{"id":17448,"date":"2016-12-19T13:17:35","date_gmt":"2016-12-19T13:17:35","guid":{"rendered":"http:\/\/www.biphoo.com\/bipnews\/?p=17448"},"modified":"2016-12-19T13:17:35","modified_gmt":"2016-12-19T13:17:35","slug":"why-yahoo-security-problems-are-a-story-of-too-little-too-late","status":"publish","type":"post","link":"https:\/\/www.biphoo.com\/bipnews\/technology\/why-yahoo-security-problems-are-a-story-of-too-little-too-late.html","title":{"rendered":"Why Yahoo Security Problems Are a Story of Too Little Too Late"},"content":{"rendered":"
\n

Why Yahoo Security Problems Are a Story of Too Little Too Late<\/span><\/strong><\/span><\/h2>\n

In the summer of 2013, Yahoo YHOO 0.52% launched a project to better secure the passwords of its customers, abandoning the use of a discredited technology for encrypting data known as MD5.<\/span><\/p>\n

It was too late. In August of that year, hackers got hold of more than a billion Yahoo accounts, stealing the poorly encrypted passwords and other information in the biggest data breach on record. Yahoo only recently uncovered the hack and disclosed it last week.<\/span><\/p>\n

The timing of the attack might seem like bad luck, but the weakness of MD5 had been known by hackers and security experts for more than a decade. MD5 can be cracked more easily than other so-called \u201chashing\u201d algorithms, which are mathematical functions that convert data into seemingly random character strings.<\/span><\/p>\n

Some say Yahoo\u2019s failure to move away fast enough from a discredited technology was a telling sign.<\/span>
\nIn the summer of 2013, Yahoo YHOO 0.52% launched a project to better secure the passwords of its customers, abandoning the use of a discredited technology for encrypting data known as MD5.<\/span><\/p>\n

It was too late. In August of that year, hackers got hold of more than a billion Yahoo accounts, stealing the poorly encrypted passwords and other information in the biggest data breach on record. Yahoo only recently uncovered the hack and disclosed it last week.<\/span><\/p>\n

The timing of the attack might seem like bad luck, but the weakness of MD5 had been known by hackers and security experts for more than a decade. MD5 can be cracked more easily than other so-called \u201chashing\u201d algorithms, which are mathematical functions that convert data into seemingly random character strings.<\/span>
\nIn 2008, five years before Yahoo took action, Carnegie Mellon University\u2019s Software Engineering Institute issued a public warning to security professionals through a U.S. government-funded vulnerability alert system: MD5 \u201cshould be considered cryptographically broken and unsuitable for further use.\u201d<\/span><\/p>\n

Yahoo\u2018s failure to move away from MD5 in a timely fashion was an example of problems in Yahoo\u2018s security operations as it grappled with business challenges, according to five former employees and some outside security experts. Stronger hashing technology would have made it more difficult for the hackers to get into customer accounts after breaching Yahoo\u2018s network, making the attack far less damaging, they said.<\/span><\/p>\n

\u201cMD5 was considered dead long before 2013,\u201d said David Kennedy, chief executive of cyber firm TrustedSec. \u201cMost companies were using more secure hashing algorithms by then.\u201d He did not name specific firms.<\/span><\/p>\n

Yahoo, which has confirmed it was still using MD5 at the time of the attack, disputed the notion that the company had skimped on security.<\/span><\/p>\n

\u201cOver the course of our more than 20-year history, Yahoo has focused on and invested in security programs and talent to protect our users,\u201d Yahoo said in a statement to Reuters. \u201cWe have invested more than $250 million in security initiatives across the company since 2012.\u201d<\/span><\/p>\n

COMPETING PRIORITIES<\/span><\/strong><\/p>\n

The former Yahoo security staffers, however, told Reuters the security team was at times turned down when it requested new tools and features such as strengthened cryptography protections, on the grounds that the requests would cost too much money, were too complicated, or were simply too low a priority.<\/span><\/p>\n

Partly, that reflected the internet pioneer\u2019s long-running financial struggles: Yahoo\u2018s revenues and profits have fallen steadily since their 2008 peak while Alphabet\u2019s Google GOOGL -0.71% , Facebook FB -0.58% , and others have come to dominate the consumer internet business.<\/span><\/p>\n

\u201cWhen business is good, it\u2019s easy to do things like security,\u201d said Jeremiah Grossman, who worked on Yahoo\u2018s security team from 1999 to 2001. \u201cWhen business is bad, you expect to see security get cut.\u201d<\/span><\/p>\n

