Forgot your password?
typodupeerror
Yahoo! Security

Yahoo Mail Resets Account Passwords After Attack 96

Posted by Soulskill
from the fallout-from-an-earlier-breach dept.
MAXOMENOS writes: "Last night Yahoo! announced via their Tumblr page that they had detected attacks against some Yahoo Mail accounts. They reset the passwords to all affected accounts, and advised users of good password practices. Quoting: 'Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise. We have no evidence that they were obtained directly from Yahoo's systems. Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts. The information sought in the attack seems to be names and email addresses from the affected accounts' most recent sent emails.'"
This discussion has been archived. No new comments can be posted.

Yahoo Mail Resets Account Passwords After Attack

Comments Filter:
  • The real news (Score:5, Insightful)

    by Anonymous Coward on Friday January 31, 2014 @09:51AM (#46119141)

    The real news is that apparently, Yahoo Mail still exists.

    • by Thanshin (1188877)

      I wonder how desperate for attention one must be to confess a security breach just to be in some news.

      • "I wonder how desperate for attention one must be to confess a security breach just to be in some news."

        Do you really think that was the goal? Advertising a security breach? It isn't really anything novel these days--everyone is doing it. We've become bored with the very idea.

        More than likely, they are simply trying to determine who is using which account. They release this sort of announcement to get users to simply interact in any way, be that changing your password or even trying to do so. This way, they

    • Re:The real news (Score:5, Interesting)

      by CubicleZombie (2590497) on Friday January 31, 2014 @10:40AM (#46119533)

      I've been using Yahoo mail since almost the beginning and still do.

      I changed my password as soon as I heard about this. Or, I tried to. Yahoo makes it so difficult to change your password that I actually had to go to Google and search for "How do I change my Yahoo password". Then once I figured out where to go (none of the links worked - I had to paste it from an answers.yahoo.com reply), the AJAXified page wouldn't work in Firefox on Linux, so I had to fire up my work PC and use IE.

      Unbelievable.

      While I was there, I deleted an old yahoo personals alias (also didn't work in Firefox - had to use IE), and then changed my backup email. But that didn't work either - the link in the confirmation email went to an error page.

      • by Anonymous Coward

        Odd, I did the same thing last night with Firefox on Linux. Was easy to find link, was easy to change, had no issues at all.

        I keep reading about how horrible Yahoo mail is, but I never seem to have the issues everyone else does. Their spam filter is also nearly 100% perfect for me as well.

        • by rueger (210566)
          YMMV, but I had no problem with a Chrome/Mint Linux combo. Admittedly it took some rather irritating hunting (and multiple log-ins) to get to where I could change the password, but the actual change was no more or less easy than any other site.

          And once again I was reminded that the only reason that I have a Yahoo e-mail/profile/thingy is because there is one, countem' ONE Yahoo group that I use. The actual e-mail account has nothing in it, not even random spam, after three or four months between log-in
      • My Soapbox! (Score:3, Interesting)

        by Anonymous Coward

        I manage mail servers for a mid sized company, and Yahoo can kiss my ass! Their IP ranking system is stupid and they won't change it, which fucks any smaller ISP hosting multiple domains on a single IP. If we have a company get a mailbox compromised from domainx, yahoo blocks all mail from the IP instead of the domain so everyone else is screwed. Even when we lock the account, yahoo has no method of unblocking.

        To make things 10 times worse, their mail interface has a big ole "SPAM" button which allows us

      • by GIL_Dude (850471)
        I actually got a text message the other day (purporting to be Yahoo - turns out it was them) saying that unusual activity had been seen on my account and they had disabled it until I went to the site on a PC. (I hardly ever use it - so this was a surprise - it is just a catch all for crap sites I may have to sign up for to keep them out of my "real" email). Anyway, I have two factor auth turned on (for Google, MS, and Yahoo) so I was surprised to see this. I guess they used the right password, but couldn't
      • When in Yahoo mail, click the gear in the upper right, select "account info" (it's the thing at the bottom), at the next page click "change password".

        That's not at all difficult, it's barely different from how you do it on google or anything else.

        I used Chrome to do it.

