Skip to main content

Yahoo! Voice hacked; 400,000+ login credentials dumped online

Hackers belonging to a hacking collective called D33Ds Company have retrieved and dumped login details of more than 400,000+ user accounts in plain text. A post on Trustedsec stated, "The passwords contained a wide variety of email addresses including those from yahoo.com, gmail.com, aol.com, and much more." Interestingly, the post adds that the affected website is a sub-domain of yahoo.com, and that the compromised server may be Yahoo! Voice a.k.a Associated Content. "The affected website was only named as a sub-domain of yahoo.com. However, digging through and searching for the hostname, the attacker forgot to remove the hostname “dbb1.ac.bf1.yahoo.com” (credit to Mubix for the hostname find)," Trustedsec wrote. The most worrisome bit here is that the passwords that were stored were completely unencrypted, and as you're reading this, 400,000+ login credentials (comprising usernames and passwords) have been exposed.

It has been brought to light that the hackers used a union-based SQL injection attack to get away with the information stored in the database. The post on Trustedsec also put forth a glimpse of what the data leaked online looks like (can be seen in the image below). 


A note at the end of the dump reads, "We hope that the parties responsible for managing the security of this sub-domain will take this as a wake-up call and not as a threat. There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The sub-domain and vulnerable parameters have not been posted to avoid further damage."

Reporting on the issue, Ars Technica's Dan Goodin wrote that the union-based SQL injection hacking technique used here affects inadequately secured web applications that do not "properly scrutinize text entered into search boxes and other user input fields". He added, "By injecting powerful database commands into them, attackers can trick back-end servers into dumping huge amounts of sensitive information."

Security breach, such as the case in point or the LinkedIn database leak, is emerging as a worrying trend. LinkedIn recently suffered a data breach where passwords of some of the social network's members were compromised. At the time of the incident, LinkedIn engineer Vicente Silveira confirmed on the website's blog that some passwords were "compromised". "We are continuing to investigate this situation," he said.

Comments

Popular posts from this blog

What is the difference between a frigate,cruiser,destroyer, battleship ?

Usually the size and the purpose. The period of time sometimes distinguishes the name.Modern navy combat ships are generally divided into seven main categories. The categories are: Aircraft Carriers, Battleships, Cruisers, Destroyers, Frigates, Submarines, and Amphibious assault ships. There are also support and auxiliary ships, including the minesweeper, patrol boat, and tender. During the age of sail, the ship categories were divided into the ship of the line, frigate, and sloop-of-war.
Frigate is a name which has been used for several distinct types of warships at different times. It has referred to a variety of ship roles and sizes. From the 18th century, it referred to a ship smaller and faster than a ship-of-the-line, used for patrolling and escort work rather than fighting fleet actions. In modern military terminology, the definition of a frigate is a warship intended to protect other warships and merchant marine ships and as anti-submarine warfare (ASW) combatants for amphibiou…

10 Ways Men Are Dressing Wrong

Why are we not allowed to switch on our phones at Petrol stations?

If we use cell phone at petrol station its radiation can make any spark in some machine of the patrol station.And a little spark can make a big explosion.So,Better stay away from it because It is better to safe than sorry