Cybersecurity , Data Breach

The record-breaking Yahoo breach wasn't perpetrated by nation-state attackers, as Yahoo has claimed, but rather by a group of "professional blackhats from Eastern Europe" who are also suspected of stealing and reselling customer data from LinkedIn, MySpace and Tumblr, according to a new report from the security firm InfoArmor (see Yahoo Breach: The Great 'Nation-State' Cop Out).

See Also: Disrupt Attack Campaigns with Network Traffic Security Analytics

Yahoo didn't immediately respond to a request for comment on the InfoArmor report.

But a Yahoo spokesman previously told Information Security Media Group: "As we disclosed on Sept. 22, a recent investigation by Yahoo has confirmed that a copy of certain user account information was stolen from our systems in late 2014 by what we believe is a state-sponsored actor. Our investigation into this matter is ongoing and the issues are complex."

Now, however, Arizona-based InfoArmor, which sells products designed to protect against employee identity theft, claims that it's traced the Yahoo data theft to a group of hackers that it dubs "Group E." InfoArmor says the group apparently exfiltrated the data via a remote attack.

"The bad actors exfiltrated the data in segments, which is supported by the fact that the database dump is divided into over a hundred equal parts, delivered in different files that are organized alphabetically by the name of user accounts," according to InfoArmor's report.

"The actual number of Yahoo accounts affected could be more than 1 billion, but is much higher than the 500 million reported which includes dormant accounts and bot accounts," it adds.

InfoArmor appears to have access to at least some of the exfiltrated data. The Wall Street Journal reports that it gave InfoArmor 10 active Yahoo IDs and the firm successfully cracked and shared eight of the associated passwords in less than a day - reporting that the other two passwords were likely more complex and would have taken longer to crack. InfoArmor also was able to recover the correct date of birth, phone number and ZIP code associated with the eight accounts, the newspaper reports.

InfoArmor's report says the stolen Yahoo data included:

As of Sept. 27, "the actual Yahoo data dump is still not available on any underground forums or marketplaces," InfoArmor's report says. Instead, it says the data is being monetized via a proxy for the group, "based on the sale of particular records from the dump, which can be delivered based on the specific criteria of the buyer - login, recovery e-mail, geography, etc."

No State Sponsor

Andrew Komarov, InfoArmor's chief intelligence officer, tells ISMG in an interview that Group E are professional criminals, and that they've been involved in breaches relating to MySpace, Tumblr and LinkedIn.

"We have been monitoring the group since their early hacks that happened in 2012/2013 and know the timeline of their activities along with some of their customers," he says. "They have nothing to do with any state-sponsored parties, and act as professional cybercriminals that specialize in large-scale data breaches."

InfoArmor's report claims that the stolen Yahoo data has been exclusively sold - by a Group E proxy - just three times, beginning in 2015. "We determined that one of the first deals occurred with a state-sponsored party who had interest in exclusive database acquisition," its report says. Even so, "two other transactions took place with notable cybercriminals who planned to use the data for spam campaigns against global targets, monetizing their activities through their own underground affiliate networks."

Yahoo data stolen by Group E. Source: InfoArmor.

Peace of Mind: No Real Deal

The InfoArmor report also offers new insights into the activities of the darknet marketplace sellers and English-speaking "threat actors" known as Tessa88 and Peace_of_Mind, a.k.a. Peace. Tessa88 has been selling stolen LinkedIn and MySpace data. He also claimed to be selling data from Dropbox, although security expert Troy Hunt told ISMG that the latter was actually a mishmash of Tumblr and Twitter data.

On Aug. 2, meanwhile, Peace claimed to offer for sale 200 million Yahoo account credentials on the Real Deal, a darknet marketplace. But his asking price of only 3 bitcoins - worth about $1,800 - raised immediate red flags. As InfoArmor's report notes: "For any experienced threat intelligence analyst, the price of 3 [bitcoins] for 200 million Yahoo user accounts is suspiciously strange and has no rational explanation."

After Yahoo last week warned that it had been breached and that 500 million accounts had been stolen, it said that it had no proof to back up Peace's claims, after some media outlets suggested that Peace may have been responsible for the breach. "Yahoo has never had reason to believe there is any connection between the security issue disclosed on Sept. 22 and the claims publicized by a hacker in August 2016," a Yahoo spokesman told ISMG. "Conflating the two events is inaccurate."

InfoArmor has likewise dismissed Peace's claimed possession of stolen Yahoo data. "After extensive analysis and cross reference against the data breach intelligence systems of InfoArmor, it was determined that the dump is based on multiple third-party data leaks, which have no relation to Yahoo," its report says. "Presumably, the threat actor specially misrepresented this data set in order to sensationalize and sell it for the purpose of monetizing his efforts following the negative impact of his relationship with tessa88."

