September 28, 2016 The Skanner Page 9
Business News
Experts worry cybercriminals may use leaked data,
including security questions, to unlock accounts on
other websites
By RAPHAEL SATTER
Associated Press
LONDON — As inves-
tors and investigators
weigh the damage of
Yahoo’s massive breach
to the internet icon,
information
security
experts worry that the
record-breaking haul of
password data could be
used to open locks up
and down the web.
While it’s unknown to
what extent the stolen
data has been or will be
circulating — or how
easy it would be to use if
it were — giant breaches
can send ripples of inse-
curity across the inter-
net.
“Data breaches on the
scale of Yahoo are the se-
curity equivalent of eco-
logical disasters,” said
“
the “vast majority” of its
passwords were stored
in an encrypted form
believed to be diicult
to unscramble. On the
other hand, Yahoo said
the thet occurred in late
2014, meaning that hack-
ers have had as many as
two years to try to deci-
pher the data.
Ghosemajumder said
he didn’t see a surge in
new breaches so much
as a steady increase in
attempts as cybercrim-
inals replenish their
stock of freshly hacked
passwords.
The irst hint that
something was wrong at
Yahoo came when Moth-
erboard journalist Jo-
seph Cox started receiv-
ing supposed samples of
credentials hacked from
Data breaches on the scale of
Yahoo are the security equiv-
alent of ecological disasters
Matt Blaze, a security
researcher who directs
the Distributed Systems
Lab at the University of
Pennsylvania, in a mes-
sage posted to Twitter .
A big worry is a cy-
bercriminal technique
known as “credential
stuing,” which works
by throwing leaked us-
ername and password
combinations at a series
of websites in an efort
to break in, a bit like a
thief inding a ring of
keys in an apartment
lobby and trying them,
one ater the other, in
every door in the build-
ing. Sotware makes the
trial-and-error process
practically
instanta-
neous.
Credential stuing typ-
ically succeeds between
0.1 percent and 2 percent
of the time, according to
Shuman Ghosemajum-
der, the chief technology
oicer of Mountain View,
California-based Shape
Security. That means cy-
bercriminals wielding
500 million passwords
could conceivably hijack
tens of thousands of oth-
er accounts.
“It becomes a num-
bers game for them,”
Ghosemajumder said in
a telephone interview.
So will the big Yahoo
breach mean an explo-
sion of smaller breaches
elsewhere, like the ater-
shocks that follow a big
quake?
That seems unlikely
given that Yahoo says
the company in early
July. Several weeks later,
a cybercriminal using
the handle “Peace” came
forward with 5,000 sam-
ples — and the startling
claim to be selling 200
million more.
On Aug. 1 Cox pub-
lished a story on the
sale , but the journalist
said he never established
with any certainty where
Peace’s credentials came
from. He noted that Ya-
hoo said most of its pass-
words were secured with
one encryption protocol,
while Peace’s sample
used a second. Either
Peace drew his sample
from a minority of Yahoo
data or he was dealing
with a diferent set of
data altogether.
“With the information
available at the moment,
it’s more likely to be the
latter,” Cox said in an
email Tuesday.
The Associated Press
has been unable to locate
Peace. The darknet mar-
ket where the seller has
been active in the past
has been inaccessible for
days, purportedly due to
cyberattacks.
At the moment it’s not
known who holds the
passwords or whether
a state-sponsored ac-
tor, which Yahoo has
blamed for the breach,
would ever have an in-
terest in passing its data
to people like Peace .
Even if the hack was a
straightforward espio-
nage operation, Gartner
security analyst Avivah
Litan said that wouldn’t
be a reason to relax.
Spies can mine trivi-
al-seeming data from
apparently random cit-
izens to tease out their
real targets’ secrets.
“That’s how intelli-
gence works,” Litan said
in a phone call.
Meanwhile Yahoo us-
ers who recycle the same
password across the in-
ternet may still be at risk.
While people can always
change the passwords
PHOTO BY DUANE STOREY (CC BY-NC-ND 2.0)
Password Breach Could Have Ripple Efects Well Beyond Yahoo
Security experts are worried that criminals will use credentials leaked during the Yahoo security breach
– including security information – to steal personal information from other websites.
across all the sites they
use, Yahoo’s announce-
ment that some security
questions were compro-
mised too means that the
risks associated with the
breach are likely to lin-
ger.
A password can be
changed, ater all, but
how do you reset your
mother’s maiden name?
Raphael Satter can be
reached at: http://raphael-
satter.com
