Yahoo says one billion accounts exposed in newly discovered security breach

December 15, 2016

Dec 15: Yahoo Inc (YHOO.O) warned on Wednesday that it had uncovered yet another massive cyber attack, saying data from more than 1 billion user accounts was compromised in August 2013, making it the largest breach in history.

yahooThe number of affected accounts was double the number implicated in a 2014 breach that the internet company disclosed in September and blamed on hackers working on behalf of a government. News of that attack, which affected at least 500 million accounts, prompted Verizon Communication Inc (VZ.N) to say in October that it might withdraw from an agreement to buy Yahoo's core internet business for $4.83 billion. Following the latest disclosure, Verizon said, "we will review the impact of this new development before reaching any final conclusions." A Yahoo spokesman told Reuters that the company has been in communication with Verizon during its investigation into the breach and that it is confident the incident will not affect the pending acquisition.Yahoo required all of its customers to reset their passwords - a stronger measure than it took after the previous breach was discovered, when it only recommended a password reset.

Yahoo also said Wednesday that it believes hackers responsible for the previous breach had also accessed the company"s proprietary code to learn how to forge "cookies" that would allow hackers to access an account without a password."Yahoo badly screwed up," said Bruce Schneier, a cryptologist and one of the world's most respected security experts. "They weren't taking security seriously and that's now very clear. I would have trouble trusting Yahoo going forward."Yahoo was tentative in its description of new problems, saying the incident was "likely" distinct from the one it reported in September and that stolen information "may have included" names, e-mail addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.

It said it had not yet identified the intrusion that led to the massive data theft and noted that payment-card data and bank account information were not stored in the system the company believes was affected.Yahoo said it discovered the breach while reviewing data provided to the company by law enforcement. FireEye Inc"s (FEYE.O) Mandiant unit and Aon Plc's (AON.N) Stroz Friedberg are assisting in the investigation, the Yahoo spokesman told Reuters.The breach is the latest setback for Yahoo, an internet pioneer that has fallen on hard times in recent years after being eclipsed by younger, fast-growing rivals including Alphabet Inc's (GOOGL.O) Google and Facebook Inc (FB.O).

Hours before it announced the breach on Wednesday, executives with Google, Facebook and other large U.S. technology companies met with President-elect Donald Trump in New York. Reflecting its diminished stature, Yahoo was not invited to the summit, according to people familiar with the meeting.The Yahoo spokesman said Chief Executive Marissa Mayer was at the company's Sunnyvale, California headquarters to assist in addressing the new breach. Yahoo shares were down 2.4 percent to $39.91 in extended trading. Verizon shares were little changed from their close at $51.63. (Reporting by Jim Finkle in Boston and Anya George Tharakan in Bengaluru; Additional reporting by Dustin Volz in Washington and Jessica Toonkel in New York; Editing by Savio D'Souza, Bernard Orr)

This story has not been edited by Firstpost staff and is generated by auto-feed.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
March 25,2020

In an unprecedented crisis despite Prime Minister Narendra Modi assuring the continuation of essential services like food and groceries, online marketplaces like Flipkart and Amazon along with delivery platforms like Bigbasket, Grofers and FreshToHomes hit a major blockade on Wednesday as local authorities shut warehouses and sent delivery boys back, even harassed them.

Millions of people across cities were left helpless at homes as essential items like fruits and vegetables, dairy and milk, meat and fish etc did not reach their doors despite placing orders well in advance. Later, the orders went dry.

While Grofers' warehouse in Faridabad was closed by the local law enforcement agencies, Bigbasket complained that the police stopped its delivery partners and "some of them were even beaten up by for no fault of theirs".

"We are not operational due to restrictions imposed by local authorities on movement of goods in spite of clear guidelines provided by central authorities to enable essential services. We are working with the authorities to be back soon,' Bigbasket tweeted.

In a statement to IANS, Bigbasket said that it will help to have better coordination between the Centre and state, and between the state and local police to "ensure that our delivery vans and bikes don't get stopped by the police. Bigbasket and bb daily are not taking new orders".

Furious people stormed the social media platforms, writing their plight to NITI Aayog CEO Amitabh Kant on Twitter.

"Sir, all e-commerce are down. Believe me I tried everything (Grofers, Bigbasket, Flipkart, Amazon, Big Bazaar), no delivery till 31st March or Server Down or No Service. Need to think how we can enable them through digital India," tweeted one user.

