yahoomail100686335orig
Security

Yahoo breach means hackers had three years to abuse user accounts

Security researchers are disturbed it took Yahoo three years to discover that details of over 1 billion user accounts had been stolen back in 2013.

It means that someone -- possibly a state-sponsored actor -- had access to one of the largest email user bases in the world, without anyone knowing. The stolen database may have even included information on email ids of U.S. government and military employees.

“It is extremely alarming that Yahoo didn’t know about this,” said Alex Holden, chief information security officer with Hold Security.

Yahoo said back in November it first learned about the breach when law enforcement began sharing with the company stolen data  that had been provided by a hacker. At the time, the company was already dealing with a separate data breach, reported in September, involving 500 million user accounts.

However, this hacker was apparently sitting on another mother lode of stolen Yahoo data, but it's still unclear how the theft occurred. 

Holden, who investigates online black markets, said there was always chatter among underground dealers that someone had made away with a massive trove of information from the internet firm.

“Hackers allegedly had small samples, but they had never seen the full data set,” Holden said.

But the stolen data never appeared to be widely circulated to make a major profit, he said. It suggests that state-sponsored hackers may have been behind the breach, and wanted to keep the data secretly to themselves.  

“This information would have been distributed widely if cyber criminals were involved,” Holden said. “But right now, that seems not to be the case, even two or three years later.”

Private security firm InfoArmor may have actually discovered details about the Yahoo data breach earlier this year. In September, the company claimed it had found a stolen database allegedly belonging to Yahoo that was obtained from elite hackers-for-hire.

Yahoo, however, didn’t comment on the company’s finding, making it unclear if the data was legitimate.  

InfoArmor has claimed that a hacking team called “Group E,” likely out of Eastern Europe, breached Yahoo and sold the data in three private deals. At least one of the buyers was a state-sponsored actor, said Andrew Komarov, InfoArmor's chief intelligence officer, in an email on Wednesday.

The security firm has shared its findings with law enforcement agencies in the U.S., U.K., Australia and Europe. It said the stolen database it found also has information relating to over 150,000 U.S. government and military employees. Backup email addresses included in the discovered dump contain .gov and .mil domain names, said Komarov, who called the Yahoo breach a "matter of national security."

The stolen data "may allow the threat actors to identify government employees very quickly," he said. 

The FBI has only said its investigating the Yahoo hack, and on Wednesday, the agency didn’t provide any new details.

Yahoo also hasn't mentioned who might have pulled off the intrusion, except to say an "unauthorized third party" was involved.  

Still, the recent data breaches at the company highlight the need for the tech industry to constantly be on guard against cyber threats, a security expert said.

“The lesson is clear: no organization is immune to compromise,” said Jeff Hill, director of product management for security provider Prevalent, in an email. “Criminal actors can do significant damage in days and weeks; give them years, and all bets are off."

IDG Insider

PREVIOUS ARTICLE

« Arista wins big in latest court patent case go-around over Cisco

NEXT ARTICLE

Imagination GPU tech next year could power Apple iPhone 8 graphics »
author_image
IDG News Service

The IDG News Service is the world's leading daily source of global IT news, commentary and editorial resources. The News Service distributes content to IDG's more than 300 IT publications in more than 60 countries.

  • Mail

Recommended for You

Future-proofing the Middle East

Keri Allan looks at the latest trends and technologies

FinancialForce profits from PSA investment

Martin Veitch's inside track on today’s tech trends

Amazon Cloud looms over China: Bezos enters Alibaba home ground

Lewis Page gets down to business across global tech

Poll

Do you think your smartphone is making you a workaholic?