Nearly half a million Yahoo passwords leaked following hack
Some 450,000 email addresses and associated unencrypted passwords have been dumped online by the hacking collective “D33Ds Company” following the compromise of a Yahoo subdomain.
The attackers said that they managed to access the subdomain by leveraging a union-based SQL injection attack, which made the site return more information that it should have.
“We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat,” they concluded. “There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage.”
Still, the dbb1.ac.bf1.yahoo.com hostname which was included in the dump seems to point to the fact that the password database belongs to the Yahoo! Voice service.
According to ars technica, the dump also includes over 2,700 database table or column names and 298 MySQL variables retrieved during the attack.
Yahoo has yet to comment on the situation.
In the meantime, ESET researcher Anders Nilsson did a quick analysis of the leaked passwords. Unsurprisingly, the most popular ones are “123456” and “password”.
It is still unknown whether the passwords were retrieved in the clear text format or were decrypted by the attackers afterwards.
UPDATE: Yahoo has officially confirmed that the leaked emails come from its servers.
“We confirm that an older file from Yahoo! Contributor Network (previously Associated Content) containing approximately 400,000 Yahoo! and other company users names and passwords was stolen yesterday, July 11,” they shared with Tech Crunch.
“Of these, less than 5% of the Yahoo! accounts had valid passwords. We are fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo! users and notifying the companies whose users accounts may have been compromised.”
UPDATE #2: Yahoo! closes security hole that led to huge password breach.