Yahoo is investigating a breach of its system which may have exposed 400,000 user IDs. US security firm Trustedsec said the attack appeared to have originated from servers connected to Yahoo Voices, a user-generated section of the site. Over 400,000 usernames and passwords were posted online following what appears to be a hack of voice […]
Yahoo is investigating a breach of its system which may have exposed 400,000 user IDs. US security firm Trustedsec said the attack appeared to have originated from servers connected to Yahoo Voices, a user-generated section of the site.
Over 400,000 usernames and passwords were posted online following what appears to be a hack of voice over IP (VoIP) service Yahoo Voice by hacktivists ‘D33Ds Company’.
The credentials were made available in plain text in a data dump posted online by the hacker collective on Wednesday.
In the document, the group responsible for the breach said that it was intended to be “a wake-up call” for Yahoo.
“We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat,” the hackers wrote.
“There have been many security holes exploited in webservers belonging to Yahoo Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage.”
Hours after the attack came to light, Yahoo had not put a warning on its site.
In a statement Yahoo said: “We are currently investigating the claims of a compromise of Yahoo! user IDs,” adding that it encouraged users to “change their passwords on a regular basis”.
The document which gives details of the hack does not make clear which Yahoo service was targeted.
According to US security firm Trustedsec, the compromised Yahoo passwords were associated with a variety of email addresses including those from yahoo.com, gmail.com and aol.com.
It said that hackers used a well-established technique known as SQL injection to extract the sensitive information from the database.
“The most alarming part of the entire story was the fact that the passwords were stored entirely unencrypted,” the security firm said in its blog.
Initial analysis by security firm Impervia suggests that the compromised database may have contained some private data as well including names, addresses including postcode, phone numbers and dates of birth.
Follow Netimperative on Twitter
Keep up-to-date with Netimperative’s daily and weekly newsletters
