Menu
The Yahoo hackers weren't state-sponsored, a security firm says

The Yahoo hackers weren't state-sponsored, a security firm says

Elite hackers-for-hire were actually behind the breach, according to InfoArmor

Common criminals, not state-sponsored hackers, carried out the massive 2014 data breach that exposed information about millions of Yahoo user accounts, a security firm said Wednesday.

Yahoo has blamed state actors for the attack, but it was actually elite hackers-for-hire who did it, according to InfoArmor, which claims to have some of the stolen information.   

The independent security firm found the alleged data as part of its investigation into "Group E," a team of five professional hackers believed to be from Eastern Europe.

"According to our information, most of the group's clientele are spammers," said Andrew Komarov, InfoArmor's chief intelligence officer.

InfoArmor's claims dispute Yahoo's contention that a "state-sponsored actor" was behind the data breach, in which information from 500 million user accounts was stolen. Some security experts have been skeptical of Yahoo's claim and wonder why the company isn't offering more details.

The database that InfoArmor has contains only "millions" of accounts, but it includes the users' login IDs, hashed passwords, mobile phone numbers and zip codes, Komarov said.

The security firm says it obtained the data from "operative sources" about a week ago and has verified that the account information is real. Komarov wouldn't say more about how InfoArmor got the data.

Group E has sold the stolen Yahoo database in three private deals, Komarov said. At one point, the Yahoo database was sold for at least $300,000, he said. His firm has been monitoring the group's activities for more than three years. 

InfoArmor also claimed that Group E was behind high-profile breaches at LinkedIn, Dropbox and Tumblr. To sell that information, the team has used other hackers, such as Tessa88 and peace_of_mind, to offer the stolen goods on the digital black market.

"The group is really unique," Komarov said. "They're responsible for the largest hacks in history, in term of users affected."

However, in the case of the Yahoo database, which was taken before Dec. 2014, Group E hasn't made it generally available on the black market, according to Komarov. Group E wants to preserve the database's value. Other hackers have claimed to offer it for sale, but they were actually selling fake information, he said.

Yahoo didn't respond to a request for comment. The company hasn't offered any evidence supporting its claim that state-sponsored hackers carried out the attack.

Other security experts are split over InfoArmor's findings.

Alex Holden, Chief Information Security Officer at Hold Security, said InfoArmor's claims were mostly consistent with what he had found in his own investigations. However, he added, "Right now we do not know with full confidence who was behind the original breach in 2014, and if there was only one breach."

Vitali Kremez, a cybercrime analyst at Flashpoint, is more skeptical of InfoArmor's findings. "They might have jumped the gun too early on this," he said.

He questioned discrepancies between the database that InfoArmor obtained and what Yahoo said was stolen. For example, Yahoo said passwords hashed with the bcrypt algorithm and security questions may have been lifted as part of the breach. The data InfoArmor uncovered only contains passwords hashed with the MD5 algorithm, and no mention of security questions, he said.

"Yahoo said that the stolen passwords used bcrypt. Why would they lie about that?" Kremez said. "It's possible that InfoArmor has a different data set."

InfoArmor's Komarov said his company is happy to work with law enforcement, Yahoo and other independent parties to examine the data he's recovered. A sample of the data is available in the company's findings.

IDG News Service tried some of the sample login IDs and found that Yahoo recognized some. The login IDs also didn't appear to be recycled from other leaked databases. However, Yahoo didn't recognize some of the other IDs.

Komarov said that although most of Group E's clients are spammers, they had at least one customer who was a state-sponsored actor. The stolen Yahoo database might have been used to target U.S. government officials, InfoArmor said in its report. 

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments