Feeds

They didn't predict that: Astrologers! blamed! after! Yahoo! hack!

When Jupiter aligns, your web app will meet a mysterious SQL stranger

The Power of One eBook: Top reasons to choose HP BladeSystem

Weaknesses in cloud security and third-party code allowed a hacker to compromise Yahoo! systems last month, according to an analysis of the purported breach.

In December, an Egyptian nicknamed ViruS_HimA claimed he cracked the web giant's security systems, acquired full access to 12 databases and broke into an unspecified server. He boasted this gave him access to site backups.

ViruS_HimA breached Yahoo! with an SQL injection attack that took advantage of a vulnerability in a third-party application, according to new research by security tools firm Imperva. More specifically, we're told, ViruS_HimA took advantage of an information-leaking error message from Microsoft SQL Server to pull off the raid. The error was triggered by fooling the software into using a string of text as a number.

SQL injection attacks exploit programming bugs to trick systems into coughing up sensitive data from backend databases or even, as in the Egyptian hacker's case, execute arbitrary commands on the compromised server. These bugs typically pass user-submitted data direct to the database without scrubbing it of harmful characters.

Imperva explained in a report:

This Yahoo! attack was probably done by using MSSQL’s XP_CMDSHELL system-stored procedure. Many administrative activities in a MSSQL database can be performed through system stored procedures. The XP_CMDSHELL executes a given command string as an operating-system command shell and returns any output as rows of text. Therefore, a SQL injection vulnerability in an application using MSSQL DB enables the hacker to execute shell commands and take over the server.

The security researchers added: "Exploiting MSSQL SQLi vulnerability for command execution is supported in automatic SQLi tools such as Havij, which means a vulnerability can be exploited relatively easily."

Havij is a popular hacking tool for SQL injection attacks, and was developed in Iran but is available in the English language.

Screenshots posted by ViruS_HimA as trophies from the hack suggest that the vulnerable application runs on ASP.NET, and not PHP as used in most other Yahoo! web apps. In addition the partially redacted hacked machine's domain name ends in "yle.yahoo.net" and not yahoo.com.

These factors and others allowed Imperva to narrow down the list of potential suspects and conclude that the hack was pulled off by exploiting vulnerabilities within in.horoscopes.lifestyle.yahoo.net, an Indian astrology site built by engineers external to Yahoo!

"The weak link in the Yahoo! attack was not programmed by Yahoo! developers, nor was it even hosted on the Yahoo! servers, and yet the company found itself breached as a result of third-party code," explained Amichai Shulman, CTO at Imperva. “The challenge presented by the Yahoo! breach is that web-facing businesses should take responsibility to secure third-party code and cloud-based applications."

Imperva published its research, titled Lessons Learned from the Yahoo! Hack, in the January edition of its regular monthly Hacker Intelligence Initiative Report [PDF]. As well as examining how the hack was pulled off the report provides recommendations on how similar breaches can be prevented - from auditing code to buying a web-application firewall. Which Imperva and others happen to sell.

The December break-in is not the first time Yahoo! has run aground on flawed third-party software. Last July, a decommissioned part of Yahoo! Voices was breached, and approximately 450,000 users’ credentials were exposed. Hackers boasted that they carried out the attack using a union-based SQL injection, the same sort of technique used to pull off the December attack by ViruS_HimA. Yahoo! Voices is an online publishing application that was developed by Associated Content before it was acquired by Yahoo! ®

Designing a Defense for Mobile Applications

More from The Register

next story
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.