Yahoo Security Breach Review

YAHOO SECURITY BREACH REVIEW

Name:

Course:

Number:

Institution:

YAHOO SECURITY BREACH REVIEW

Introduction

Ahmed & Hossain, (2014), define a security breach as any incident that yields to unauthorized data access, applications, services, devices, services and/or networks by circumventing the underlying security mechanisms. The perpetrators of these security breaches have different motivations to their operations.  Some of these attacks happen on an individual level while others happen on a commercial level. Over the years business owners have been working tirelessly to ensure the safety of their workplaces, but the approach to these security issues have been changing with technology. With the technological advancements, IT-related security breaches are taking the lead in security breaches in different organizations. IT securing breaches have been raising with the increase in the number of internet users. Some of the security breaches occur from within organizations while others are perpetrated by individuals outside the organization. IT security breaches have made organizations to lose a lot of their cash in the resulting environment. Putting the necessary infrastructure in place to safeguard an organization from such security breaches may seem costly, but is worth it in most cases. Many companies have suffered immense irrecoverable losses as a result of it security breaches. Yahoo Inc. is one of such companies that has experienced a world record-breaking security breach. This essay will review the world record breaking security breach ad propose the possible remedy to the attack.

What happened?

On September 2016, Yahoo through its chief information security officer (CISO), Bob Lord, confirmed that more than five hundred million Yahoo users’ information was stolen in the 2014 data breach (“yahoo.tumblr.com,” 2016, September 22). This was a record-breaking data breach incident by the time only to be taken over by a later report on the 2013 data breach on the same company. In its confirmation report on the late 2014 security breach, argued that the attackers managed to gain control over the Yahoo users, information which included their dates of birth, names, security questions and encrypted passwords.  As a relief to its customers, the company argued that the stolen data did not include any associated bank information and payment data as these were not stored in the affected system. In this same report, the company associates the attack to a non disclosed foreign state. The company could not ascertain whether the actors of the state-sponsored felony was one of the yahoo staff.

According to the 15th December article on theguardian.com by Sam Thielman, Yahoo’s December 2016 report on the ‘discovered’ 2013 cyber-attack stood out more distinctly than the earlier reported 2014 attack (Thielman, 2016). As Thielman argues, more than a billion user accounts were compromised in the 2013 attack. This makes it the largest ever data security breach in the world. The company also indicts an unknown government for sponsoring the attack. According to the company’s CISO, just as the 2014 incident, the stolen data only included the users’ email addresses, dates of birth, phone numbers, security questions and MD5 encrypted passwords.

How the attackers got in

To perpetuate the attack, the company’s CISO Bob Lord argues that the attackers “forged ‘cookies’” to allow them to access yahoo users’ accounts even without their password. Normally, cookies are code bits that are cashed by the user’s browser to facilitate the user’s subsequent accesses to their accounts without necessarily using their accounts. The forged cookies were designed in a way to allow the hackers to access the Yahoo users’ accounts without requiring them to use their passwords. The cookies misidentified the intruders as the owners of the email accounts they accessed thus requiring no password. Bob Lord argued that the forgery was probably made possible using the yahoo’s proprietary code which the attackers had stolen in advance. The company became suspicious of the breach in November 2016 when one of their users through a law enforcement organ approached the company with the “user data” the contained the forged cookies.