Yahoo security problems a story of too little, too late
Yahoo security problems a story of too little, too late

Yahoo security problems a story of too little, too late

Yahoo comes under renewed scrutiny by federal investigators and lawmakers after disclosing largest known data breach in history, prompting Verizon Communications to demand better terms for its planned purchase of Yahoo's internet business.
Estelle de Bruyn
In the summer of 2013, Yahoo Inc launched a project to better secure the passwords of its customers, abandoning the use of a discredited technology for encrypting data known as MD5.

It was too late. In August of that year, hackers got hold of more than a billion Yahoo accounts, stealing the poorly encrypted passwords and other information in the biggest data breach on record.

Yahoo only recently uncovered the hack and disclosed it last week. The timing of the attack might seem like bad luck, but the weakness of MD5 had been known by hackers and security experts for more than a decade. MD5 can be cracked more easily than other so-called “hashing” algorithms, which are mathematical functions that convert data into seemingly random character strings. In 2008, five years before Yahoo took action, Carnegie Mellon University's Software Engineering Institute issued a public warning to security professionals through a U.S. government-funded vulnerability alert system: MD5 “should be considered cryptographically broken and unsuitable for further use.”

Yahoo's failure to move away from MD5 in a timely fashion was an example of problems in Yahoo's security operations as it grappled with business challenges, according to five former employees and some outside security experts. Stronger hashing technology would have made it more difficult for the hackers to get into customer accounts after breaching Yahoo's network, making the attack far less damaging, they said.

“MD5 was considered dead long before 2013,” said David Kennedy, chief executive of cyber firm TrustedSec LLC. “Most companies were using more secure hashing algorithms by then.” He did not name specific firms.

Yahoo, which has confirmed it was still using MD5 at the time of the attack, disputed the notion that the company had skimped on security.“Over the course of our more than 20-year history, Yahoo has focused on and invested in security programs and talent to protect our users,” Yahoo said in a statement to Reuters. “We have invested more than US$250 million in security initiatives across the company since 2012.”



COMPETING PRIORITIES

The former Yahoo security staffers, however, told Reuters the security team was at times turned down when it requested new tools and features such as strengthened cryptography protections, on the grounds that the requests would cost too much money, were too complicated, or were simply too low a priority.