Congress Questions Detection Delay

Following Yahoo's data breach alert this month, Congress hasn't been silent. The Senate's ranking Judiciary Committee member, Patrick Leahy, D-Vt., wants to hold a hearing on the matter, an aide tells the news website The Hill.

On Sept. 27, a letter from six Democratic senators - Leahy, as well as Richard Blumenthal, Al Franken, Ron Wyden, Edward J. Markey and Elizabeth Warren - demanded that Yahoo CEO Marissa Mayer fully describe what Yahoo knew, and when, as well as what it's now doing to protect users. "Press reports indicate the breach first occurred in 2014, but was not discovered until August of this year," the senators noted in their letter to Mayer. "If this is accurate, how could such a large intrusion of Yahoo's systems have gone undetected?"

Sen. Mark Warner, D-Va., on Sept. 26, asked the U.S. Securities and Exchange Commission if Yahoo had fulfilled its obligations to inform investors about the data breach. "Disclosure is the foundation of federal securities laws, and public companies are required to disclose material events that shareholders should know about," Warner said in a letter to Mary Jo White, the SEC's chairwoman.

He also used the incident to call on Congress to pass a national data breach notification law. Despite discussing breach-related laws for years, Congress has failed to enact any such legislation.

Troubled by news of @Yahoo hack affecting 500+ m. It's time Congress creates a uniform notification standard to protect consumers.

Detection Delays are Common

The two-year lag between the breach occurring and Yahoo warning customers, however, isn't that unusual. According to cybersecurity firm FireEye's Mandiant division, organizations require on average 146 days to discover they've been breached. Also, 53 percent of compromised organizations first learn that they were breached only thanks to an external entity.

But there's a potential wrinkle. Allegedly, Yahoo detected the 2014 attack against it several weeks after the breach occurred, anonymous sources have told The Wall Street Journal. That means Yahoo may have failed to spot that data relating to at least 500 million accounts was exfiltrated.

Whoever stole the data appears to have kept a low profile, according to InfoArmor's report.

Dramatically underestimating the impact of a data breach also isn't unusual. LinkedIn, for example, underestimated how badly it was breached in July 2012, earlier this year revising a warning that 6.5 million accounts had been hacked, which was based on those accounts having been uploaded to an underground forum. In fact, more than 164 million records had been compromised, which became clear when they showed up for sale in May on a darknet marketplace by Tessa88. The data was later resold by Peace.

LinkedIn subsequently faced intense criticism for having failed to force all users to reset their passwords in 2012. Similar criticism is now being leveled at Yahoo, which is already the focus of breach-related lawsuits.

The impact of the breach revelations on Yahoo's pending sale to Verizon for $4.8 billion also remains to be seen.

DDoS , Risk Management

An army of networked devices - webcams, digital video recorders, CCTV cameras and routers - has been unwittingly drafted into doing electronic battle via a type of attack that has existed since the early days of the internet, but which has reached new levels of intensity in recent weeks.

See Also: API vs. Proxy: Understanding How to Get the Best Protection from Your CASB

Website operators and companies regularly fight off distributed denial-of-service attacks, which seek to take down services through overwhelming or else highly pinpointed barrages of traffic. DDoS attacks have typically been launched from compromised desktop computers. But in a development that experts have long forecasted, hackers are increasingly using so-called internet of things devices to launch record-breaking attacks.

The assaults are asymmetrical: The cost of launching attacks are often trivial compared to the cost of defending against them. While large organizations, such as financial service companies, are usually ready for DDoS attacks, many are not, and the unprepared often find themselves scrambling in panic as their websites remain unavailable.

The attacks highlight structural weaknesses in the internet - now essential to global commerce and business - which wasn't designed to defend against this type of abuse.

"Never before in human history have so many people across the world been utterly dependent upon such a fragile, brittle technology as the internet," says Roland Dobbins, a principal engineer at Arbor Networks in Singapore.

The consultancy Gartner predicts that 6.4 billion internet-connected devices that fall into the IoT category will be online this year. By 2020, 25 percent of cyberattacks within enterprises will involve IoT devices, but just 10 percent of IT security budgets will be dedicated to safeguarding them, Gartner forecasts.

The most prominent apparent IoT attack of late was directed against the website of cybersecurity journalist Brian Krebs, whose exposés on the cybercrime underground have made him a frequent target of online attacks and other harassment. His site was hit Sept. 20 with 620 gigabits per second of traffic in one of the largest-ever DDoS attacks ever seen. By comparison, most DDoS attacks are in the range of 1 Gbps to 15 Gbps.

The network security company Akamai had protected Krebs's site, but in light of the size of the attacks, it quit providing pro bono services to him. Krebs later secured support from Google's Project Shield, which helps protect journalists from DDoS attacks. One company told him that protecting his site would otherwise have cost $150,000 to $200,000 a year.

