Humiliating Billion User Hack Attack on Yahoo 'Likely Launched by a State Actor'

© REUTERS / Dado RuvicYahoo Mail logo is displayed on a smartphone's screen in front of a code in this illustration taken in October 6, 2016.
Yahoo Mail logo is displayed on a smartphone's screen in front of a code in this illustration taken in October 6, 2016. - Sputnik International
Last week, Yahoo! Inc. announced that it was working with law enforcement following a hacking breach of over a billion user accounts. Speaking to Radio Sputnik, senior cybersecurity expert Gary Miliefsky said that there was good reason to believe that state actors were behind the hack, and explained why.

The attack on the company, whose existence was revealed on Wednesday, occurred over three years ago, in August 2013. Involving over a billion user accounts, the hack is the largest security breach in history. The company had already secured this humiliating title just three months ago, in September 2016, when the data of 500 million users was reported to have been breached. That attack was said to have been the work of a "state-sponsored actor," and Yahoo believes the two hacks may be connected.

Speaking to Radio Sputnik, Gary Miliefsky, senior cybersecurity expert and founding member of the US Department of Homeland Security, discussed the details of the latest hack, and why he agreed with Yahoo's assessment of this probably being the work of a foreign government.

For a start, the expert explained that the Yahoo hack appears to be part of the global problem of sophisticated phishing attacks. "If we step back and look at all the breaches all across the globe…it's all about an employee in the company getting an email that appears to be from someone they trust, called a spear phishing attack. When they click on a link, or download an attachment or open a file they think they should open, because they trusted the email, they get infected with a remote access trojan which allows criminals, hackers or nation states to get at the data inside that network from far away."

Yahoo - Sputnik International
Hacked Again: ‘More Than A Billion’ Yahoo Accounts May Have Been Compromised
Unfortunately, Miliefsky added, the fact that most people are trusting, and employees of companies are poorly trained in resisting these attacks, makes it very likely that this form of hacking will continue to remain popular. Asked what individuals can do to protect themselves, the cybersecurity specialist stressed that it's best not to open email attachments, or better yet, not to send files over email in the first place if possible without verification.

"Spearfishing is the number one way to steal data from any organization. In the United States, lost 80 million records, lost 22 million records, now Yahoo a billion – it'll just keep happening if people are not more aware and more vigilant," Miliefsky noted.

Specifically regarding the Yahoo attack, the expert said that his gut feeling told him "a nation state" was probably responsible. "Some have leaned toward Russia; I think it's actually the Chinese government, because they're great at these kinds of attacks – and of cross-correlating records. You do one breach here and another breach there and then you find common information," eventually building up a dossier of important data.

At the same time, Miliefsky explained that the massive hack was probably the work of a state actor, due to its targeting of user data en masse, while ordinary cybercriminals "don't waste their time on info if they don't get credit card data."

As for how an attack of this scale could have taken place in the first place, the expert suggested that it was likely done "over a period of many months using what's called a remote access trojan. Many remote access trojans cannot be detected by [even] the latest anti-virus scanner…In other words, most of the new malware that can sit around and eavesdrop on your network for days, weeks or months is custom-written and non-detectable by your favorite anti-virus scanner –that's one of the big problems."

The US Senate Intelligence Committee approved a bill Thursday which facilitates the sharing of information about cybersecurity threats between private companies and US government intelligence agencies. Critics fear it’s “a surveillance bill by another name.” - Sputnik International
India to Overhaul Cybersecurity After Banks, Parliament Hacks
Given the logistics of stealing the information of a billion users, Miliefsky noted that the data was probably stolen from Yahoo over a period of many months, in order to avoid alerting firewalls, antivirus software, and other intrusion prevention tools.

Moreover, the analyst stressed that such attacks, whether against companies or governments, can be very sophisticated, stretching out over a very long period of time to glean reams of sensitive information. 

"When you install a remote access trojan, just like the breach of 100 banks in Russia [last year], where they stole over a billion dollars, what they did is sat on the network, and wormed their way across for at least six months, collecting data, eavesdropping on the microphone, the webcam, the keyboard, learning a lot about the environment. And next thing you know [the hacker] is part of the network administration team, and no one even knows they're there." The same scenario may have occurred with the Yahoo breach.

Asked why it took so long for the company to publicly admit the existence of the hack, Miliefsky said that that's actually a very good question. "Under California law, where they're located, they would have had to disclose in 30 days." He suggested that it was possible that the company found out about the incident very late after the event. "According to [cybersecurity firm] FireEye, most companies that have been breached don't know about it for almost a year. So they may not have found out for a while, and then asked the FBI for help, and perhaps the FBI told them not to disclose the breach" in order to investigate it more thoroughly.

Internet of Things - Sputnik International
'I’m Afraid, Dave' - Global Havoc-Causing Mirai Malware Evolves, Adapts
Ultimately, the expert advised Yahoo users to get a new user account, or choose another company. In any case, he noted that in light of the recent breaches, Yahoo probably isn't the safest place to have an email account.

Following the hack, Verizon, which planned to acquire Yahoo for $4.8 billion, announced that it would review the terms of the agreement, including the purchase price. Miliefsky noted that the hacking news amounted to an "epic fail" by Verizon's mergers and acquisitions team, and will likely affect the purchase price by a "tremendous amount."

To participate in the discussion
log in or register
Заголовок открываемого материала