Between Cybercriminals and State Actors, Password War is Being Lost Jeremy Kirk (jeremy_kirk) • September 23, 2016     Source: Yahoo

Yahoo's disclosure of one of the largest-ever data breaches comes after months of dark web chatter that indicated it may be the next victim following large online services including Twitter, LinkedIn and Dropbox.

See Also: Creating a User-Centric Authentication and Identity Platform for the Healthcare Industry

Yahoo blames the attack on a "state-sponsored actor," but it did not name a suspect country. Still, it's a confident assertion for a cyberattack, which computer security experts contend is notoriously difficult to attribute.

Yahoo says details on at least 500 million accounts were stolen in late 2014. The company is notifying those affected and asking them to change their passwords. Most, but not all, of the exposed passwords were encrypted with a strong algorithm, leaving some users at more risk than others.

Over the two years since the breach, state-sponsored hackers would have had plenty of time to attempt to crack even the strongly encrypted passwords, says Michael Lipinksi, CISO and chief security strategist at Securonix. "I think it's safe to say those accounts were compromised," he says.

The theft of account credentials apparently is the biggest that's ever been discovered, easily overtaking the exposure of 359 million MySpace accounts in 2008, which only came to light earlier this year. Other record-setting breaches included the exposure of 164 million LinkedIn emails and passwords in 2012 - which also came to light this year - as well as the exposure of 152 million Adobe accounts in 2013.

Unlike the breaches at LinkedIn and MySpace, as well as other big breaches involving Dropbox and Tumblr, the Yahoo account details are not circulating or for sale on the underground, a sign that experts say may indicate the company's attribution is accurate. The company says an "investigation has found no evidence that the state-sponsored actor is currently in Yahoo's network."

In addition to passwords, the compromised information includes names, email addresses, phone numbers and birth dates. Also stolen were the security questions and answers users had selected to verify their accounts, only some of which were encrypted. Payment card and bank account information was likely not affected, because that information was not stored in the compromised system, Yahoo says.

Deal With Verizon Pending

The breach disclosure comes at a sensitive time as Yahoo winds through legal processes prior to its pending $4.8 billion sale to Verizon.

Sen. Richard Blumenthal, D-Conn., the ranking member of the Senate subcommittee with consumer protection and data security oversight, calls on law enforcement and regulators to examine whether Yahoo may have concealed knowledge of the breach to artificially bolster its valuation in its pending acquisition by Verizon.

"If Yahoo knew about the hack as early as August, and failed to coordinate with law enforcement, taking this long to confirm the breach is a blatant betrayal of their users' trust," Blumenthal says. "Asking users to reset their passwords when it first learned of the breach would have been a simple and effective step at mitigating any risk to accounts and protecting consumer data."

Meanwhile, the FBI is investigating the breach. "We take these types of breaches very seriously and will determine how this occurred and who is responsible," the agency says.

Experts have been at a loss as to why data breaches that occurred years ago have now become public or who may have been behind the attacks (see 'Historical Mega Breaches' Continue: Tumblr Hacked).

Breach Rumors

The seeds for the password woes of many online web services this year were sown as early as March. That's when someone using the nickname Tessa88 began hawking on underground forums large batches of data (see LinkedIn, MySpace Hacker 'Urgently' Needs Money).

Tessa88 often delivered the goods, either by proxy or directly. The persona passed data stolen from Twitter and VKontakte to LeakedSource.com, which runs a paid-for search service for stolen data. Other batches, such as LinkedIn and MySpace, were sold on a dark Web market called The Real Deal through its co-founder, peace_of_mind, or Peace.

But some of Tessa88's data batches turned out to be amalgamations of other leaked credentials bundled together and intentionally mislabeled. Cybercriminals seeking to buy stolen data became so frustrated that Tessa88 was banned from underground forums, says Vitali Kremez, a senior cybercrime intelligence analyst at Flashpoint.

"[Tessa88] was lying to other criminals," Kremez says.

On Aug. 2, Peace advertised 200 million Yahoo account credentials on The Real Deal for $1,800 in bitcoin. But Kremez says the advertised details do not match Yahoo's description of what was taken.