        • Seconded, I changed my short before hopping onto /. today. Took a few seconds, no problems at all. I was surprised there wasn't a second box to confirm the new password in, although you can show it as plaintext.

          There's plenty wrong with the new, "improved" Yahoo mail, I'd move to Gmail or something else if it weren't for the fact that 15 years worth of everybody in my life has my Yahoo address, but changing the password isn't problematic.

      • Had to change the password on an old account that I forgot the password to and had to access recently. The trick to get past the 'password not secure enough' error is simply to turn off adblock for that moment. Was driving me nuts, when I was trying 30+ random-char, unmemorizable passwords that would probably satisfy ~95% of all password requirements and still getting that stupid error, until I found the solution.
    • Re: (Score:3, Insightful)

      Yahoo mail was once the equivalent to gmail. It had very good UI, speed and storage for its day. All of this when many ISPs still charged for an email account. It is not surprising that many people still hold on to their yahoo mail accounts.

      • by edjs (1043612)

        Also, Yahoo acquired a number of email list service providers many years ago; the only reason I still have an account there.

    • by chispito (1870390)
      It has better spam filtering than gmail, and ten years ago, when I started using it, way better than hotmail. Also, it was a great place to play chess.
      • Really? Last time I used it, admittedly a long time ago, about half my mail was spam. Sadly, that was still better than my ISP mail.

    • The big advantage Yahoo! Mail had back around 2000-2005 was the large mailbox size, a larger limit on attachment size, etc.

      This was back when ISPs only gave you a 2-10MB mailbox and limited attachment sizes to as little as 1MB.

      Then GMail hit with their 1GB mailbox, all the other free webmail providers had to up their limits.
    • by Darinbob (1142669)

      It is the primary mail service for AT&T.

    • No the real news is that Yahoo still exists separately from Google. I would have figured the Marissa Mayer, being the former resident Queen Bee, (literally, Illinois Institute of Technology granted Mayer an honoris causa doctorate degree in recognition of her work in the field of search in 2009 [and she was Vice President of Local, Maps, and Location Services and, before that, vice president of search products and user experience as well as the highest ranking female there.]) would have taken the job of CE

  • Why in the fuck weren't the passwords hashed or something? Why did a third party need the passwords? Grr
    • Re:WTF (Score:5, Interesting)

      by Albanach (527650) on Friday January 31, 2014 @10:06AM (#46119243) Homepage

      Hashing passwords is pretty pointless unless they're also salted. Otherwise all the common and short passwords are as good as being in plain text.

      As for why a 3rd party had the passwords, I think Yahoo need to be quite a bit more forthcoming and explain this. Surely they are aware that their customers are going to be reusing passwords and that, by giving a third party these passwords they are also exposing their customer's accounts on numerous other sites?

      • Re:WTF (Score:5, Insightful)

        by sl4shd0rk (755837) on Friday January 31, 2014 @10:37AM (#46119513)

        As for why a 3rd party had the passwords, I think Yahoo need to be quite a bit more forthcoming and explain this.

        Quite feasible that yahoo had nothing to do with it:
        Jimbob creates account on somecrackablesite.com using jimbob@yahoo.com email address. somecrackablesite.com gets cracked and attacker gets DB dump which contains username/email/pass for jimbob. Attacker assumes jimbob used same password for both sites and gains access to yahoo account. This is why using the same password for multiple sites is a big no-no.

        • Re:WTF (Score:4, Insightful)

          by jones_supa (887896) on Friday January 31, 2014 @11:10AM (#46119777)

          This is why using the same password for multiple sites is a big no-no.

          And flipping that around a bit, it is also a security risk as so many sites allow a password reminder through e-mail. If someone cracks only your e-mail, he can just send these reminder requests around the web and get access to various sites.

          • by Anonymous Coward

            That's why your e-mail should be one of your most closely guarded accounts, together with banking accounts and alike. Did y'all turn on 2 factor auth yet?

            Obliquely related, some e-mail providers let you freely use aliases like somemail+slashdot@gmail.com and somemail+dotslash@gmail.com for somemail@gmail.com - sites that ask for e-mail in password reset form will just tell you "No such account" if you have it set to "somemail+thissite@..." but ask for "somemail@...". As a bonus, you'll instantly know there

        • by Albanach (527650)

          Quite feasible that yahoo had nothing to do with it:

          It's feasible, but Yahoo are taking a hammering on this.

