Yahoo Investigates Leak Of 400,000 Passwords

“In addition to changing their Yahoo passwords, people should change the passwords on any accounts for other sites or applications where they reused the same password, and this time they should not be using the same thing!” said Marcus Carey, security researcher at Rapid7. “In this particular case Gmail, AOL, Hotmail, Comcast, MSN, SBC Global and Verizon users had their data breached as well, because they could sign up with any email address. The users of these other services could also be compromised because of password reuse.”

A group called the D33DS Company has been attributed as the source of the breach. The hackers are believed to have used a Union-based SQL injection to collect the data, and they posted the passwords as a high-profile way of making a point about Yahoo’s security and the state of information security, in general.

[Related: 7 Security Threats Circling Your Network ]

“Basic SQL injection techniques were used to exploit vulnerabilities identified by the hackers,” explained Sean Roth, database security product marketing manager, at McAfee. “It’s increasingly important to have visibility into the number, location and types of databases in the landscape in order to accurately assess your level of vulnerability and successfully address those threats, whether those threats come from the inside or from the outside.”

Yahoo has acknowledged the breach and is urging users to change their passwords.

“We’re seeing a lot of password breaches, meaning there’s a whole lot of passwords floating around the underground,” said Tom Cross, director of security research at Lancope, an Alpharetta Ga.-based security vendor. “To the extent that hackers can get a sense of which passwords are used most commonly, they can get a better sense of how to make future attacks successful. It’s also especially important to closely monitor your infrastructure because this also means that people who are not supposed to access your network are able to do so, using credentials that belong to a legitimate user.”

The news comes on the heels of a series of similar password breaches at LinkedIn, eHarmony, and other sites.

PUBLISHED JULY 12, 2012