5 ms·
Hackers expose 453,000 credentials allegedly taken from Yahoo service
- jokc 14y agoomg! plaintext...
- asciident 14y agoDoesn't Yahoo have an entire team called "The Paranoids" to deal with security? Were they not involved in setting up this service?
- skarip 14y agoAlmost definitely laid off / working elsewhere at this point in time.
- kentbrew 14y agoNope. Most of the originals have fled; the few who remain have been renamed something lame. (I forget the exact name but I'm sure it contains some or all of the Standard Yahoo Corporate Buzzwords, which are: Global, Platform, Initiative, Strategy, and Partnership.)
- rll 14y agoThey did, and their influence will still be there. If this really did come from a Yahoo service it was likely some sort of co-branded partner. All core Yahoo apps authenticate against a central service with no hint of any sort of plain text credentials stored anywhere.
- jmathai 14y agoIf it's on the yahoo.com domain then it has to go through the login servers. No one else can issue the Y/T cookies they use for authentication.
- zer01 14y agoCan't forget that this 'dream team' also failed to catch the fact that they released their private signing key with the Axis chrome extension. http://nakedsecurity.sophos.com/2012/05/24/yahoo-leaks-its-own-private-key-via-new-axis-chrome-extension/ http://nakedsecurity.sophos.com/2012/05/24/yahoo-leaks-its-o...
- rll 14y agowhich happened well after the dismantling of the Paranoids
- gingerjoos 14y agoFrom what I heard a couple of years back, no Yahoo product is allowed into the wild without paranoid approval.
- prayag 14y agoDespite of the state Yahoo! is in I find it very hard to believe that a company like Yahoo! would store it's passwords in plain-text. In addition, doesn't yahoo voice uses the Yahoo single sign on, that would mean that there is a very good chance that the central authentication server and not yahoo voice is authenticating the user and the password doesn't even touch yahoo voice. Of course, there is a possibility that Yahoo uses a simple API based authentication for own apps and the architect took the easy way out and just stored the plain-text password. If it wasn't in such credible news source I would have found the entire thing very hard to believe.
- nivla 14y agoSadly a lot of prominent websites choose to store passwords in plain text or with a reversible encryption. It not until a hacker dumps their db or someone exposes it, we come to know about it. For me, I was really surprised to find even Discover Bank storing their customer's passwords in plain text. I did a write up about it: http://www.techflock.com/discover-card-storing-passwords-in-plaintext/ http://www.techflock.com/discover-card-storing-passwords-in-... YC Disc: http://news.ycombinator.com/item?id=4102387 http://news.ycombinator.com/item?id=4102387
- damncabbage 14y agoThere is a review process by a disinterested internal party that's given licence to shoot anything down that isn't secure enough by their standards, so I agree with the parent poster that this is unlikely (but not impossible, if someone was doing something really stupid).
- prayag 14y agoI agree that a lot of websites store passwords in plain text. Mostly it's because these companies are not technical. They have IT departments but are companies like a bank (As in the case of Discover, or hardware manufacturers or govt. agencies). I just hold a tech company like Yahoo to a much higher standards. In addition, a little bird told me that these passwords are not being accepted by the yahoo servers. The whole thing doesn't pass the smell test.
- 14y ago
- Mithrandir 14y agoThe server hosting it is a bit slow now, so here's the file compressed with bzip2: http://www.mediafire.com/download.php?769gk65ix183vbd http://www.mediafire.com/download.php?769gk65ix183vbd
- nivla 14y agoThanks for the mirror!
- Wingman4l7 14y agoThe TrustedSec blog post that ArsTechnica links to gave the link for the password dump, so if you want to check for a compromised account: https://d33ds.co/archive/yahoo-disclosure.txt https://d33ds.co/archive/yahoo-disclosure.txt (WARNING: That file is ~17 MB.)
- nivla 14y agoIt seems to be down. Anyone has a mirror of the file?
- therealarmen 14y agoI have an old Yahoo! Voice account and could not find my credentials in the txt dump. Anyone with an account find theirs?
- joering2 14y agoI ran it against my contact lists in both yahoo and gmail (accounts I have over 6 years now) and could not match anyone. Further, this list have Gmail and AOL and other providers on it... I dont get it how they got there. Any clues?
- mathrawka 14y agoI used to work on the login system for Yahoo! and find this to be not 100% true. Passwords were never stored in plaintext, even the log files went through a library that would mask any passwords or sensitive information if it was sent over HTTPS in plaintext. I would still trust Yahoo! to not leak my password ala LinkedIn.
- damncabbage 14y agoI'm ex-Y! as well, but do you any basis for "I find this to be not 100% true"? Is there any possibility of someone someone caching the details for convenience's sake on login, and said service not going through the Paranoid review process? I haven't done this personally, but I have had to work with some absolutely dreadful internal APIs that I needed to cache information from out-of-band to make them usable. (In all fairness, though, I'm find it hard to believe this report. I'll guess we'll find out the truth pretty soon.)
- mathrawka 14y agoI suppose a rouge developer can show their own login dialog box, but that is such a hack and should be pointed out by their boss, local paranoid (guess they are all gone?), or QA. They would have to capture the user's credentials and post it to the login handler themselves. Even the user might realize that it is not the login page and assume it is a phishing site. The secret code for the encryption of the cookies is only installed on the login servers, and without that package installed, there would be no way to generate a valid signed cookie. In short, there is no 100% guarantee a rouge developer could not do any damage, but it would be pretty hard to go unnoticed.
