HOME     MENU     SEARCH     NEWSLETTER    
THE ENTERPRISE SECURITY SUPERSITE. UPDATED 10 MINUTES AGO.
You are here: Home / Data Security / Yahoo Breach Having a Ripple Effect
Build Apps 5x Faster
For Half the Cost Enterprise Cloud Computing
On Force.com
Yahoo Breach Having a Ripple Effect
Yahoo Breach Having a Ripple Effect
By Jennifer LeClaire / Enterprise Security Today Like this on Facebook Tweet this Link thison Linkedin Link this on Google Plus
PUBLISHED:
JULY
13
2012


Yahoo on Thursday confirmed that more than 400,000 user names and passwords were stolen in a hack attack by a group calling itself D33D Company.

But the Yahoo breach is having a ripple effect through the industry. That's because the passwords to the 453,492 accounts not only belong to Yahoo users, they also work on Gmail, Hotmail, AOL, MSN, Comcast, SBC Global, Bellsouth, Live.com and Verizon accounts.

In a published statement, Yahoo said it was "fixing the vulnerability that led to the disclosure of this data, changing the passwords of the affected Yahoo users and notifying companies whose user accounts may have been compromised." But security experts are still suggesting users change their passwords to Yahoo and other sites.

A Black Market for Passwords

We turned to Chris Petersen, chief technology officer and founder of LogRhythm, to get his second-day reaction on the Yahoo breach. He told us Web applications continue to be seen as a soft target by cyber criminals looking to sell passwords on the black market.

"Passwords are of value when associated with an e-mail account, which is purported to be the case in the Yahoo breach," Petersen said. "Because users often use the same password across different accounts, cyber criminals might be able to access other sites, company networks, and banking accounts if they can successfully map the compromised e-mail address to the individual that owns it."

Petersen is charging organizations to start doing a better job of implementing Web application defenses if they want to avoid being the next Yahoo. Perimeter defenses including Web application firewalls are a good start but by themselves not sufficient.

"These technologies operate largely on the premise they can detect what is known," Petersen said. "To have a chance detecting what is not known, additional monitoring and response approaches must be employed. For example, by analyzing Web server logs and network activity patterns, attacks that evade perimeter defense can still be detected and defended against."

Detecting Hackers

Tom Cross, director of security research at Lancope, said there are a lot of passwords and password hashes circulating in the underground after a string of recent breaches and disclosures like this one and the recent LinkedIn hack that saw 6.5 million passwords exposed on a Russian site.

"We have every reason to believe that we are going to see similar compromises in the future," Cross told us. "These passwords are going to be used to compromise corporate networks."

From Cross' perspective, the question that we need to be asking is this: How do we detect attackers who log into our networks with legitimate credentials?

"Organizations that are only focused on looking for exploit activity at the network perimeter can't see attacks after they've already gotten in the front door," Cross said. "IT security teams also need visibility into authorized traffic on the internal network that enables them to detect and mitigate compromises after the walls have been breached."

Tell Us What You Think
Comment:

Name:

Like Us on FacebookFollow Us on Twitter
TOP STORIES NOW
MAY INTEREST YOU
ISACA® offers a global community of more than 115,000 IS/IT constituents in over 180 countries. We develop and deliver industry-leading certifications, education, research and business frameworks. We equip individuals to be leaders in the fast-changing world of information systems and IT - Learn More>
MORE IN DATA SECURITY
Product Information and Resources for Technology You Can Use To Boost Your Business

NETWORK SECURITY SPOTLIGHT
Sony is no stranger to breaches. Sony’s PlayStation Network was hacked in 2011 and attackers obtained 77 million user accounts. The latest attack comes against Sony Pictures Entertainment.

ENTERPRISE HARDWARE SPOTLIGHT
Chinese computer maker Lenovo got creative with the marketing campaign around its Yoga 3 Pro. Lenovo hired the Upright Citizens Brigade, a comic troupe, to help drum up visibility for its new device.

MOBILE TECHNOLOGY SPOTLIGHT
In its bid for the wearables market, Sony is reportedly developing a watch made out of electronic paper for release as soon as next year. The e-paper watch will emphasize style over tech innovations.

© Copyright 2014 NewsFactor Network, Inc. All rights reserved. Member of Accuserve Ad Network.