The IoT devices apparently marshaled into the attack against Krebs and other gaming sites in recent weeks are prime candidates for criminals to draft into service because they're poorly secured, rarely monitored by users and may have known vulnerabilities that never get patched - or for which no patches are available - even though such devices often remain internet-connected for years.

DDoS Attacks Pummel French Hosting Firm

The attack against Krebs's site wasn't isolated. On Sept. 19, by Octave Klaba, CTO of Paris-based internet hosting firm OVH, reported that a botnet comprising 146,000 hacked digital video recorders and internet-connected cameras was targeting it with massive DDoS attacks. Klaba said the attacks occasionally reached 100 to 800 Gbps, although were more often in the 30 to 100 Gbps per second range. He also believes that the attacks have been launched by the same botnet that targeted Krebs' site.

Klaba warned Sept. 26, meanwhile, that the botnet had grown to comprise 168,000 hacked devices.

+6857 new cameras participated in the DDoS last 48H.

Pop a Linux Box

IoT devices typically run embedded Linux - an open source operating system. Many such devices have become commoditized - competing for sales based solely on their cost. As a result, many manufacturers focus on bringing new devices to market quickly rather than maintaining older devices or building in ways to keep them updated and secure.

"Businesses may be more focused on income rather than security of the internet of things," says Shui Yu, a senior lecturer at Deakin University in Australia who is on the editorial board of the IEEE Internet of Things Journal. "When attacks become a big concern to the public, then the manufacturers may pay more attention to security."

Too often, remote hackers can easily break into IoT devices. Devices often ship with remote login protocols - typically via telnet or SSH - enabled by default, as well as default passwords. Such passwords are often easy to guess, and lists of manufacturers' most commonly used passwords abound on hacking forums.

Once an attacker finds a potentially vulnerable device via internet scans, it's only a matter of logging in and then uploading malware to the device. In a recent report, Symantec described a dozen of the most common malware families targeted at embedded Linux OSes.

"The current IoT threat landscape shows that it does not require much to exploit an embedded device," Symantec says "The majority of the threats simply take advantage of weak built-in defenses and default password configurations in embedded devices."

The compromised devices are corralled into a botnet, which is the term for a network of compromised devices. Once a botnet is created, hackers rent their networks, which are often advertised in dark web forums as "booter" or "stresser" services.

Many manufacturers never develop or release security updates for devices after they reach market. In fact, some devices can't be upgraded at all. Users rarely interact with IoT devices, aside from setting them up, and they also may never notice any decline in performance relating to a malware infection, as they might, for example, if their desktop computer had been infected with malicious software.

"The attackers have realized this is really the most efficient way to build a highly scalable DDoS cannon," Arbor's Dobbins says.

Although the DDoS methodologies and use of IoT devices is not new, "the fact that the attackers have now upped the game in terms of their total capacity that they can bring to bear is a significant change in the threat landscape," he says.

DDoS: Noisy Attacks

DDoS attacks are noisy - it's typically easy to see where they're coming from and where they're going. Network operators can quickly isolate which internet service providers are carrying attack traffic. Once contacted, the ISP can cut off access to the offending subscriber.

But notifying ISPs is largely a pick-up-the-phone type of process these days, says Mike Smith, Akamai's CTO for security for Asia-Pacific and Japan. That notification method quickly becomes unfeasible if millions of devices around the world, hosted by many different providers, are sending attack traffic. Accordingly, he says that process is in desperate need of automation.

"We're relying on people who have connections with each other to solve the problem," Smith says. "That's worked so far, up to a point, but I think we're growing beyond our ability to effectively manage that."

The other large problem involves remediating infected devices. Many ISPs will notify customers suspected of running malware-infected PCs, which may reveal themselves once attackers begin tapping them to send voluminous quantities of spam. But cleaning up such machines is still a challenge.

Jaeson Schultz, for example, used to manage SpamCop, a spam monitoring and reporting service. He says consumers would insist that their computer was not infected - even if it clearly was - thus demonstrating the difficulty in persuading people to take action.

"Now, somebody's going to infect a fitness tracker or a smart home door lock, and these people are going to have no clue that this is a rogue device on their network," says Schultz, who's now a technical leader with Cisco's Talos research group. "We're not very far away from seeing a lot more of that."

A broader solution would involve identifying the groups who launch or enable these attacks and then arresting them, Akamai's Smith says. In the past, law enforcement has pursued especially flagrant cyberattack groups, such as Anonymous or the Lizard Squad, whose public boasting drew worldwide attention. But that's a time-consuming and reactive type of intervention - one that may not always successfully prevent or disrupt either today or tomorrow's IoT attackers.