- jmathai 14y agoEx-Yahoo and former local paranoid. I agree with you. That's so unlikely that I'd be willing to put money that it wasn't a rogue developer.
- damncabbage 14y ago
- technolem 14y agoI found my account (different name) there, but with the wrong password. I think I remember using the one they had a long while back, but couldn't remember from where. Might be that these passwords are scrapped from various other sites, or were held onto for some time.
- MindTwister 14y agoMost people here seem to agreed that it is very unlikely that this comes from Yahoo. With the amount of compromised sites lately. Isn't it more likely that the credentials from other sites have simply been matched with yahoo services? "Oh look at all these Linkedin passwords, I wonder which ones works on yahoo as well"
- AlliedEnvy 14y agoI think this may be from Yahoo indirectly, due to an acquisition. A number[1] of these passwords contain phrases like 'associatedcontent'[2], now Yahoo Voices after being purchased by Yahoo in 2010. [1] 115 match associated.*content, 104 match yahoo, 25 gmail, 0 ycombinator. I think I saw a 4550c1473dc0n73n7 in there too. Then again, 135 match google. (all case-insensitive matches) [2] http://en.wikipedia.org/wiki/Associated_Content http://en.wikipedia.org/wiki/Associated_Content
- Mithrandir 14y agoI wrote a very cheesy Python script that runs through the file and counts the passwords and the amount of times they appear. Note that these may not even be correct. This is what I got for the top 10: len(passlist): 342,514 # Amount of unique passwords. Password, Repetition '', 10,654 (Apparently, some passwords were blank.) '123456', 1667 'password', 780 'ninja', 333 'abc123', 250 '123456789', 222 '12345678', 208 'sunshine', 205 'princess', 202 Edit: Source code at https://gist.github.com/3096511 https://gist.github.com/3096511
- __alexs 14y agocut -d: -f2- | sort | uniq -c | sort -k2 -n
- ralph 14y agoWhat's the input to that? Is it lines like 133438:remia.eu@hotmail.com:combinate
- __alexs 14y agoI hadn't seen the original data. Should probably be cut -d: -f3- then.
- ralph 14y agoIsn't the sort a bit odd too? To sort by uniq's frequency it's more like sort -k1n,1 -k2
- ralph 14y agoUnsure why the downvote since the original is wrong. To be clear, cut -d: -f3- | sort | uniq -c | sort -k2 -n would be sorting the output of uniq(1) by the password, treating them all as numeric. Depending on one's locale that gives results like 1 00auditt 100 babygirl 1 00beetle or 1 100671105192 1 100997162005jm 2 102030405060 1 102990091404
- disclosure 14y agoSearchable list available for users at http://dazzlepod.com/yahoo/ http://dazzlepod.com/yahoo/
- leke 14y agoI got an email from Yahoo yesterday saying I had sent a request to reset my password via secret question verification. The email was from yahoo, but maybe this is how they got the passwords. My account was still there at the time though.
- jmathai 14y agoYes, it's entirely possible that these were phished.
- kintamanimatt 14y agoPerhaps the best password I've found in this list is \0/ In the original SQL dump it also seems that some accounts don't have a password. I'm not sure how this is possible. For example: 334860:cashcratereferer@live.com: vs. a normal entry 334868:ktomlinson7@yahoo.com:password
- DangerousPie 14y agoThis would support the idea that they were phished rather than straight from the database. The phishing site may have just dumped all the submitted form values to a file, regardless of whether a password was entered or not.
- jmathai 14y agoSo I dealt with something that seemed very similar while I was at Yahoo as a Local Paranoid (security person for a product). There was an enormously successful phishing attack that had rendered a crapton (more than 450k) users in a compromised state. Their passwords were basically stolen. The solution was a several month long effort by multiple engineers to get the proper owner to change/reset their password. Remember, their accounts are basically hijacked at this point and they don't even know. It was one of the most involved and complex issues I've ever worked on. Having gone through that I gained a lot of respect for Yahoo! and how they treat/handle these types of situations. Nowadays everything looks different so I don't know who's doing what. But the more I read and think about this my guess is that all those users were phished.
- bertrandom 14y agoI built this website to help you easily check if your credentials have been compromised: http://voices.thatsaspicymeatball.com/ http://voices.thatsaspicymeatball.com/
- geekin 14y agoI still see that Yahoo is hiring paranoids. There seems to be a team of paranoids at Yahoo still. Even if the login process of this particular subdomain was not monitored by paranoids, I doubt if yahoo uses separate login systems for each domain - and if there is a central code/library that handles logins, I seriously doubt if passwords are handled in plain texts and SQLs are not sanitized.
- ralph 14y agoIs it mere coincidence that password `123456' is the most frequent with exactly 1667 occurrences?
- vicaya 14y agoLooks like this is from a property of a recent acquisition (associated content, acquired in 2010). Most likely a dump of old tables before authentication was migrated to login.yahoo.com. Should've dropped these tables after the migration. I personally have no sympathy for these "users", as they're professional content spammers :)
- exim 14y agoPlease stop calling those persons Hackers... They are just parasites.