This is a courageous disclosure since the OP risks to be in some trouble for his "ethical probing".
I am pretty surprised he didn't disclose it anonymously to be honest.
[deleted]
Yahoo Hacked
11–20 of 258 posts
Re: Yahoo Hacked
#12Not mentioned in the title, but important:
Winzip.com has been hacked as well. Do not trust their binaries.
Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they will go after him, because they know who he is, and will not have any joy identifying the actual intruders, and this will just go further to demonstrate that the spy agency dragnets are as useful as a chocolate teapot in preventing and acting against actual crime.
I hope he contacted a great defence attorney and the ACLU at the same time as Yahoo and the FBI.
Re: Yahoo Hacked
#13Is this a new phenomenon? I always felt that Yahoo's systems weren't secure. Until I shut down my Yahoo accounts, it would be a semi-regular occurrence for both my Yahoo email and IM to send out spam to everyone in my Yahoo contacts list. Am I wrong? I've since shut down my account since I got sick of dealing with it.
That's not a Yahoo hack though. When that happens it is almost always your local machine that has been breached by a virus which simply reads the locally stored contact list. And to answer your question, no, it is not a regular occurrence for Yahoo, or any of the major players, to have their servers hacked.
Re: Yahoo Hacked
#14[deleted]
Re: Yahoo Hacked
#15[deleted]
No. He CC'd them.
Re: Yahoo Hacked
#16Is this a new phenomenon? I always felt that Yahoo's systems weren't secure. Until I shut down my Yahoo accounts, it would be a semi-regular occurrence for both my Yahoo email and IM to send out spam to everyone in my Yahoo contacts list. Am I wrong? I've since shut down my account since I got sick of dealing with it.
That's not a Yahoo hack though. When that happens it is almost always your local machine that has been breached by a virus which simply reads the locally stored contact list. And to answer your question, no, it is not a regular occurrence for Yahoo, or any of the major players, to have their servers hacked.
To my knowledge, my machine is secure. It wasn't Windows and I had both anti-virus and a firewall active. For one thing, what made this strange was that I haven't even logged into Yahoo for months (probably close to a year) when this happened, repeatedly.
Re: Yahoo Hacked
#17Not mentioned in the title, but important: Winzip.com has been hacked as well. Do not trust their binaries. Either this will be headline news tomorrow, or it will be suppressed in its entirety. The OP will probably go to prison, unfortunately, as they will not differentiate between this and black hat intrusion - the case will be judged by someone who saw his nephew using a computer, once, and they will go after him,…
TIL - people still use WinZip
Re: Yahoo Hacked
#18This guy works in the security industry and yet he couldn't google "yahoo security" to find their security contact email address (second result for me)? He was also unaware that Yahoo runs a Bug Bounty Program?
Re: Yahoo Hacked
#19I wonder what best practice is for consumer websites which have domains like yahoo.com which has mostly customers, and yahoo-inc.com for corporate, for things like security@ addresses. It's reasonable someone wouldn't know about yahoo-inc.com.
BCP is for domains to have abuse@, which for Yahoo.com should be tied into their corporate security and intelligence group.
Re: Yahoo Hacked
#20"Though the FBI seemed intrigued by this, in my opinion, they aren’t moving with any form of haste."
I am doubtful that FBI would share their plans and/or actions with OP.