          If they believe the data was obtained via a 3rd party and they know they don't share passwords hashed or otherwise with 3rd parties, I would have expected them to be shouting that from the rooftops.

      • by hairyfeet (841228)

        Well from what I've seen it appears that this is the case, some users have been using the same lame passwords all over the place, with some of them foolish enough to use their yahoo mail AND their Yahoo mail password on some third party website and naturally when the website got boned the spammers starting trying out the passwords, hence the reset.

        Anyway that is what I'm seeing at the shop, the customers that don't use the same password at every site aren't seeing any resets, neither have I and I have 3 yah

    • by cdrudge (68377)

      Maybe they were. As the Target security breach demonstrated, if you can intercept the information prior to it being hashed/encrypted, it's still usable.

      For an example, say a website's authentication process code is compromised. It works exactly the same as it always has been, but prior to hashing the supplied password to compare to the saved salted & hashed value (exactly the way it should be), an extra function call is made that saves the username and password to some data store (text file, remote dat

  • by Anonymous Coward on Friday January 31, 2014 @10:05AM (#46119233)

    advised users of good password practices

    Good password practices are pointless if the backend database is compromised. That's like adhering to the five second rule after dropping a donut in a dogpile.

    • by Anonymous Coward

      They're saying you shouldn't make it so your username and password from $third_party_site can log you in to Yahoo Mail.

  • Happens at all ISPs (Score:2, Informative)

    by Anonymous Coward
    I work for a large ISP and we regularly see our customers' accounts targeted when some other website leaks their user information and it includes email addresses on our network and passwords the attackers can guess will give them access. If we can get hold of the leaked data we can work out which accounts are at risk and either warn the customers or reset their authentication credentials before hand. Standard practice and good to see Yahoo is following it.
  • by fidget (46220) on Friday January 31, 2014 @10:18AM (#46119333)

    ... is why suddenly yahoo is making a show of caring.

    I have a four-letter yahoo account (not that kind of four-letter word...) from waaaaay back in the day. It was something I maintained for about two decades for plausible deniability... a cut-out.

    SCORES of people have tries to hack it. A couple have succeeded, but not since I switched it to a 32-character mixed-case-and-special password. Still, they try at the rate of about 3 a week (that I *see* via attempted password-reset manipulations, 2-factor authentication change attempts, etc).

    But ... I have received about 10 emails from folks who wanted to 'own' the email address. And -- I think -- because I didn't acquiesce, I have received hundreds of thousands of spam emails in the intervening time. They've submitted my email to stupid dating sites in French, German, Thai, Spanish, Tamil and most recently Hebrew. Hell, I got 1000+ emails/day from ONE SITE for a few days, about a week ago.

    There's been phishing, spear-phishing based on the pseudo-identity hosted there, blind newsletter sign-up. Every kind of crap you can imagine, and several more.

    And every step of the way, I reported the infringements, the spamming, the users who have a variant of the name (e.g. foo2525 instead of foo): to the spam-handlers and to the variant-users.

    And yahoo has never given a shit. Not once. Period. IMHO, 'cause it was one account-holder. But I've kept it anyway -- since it's a great cut-out. And I'll continue to do so. Yahoo is a joke; has been for many years now. Sometimes... that's its value. It's a great example of what NOT to do, and it's a great revealer of the seedy underbelly of the 'net.

    http://demotivators.despair.co... [despair.com]

    • And yahoo has never given a shit. Not once. Period. IMHO, 'cause it was one account-holder.

      And frankly, that's as it should be. If you lucked into an especially desirable account name, it's not Yahoo!'s responsibility to keep people who want to buy it away from you. And reporting people who have a variant? Seriously? Unless it's a trademark or copyright issue, you have precisely zero leg to stand on. Yahoo! isn't responsible for your sense of self entitlement.