It means that while Yahoo may have been looking for signs of a specific intrusion that matched the data Peace claimed to have, the company might have discovered a different one.

First, the number of accounts is way off: 200 million vs. 500 million. The Real Deal advertisement didn't mention having users' security questions. Yahoo hasn't said country code identifiers for accounts were leaked, which The Real Deal advertisement did. Peace claimed the database was from 2012, which predates Yahoo's estimation of a breach by two years.

"The likely scenario is that Yahoo has been investigating Tessa88's allegations and Peace's allegations," Kremez says. "While they were investigating, they stumbled upon other signs of intrusion."

Hashing Madness

Companies with enormous user bases such as Yahoo face large challenges in a changing security landscape. What have been considered the minimum safety standards around passwords have vastly changed over the last decade.

"It's a little bit difficult for companies like Yahoo because they are getting judged on yesterday's practices that are being measured on today's standards," says Troy Hunt, a data breach expert who runs the Have I Been Pwned breach notification service.

The issue revolves around the mathematical processes that are applied to passwords. Since passwords can't be stored in plain text, they're processed with a one-way deterministic algorithm to produce a hash.

Growing computational power has meant the output of some algorithms can be rapidly guessed. Over the years, companies have switched to stronger algorithms, which slows down rate at which attackers can guess the output, which is the hash stored on their systems.

For a company with as many users as Yahoo, migrating to a new algorithm and securing weak hashes is a huge problem, says John Bambenek, manager for threat systems at Fidelis Cybersecurity. "That's a heavy drinking week for your IT department if you do that," he says.

The easy way would be to ask all users to create a new password. But companies don't want to issue full password reset decrees - for good reason. Users get annoyed. It also raises suspicions if a company has been breached, which is a potential public relations problem.

The result is that some companies are forever in a state of transition, Hunt says. Yahoo says the "majority" of the leaked passwords were encrypted with bcrypt - a well-regarded, purpose-built password-hashing algorithm - but that indicates that some passwords were not so strongly hashed.

Dropbox, which said in August that 69 million accounts created before mid-2012 were compromised, is another example. Hunt says half of those passwords were encrypted with bcrypt, while the other half were encrypted with SHA1, which is now considered very weak (see Dropbox's Big, Bad, Belated Breach Notification).

A hashing algorithm such as MD5 can be computed billions of times per second on consumer-grade hardware, whereas an algorithm like bcrypt may be only hundreds of times per second, Hunt says.

A way around the problem is to take hashes that can be rapidly guessed, such as MD5s or SHA1s, and run them through bcrypt. But it would appear from several of the large breaches from this year that companies have just rolled over to a new password hashing algorithms and not secured the weaker ones, Hunt says.

That's why, in part, the Yahoo breach still poses a risk. If the weak hashes can be cracked, those passwords can be tried against other services, such as bank or social media accounts.

Security expert Sean Sullivan says he's not surprised that the 2014 breach of Yahoo, which exposed at least 500 million account details, only recently came to light.

That's because multiple other sites - including Dropbox, LinkedIn, MySpace and Tumblr - also were either greatly delayed in discovering they'd been breached or they dramatically underestimated how badly they'd been breached, notes Sullivan, who's a security adviser at Finnish security firm F-Secure.

Sullivan adds that it's quite likely that Yahoo wouldn't have fallen a victim to such an attack, or at least a breach of this severity, if it were to be targeted today, thanks to security changes put in place since 2014. "The revelations from some of the documents that Edward Snowden ... disclosed really kind of woke up Silicon Valley to securing their systems not just from outside threats, but also from internal [threats]," he says. Snowden-related leaks began in 2013, which was the same year that a watering hole attack against the popular iPhoneDevSDK site for iOS developers led to the compromise of Apple, Facebook, Microsoft and Twitter, among others.

Those incidents were a wake-up call for technology firms to better secure their data, and Sullivan says that subsequently, Yahoo began using better encryption for its passwords, offering users two-factor authentication and encrypting users' security questions and answers.