Kant tweeted back to Bigbasket: "They should give me specifics - State & location. I will act on it by getting in touch with concerned authorities & sorting it out. Govt guidelines exempt them. We will ensure that citizens are not impacted".

Kant also responded to Grofers: "Cold storages & Warehouses as well as delivery of all essentials goods including food, pharma thru E-Commerce are exempted under MHA order. I have spoken to CS & DGP, Haryana . They have taken immediate action to ensure that supply chains efficiently function for the citizens".

The subscription-based hyperlocal delivery startup FreshToHome sent messages to its customers, saying that despite the government declaring food delivery as essential, "we are facing hardships in continuing our operations".

"Please bear with us as we are working hard to unblock local authority hurdles," said the FreshToHome team.

Reports later surfaced that the Department for Promotion of Industry and Internal Trade (DPIIT) has initiated talks with the state Chief Secretaries asking them not to restrict movement of people engaged in home delivery of essential items, mentioned in the list of exempted items circulated by the Home Ministry.

Meanwhile, Flipkart said it has temporarily suspended its operations and services - including grocery items. The marketplace has decided to halt all orders from March 25 for all three supply chains -- groceries, non-large goods and large items.

"Flipkart has temporarily suspended orders as we assess the possibilities of operating in the lockdown. We are prioritising the safety of our delivery executives and seeking the support of the local governments and police authorities to meet the needs of our customers as they stay home during this lockdown," Rajneesh Kumar, Chief Corporate Affairs Officer, Flipkart, said in a statement.

E-commerce giant Amazon said the company has to "temporarily stop taking orders and disable shipments for lower-priority products.

"For all pending customer orders on lower-priority products, we are reaching out to customers and giving them a choice to cancel their orders, and receive a refund for prepaid items," said the company.

Witnessing a surge in demand, supermarket chain Biz Bazaar entered the fray, with launching doorstep delivery services in major cities like Delhi, Mumbai, Bengaluru and Gurugram.

However, within no time, Big Bazaar was flooded with calls, forcing the company to issue a statement, saying that "In light of the recent announcement, we are receiving an unprecedented number of requests for doorstep delivery. There could be a delay due to the restrictions on movements".

Already battling massive surge in demand, the online delivery platforms faced other issues too, including zero access to several high-rises across the country which have gone under complete lockdown with all entry and exit gates locked.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
July 19,2020

New Delhi, Jul 19: Three of the 10 most valued companies added a total of Rs 98,622.89 crore to their market valuation last week, led by stellar gains in IT major Infosys.

Seven companies from the coveted list witnessed a decline in their market valuation last week, but their cumulative loss of Rs 37,701.1 crore was less than the total gain made by three firms -- Reliance Industries Limited, Hindustan Unilever Limited and Infosys.

The market capitalisation of Infosys zoomed Rs 52,046.87 crore to Rs 3,85,027.58 crore. Shares of Infosys had rallied over 9 per cent on Thursday after the company posted a stronger-than-expected 12.4 per cent rise in the first quarter consolidated net profit.

Hindustan Unilever Limited added Rs 25,751.07 crore in its market valuation which stood at Rs 5,48,232.26 crore at close on Friday. Reliance Industries' m-cap jumped Rs 20,824.95 crore to Rs 12,11,682.08 crore.

In contrast, HDFC's valuation plunged Rs 13,920.21 crore to Rs 3,13,269.70 crore and that of Tata Consultancy Services (TCS) declined Rs 7,617.34 crore to Rs 8,26,031.21 crore.

The valuation of ICICI Bank tumbled Rs 4,205.71 crore to Rs 2,29,156.24 crore and that of Kotak Mahindra Bank by Rs 4,175.28 crore to Rs 2,62,864.37 crore.

Bharti Airtel's m-cap dipped Rs 4,009.83 crore to Rs 3,09,521.05 crore and HDFC Bank's by Rs 3,403.97 crore to Rs 6,03,463.97 crore.

The valuation of ITC declined by Rs 368.76 crore to Rs 2,38,469.29 crore.

In the ranking of top-10 firms, RIL was at the number one rank followed by TCS, HDFC Bank, HUL, Infosys, HDFC, Bharti Airtel, Kotak Mahindra Bank, ITC and ICICI Bank.

During the last week, the 30-share BSE index advanced 425.81 points or 1.16 per cent.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
February 27,2020

Feb 27: With the window to submit comments on India's proposed personal data protection law closing on Tuesday, a period of anxious wait for final version of the Bill started for social media firms.

