Feeds

They didn't predict that: Astrologers! blamed! after! Yahoo! hack!

When Jupiter aligns, your web app will meet a mysterious SQL stranger

SANS - Survey on application security programs

Weaknesses in cloud security and third-party code allowed a hacker to compromise Yahoo! systems last month, according to an analysis of the purported breach.

In December, an Egyptian nicknamed ViruS_HimA claimed he cracked the web giant's security systems, acquired full access to 12 databases and broke into an unspecified server. He boasted this gave him access to site backups.

ViruS_HimA breached Yahoo! with an SQL injection attack that took advantage of a vulnerability in a third-party application, according to new research by security tools firm Imperva. More specifically, we're told, ViruS_HimA took advantage of an information-leaking error message from Microsoft SQL Server to pull off the raid. The error was triggered by fooling the software into using a string of text as a number.

SQL injection attacks exploit programming bugs to trick systems into coughing up sensitive data from backend databases or even, as in the Egyptian hacker's case, execute arbitrary commands on the compromised server. These bugs typically pass user-submitted data direct to the database without scrubbing it of harmful characters.

Imperva explained in a report:

This Yahoo! attack was probably done by using MSSQL’s XP_CMDSHELL system-stored procedure. Many administrative activities in a MSSQL database can be performed through system stored procedures. The XP_CMDSHELL executes a given command string as an operating-system command shell and returns any output as rows of text. Therefore, a SQL injection vulnerability in an application using MSSQL DB enables the hacker to execute shell commands and take over the server.

The security researchers added: "Exploiting MSSQL SQLi vulnerability for command execution is supported in automatic SQLi tools such as Havij, which means a vulnerability can be exploited relatively easily."

Havij is a popular hacking tool for SQL injection attacks, and was developed in Iran but is available in the English language.

Screenshots posted by ViruS_HimA as trophies from the hack suggest that the vulnerable application runs on ASP.NET, and not PHP as used in most other Yahoo! web apps. In addition the partially redacted hacked machine's domain name ends in "yle.yahoo.net" and not yahoo.com.

These factors and others allowed Imperva to narrow down the list of potential suspects and conclude that the hack was pulled off by exploiting vulnerabilities within in.horoscopes.lifestyle.yahoo.net, an Indian astrology site built by engineers external to Yahoo!

"The weak link in the Yahoo! attack was not programmed by Yahoo! developers, nor was it even hosted on the Yahoo! servers, and yet the company found itself breached as a result of third-party code," explained Amichai Shulman, CTO at Imperva. “The challenge presented by the Yahoo! breach is that web-facing businesses should take responsibility to secure third-party code and cloud-based applications."

Imperva published its research, titled Lessons Learned from the Yahoo! Hack, in the January edition of its regular monthly Hacker Intelligence Initiative Report [PDF]. As well as examining how the hack was pulled off the report provides recommendations on how similar breaches can be prevented - from auditing code to buying a web-application firewall. Which Imperva and others happen to sell.

The December break-in is not the first time Yahoo! has run aground on flawed third-party software. Last July, a decommissioned part of Yahoo! Voices was breached, and approximately 450,000 users’ credentials were exposed. Hackers boasted that they carried out the attack using a union-based SQL injection, the same sort of technique used to pull off the December attack by ViruS_HimA. Yahoo! Voices is an online publishing application that was developed by Associated Content before it was acquired by Yahoo! ®

High performance access to file storage

More from The Register

next story
Parent gabfest Mumsnet hit by SSL bug: My heart bleeds, grins hacker
Natter-board tells middle-class Britain to purée its passwords
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Mounties always get their man: Heartbleed 'hacker', 19, CUFFED
Canadian teen accused of raiding tax computers using OpenSSL bug
Samsung Galaxy S5 fingerprint scanner hacked in just 4 DAYS
Sammy's newbie cooked slower than iPhone, also costs more to build
Snowden-inspired crypto-email service Lavaboom launches
German service pays tribute to Lavabit
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.