In this audio interview with Information Security Media Group, Sullivan also discusses:

The timing of Yahoo's breach disclosure, vis-à-vis its related digital forensic investigation; Why organizations such as Yahoo, post-Snowden, are likely better equipped to prevent these types of breaches; Password hygiene best practices, both for organizations that store passwords as well as users who pick them.

Sullivan is a security adviser at Helsinki, Finland-based security firm F-Secure.

Cybercriminals who wage a successful malware attack rapidly target other victims - and the targeted organizations rarely detect the attacks on their own, according to Verizon's latest Data Breach Investigations Report.

"Most of the threat actors want to move quickly in order to be able to continue to reuse their tools, techniques and procedures," Chris Novak, director of investigative response for Verizon's RISK Team, says in an interview with Information Security Media Group at the PCI Security Standards Council's North American Community Meeting in Las Vegas. "So if they have a piece of malware that works ... they want to hit as many victims as they can before they get discovered. ... For them, it's all about speed before their tools get identified."

That's why it's so important that organizations dramatically improve their ability to mitigate malware risks, Novak says.

"In our investigations, it's not usually that we're recommending an organization buy more tools," Novak says. "Usually it's more about improved resources, processes and procedures."

PCI Security Standards Council General Manager Stephen Orfei, who also participated in the interview, says that when it comes to fighting malware attacks, speed is essential.

"We're really going to look at detection, and figure out, 'How can we collapse this timeframe? How can we detect and deter these intrusions in a timely manner, and really look at incident response and encourage tabletop exercises? Don't just have a plan that sits on a shelf - actually execute against it."

Overcoming Resistance to Change

The council is working to educate organizations about the importance of keeping systems and software up to date and implementing other basic security practices. Overcoming resistance to change is a key component, Orfei says. Too often, he says, senior executives "get comfortable with the system and really don't want to change anything."

During this interview (see audio link below image), Novak and Orfei also discuss:

The types of attacks targeting different industries; Why most breaches impacting retailers could have been prevented with easy fixes; and How phishing attacks continue to be fraudsters' easiest means for breaking into networks and systems.

Novak has been involved with information security for more than 15 years, and has assisted corporations, government agencies and attorneys with computer forensics, fraud investigations and crisis management. He has been an adviser on dozens of high-profile intrusion and data breach investigations around the globe.

Orfei is an industry expert in global payment platforms, e-commerce, mobile payments and cybersecurity. He brings more than 20 years of experience developing and delivering complex global payment solutions to his role as general manager of the PCI Security Standards Council. Orfei has held senior positions at an international telecommunications corporation, security assessment companies, a global payments card brand and in military service.

×Close

Request to Republish Content

What's the cost of a data breach to the typical enterprises: $200,000 or $7 million? In this latest edition of the ISMG Security Report, you'll hear an explanation why estimates from The Rand Corp. and Ponemon Institute vary so widely.

Also in the report, you'll hear:

The ISMG Security Report appears on this and other ISMG websites on Tuesdays and Fridays. Be sure to check out our Sept. 16 and Sept. 20 reports, which respectively analyze the ISMG Fraud and Breach Prevention Summit in Toronto and a new self-assessment tool that's intended to show whether an enterprise's cyber-risk initiative aligns with its goals and strategy. The next ISMG Security Report will be Tuesday, Sept. 27.

Theme music for the ISMG Security Report is by Ithaca Audio under the Creative Commons license

Breach Notification , Breach Response , Data Breach

Yahoo Breach: The Great 'Nation-State' Cop Out Blaming Russia - Not Hacktivists, Insiders or Incompetence - Is Easy Mathew J. Schwartz (euroinfosec) • September 26, 2016     Yahoo's Sunnyvale campus in California. Credit: Yahoo (Flickr/CC)

Asked to explain the data breach that compromised 500 million of its users' accounts, Yahoo appears to be trying to blame Russia. Of course, that would be an easy face-saving exercise for a publicly traded firm currently negotiating its $4.8 billion sale to Verizon.

