An Egyptian hacker who calls himself ViruS_HimA is claiming to have breached Yahoo’s security systems following similar attacks on other companies. He allegedly has full access to the servers for at least two of Yahoo’s domains. Tal Be’ery, Web Research Team Leader at Imperva, has analysed what the hacker has released to gage how he accessed the servers:
Assuming by the screenshot released by the hacker (http://www.m5zn.com/image.php?&img=7cff83cbe4970da.jpg ) is genuine , we can learn the following:
The method of attack is SQL injection
The attacked application is coded in Microsoft ASP – due to the distinct error message. This probably means that the application was not developed by Yahoo, internally, as Yahoo uses PHP (http://xahlee.info/comp/website_lang_popularity.html ) for their application.
An SQL injection on an application that yahoo had acquired from some 3rd party? It’s déjà vu all over again. Just a few months ago, a hacker was able to penetrate Yahoo voices application via SQL injection and leak 450,000 mail addresses and passwords. Yahoo Voices was acquired from a 3rd party, Associated Content.
This new security breach strengthens our conclusion from the previous incident (http://blog.imperva.com/2012/07/how-the-yahoo-voices-breach-went-down.html )
This attack highlights the challenges of security with 3rd-party applications. It's very challenging to have an effective SDLC (Systems development life cycle – the process of quickly fixing security bugs) with 3rd parties. Therefore, you need to put them behind Web Application Firewall”.
14,000 Indian websites hacked in 2012
It has been reported that over 14,000 Indian websites have been hacked by cyber criminals this year, an increase of nearly 57 percent from 2009. Below is a comment from Barry Shteiman, Senior Security Strategist from Imperva on why these websites have been targeted:
It’s important to note that not only is the man power relatively cheaper in India for European and American companies to hire they also have the skill set and therefore lots of effort globally is focused in India. However, this also means there is also a lot of focus by hackers that understand that the security practices there might be less maintained and therefore easier to target.
Not only that, the growth of website hosting in India has risen dramatically however their security focus on application security might not, since in growing markets you first try to achieve financial growth before considering controls. Historically controls are only added when pain is visible – 14,000 sites hacked is NOW a visible pain and action needs to be taken.
All websites serve either information and/or reputation facing information, or act as an application that is the business frontend for their clients. If breached, the risk of reputation hit or data theft is a big concern. In order to mitigate these risks, companies should deploy a frontend solution at the datacenter, whether its cloud based or at their own datacenters, that will be able to enforce proper business activity and application behavior and mitigate potential attacks and will provide a complete view on the attacks in order to allow security officers to respond.
At the end of day, simplicity and automation of that process will be key to ensure that a solution will be able to help fight threats, but will be business friendly.
However, deploying a solution is not enough, good security practices are also required. Code review, vulnerability assessments and secured coding policy are key to make sure that the applications and the servers that host them are secure, and are kept secure. Always check your ecosystem, and always look for changes, when they happen – validate that your controls are up to date. A secured system is only as good as its last penetration test results.”