Vulnerabilities / Threats
9/25/2013
08:57 AM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Yahoo Responds To Recycled Email Security Problem

Yahoo will launch a "Not My Email" button to return old account-holders' email and help former users reclaim their accounts.

10 Ways To Fight Email Overload
10 Ways To Fight Email Overload
(click image for larger view and for slideshow)
Yahoo announced late Tuesday night that the company plans to roll out a tool for recipients of recycled email accounts to return messages that were not intended for them. InformationWeek reported Tuesday on three Yahoo users who began receiving emails containing personal information intended for the former user -- including bank and wireless account information -- after signing up for a recycled Yahoo account.

The new button, called "Not My Email," will roll out this week and will be found under the "Actions" tab in users' inboxes. The button will help users of recycled accounts train their inboxes to recognize which email is intended for them and which is not, eventually rejecting email before the user has read it.

Yahoo said it also plans to help to users who have lost their Yahoo account due to inactivity. These steps include outreach to users by phone and email and extending the grace period for inactive accounts.

[ Some Yahoo users got more than they bargained for. Read more: Yahoo Recycled Emails: Users Find Security Surprises. ]

In a statement to InformationWeek, a Yahoo spokesperson said that users of inactive accounts will be notified one month in advance via their Yahoo Mail account, alternate email address and SMS if their account is subject to being recycled. If they don't activate their account within the next 30 days by logging into any Yahoo property, the email account will be scrubbed and everything deleted.

"We will then bounce emails to it and after a period of time open it up for anyone to register for," the spokesperson said. "At that time, the earlier account owner could try to register for it -- but their content wouldn't be in there. Alternatively, if someone else registers the account, the earlier account owner could go to watchlist.yahoo.com and pay $1.99 to get put on the watchlist for that name and 4 others."

According to Dylan Casey, Yahoo's senior director of platforms, the company monitored systems for claims about mistaken deliveries and were able to identify the problem with some of the accounts. The email bounce method, he said, was insufficient for senders to see that the email was no longer valid. Casey maintained that the email problem has affected only a small number of Yahoo users.

Casey also said that Yahoo is continuing to look into its Require-Recipient-Valid-Since protocol, a header that senders add to emails to check the age of the account before delivering a message. The company said it is reaching out to businesses such as Amazon, eBay, PayPal and Walmart to target emails to current users instead of the former account holders.

Yahoo's initiative to free up dormant accounts began in mid-June when the company first announced its plan. Yahoo said it would alert users who had been inactive for at least 12 months and instruct them to login to their accounts if they wanted to keep them. Accounts that remained dormant would be recycled and up for grabs.

In July, Yahoo opened up a wish list where users could name their top five choices for a username. In August, Yahoo contacted them if one of their IDs was available and sent them instructions to claim it within 48 hours. Almost immediately, privacy advocates and security analysts criticized Yahoo's initiative.

A Yahoo user cited in InformationWeek's story reported that the emails he received would allow him to log into the former accountholder's Pandora and Facebook accounts. He also knew the user's name, address, phone number, the last four digits of the user's social security number and where the user's child goes to school.

The other Yahoo users reported similar experiences: They received email receipts from Nordstrom, timecards that detailed mileage reimbursements, airline confirmations and an apartment application confirmation.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
AustinIT
50%
50%
AustinIT,
User Rank: Apprentice
9/25/2013 | 6:10:57 PM
re: Yahoo Responds To Recycled Email Security Problem
"Not My Email"... LOL
They follow up one disaster with another. It's NEVER a good idea to recycle any account without first deleting any data associated with the previous account holder. Yahoo should have handled this correctly instead of making one gaffe beget another.
Kawit Ajang
50%
50%
Kawit Ajang,
User Rank: Apprentice
9/26/2013 | 8:06:32 AM
re: Yahoo Responds To Recycled Email Security Problem
why
GinaH714
50%
50%
GinaH714,
User Rank: Apprentice
6/1/2016 | 12:15:43 AM
re: Yahoo Responds To Recycled Email Security Problem
Yahoo should have notified all users before they deleted accounts and give them an option to keep them .however not all deleted accounts were inactive for a long time.Also,Some accounts will not let you sign in even with the correct password unless a phone verification code is used without an email  warning for a chance to  update info .There is no option to verify old phone numbers to add new one.so people are locked out,even though they have an open active account and correct password
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: You should see what I wear on my work from home days!
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.