4 ms·
On a number of engagements I've come across password databases that have been migrated to bcrypt. In one case I checked CVS to see who made the code change, and
by dsl 10y ago
On a number of engagements I've come across password databases that have been migrated to bcrypt. In one case I checked CVS to see who made the code change, and found the MD5 passwords on his dev box. In another I tracked down a MySQL slave that had broken replication for over a year.
In both cases I tried to track down backups, but discovered neither company was keeping them. That is another possible vector.
- jsjohnst 10y ago1) I'd be flabbergasted beyond belief if there was ever a Yahoo! engineer who had user passwords on their laptop / Dev box. The technical hurdle for that would be a stretch, let alone the fact of the other ramifications of doing this. 2) there's no SQL database involved with Yahoo!'s storage of passwords. It's a custom built db system with proprietary access and replication protocols.
- mturmon 10y agoYet, somehow they did get out.
- jsjohnst 10y agoApologies, I've heard the details at this point and I can't disclose them. The limit of what I can do is poke holes in the theories that are wrong.
- CobrastanJorji 10y agoAren't the details "three years after we were hacked, law enforcement told us that we had been hacked, and we believe them?" The press release explicitly says "We have not been able to identify the intrusion associated with this theft." I especially noticed that the "What are we doing to protect our users?" section doesn't mention anything about Yahoo fixing any security issues. Presumably, then, as a Yahoo engineer, you know what your security practices are but you don't know what you did wrong or whether you've fixed it.
- deleted 10y ago[deleted]
- jsjohnst 10y agoDo you honestly believe a press release covers every detail, especially ones with strong legal implications, and might not have rather been worded very carefully?
- mustacheemperor 10y agoThe contrast between your statements and the press statement is great enough to imply Yahoo is being dishonest.
- jsjohnst 10y ago"Dishonest", not in the slightest. From what I'm told, they really don't know how they got in. But that's only the part of the story discussed in the press release, what's not discussed is how the data existed in that format.
- geekone 10y agoIf they do not know how the adversaries got in, how do they know the adversaries are not still in to some degree?
- jsjohnst 10y agoGood point. I don't know if they do know that for sure.
- normaljoe 10y agoFrom my experience if Paranoids did know they would have locked it down at the expense of engineers or others. I know since I have made breaking changes to infrastructure which did lock out some engineers and cause plenty of headaches. Every Yahoo I have ever known has cursed the Paranoids for getting and the way. Every Yahoo that has actually been in a situation has also blessed the Paranoids for the same reasons. Simple fact is that Yahoo has a mega butt ton of code from several decades. There are going to be holes and when they are found they are fixed pretty damn quick. Last one I dealt with was solved in hours with all hand on deck. Sometimes it just sucks to be as old a Yahoo is.
- normaljoe 10y agoI am taking a WAG here but if they got code then they might be able to take educated guesses at the UDB values without actual access to UDB. Those guesses are more likely to be true with bot registered accounts where there is duplication of information. This goes back to my theory that a good portion where junk accounts. Not saying this is acceptable, just saying garbage in garbage out.
- jsjohnst 10y agoYou can't guess the XX (anonymized for obvious reasons) key without access to the UDB.
- dsl 10y agoI wasn't saying either possibility was the cause of the Yahoo breach. Simply pointing out that there is always another way. The NSA's MUSCULAR program for example decoded proprietary secret squirrel cross datacenter replication protocols designed by both Google and Yahoo, so that isn't much of a safe guard against state level actors.