      Meanwhile, I've had a Yahoo! account for de

      • by fidget (46220)

        RTFMessage. To be clear, I wrote that I reported folks who used a variant to the variant-user. e.g. send email as foo@yahoo.com instead of foo2525@yahoo.com and I get the email reply, I sent it on to foo2525 with a note that they used the wrong email. Of course, the correct email has to be indicated somewhere, or I have no way ...

        My mistake was not adding ", respectively" to the sentence.

        Glad to see you got your exercise today, jumping to conclusions.

        • To be clear, I wrote that I reported folks who used a variant to the variant-user. e.g. send email as foo@yahoo.com instead of foo2525@yahoo.com and I get the email reply, I sent it on to foo2525 with a note that they used the wrong email.

          To be clear, no you didn't write any such thing. You didn't write anything even close to such a thing.

          Your mistake isn't that you didn't add "respectively", it's that you're a clueless moron who not only didn't read what he wrote, but for 'reporting them to Yahoo' and bel

          • Amazing. I restrained myself and didn't call out your ignorance, since I tend to use rather complicated sentence construction. You failed to learn when hit with the clue-stick.

            So hey, let's play...

            The sentence read "I reported the infringements, the spamming, the users who have a variant of the name (e.g. foo2525 instead of foo): to the spam-handlers and to the variant-users." Let's dissect this.

            The disingenuous would read this to mean I reported everyone to the spam-handlers *and* the variant-owners. T

    • What is it, asdf@yahoo.com?
  • by cjmnews (672731) <cjmnews@yahoo.com> on Friday January 31, 2014 @10:25AM (#46119409) Homepage

    A spam email that went to the Inbox stating that Yahoo! was going to close all inactive accounts if you did not click on this link and log in was probably how the attacker got the passwords. The link went to one of those off-shore URLs that we should all avoid.

    Phishing is still alive and well.

    And there are a lot of gullible people to phish for.

    • by sconeu (64226)

      My mom got that one. Fortunately, she called me first BEFORE she did anything about it.

    • by edjs (1043612)

      I think that was just the usual background phishing that's always going on.

      On the 19th I got a legitimate Yahoo sign-in alert for an account I had forgotten about and not used for the better part of a decade, with the only activity being a "Yahoo! Partner's Application" login. I'm guessing this login was part of this attack.

  • "Yahoo! announced via their Tumblr page"


    Really? This is how businesses are delivering their security announcements?
  • Yahoo mail has always been a one off disposable email to me, and answers.yahoo is just silly, who would post something there when you can just Google it, not to mention virtually every answer that I have seen get "modded up" as best has been incorrect.

    Interestingly, using it to sign up for a site recently I noticed they wanted my phone number with a promise to "keep it secure" next to the number space.

  • You put the "fun" back in dysfunctional. Whenever I think of Yahoo, inevitably this pops into my head "It's the Bumpus Hounds! Ta da da da, da da!"
  • WTF is that and why did Yahoo think I would see it?

  • ..since my Yahoo (junk) mail account was hacked a couple of months ago. I am certain it was because I used by Yahoo credentials to post a comment on a popular 'news' website (**cough** Slate).
    I changed my PW to a machine-generated chunk of gibberish, and turned on 2-factor ID.
    • by vinn01 (178295)

      I think you'll find that the comment section of that news website is run by Disqus.com. It's not the news site that got hacked. Disqus.com got hacked.

  • Even with this breach, I still think their mandatory MOBILE phone number requirement to get a Yahoo account is BS. Just one more data point floating in the revenue stream...
  • Been trying to help a friend get into their yahoo mail all morning, it won't allow access, sends to password reset instead, and no matter how strong I make the password it says it's too weak.

    Yahoo will probably issue themselves a "best of the web" award to compensate for the inconvenience.

    Such douchebaggery.
  • I received the Yahoo password notification (cell phone text) for a Yahoo account that I set up only for the purpose of making comments on Disqus sites.

    I had to change the password from something simple to something obtuse in order to login. The sent folder is still empty, since I have never sent a single email from that account. Since I have never used that email account for any other site, obviously there are no password reset attempts in the inbox.

    There far too many web sites getting hacked. Are the d

If all the world's economists were laid end to end, we wouldn't reach a conclusion. -- William Baumol

Working...