4 ms·
This sort of thing happens pretty regularly though nothing of this scale. While I was at Yahoo! we dealt with 3M compromised accounts. I feel for all the engin
by jmathai 13y ago
This sort of thing happens pretty regularly though nothing of this scale. While I was at Yahoo! we dealt with 3M compromised accounts.
I feel for all the engineers involved in resolving this issue. We had a team of 3 or 4 working on the resolution for a few weeks.
It's normally the result of a successful phishing attack. The affected users probably have no idea their accounts were compromised.
- hkmurakami 13y agoout of curiosity, how do you go about "resolving" such a situation?
- jmathai 13y agoAt Yahoo! there's a dedicated security team that handled identifying the exact cause and worked with us to resolve it. To identify compromised accounts we looked for profile photos matching a certain md5. The attackers were using the accounts for viagra links and updated compromised account profile photos with one of about 50 photos. Once we identified the accounts they were "quarantined". But the attackers got smart and started shifting a pixel so that the md5 wouldn't match our set of known bad photos. There were other patterns we identified to isolate the compromised accounts but it was ongoing which meant as we cleaned up accounts the attackers adapted. For the 3M accounts a bit was flipped in their account. The membership team which handles logins handled the first step of the compromised user signing in. They redirected the user to a specific page that took them through a password reset flow. It wasn't the standard password reset flow. After all, we couldn't know if it was the attacker or the user logging in. This was all a while back but it was more or less something along those lines. It was not fun.