Yahoo users should also activate the aforementioned second sign-in verification, which Yahoo first introduced in 2011. Once activated, the two-factor verification system will send a six-digit code via SMS to the mobile phone number on file anytime it sees a login attempt -- with a valid username and password -- from a new system. Without that code, would-be attackers can't access the account.

For access to Yahoo email via any non-Yahoo application, meanwhile, the company also offers one-time codes. "Certain applications -- for instance, iOS Mail, Android Mail, and Outlook -- don't support Yahoo's second sign-in verification," Cluley said. "For those, you will need to generate one-time passwords, separate from the one you use on your Yahoo account."

Having a wealth of data is a good thing -- if you can make sense of it. Most companies are challenged with aggregating and analyzing the plethora of data being generated by their security applications and devices. This Dark Reading report, How Existing Security Data Can Help ID Potential Attacks, recommends how to effectively leverage security data in order to make informed decisions and spot areas of vulnerability. (Free registration required.)

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
<<   <   Page 3 / 3
krassofnod
50%
50%
krassofnod,
User Rank: Apprentice
1/31/2014 | 11:10:42 AM
Re: Just one password?
because if you use a single passwrod for everything if that password gets hacked anywhere, the hacker has access to everything
AmericanPrivacy
100%
0%
AmericanPrivacy,
User Rank: Apprentice
1/31/2014 | 10:30:42 AM
Still think your free email is free? Think again
So News has broke that Yahoo emails have been compromised. This does not surprise me in the least. Did you know that Google, Yahoo, Hotmail, AOL and other service providers are scanning, analyzing and categorizing your emails every day? As a result, these numerous providers are pleased to give you a "free" email service because they generate large revenues for themselves through the selling of your personal information to third parties! That's right third parties! Exactly who yahoo is blaming for this data breach!!
100% Privacy guaranteed. At americansrighttoprivacy.com you will remain anonymous as we DO NOT and WILL NOT copy, scan, or sell any of your content. Our email service is 100% privacy guaranteed. Privacy is not only a human right but also required to survive in a competitive business environment. We are very serious about protecting your electronic communications and due to the strict restrictions of the U.S. Patriot Act for law abiding citizens, we cannot align ourselves with servers located in the United States. Therefore, our servers are located in Switzerland where strong data privacy laws do not abide by the U.S. Patriot Act.
Drew Conry-Murray
50%
50%
Drew Conry-Murray,
User Rank: Ninja
1/31/2014 | 10:20:38 AM
Just one password?
If I have to create a really long password to ues a password manager, why not just use that really long password for every site instead of having a password manager in the first place?
<<   <   Page 3 / 3
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3409
Published: 2014-10-25
The Ethernet Connectivity Fault Management (CFM) handling feature in Cisco IOS 12.2(33)SRE9a and earlier and IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (device reload) via malformed CFM packets, aka Bug ID CSCuq93406.

CVE-2014-4620
Published: 2014-10-25
The EMC NetWorker Module for MEDITECH (aka NMMEDI) 3.0 build 87 through 90, when EMC RecoverPoint and Plink are used, stores cleartext RecoverPoint Appliance credentials in nsrmedisv.raw log files, which allows local users to obtain sensitive information by reading these files.

CVE-2014-4623
Published: 2014-10-25
EMC Avamar 6.0.x, 6.1.x, and 7.0.x in Avamar Data Store (ADS) GEN4(S) and Avamar Virtual Edition (AVE), when Password Hardening before 2.0.0.4 is enabled, uses UNIX DES crypt for password hashing, which makes it easier for context-dependent attackers to obtain cleartext passwords via a brute-force a...

CVE-2014-4624
Published: 2014-10-25
EMC Avamar Data Store (ADS) and Avamar Virtual Edition (AVE) 6.x and 7.0.x through 7.0.2-43 do not require authentication for Java API calls, which allows remote attackers to discover grid MCUser and GSAN passwords via a crafted call.

CVE-2014-6151
Published: 2014-10-25
CRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.