{"id":7252,"date":"2016-09-29T09:52:15","date_gmt":"2016-09-29T16:52:15","guid":{"rendered":"http:\/\/www.infosecurity.pro\/?p=7252"},"modified":"2019-04-20T16:24:32","modified_gmt":"2019-04-20T16:24:32","slug":"yahoos-exfiltration-of-md5-credentials","status":"publish","type":"post","link":"https:\/\/www.infosecurity.pro\/?p=7252","title":{"rendered":"Yahoo&#039;s exfiltration of MD5 credentials"},"content":{"rendered":"<p>\t\t\t\t<![CDATA[Since Yahoo's announcement that it had approximately 500 million accounts stolen by what they believed to be state sponsored hackers, the company InfoArmor,\u00a0which is\u00a0based out of Arizona, claims that it has traced the Yahoo data theft to a hacker group called \"Group E\". \u00a0\"Group E\" is believed to have attempted to sell \u00a0Yahoo credentials data 3 times since 2015. \u00a0The data is believed to have been stolen sometime prior to December 4, 2014.\nInfoArmor claims to have been tracking \"Group E\" since 2013 after the hacker group allegedly stole 100M+ records from LinkedIn.\nFurther claims are that the data was exfiltrated in over 100 large portions by alphabetical order of user account names. \u00a0The Yahoo data is believed to have included (based on 8 out of 10 Yahoo IDs provided by The Wall Street Journal and successfully cracked in less than 48 hours\u00a0by\u00a0InfoArmor):\n\n\n<ol>\n \t\n\n<li>Login ID<\/li>\n\n\n \t\n\n<li>Country Code<\/li>\n\n\n \t\n\n<li>Date of Birth<\/li>\n\n\n \t\n\n<li>Recovery email address &amp; zipcode<\/li>\n\n\n \t\n\n<li>MD5 hash based password<\/li>\n\n\n \t\n\n<li>Mobile phone number<\/li>\n\n\n<\/ol>\n\n\nYahoo initially investigated the possibility of the breach in July after discovering hackers Tessa88 and &#8216;Peace of Mind&#8217; were trying to sell segments of legitimate mixed with bogus data dumps of Yahoo credentials. \u00a0 At the same time period of the investigation\u00a0Yahoo was selling\u00a0its internet business and some real estate for $4.8B to Verizon Communications. \u00a0On September 9th in their securities filing, Yahoo claimed it was not aware of any loss, theft, unauthorized access, or security breach of user data.\n[caption id=\"attachment_7253\" align=\"alignright\" width=\"474\"]<a href=\"http:\/\/www.infosecurity.pro\/wp-content\/uploads\/2016\/09\/Screen-Shot-2016-09-29-at-9.48.20-AM.png\"><img loading=\"lazy\" decoding=\"async\" class=\"size-large wp-image-7253\" src=\"http:\/\/www.infosecurity.pro\/wp-content\/uploads\/2016\/09\/Screen-Shot-2016-09-29-at-9.48.20-AM-1024x786.png\" alt=\"example of Yahoo hash based credentials\" width=\"474\" height=\"364\" \/><\/a> example of Yahoo hash based credentials[\/caption]]]>\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\t\t\t\t<![CDATA[]]>\t\t<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"amazonpipp_noncename":"","amazon-product-isactive":"","amazon-product-single-asin":"","amazon-product-content-location":"1","amazon-product-content-hook-override":"2","amazon-product-excerpt-hook-override":"3","amazon-product-singular-only":"","amazon-product-amazon-desc":"","amazon-product-show-gallery":"","amazon-product-show-features":"","amazon-product-newwindow":"2","amazon-product-show-list-price":"","amazon-product-show-used-price":"","amazon-product-show-saved-amt":"","amazon-product-timestamp":"","amazon-product-new-title":"","amazon-product-use-cartURL":"","amazon_featured_post_meta_key":"","_amazon_featured_alt":"","amazon-product-template":"","footnotes":""},"categories":[64],"tags":[],"class_list":["post-7252","post","type-post","status-publish","format-standard","hentry","category-risks"],"_links":{"self":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7252","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7252"}],"version-history":[{"count":1,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7252\/revisions"}],"predecessor-version":[{"id":7883,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=\/wp\/v2\/posts\/7252\/revisions\/7883"}],"wp:attachment":[{"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7252"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7252"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.infosecurity.pro\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7252"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}