{"id":2342,"date":"2012-07-17T10:11:01","date_gmt":"2012-07-17T14:11:01","guid":{"rendered":"http:\/\/southjerseytechies.net\/blog\/?p=2342"},"modified":"2025-11-03T12:34:29","modified_gmt":"2025-11-03T17:34:29","slug":"is-your-yahoo-password-in-450k-leak","status":"publish","type":"post","link":"https:\/\/southjerseytechies.net\/blog\/is-your-yahoo-password-in-450k-leak\/","title":{"rendered":"Is Your Yahoo Password in 450K Leak?"},"content":{"rendered":"

Takeaway<\/span>:\u00a0Hackers have posted 450K Yahoo email addresses<\/a> and passwords online, and hint Gmail, Hotmail, other services are next. How can you check if your users\u2019 accounts are among them?<\/p>\n

Hackers posted more than 400,000 Yahoo Voice and email names and passwords and the posting might not be over yet.<\/p>\n

Yahoo reps say they are working on the compromised system\u2013not great timing for a beleaguered company enduring what Yahoo chair Alfred Amoroso called a \u201ctumultuous\u201d time for the company. The firm apologized in an online statement and did not comment further at this writing.<\/p>\n

Not a Yahoo user? IT pros and security experts worry this most recent hack on Yahoo – allegedly perpetrated by a group calling itself d3dd3 – is likely \u201cway bigger than Yahoo,\u201d said Marcus Carey, in a\u00a0Reuters\u00a0report. Hotmail, MSN, Live, Gmail and other personal services are at risk, too, he said.<\/p>\n

NOTE: If you want to check your own or other users\u2019 Yahoo emails to see if they are part of the current leak, there\u2019s an easy way to check here at\u00a0Sucuri Malware Labs. Just type in the email address and search.<\/p>\n

Plan for next time<\/span><\/h2>\n

Change passwords. Consider training customers on utilities like\u00a0Lastpass. IT pros we interviewed across the board said users in enterprises who use open cloud-based email services, or other non-enterprise communication methods like Skype or Google Groups, should, at the very least, be using such utilities, which provide more control and protection in case of events like this one.<\/p>\n

With so much data potentially compromised via users relying on such BYOD services as these, \u201cthe process (to avoid future attacks) is much easier if (users) have Lastpass,\u201d said\u00a0John Livingston, a tech pro for the American Red Cross in Savannah, Georgia. \u201cTime to change your Yahoo, Google, Hotmail, and AOL passwords. And with LastPass, each site and service has a unique password, which limits damage if the password does get out. Changing passwords then is quick and easy. Plus if you\u2019re a manager you don\u2019t have to worry about remembering a new password.\u201d<\/p>\n

\u201cOnce this clears, I will be changing the passwords for Gmail, even though there\u2019s no confirmation on that (hack) yet,\u201d said\u00a0Brian Geniesse, who works the IT tech desk at his firm in Monominee, Michigan. \u201cAlso be careful. Password managers can be hacked just the same.\u201d<\/p>\n

Yahoo is to blame ultimately, most IT pros we interviewed told us.<\/p>\n

\u201cShame on Yahoo for not running normal security audits on (its) networks – and services that would have detected the SQL injection vulnerability (reportedly) used in the attack,\u201d adds\u00a0Dan Phillips, an IT pro in Cambridge, Ontario, Canada.<\/p>\n

Geniesse expanded on that with a message that will resound with most IT pros and CTOs. Most people use weak passwords\u2013see below.<\/p>\n

\u201cYou can preach the use of LastPass and the like until you are blue in the face but users will never change their habits unless you force them,\u201d Geniesse said. And \u201cYahoo needs to force some kind of password complexity to help protect their users.\u201d<\/em><\/p>\n

So many folks are checking the hack post, the hackers allegedly responsible are having trouble maintaining traffic load. Due to high traffic on this group\u2019s site, the page with the Yahoo hacked emails and passwords is going up and down.\u00a0We\u00a0caught part of it in a cut and paste.<\/p>\n

When it was up earlier today, it read in part:<\/p>\n

We hope that the parties responsible for managing the security of this subdomain will take this as a wake-up call \u2026 not as a threat \u2026<\/em><\/p>\n

There have been many security holes exploited in webservers belonging to Yahoo \u2026 ?that have caused far greater damage than our disclosure (today). Please do not take (the posting) lightly. The subdomain and vulnerable parameters have not been posted to avoid further damage \u2026<\/em><\/p>\n

The author quotes\u00a0author Jean Vanier\u00a0from his book, Becoming Human: \u201cGrowth begins when we begin to accept our own weakness,\u201d Vanier wrote.<\/p>\n

If you\u2019re a Star Wars, Star Trek or comic book fan, just change your passwords right away, other observers add. And talk your users into it to. Check this out:\u00a0CNET\u2019s Declan McCullagh wrote a program\u00a0to analyze the most frequently used passwords using data from the post of 450K email addresses and passwords. He listed:<\/p>\n