Yahoo says one billion accounts exposed in newly discovered security breach

December 15, 2016

Dec 15: Yahoo Inc (YHOO.O) warned on Wednesday that it had uncovered yet another massive cyber attack, saying data from more than 1 billion user accounts was compromised in August 2013, making it the largest breach in history.

yahooThe number of affected accounts was double the number implicated in a 2014 breach that the internet company disclosed in September and blamed on hackers working on behalf of a government. News of that attack, which affected at least 500 million accounts, prompted Verizon Communication Inc (VZ.N) to say in October that it might withdraw from an agreement to buy Yahoo's core internet business for $4.83 billion. Following the latest disclosure, Verizon said, "we will review the impact of this new development before reaching any final conclusions." A Yahoo spokesman told Reuters that the company has been in communication with Verizon during its investigation into the breach and that it is confident the incident will not affect the pending acquisition.Yahoo required all of its customers to reset their passwords - a stronger measure than it took after the previous breach was discovered, when it only recommended a password reset.

Yahoo also said Wednesday that it believes hackers responsible for the previous breach had also accessed the company"s proprietary code to learn how to forge "cookies" that would allow hackers to access an account without a password."Yahoo badly screwed up," said Bruce Schneier, a cryptologist and one of the world's most respected security experts. "They weren't taking security seriously and that's now very clear. I would have trouble trusting Yahoo going forward."Yahoo was tentative in its description of new problems, saying the incident was "likely" distinct from the one it reported in September and that stolen information "may have included" names, e-mail addresses, telephone numbers, dates of birth, hashed passwords and, in some cases, encrypted or unencrypted security questions and answers.

It said it had not yet identified the intrusion that led to the massive data theft and noted that payment-card data and bank account information were not stored in the system the company believes was affected.Yahoo said it discovered the breach while reviewing data provided to the company by law enforcement. FireEye Inc"s (FEYE.O) Mandiant unit and Aon Plc's (AON.N) Stroz Friedberg are assisting in the investigation, the Yahoo spokesman told Reuters.The breach is the latest setback for Yahoo, an internet pioneer that has fallen on hard times in recent years after being eclipsed by younger, fast-growing rivals including Alphabet Inc's (GOOGL.O) Google and Facebook Inc (FB.O).

Hours before it announced the breach on Wednesday, executives with Google, Facebook and other large U.S. technology companies met with President-elect Donald Trump in New York. Reflecting its diminished stature, Yahoo was not invited to the summit, according to people familiar with the meeting.The Yahoo spokesman said Chief Executive Marissa Mayer was at the company's Sunnyvale, California headquarters to assist in addressing the new breach. Yahoo shares were down 2.4 percent to $39.91 in extended trading. Verizon shares were little changed from their close at $51.63. (Reporting by Jim Finkle in Boston and Anya George Tharakan in Bengaluru; Additional reporting by Dustin Volz in Washington and Jessica Toonkel in New York; Editing by Savio D'Souza, Bernard Orr)

This story has not been edited by Firstpost staff and is generated by auto-feed.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
March 16,2020

While Google is still working on a coronavirus screening and tracking website, Microsoft Bing team has already launched a web portal for tracking COVID-19 infections worldwide.

The website, accessible at bing.com/covid, provides up-to-date infection statistics for each country.

The COVID-19 Tracker currently lists 168,835 as total confirmed cases, 84,558 active cases, 77,761 recovered cases and 6,516 deaths.

There are at least 3,244 confirmed cases of novel coronavirus in the US and at least 61 deaths.

"Lots of Bing folks worked (from home) this past week to create a mapping and authoritative news resource for COVID19 info," Michael Schechter, General Manager for Bing Growth and Distribution at Microsoft, was quoted as saying in a ZDNet report on Sunday.

An interactive map allows site visitors to click on the country to see the specific number of cases and related articles from a variety of publishers.

Data is being aggregated from sources like the World Health Organization (WHO), the US Centers for Disease Control and Prevention (CDC), and the European Centre for Disease Prevention and Control (ECDC).

Microsoft announced the website two days after US President Donald Trump said Google has begun working on COVID-19-related portal for US citizens.

Google's website is being built by Verily, a subsidiary of Alphabet focused on healthcare services.

"More than 1,700 engineers are currently working on the site", Trump said during a press briefing last week.

The tool will triage people who are concerned about their COVID-19 risk into testing sites based on guidance from public health officials and test availability.

Initially, there was some confusion on Google's coronavirus portal but the company later announced that it is "partnering with the US Government in developing a nationwide website that includes information about COVID-19 symptoms, risk, and testing information."

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
June 5,2020

With the scrapping of Mitron and Remove China Apps from its Play Store gaining a lot of attention in India, Google on Thursday said that it removed a video app "for a number of technical policy violations", while adding that it also does not allow an app that "encourages or incentivizes users into removing or disabling third-party apps".

Both the apps became immensely popular in India within a short span of time due to the prevailing anti-China sentiment amid border tensions between India and China in Ladakh and calls by Indian activists to boycott Chinese products.

Reports suggested that the Mitron app is a repackaged version of TicTic, which is a TikTok clone.

The Remove China Apps was designed to help users identify applications of Chinese origin.

Without naming the apps, Google hinted that the Mitron app may make a comeback on the Play Store once it fixes some technical issues, but the chances of the Remove China Apps are thin.

"We have an established process of working with developers to help them fix issues and resubmit their apps. We've given this developer (of the video app) some guidance and once they've addressed the issue the app can go back up on Play," Sameer Samat, Vice President, Android and Google Play, said in a statement.

Google said that its Android app store was designed to provide a safe and secure experience for the consumers while also giving developers the platform and tools they need to build sustainable businesses.

Samat said that Google Play recently suspended a number of apps for violating the policy that it does not allow an app that "encourages or incentivizes users into removing or disabling third-party apps or modifying device settings or features unless it is part of a verifiable security service".

"This is a longstanding rule designed to ensure a healthy, competitive environment where developers can succeed based upon design and innovation. When apps are allowed to specifically target other apps, it can lead to behaviour that we believe is not in the best interest of our community of developers and consumers," Samat said.

"We've enforced this policy against other apps in many countries consistently in the past - just as we did here," he added.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.