Now, Yahoo user data could be behind scores of spear-phishes or other breaches.

http://i.imgur.com/iU4d8j5.jpg

In October of 2013, as a result of documents leaked by Edward Snowden, we learned the National Security Agency tapped straight into the connections between data centers at Yahoo and Google as part of a program called MUSCULAR. A month later, Yahoo announced it would encrypt all of its internal networks between data centers and add Secure Socket Layer encryption and secure (HTTPS) Web connections to all its services.

That move, however, failed to prevent two major breaches of user data: a breach affecting user data from more than 500 million user accounts late in 2014 (revealed in September) and the breach revealed yesterday involving data from more than 1 billion accounts. The recent break took place in August of 2013—before the barn door was closed. In addition, Yahoo's chief information security officer, Bob Lord, said that the parties behind the 2014 breach had stolen some of Yahoo's code and used it to forge Web "cookies" that gave access to users' accounts without the need to use login credentials.

Evidence of the August 2013 breach was given to Yahoo by "law enforcement officials," according to Lord, but it was likely discovered by a security researcher watching for data on underground markets. That suggests the data was in circulation in underground marketplaces in one form or another and actively in use by Internet criminal rings for a variety of purposes. If that's the case, then practically all of Yahoo's users who set up accounts prior to 2013 may have had details from their accounts used in targeted attacks, attempts to gain access to other Web accounts and cloud services, or any number of other scams.

Given that the data exposed included the name, birth date, personal details shared as security questions, additional e-mail addresses, and in some cases phone numbers, the account data could be used to identify and target individuals in a number of ways. And that information is likely to have been combined with other breached data to provide a powerful tool to hackers looking to target specific individuals.

For example, there's the case of Alexandra Chalupa, a consultant who had been working for the Democratic National Committee. Despite frequent password changes, she received numerous pop-up messages from Yahoo Mail stating, "We strongly suspect your account has been the target of state-sponsored actors." Chalupa sent a message to DNC Communications Director Luis Miranda about the alerts on May 3 as the DNC began to become aware of its serious security issues.

The incidents began while she was researching former Donald Trump Campaign Chairman Paul Manafort's work for former Ukraine President Viktor Yanukovich (whose government was toppled by protests in Ukraine, leading to the current conflict between Ukraine and Russia-backed separatists). Chalupa, who was using her personal Apple computer with an older version of the MacOS X operating system and the Safari browser, may have been targeted using forged cookies. Yahoo would not comment on Chalupa's case, though the company confirmed that the message she shared was consistent with what users believed to have been subjected to a state-sponsored or advanced persistent threat attack would have seen.

The exposure for Chalupa went beyond hacking. According to her sister, she was targeted personally in more physical ways. In a July Facebook post, Andrea Chalupa said:

This just breaking, so since it's family, I'll share finally that my sister has been personally harassed, including her car broken into, an attempt to break into her house in the middle of the night, her personal e-mail hacked ever since she began, many months ago, investigating Trumps ties to Putin/Russia.

Chalupa's case is an extreme instance, but it highlights some of the risks users may face if their account data was used to target them. Foreign Intelligence agencies could use the data from the Yahoo breach to help with other efforts targeted at government employees.

As Bloomberg reported last night, the data from the 2013 breach included personal data of more than 150,000 US government employees and members of the military. Whether or not that information gets combined with data pulled from the hack of the Office of Management and Budget attributed to China earlier this year, the information could be used in spear-phishing campaigns—especially if government e-mail addresses or other data identifies an account owner as affiliated with the government or military.

That's not to minimize the danger associated with the information being in the hands of criminals, who are just as capable of using data for targeted attacks. The passwords alone are a major hazard. While they were protected by an MD5 hash, the security of those passwords depends greatly on the strength of the hash key and of the password—and many of the weaker passwords in the exposed accounts may have been easily cracked. "If the billion password hashes have been broken," said Richard Henderson, global security strategist at end-point security software provider Absolute Software, "then that provides a ton of ammunition for attackers to attempt to get into other accounts belonging to the same target."

What is perhaps most unsettling about the breach is that Yahoo and the forensics experts brought in did not discover the earlier breach when investigating the 2014 incident. And Yahoo still does not know the means by which this compromise occurred. To boot, there's no telling how much personal data has been exposed in the meantime as a result of that data exposure.

I'm yahoo old member