This comes even as global Internet companies have called on the government for improved transparency related to intermediary Guidelines (Amendment) Rules and allay fears about the prospect of increased surveillance and prompting a fragmentation of the Internet in India that would harm users.

As per the proposed amendments, an intermediary having over 50 lakh users in the country will have to be incorporated in India with a permanent registered office and address.

When required by lawful order, the intermediary shall, within 72 hours of communication, provide such information or assistance as asked for by any government agency or assistance concerning security of the state or cybersecurity.

This means that the government could pull down information provided by platforms such as Wikipedia, potentially hampering its functioning in India.

In the open letter to IT Minister Ravi Shankar Prasad, leading browser and software development platform like Mozilla, Microsoft-owned GitHub and Cloudflare earlier called for improved transparency by allowing the public an opportunity to see a final version of these amendments prior to their enactment.

According to a Business Insider report, Indian users may lose access to Wikipedia if the new intermediary rules for internet and social media companies are approved.

Since the rules would require the website to take down content deemed illegal by the government, it would require Wikipedia to show different content for different countries.

Anusha Alikhan, senior communications director for Wikimedia told Business Insider that the platform is built though languages and not geographies. Therefore, removing content from one country, while it is still visible to other country users may not work for the company’s model.

India is one of Wikipedia’s largest markets. Over 771 million Indian users accessed the site in just November 2019.

Also read: Explained: What is the Personal Data Protection Bill and why you should care

The Personal Data Protection Bill, 2019, which was introduced in Lok Sabha in the winter session last year, was referred to a Joint Parliamentary Committee (JPC) of both the Houses.

The government last month decided to seek views and suggestions on the Bill from individuals and associations and bodies concerned and the last date for submitting the comments was on Tuesday.

Prasad, while introducing the Personal Data Protection Bill, 2019, in the Lok Sabha on December 11, announced that the draft Bill empowers the government to ask companies including Facebook, Google and others for anonymised personal data and non-personal data.

There was a buzz when the Bill's latest version was introduced in the Lok Sabha, especially the provision seeking to allow the use of personal and non-personal data of users in some cases, especially when national security is involved.

Several legal experts red-flagged the issue and said the provision will give the government unaccounted access to personal data of users in the country.

In their submission to the JPC, several organisations also flagged that the power to collect non-personal and anonymised data by the government without notice and consent should not form part of the Bill because of issues regarding effective anonymisation and potential abuse.

"Clauses 35 and 36 of the Bill provide unbridled access to personal data to the Central Government by giving it powers to exempt its agencies from the application of the Bill on the basis of various broad worded grounds," SFLC.in, a New Delhi-based not-for-profit legal services organisation, commented.

The Software Alliance, also known as BSA, a trade group which includes tech giants such as Microsoft, IBM and Adobe, among others said that the current version of the privacy bill pose substantial challenges, including the sweeping new powers for the government to acquire non-personal data, restrictions on data transfers, and local storage requirements.

"We urge the Joint Parliamentary Committee, as it considers revisions to the Bill, to eliminate provisions concerning non-personal data from the Personal Data Protection Bill and to remove the data localisation requirements and restrictions on international data flows," said Venkatesh Krishnamoorthy, Country Manager-India, BSA.

The Personal Data Protection (PDP) Bill, 2019 draws its origins from the Justice B.N. Srikrishna Committee on data privacy, which produced a draft of legislation that was made public in 2018 ("the Srikrishna Bill").

The mandatory requirement for storing a mirror copy of all personal data in India as per Section 40 of the Srikrishna Bill has been done away with in the PDP Bill, 2019, meaning that companies like Facebook and Twitter would be able to store data of Indian users abroad if they so wish.

But the bill prohibits processing of sensitive personal data and critical personal data outside India.

What is more, what constitutes critical data has not been clearly defined.

As per the proposals, social media companies will have to modify their application as they are required to have a system in place by which a user can verify themselves.

So legal experts believe that some system to upload identification documents should be there and something like the Twitter blue tick mark should be there to identify verified accounts.

"The 2019 Bill introduces a new category of data fiduciaries called social media intermediaries ('SMIs'). SMIs are a subcategory of significant data fiduciaries ('SDFs') and will be notified by the Central government after due consultation with the DPA, or the Data Protection Authority. Clause 26(4) of the Bill defines SMIs as intermediaries who primarily or solely enable online interaction between two or more users," SFLC.in said.

"On a plain reading of the definition, online platforms like Facebook, Twitter, YouTube, TikTok, ShareChat and WhatsApp are likely to be notified as SMIs under the Bill," it added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.