![]() |
Rick's b.log - 2015/09/30 |
It is the 8th of September 2024 You are 3.128.202.85, pleased to meet you! |
|
mailto:
blog -at- heyrick -dot- eu
Well...
My hat off to Mick who did a little bit of detective work and turned up a story that I managed to miss. Surely it was on The Register? I dunno...
Some selected quotes from the article:
Unanswered questions - obviously - are:
Compromised - it wasn't me!
Yesterday I reported that a spammy message was sent to odd-looking names from my "address book", sort of. The list of names didn't match any that I had stored in any of my devices, but it seemed to be ones that I have emailed at some stage. My guess, based upon the names, was that Yahoo!'s webmail may have been compromised; but I didn't want to come right out and say that with no sort of proper evidence.
And, now, paydirt. This one explains exactly what I was suspecting and why I thought it was Yahoo! webmail that had been compromised:
and:
Look, this isn't hard. Or computationally expensive. The process is performed once when the user sets/changes their password, giving a number. Which is stored in the user account data. When the user comes to sign in, the process is performed upon the password that they enter. This, too, results in a number. It's a basic equality test - does this number just calculated match the number stored for this account? Yay or nay. Grant access or say sod off. It is EASY. Really.
I have written a server. It is not intended to be secure, but it does exactly this (only without the password length part; but I'm never going to have 237,000,000 users). Only a total effing twat would, in this day and age, store passwords in any sort of readable form.
Yahoo! - YOU. FAIL. COMPLETELY.
David Pilling, 1st October 2015, 03:04 A year or two back, yahoo accounts getting hacked was common - moderating various 'lists I got to see the effects. I always wondered why yahoo, what was it about that system. Might be that it was big enough to attract hackers. 237 million is enough that any guess for a password is likely to be right for someone.VinceH, 1st October 2015, 12:17 I would say "Wow, what a massive fail!" but the first word suggests surprise.
These days, I am not surprised by any security breach.
Which is sad.
© 2015 Rick Murray |
This web page is licenced for your personal, private, non-commercial use only. No automated processing by advertising systems is permitted. RIPA notice: No consent is given for interception of page transmission. |