To be sure, no system is completely hack-proof. Hackers have managed to break into passwords that were encrypted using more advanced technologies than MD5. Other Internet companies, such as LinkedIn and AOL, have also suffered security breaches, though none nearly as large asYahoo\u2018s.<\/span><\/p>\n

\u201cThis could happen to any large corporation,\u201d said Tom Kellermann, a former World Bank security manager and security industry executive.<\/span><\/p>\n

Kellermann, now CEO of investment firm Strategic Cyber Ventures, said he was not surprised that it had taken Yahoo several years to identify the massive attacks. \u201cHackers often have a capacity to burrow deeper than we thought into a system and remain for years,\u201d he said.<\/span><\/p>\n

Reuters could not determine how many companies besides Yahoo were using MD5 in 2013. Google, Facebook and Microsoft MSFT -0.45% did not immediately respond to requests for comment.<\/span><\/p>\n

According to another former security veteran at Yahoo, even when the company was growing quickly, security sometimes took a back seat as the company focused on system performance to keep up with the growth.<\/span><\/p>\n

Then, when growth stalled, senior security staff left for other companies and the chances of getting approval for expensive upgrades dropped further, the person said.<\/span><\/p>\n

\u201cAny changes to the user database took forever because they were understaffed, and it\u2019s an ultra-critical system \u2013 everything depends on it,\u201d said the former Yahoo employee.<\/span><\/p>\n

Yahoo declined to comment on details of its security practices, but said it routinely conducted drills to test and improve its cyber defenses and highlighted campaigns such as a \u201cbug bounty\u201d program in which it pays hackers to find security flaws and report them to the company.<\/span><\/p>\n

TWO BIGGEST BREACHES<\/span><\/p>\n

Last September, Yahoo disclosed a 2014 cyber attack that affected at least 500 million customer accounts, the biggest known data breach at the time.<\/span><\/p>\n

Following last week\u2019s news of the even bigger 2013 breach, U.S. federal investigators and lawmakers said they are scrutinizing Yahoo\u2018s security practices, and Verizon Communications VZ 0.89% is seeking to renegotiate a July deal to buy Yahoo\u2018s internet business for $4.8 billion.<\/span><\/p>\n

The former Yahoo employees said the company\u2019s security problems began before the arrival of Chief Executive Marissa Mayer in 2012 and continued under her tenure. Yahoo had suffered attacks by Russian hackers for years, two of the former staffers said.<\/span><\/p>\n

In 2014, Yahoo hired a new security chief, Alex Stamos, and one of the security crews he led \u2013 known internally as \u2018The Paranoids\u2019 \u2013 thought they were making headway against the hackers, former employees said. In 2015, when the security crew discovered a hidden program attached toYahoo\u2018s email servers that was monitoring all incoming messages, their first thought was that the Russian hackers had come back.<\/span><\/p>\n

It turned out that the program had been installed by Yahoo\u2018s email engineers to comply with a secret surveillance order requested by a U.S. intelligence agency, as Reuters previously reported. Stamos and some of his staff left Yahoo soon after that, creating further disruptions to security operations.<\/span><\/p>\n

This week, in addition to disclosing the 2013 hack, Yahoo said someone had accessed its proprietary computer code to learn how to forge \u201ccookies,\u201d which would allow hackers to access an account without passwords. Yahoo said it connected some cookie-forging activity to the same state-sponsored actor it believed was responsible for the 2014 data theft.<\/span><\/p>\n

\u201cThey burrowed in and got access to everything,\u201d said Dan Guido, chief executive of cyber security firm Trail of Bits.<\/span><\/p>\n

On Thursday, Germany\u2019s cyber security authority criticized Yahoo for failing to adopt adequate encryption techniques and advised German consumers to switch to other email providers.<\/span><\/p>\n

Yahoo told Reuters it was committed to keeping users secure by staying ahead of new threats. \u201cToday\u2019s security landscape is complex and ever-evolving, but, at Yahoo, we have a deep understanding of the threats facing our users and continuously strive to stay ahead of these threats to keep our users and our platforms secure.\u201d<\/span><\/p>\n

Source:-\u00a0http:\/\/fortune.com\/2016\/12\/19\/yahoo-hack-cyber-security\/<\/strong><\/span><\/div>\n

\n\t\t\t
\n\t\t\t <\/div><\/div>\n\t\t