Yahoo confirms breach, passwords appear not encrypted

Share this article:

Yahoo on Thursday confirmed that its database was hacked to steal about 400,000 usernames and passwords of members who belong to the company's Contributor Network, which formerly was known as Associated Content.

Yahoo said the theft of the file occurred on Wednesday, but fewer than five percent of the stolen accounts still contained "valid" passwords.

According to Ohio-based security firm TrustedSec, the hackers, which claimed to be part of a relatively unknown contingent known as "D33ds Company," obtained the booty in clear text through a SQL injection attack, a common technique used to infiltrate vulnerable web applications. The hackers publicly posted the file they stole, but high traffic currently is preventing it from being accessible.

"The most alarming part to the entire story was the fact that the passwords were stored completely unencrypted, and the full 400,000+ usernames and passwords are now public," TrustedSec said in a blog post.

Yahoo didn't respond to a question of why the passwords were not cloaked, but said it was asking victims to change their passwords.

Yahoo is one in a recent string of high-profile online firms, including LinkedIn, E-Harmony and Formspring, that have been breached of passwords. Each has had varying degrees of controls in place to protect the credentials.

Earlier Thursday, Eset security blogger Anders Nilsson ran an analysis to uncover common passwords and domains with the dump.

Predictably, the most common passwords were '123456', 'password' and 'welcome,' while domains Yahoo, Gmail and Hotmail appeared most frequently.

There were 1870 .edu domains, 93 .gov and 81 .mil. The full password analysis is on Pastebin and a mirror of the dump has been posted to MediaFire.

Users tend to share passwords across websites, which means the breach of one organization can lead to unauthorized access or fraud at an entirely different site.

SC Magazine Australia contributed to this article.
Share this article:

Sign up to our newsletters

More in News

DDoS attacks remain up, stronger in Q2, report says

DDoS attacks remain up, stronger in Q2, report ...

Prolexic's second quarter DDoS report noted the proliferation of shorter attacks that ate up more bandwidth.

Superman soars above fellow superheroes as most toxic search term

A McAfee study found that searches pertaining to Superman exposed users to the most infected websites.

Black Hat talk on Tor weaknesses canceled

Black Hat organizers say legal counsel for the Software Engineering Institute and Carnegie Mellon University nixed the session.