- Nampa/Reuters

Kommentaar

Republikein 2024-03-28

Geen kommentaar is op hierdie artikel gelaat nie

Meld asseblief aan om kommentaar te lewer

Katima Mulilo: 19° | 37° Rundu: 17° | 33° Eenhana: 18° | 33° Oshakati: 20° | 31° Ruacana: 19° | 33° Tsumeb: 17° | 29° Otjiwarongo: 16° | 28° Omaruru: 18° | 31° Windhoek: 17° | 28° Gobabis: 17° | 28° Henties Bay: 16° | 19° Wind speed: 24km/h, Wind direction: S, Low tide: 10:54, High tide: 04:57, Low Tide: 22:58, High tide: 17:16 Swakopmund: 15° | 17° Wind speed: 29km/h, Wind direction: SW, Low tide: 10:52, High tide: 04:55, Low Tide: 22:56, High tide: 17:14 Walvis Bay: 16° | 22° Wind speed: 33km/h, Wind direction: SW, Low tide: 10:52, High tide: 04:54, Low Tide: 22:56, High tide: 17:13 Rehoboth: 18° | 29° Mariental: 22° | 32° Keetmanshoop: 21° | 34° Aranos: 21° | 31° Lüderitz: 15° | 29° Ariamsvlei: 23° | 34° Oranjemund: 15° | 21° Luanda: 27° | 30° Gaborone: 20° | 32° Lubumbashi: 17° | 24° Mbabane: 15° | 23° Maseru: 12° | 28° Antananarivo: 16° | 27° Lilongwe: 17° | 29° Maputo: 20° | 28° Windhoek: 17° | 28° Cape Town: 17° | 23° Durban: 21° | 25° Johannesburg: 18° | 28° Dar es Salaam: 26° | 32° Lusaka: 18° | 30° Harare: 15° | 31° Currency: GBP to NAD 23.85 | EUR to NAD 20.41 | CNY to NAD 2.62 | USD to NAD 18.93 | DZD to NAD 0.14 | AOA to NAD 0.02 | BWP to NAD 1.33 | EGP to NAD 0.39 | KES to NAD 0.14 | NGN to NAD 0.01 | ZMW to NAD 0.74 | ZWL to NAD 0.04 | BRL to NAD 3.8 | RUB to NAD 0.2 | INR to NAD 0.23 | USD to DZD 134.35 | USD to AOA 832.63 | USD to BWP 13.71 | USD to EGP 47.35 | USD to KES 130.98 | USD to NGN 1415.13 | USD to ZAR 18.93 | USD to ZMW 25.01 | USD to ZWL 321 | Stock Exchange: JSE All Share Index 74536 Up +0.85% | Namibian Stock Exchange (NSX) Overall Index 1528.69 Up +0.84% | Casablanca Stock Exchange (CSE) MASI 12986.94 Up +0.04% | Egyptian Exchange (EGX) 30 Index 27559.35 Down -2.36% | Botswana Stock Exchange (BSE) DCI Same 0 | NSX: MTC 7.75 SAME | Anirep 8.99 SAME | Capricorn Investment group 17.34 SAME | FirstRand Namibia Ltd 49 DOWN 0.50% | Letshego Holdings (Namibia) Ltd 4.1 UP 2.50% | Namibia Asset Management Ltd 0.7 SAME | Namibia Breweries Ltd 31.49 UP 0.03% | Nictus Holdings - Nam 2.22 SAME | Oryx Properties Ltd 12.1 UP 1.70% | Paratus Namibia Holdings 11.99 SAME | SBN Holdings 8.45 SAME | Trustco Group Holdings Ltd 0.48 SAME | B2Gold Corporation 47.34 DOWN 1.50% | Local Index closed 677.62 UP 0.12% | Overall Index closed 1534.6 DOWN 0.05% | Osino Resources Corp 19.47 DOWN 2.41% | Commodities: Gold US$ 2 221.30/OZ UP +1.40% | Copper US$ 3.99/lb UP +0.07% | Zinc US$ 2 455.50/T UP 0% | Brent Crude Oil US$ 87.64/BBP UP +1.45% | Platinum US$ 907.62/OZ UP +1.42% Sport results: Weather: Katima Mulilo: 19° | 37° Rundu: 17° | 33° Eenhana: 18° | 33° Oshakati: 20° | 31° Ruacana: 19° | 33° Tsumeb: 17° | 29° Otjiwarongo: 16° | 28° Omaruru: 18° | 31° Windhoek: 17° | 28° Gobabis: 17° | 28° Henties Bay: 16° | 19° Wind speed: 24km/h, Wind direction: S, Low tide: 10:54, High tide: 04:57, Low Tide: 22:58, High tide: 17:16 Swakopmund: 15° | 17° Wind speed: 29km/h, Wind direction: SW, Low tide: 10:52, High tide: 04:55, Low Tide: 22:56, High tide: 17:14 Walvis Bay: 16° | 22° Wind speed: 33km/h, Wind direction: SW, Low tide: 10:52, High tide: 04:54, Low Tide: 22:56, High tide: 17:13 Rehoboth: 18° | 29° Mariental: 22° | 32° Keetmanshoop: 21° | 34° Aranos: 21° | 31° Lüderitz: 15° | 29° Ariamsvlei: 23° | 34° Oranjemund: 15° | 21° Luanda: 27° | 30° Gaborone: 20° | 32° Lubumbashi: 17° | 24° Mbabane: 15° | 23° Maseru: 12° | 28° Antananarivo: 16° | 27° Lilongwe: 17° | 29° Maputo: 20° | 28° Windhoek: 17° | 28° Cape Town: 17° | 23° Durban: 21° | 25° Johannesburg: 18° | 28° Dar es Salaam: 26° | 32° Lusaka: 18° | 30° Harare: 15° | 31° Economic Indicators: Currency: GBP to NAD 23.85 | EUR to NAD 20.41 | CNY to NAD 2.62 | USD to NAD 18.93 | DZD to NAD 0.14 | AOA to NAD 0.02 | BWP to NAD 1.33 | EGP to NAD 0.39 | KES to NAD 0.14 | NGN to NAD 0.01 | ZMW to NAD 0.74 | ZWL to NAD 0.04 | BRL to NAD 3.8 | RUB to NAD 0.2 | INR to NAD 0.23 | USD to DZD 134.35 | USD to AOA 832.63 | USD to BWP 13.71 | USD to EGP 47.35 | USD to KES 130.98 | USD to NGN 1415.13 | USD to ZAR 18.93 | USD to ZMW 25.01 | USD to ZWL 321 | Stock Exchange: JSE All Share Index 74536 Up +0.85% | Namibian Stock Exchange (NSX) Overall Index 1528.69 Up +0.84% | Casablanca Stock Exchange (CSE) MASI 12986.94 Up +0.04% | Egyptian Exchange (EGX) 30 Index 27559.35 Down -2.36% | Botswana Stock Exchange (BSE) DCI Same 0 | NSX: MTC 7.75 SAME | Anirep 8.99 SAME | Capricorn Investment group 17.34 SAME | FirstRand Namibia Ltd 49 DOWN 0.50% | Letshego Holdings (Namibia) Ltd 4.1 UP 2.50% | Namibia Asset Management Ltd 0.7 SAME | Namibia Breweries Ltd 31.49 UP 0.03% | Nictus Holdings - Nam 2.22 SAME | Oryx Properties Ltd 12.1 UP 1.70% | Paratus Namibia Holdings 11.99 SAME | SBN Holdings 8.45 SAME | Trustco Group Holdings Ltd 0.48 SAME | B2Gold Corporation 47.34 DOWN 1.50% | Local Index closed 677.62 UP 0.12% | Overall Index closed 1534.6 DOWN 0.05% | Osino Resources Corp 19.47 DOWN 2.41% | Commodities: Gold US$ 2 221.30/OZ UP +1.40% | Copper US$ 3.99/lb UP +0.07% | Zinc US$ 2 455.50/T UP 0% | Brent Crude Oil US$ 87.64/BBP UP +1.45% | Platinum US$ 907.62/OZ UP +1.42%