Attacks/Breaches

9/29/2016
04:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Researchers Shoot Down Yahoo Claim Of Nation-State Hack

InfoArmor says the attackers who stole a half-billion Yahoo user accounts were seasoned cybercriminals who later sold the booty to an Eastern European nation-state.

The Yahoo data breach saga took a new turn this week as a team of researchers from InfoArmor yesterday published new findings that the massive breach of some 500 million Yahoo customer accounts came at the hands of a cybercrime group, not a nation-state as Yahoo has stated.

According to Andrew Komarov, chief intelligence officer of InfoArmor, an Eastern European cybercrime group did the dirty work of hacking into Yahoo and stealing credentials as part of other similar attacks in 2012 and 2013 against big targets including MySpace, Tumblr, and LinkedIn, as well as others. And an Eastern European nation-state cyber espionage group later purchased that stolen cache from the cybercriminals, according to Komarov.

Perhaps most intriguing about this new twist is how it demonstrates an increasingly blurred line between cybercrime and cyber espionage groups' activities. Security researchers for several years have seen indications that the two worlds indeed collide, but this would represent one of the more high-profile examples if InfoArmor's research is confirmed.

Yahoo had not responded to press queries for comment on the InfoArmor conclusion as of this posting. The company late last week announced publicly that it had been hacked by a state-sponsored attacker that had pilfered a half-billion user account details.

InfoArmor--which has not shared its research directly with Yahoo but has shared it with law enforcement--stopped short of identifying Russia as the culprit, but the cybercrime gang who appeared to broker the sale was Russian-speaking. The researchers say there are two main groups involved: English-speaking cybercriminals, "Hell Forum," and Russian-speaking cybercriminals, "Group E," named after their leader whose nickname begins with "E."

The report says that Hell Forum's key member was behind hacks of Ashley Madison, AdultFriendFinder, and the Turkish National Police. A proxy who goes by "tessa88" brokers deals between the two groups. Tessa88 was the first to announce that the stolen Yahoo credentials were for sale, and ultimately sold the information to the state-sponsored attack group.

"The group that hacked Yahoo were black hats, and one of their clients were state-sponsored" actors that wanted to use the stolen credentials for cyber espionage purposes, Komarov says. "Special services [in state-sponsored groups] use black hats, sometimes indirectly, that had no idea about each other. They never met in person, but they [the cyber espionage actors] found they had something of high value."

Buying stolen information from cybercriminals actually can save cyber espionage gangs money, especially if they don't want to invest their own staff or resources for a task, he says.

Tom Kellermann, CEO of Strategic Cyber Ventures, says the Russian government often uses cybercrime "militias" as proxies so the intersection of cybercrime and cyber espionage groups comes as no surprise. He points to the Pawn Storm cyberspy group's work with cybercrime gangs that waged distributed denial-of-service (DDoS) attacks on their targets.

"They would direct cybercrime crews to [their] munitions and provide them a list of targets and have them leave the back doors open so they could process or mine that data," says Kellermann, pointing to the "Russian Underground 2.0" report from Trend Micro, where he previously served as chief security officer.

Cybercriminals in Russia are provided immunity from their criminal actions if they avoid hacking fellow countrymen or Russian organizations and share information with intelligence agencies, he notes. They are also rewarded for hacking for patriotic purposes, he says.

"It's a true manifestation of the digital Cold War," Kellermann says.

InfoArmor didn't specify just how the nation-state actors used the Yahoo information, except to note that the stolen Yahoo customer credentials database may have been what led to targeted attacks against US government officials. Komarov did say it was likely related to an incident where a high-level US intelligence officer's emails and contacts were published by WikiLeaks in October 2015. "His email and contacts were published in WikiLeaks. Some are  Yahoo" emails, Komarov says.

Komarov would not elaborate further. But it was during that timeframe that then-CIA director John Brennan's personal email account was breached.

'Peace' Fake

Meanwhile, InfoArmor's Komarov says the purported stolen Yahoo credentials dumped online by Peace_Of_Mind and brought to light in August of this year were a hoax: "He hasn't dumped anything," he says. "It was various Yahoo credentials from various other sources" and not an actual true data dump, he says.

Security experts had been skeptical that the "dump" was related to Yahoo's confirmed breach, anyway, and Yahoo later said the two events were unrelated.

Yahoo is just one of multiple victims of Group E. "Some of their initial targets, which occurred in 2012 and 2013, are linked directly with the recent large scale data breaches of social media networks and online-services such as MySpace, Tumblr and LinkedIn. Other well-known brands have been impacted by this group but the data stolen from them is not currently available for sale or validation in the underground, as of the writing of this report," the InfoArmor report says.

"This was not just a Yahoo hack," as these other massive social media and other breaches were also hit by Group E, Komarov says. So the total victim count is more along the lines of 3.5 billion people at the hands of Group E hackers. That makes this "one of the largest hacks in history," he says.

Three different security research vendor teams – CrowdStrike, FireEye, and Kaspersky Lab – all declined to comment on InfoArmor's report.

Related Content:

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
High Stress Levels Impacting CISOs Physically, Mentally
Jai Vijayan, Freelance writer,  2/14/2019
Valentine's Emails Laced with Gandcrab Ransomware
Kelly Sheridan, Staff Editor, Dark Reading,  2/14/2019
Making the Case for a Cybersecurity Moon Shot
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  2/19/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8980
PUBLISHED: 2019-02-21
A memory leak in the kernel_read_file function in fs/exec.c in the Linux kernel through 4.20.11 allows attackers to cause a denial of service (memory consumption) by triggering vfs_read failures.
CVE-2019-8979
PUBLISHED: 2019-02-21
Koseven through 3.3.9, and Kohana through 3.3.6, has SQL Injection when the order_by() parameter can be controlled.
CVE-2013-7469
PUBLISHED: 2019-02-21
Seafile through 6.2.11 always uses the same Initialization Vector (IV) with Cipher Block Chaining (CBC) Mode to encrypt private data, making it easier to conduct chosen-plaintext attacks or dictionary attacks.
CVE-2018-20146
PUBLISHED: 2019-02-21
An issue was discovered in Liquidware ProfileUnity before 6.8.0 with Liquidware FlexApp before 6.8.0. A local user could obtain administrator rights, as demonstrated by use of PowerShell.
CVE-2019-5727
PUBLISHED: 2019-02-21
Splunk Web in Splunk Enterprise 6.5.x before 6.5.5, 6.4.x before 6.4.9, 6.3.x before 6.3.12, 6.2.x before 6.2.14, 6.1.x before 6.1.14, and 6.0.x before 6.0.15 and Splunk Light before 6.6.0 has Persistent XSS, aka SPL-138827.