Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Weaknesses in cloud security and third-party code allowed a hacker to compromise Yahoo! systems last month, according to an analysis of the purported breach.

In December, an Egyptian nicknamed ViruS_HimA claimed he cracked the web giant's security systems, acquired full access to 12 databases and broke into an unspecified server. He boasted this gave him access to site backups.

SQL injection attacks exploit programming bugs to trick systems into coughing up sensitive data from backend databases or even, as in the Egyptian hacker's case, execute arbitrary commands on the compromised server. These bugs typically pass user-submitted data direct to the database without scrubbing it of harmful characters.

Imperva explained in a report:

This Yahoo! attack was probably done by using MSSQL’s XP_CMDSHELL system-stored procedure. Many administrative activities in a MSSQL database can be performed through system stored procedures. The XP_CMDSHELL executes a given command string as an operating-system command shell and returns any output as rows of text. Therefore, a SQL injection vulnerability in an application using MSSQL DB enables the hacker to execute shell commands and take over the server.

The security researchers added: "Exploiting MSSQL SQLi vulnerability for command execution is supported in automatic SQLi tools such as Havij, which means a vulnerability can be exploited relatively easily."

Havij is a popular hacking tool for SQL injection attacks, and was developed in Iran but is available in the English language.

Screenshots posted by ViruS_HimA as trophies from the hack suggest that the vulnerable application runs on ASP.NET, and not PHP as used in most other Yahoo! web apps. In addition the partially redacted hacked machine's domain name ends in "yle.yahoo.net" and not yahoo.com.

These factors and others allowed Imperva to narrow down the list of potential suspects and conclude that the hack was pulled off by exploiting vulnerabilities within in.horoscopes.lifestyle.yahoo.net, an Indian astrology site built by engineers external to Yahoo!

"The weak link in the Yahoo! attack was not programmed by Yahoo! developers, nor was it even hosted on the Yahoo! servers, and yet the company found itself breached as a result of third-party code," explained Amichai Shulman, CTO at Imperva. “The challenge presented by the Yahoo! breach is that web-facing businesses should take responsibility to secure third-party code and cloud-based applications."

Imperva published its research, titled Lessons Learned from the Yahoo! Hack, in the January edition of its regular monthly Hacker Intelligence Initiative Report [PDF]. As well as examining how the hack was pulled off the report provides recommendations on how similar breaches can be prevented - from auditing code to buying a web-application firewall. Which Imperva and others happen to sell.

The December break-in is not the first time Yahoo! has run aground on flawed third-party software. Last July, a decommissioned part of Yahoo! Voices was breached, and approximately 450,000 users’ credentials were exposed. Hackers boasted that they carried out the attack using a union-based SQL injection, the same sort of technique used to pull off the December attack by ViruS_HimA. Yahoo! Voices is an online publishing application that was developed by Associated Content before it was acquired by Yahoo! ®

Agentless Backup is Not a Myth