Feeds

They didn't predict that: Astrologers! blamed! after! Yahoo! hack!

When Jupiter aligns, your web app will meet a mysterious SQL stranger

Protecting against web application threats using SSL

Weaknesses in cloud security and third-party code allowed a hacker to compromise Yahoo! systems last month, according to an analysis of the purported breach.

In December, an Egyptian nicknamed ViruS_HimA claimed he cracked the web giant's security systems, acquired full access to 12 databases and broke into an unspecified server. He boasted this gave him access to site backups.

ViruS_HimA breached Yahoo! with an SQL injection attack that took advantage of a vulnerability in a third-party application, according to new research by security tools firm Imperva. More specifically, we're told, ViruS_HimA took advantage of an information-leaking error message from Microsoft SQL Server to pull off the raid. The error was triggered by fooling the software into using a string of text as a number.

SQL injection attacks exploit programming bugs to trick systems into coughing up sensitive data from backend databases or even, as in the Egyptian hacker's case, execute arbitrary commands on the compromised server. These bugs typically pass user-submitted data direct to the database without scrubbing it of harmful characters.

Imperva explained in a report:

This Yahoo! attack was probably done by using MSSQL’s XP_CMDSHELL system-stored procedure. Many administrative activities in a MSSQL database can be performed through system stored procedures. The XP_CMDSHELL executes a given command string as an operating-system command shell and returns any output as rows of text. Therefore, a SQL injection vulnerability in an application using MSSQL DB enables the hacker to execute shell commands and take over the server.

The security researchers added: "Exploiting MSSQL SQLi vulnerability for command execution is supported in automatic SQLi tools such as Havij, which means a vulnerability can be exploited relatively easily."

Havij is a popular hacking tool for SQL injection attacks, and was developed in Iran but is available in the English language.

Screenshots posted by ViruS_HimA as trophies from the hack suggest that the vulnerable application runs on ASP.NET, and not PHP as used in most other Yahoo! web apps. In addition the partially redacted hacked machine's domain name ends in "yle.yahoo.net" and not yahoo.com.

These factors and others allowed Imperva to narrow down the list of potential suspects and conclude that the hack was pulled off by exploiting vulnerabilities within in.horoscopes.lifestyle.yahoo.net, an Indian astrology site built by engineers external to Yahoo!

"The weak link in the Yahoo! attack was not programmed by Yahoo! developers, nor was it even hosted on the Yahoo! servers, and yet the company found itself breached as a result of third-party code," explained Amichai Shulman, CTO at Imperva. “The challenge presented by the Yahoo! breach is that web-facing businesses should take responsibility to secure third-party code and cloud-based applications."

Imperva published its research, titled Lessons Learned from the Yahoo! Hack, in the January edition of its regular monthly Hacker Intelligence Initiative Report [PDF]. As well as examining how the hack was pulled off the report provides recommendations on how similar breaches can be prevented - from auditing code to buying a web-application firewall. Which Imperva and others happen to sell.

The December break-in is not the first time Yahoo! has run aground on flawed third-party software. Last July, a decommissioned part of Yahoo! Voices was breached, and approximately 450,000 users’ credentials were exposed. Hackers boasted that they carried out the attack using a union-based SQL injection, the same sort of technique used to pull off the December attack by ViruS_HimA. Yahoo! Voices is an online publishing application that was developed by Associated Content before it was acquired by Yahoo! ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.