2012 Yahoo Voices hack

Data breach of Yahoo! Voices accounts 2012 Yahoo! Voices hack 2012 07 11 Yahoo! servers Yahoo Voice hack SQL injection attack TrustedSec 450,000 usernames and passwords leaked D33Ds Company (hacking group) Yahoo! Voices Passwords were stored unencrypted In July 2012, Yahoo Voice, a user-generated content platform owned by Yahoo, suffered a major data breach. On July 11, 2012, a hacking group calling itself "D33DS Company" posted a file online containing approximately 450,000 login credentials and passwords from Yahoo Voice users. The data was obtained through a SQL injection attack that exploited vulnerabilities in Yahoo's database servers.Warren Tom 2012-07-12 Yahoo Voice website reportedly hacked, over 400,000 usernames and passwords made public https://www.theverge.com/2012/7/12/3154247/yahoo-voice-reportedly-hacked-400000-credentials-leaked 2024-10-02 The VergeCondliffe Jamie 2016-12-15 A History of Yahoo Hacks https://www.technologyreview.com/2016/12/15/106901/a-history-of-yahoo-hacks/ 2024-10-02 MIT Technology ReviewYahoo investigating exposure of 400,000 passwords https://www.bbc.co.uk/news/technology-18811300 BBC News 2012-07-12 2024-10-02Arthur Charles 2012-07-12 Yahoo Voice hack leaks 450,000 passwords https://www.theguardian.com/technology/2012/jul/12/yahoo-voice-hack-attack-passwords-stolen 2024-10-02 The Guardian The Breach The Yahoo Voices breach occurred on July 12, 2012, when a hacking group calling themselves "D33DS Company" used a union-based SQL injection attack to gain unauthorized access to Yahoo's servers.Bisht Prabhat Rauthan Manmohan Singh Bisht Raj Kishore Component Based Web Application Firewall for Analyzing and Defending SQL Injection Attack Vectors International Journal of Recent Technology and Engineering September 2019 8 3 4183–4190 The attackers were able to extract and publish unencrypted account details, including emails and passwords, for approximately 450,000 user accounts belonging to the Yahoo Voices service.Mirante Dennis Cappos Justin Understanding Password Database Compromises Polytechnic Institute of NYU 2013-09-13 The compromised passwords were stored in plaintext, without any encryption or hashing protection. This security oversight allowed the attackers to immediately access and publish the raw passwords without needing to crack them, significantly increasing the potential for immediate misuse of the stolen credentials. D33DS Company announced the leak via a Twitter post, which has since been removed. The hackers also prefaced their password dump with a statement detailing their use of a union-based SQL injection attack to obtain the data. The full dump file containing the compromised user information was made available for download via BitTorrent, allowing for widespread distribution and potential misuse of the stolen credentials. The breach compromised approximately 450,000 user accounts and the leaked data including usernames and passwords in plaintext. The attack specifically targeted Yahoo Voice, formerly known as Associated Content, which Yahoo had acquired in May 2010 for $100 million (£64.5 million). Using SQL injection techniques, the hackers were able to extract the data from Yahoo's servers and subsequently post the compromised information publicly online. Yahoo confirmed the breach, stating that "an older file from Yahoo Contributor Network... containing approximately 450,000 Yahoo and other company users' names and passwords was compromised." The company also noted that less than 5% of the Yahoo accounts had valid passwords. According to US security firm Trustedsec, the compromised passwords were associated with a variety of email addresses including those from yahoo.com, gmail.com, and aol.com. The last entries in the data dump appeared to be linked to IDs created in 2006, suggesting that the compromised database might have been an older one no longer in active use. At the time of the breach, Yahoo claimed to have more than 600,000 contributors to its Voice platform. Security experts suggested that the most alarming aspect of the attack was that the passwords for the accounts were stored unencrypted. This meant that any hacker could potentially use the stolen email addresses and passwords to access other services, including Yahoo Mail, putting far more accounts at risk than just those directly affected by the Voice breach. In a statement accompanying the data dump, the hackers said: "We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call, and not as a threat." They also noted that other security holes had led to previous disclosures and urged Yahoo not to take the vulnerabilities lightly. The breach highlighted significant security flaws in Yahoo's systems, particularly the storage of passwords in plaintext rather than using encryption. This incident came shortly after other major data breaches at companies like LinkedIn, as well as similar attacks on Android Forums and Formspring, raising broader concerns about online security practices at the time. Response In response to the breach, Yahoo stated they were "taking immediate action by fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo users and notifying the companies whose users accounts may have been compromised." The company faced criticism for its security practices and failure to adequately protect user data. This breach was one of several major security incidents Yahoo would face in the coming years, culminating in the disclosure of even larger breaches affecting billions of accounts in 2016. Yahoo! said in a written statement that it takes security very seriously and is working hard to fix the vulnerability in its site. Yahoo! said that it was in the process of changing the passwords of the hacked accounts and notifying other companies of the hack.July 12, 2012 Yahoo! fails security 101 as 443,000 passwords are leaked https://money.cnn.com/2012/07/12/technology/yahoo-hack/ https://web.archive.org/web/20120714054448/http://money.cnn.com/2012/07/12/technology/yahoo-hack/ dead July 14, 2012 July 29, 2012 CNN Moneyhttp://www.webpronews.com/yahoo-voices-is-latest-to-be-hacked-with-450000-accounts-stolen-2012-07 Yahoo Voices is latest to be hacked with 450,000 accounts stolen Webpronews.com July 29, 2012 Controversy There was no site-wide notifications about the hack, nor did any victim get any type of personal messages detailing how to reset their account passwords from Yahoo.http://www.niuzer.com/Philadelphia-PA/Yahoo-fails-to-notify-453k-users-of-massive-email-security-breach-12836310.html Yahoo! fails to notify 453k+ of affected victims Niuzer.com 29 July 2012 4 March 2016 https://web.archive.org/web/20160304000933/http://www.niuzer.com/Philadelphia-PA/Yahoo-fails-to-notify-453k-users-of-massive-email-security-breach-12836310.html dead Joseph Bonneau, a security researcher and a former product analysis manager at Yahoo, said "Yahoo can fairly be criticized in this case for not integrating the Associated Content accounts more quickly into the general Yahoo login system, for which I can tell you that password protection is much stronger." References External links http://ycorpblog.com/2012/07/13/yahoo-0713201/ https://web.archive.org/web/20120804071943/http://ycorpblog.com/2012/07/13/yahoo-0713201/ 2012-08-04 Category:2012 crimes Category:2010s in hacking Category:Hacking of Yahoo! Category:2012 data breaches