See Also: Disrupt Attack Campaigns with Network Traffic Security Analytics

In Yahoo's Sept. 22 breach notification, company CISO Bob Lord wrote: "A recent investigation by Yahoo has confirmed that a copy of certain user account information was stolen from the company's network in late 2014 by what it believes is a state-sponsored actor."

Now, referencing "a person familiar with the matter," The Wall Street Journal reports that Yahoo detected the attack - several weeks after it occurred - in the fall of 2014, believed that it had been launched from Russia and said it seemed to be seeking data relating to up to 40 specific users of its service. At the time, Yahoo also reportedly notified the FBI.

The story is careful to note that it's not clear that the breach that was detected in late 2014 was tied to the attack that resulted in the theft of half a billion credentials. A Yahoo spokesman, while telling me that "our investigation into this matter is ongoing and the issues are complex," declined to comment on the claims contained in the Wall Street Journal report,

But of course, the story raises this suggestion: Maybe the Russians did it.

Attribution: Who Stands to Gain?

Here's why that suggestion should raise a warning flag: Security experts have long cautioned that attributions are political, not technical, in part because accurately tracing attacks back is notoriously tricky. Clues are easy to fake, motives are murky, mercenaries may have been at work - selling their spoils to the highest bidder - and really, the only upside of blaming a government involves diplomatic moves or political figures furthering their own domestic or foreign agendas.

In other words, never attribute an attack to a nation-state, and if someone does, exercise caution.

Unless, of course, you're the CEO of a breached organization, in which case foreign governments make ideal scapegoats for what might have simply been a bout of IT incompetence revealed by some SQL-database-dumping, script-kiddie shenanigans.

Indeed, when seeking someone to blame for a breach, Jeffrey Carr, CEO of counterintelligence software vendor Taia Global, says in a blog post that the course of action is too often predictably clear. Namely, CEOs don't want to blame hacktivists, because it will make it look like their firm got owned by bored teenagers - as with TalkTalk and thousands of other breaches. Blaming insiders is also to be avoided, because it means that their organization would have failed to heed related warning signs, as in the case of the National Security Agency and Edward Snowden.

Instead, the easy money when betting on how a company will attempt to spin the narrative of its breach - beyond employing the typical boilerplate that it was "advanced," "sophisticated" and thus predestined to succeed - is to predict that it will blame a foreign country.

"If you can blame a nation-state by calling the actors 'state-sponsored,' then you cannot be held responsible," Carr says. "You'd be the victim of a military organization or an intelligence service with vast funding and sophisticated capabilities that could overcome any corporate network." Such story lines can feed the goals of everyone from the firm's CEO, to politicians, to incident response firms, who all stand to gain in publicity - or deflected blame - thanks to the machinations of overseas bad guys who want to destroy our way of life. And so on.

At What Price, a Missed Mega-Breach?

Just because reports in some business newspapers insinuate which bad guys were involved doesn't mean that people are buying in. Yahoo's claim that it was hacked by a state-sponsored adversary, notably, has sparked skepticism - to put it mildly - among some of our readers.

Meanwhile, the breach - and Yahoo's two-year delay in warning users - has some security experts calling for blood. "I really hope Verizon drastically drops the price they are paying for Yahoo," John Pescatore, director of emerging security trends at the SANS Institute, says in a recent SANS newsletter.

In late July, Verizon agreed to buy Yahoo's operating businesses for $4.8 billion.

Yahoo's Sept. 8 preliminary proxy statement relating to the deal notes that Yahoo isn't aware of any "security breaches, unauthorized access or unauthorized use of any of seller's or the business subsidiaries' information technology systems or ... loss, theft, unauthorized access or acquisition, modification, disclosure, corruption or other misuse of any personal data in seller's or the business subsidiaries' possession."

Accordingly, expect publicly traded Yahoo to now face sharp breach-related questions about what it knew and when, and what it didn't know - and why. Also, it's likely that Verizon will demand a discount over what's currently the biggest known breach in history.

"A big drop in acquisition value because of this would be a good wake-up call to other boards of directors," Pescatore says.

Update (Sept. 26, 2016): This blog has been updated with comment from Yahoo.