An Important Message About Yahoo User Security

Post by dlandis » Thu, Sep 22, 2016, 9:25 PM UTC

guelo wrote: post #177

supergirl wrote: post #77

"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.

I think it has to do with the sophistication of the attack. If they used multiple zero-days, multiple pieces of custom coded software, and a team of operators working full time for long periods of time then it can be assumed it's a multi-million dollar effort involving a large team of engineers. In such a case the list of potential adversaries can be reduced to corporate or state actors.

Post by mi100hael » Thu, Sep 22, 2016, 9:27 PM UTC

Sami_Lehtinen wrote: post #26

jeremyt wrote: post #22

Earlier quoted context omitted.

Try protonmail

Why not Tutanota?

Post by pbhjpbhj » Thu, Sep 22, 2016, 9:29 PM UTC

guelo wrote: post #177

supergirl wrote: post #77

"state sponsored actor". I wonder how they decided that. did the hackers plant a flag inside yahoo's data center? or is any attack originating from outside US now considered state sponsored? of course, we will never see any proof of this. also, did it take them 2 years to discover this breach? that's bad. or, do they just announce it now? that's worse.

I think it has to do with the sophistication of the attack. If they used multiple zero-days, multiple pieces of custom coded software, and a team of operators working full time for long periods of time then it can be assumed it's a multi-million dollar effort involving a large team of engineers. In such a case the list of potential adversaries can be reduced to corporate or state actors.

Post by alphapapa » Thu, Sep 22, 2016, 9:29 PM UTC

guessmyname wrote: post #20

heroiccyber wrote: post #8

You can verify if your credentials have been compromised at https://heroic.com

Here is a script for the command line enthusiasts. #!/bin/bash EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1") EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;') RESPONSE=$( curl "https://heroic.com/wp-admin/admin-ajax.php" \ -H "accept-language: en-US,en;q=0.8" \ -H "accept-encoding: gzip, deflate, br" \ -H "user-agent: Mozilla/5.0 (KHTML, like Gecko) Safari/537.36" \ -H "content-type: application…

    EADDRESS=$([[ "$1" == "" ]] && echo "noreply@example.com" || echo "$1")

    EADDRESS={$1:-noreply@example.com}

    ${parameter:-word}
        Use Default Values.  If parameter is unset or null, the expansion of word is substituted.  Otherwise, the value of parameter is substituted.

    EADDRESS=$(echo "$EADDRESS" | sed 's;@;%40;')

    EADDRESS=${EADDRESS/@/%40}

Post by talmand » Thu, Sep 22, 2016, 9:42 PM UTC

evgen wrote: post #167

serf wrote: post #155

Earlier quoted context omitted.

didn't a cache of supposedly state-sponsored tools just get auctioned off by a group who (supposedly) compromised a machine which was under the ownership of one of the three-letter groups?[0] Seems to give more credence to the viewpoint that the tool doesn't indicate the perpetrator too easily. [0]: https://www.wired.com/2016/08/hackers-claim-auction-data-sto...

If I hand you an F-16 and you use it to do damage that would indicate possible US air force involvement. If the F-16 that attacked me was preceded by advanced ECM, suppression of air defenses using stand-off munitions, and was performed in a particular precision attack pattern then US air force involvement would be much more likely. These signatures are not just about the tools, but the opsec and procedures that the…