Law enforcement provided Yahoo in November 2016 with data files that a third party claimed was Yahoo user data. We analyzed this data with the assistance of outside forensic experts and found that it appears to be Yahoo user data. Based on further analysis of this data by the forensic experts, we believe an unauthorized third party, in August 2013, stole data associated with more than one billion user accounts. Yahoo has not been able to identify the intrusion associated with this theft. We believe this incident is likely distinct from the incident we disclosed on September 22, 2016. We are notifying potentially affected users and have taken steps to secure their accounts, including requiring users to change their passwords. Yahoo has also invalidated unencrypted security questions and answers so that they cannot be used to access an account.

Yahoo says more than one billion accounts got hacked. That's obviously terabytes of data.

My question is, how can we secure website user information from hackers? Yahoo uses top level security, yet hackers managed to hack them. They are obviously using hashes and several encryption methods, but how did hackers breach their systems?

Are we all at risk?

Are the current security solutions not enough to prevent an attack? Need answers from penetration testers and security professionals.

  • 10
    "Yahoo uses top level security" Citation needed. (The evidence suggests otherwise, and just for one, Yahoo was very late to the table of webmail providers enforcing HTTPS.) Also, if you want high-profile cases, the exact same question could be asked about the US National Security Agency or Office of Personell Management, both of which are tasked with handling extremely sensitive data and both of which have suffered major leaks in recent years. (There are many more just like those, but two high-profile examples should be enough to make the point clear.) – a CVn Dec 18 '16 at 13:26
  • 5
    Firstly, you can learn from their mistakes. Yahoo failed to secure passwords because of ineffective mechanisms like MD5. Start by removing bad security practices like that. – iainpb Dec 18 '16 at 13:32
  • 2
    Not to mention that security is in large part risk assessment. An SME won't need the same level of protection Yahoo needs. Although a number of the Yahoo mistakes would be stupid anywhere... – user3244085 Dec 18 '16 at 16:36
  • shortly to say, there are many many different ways to hack a website.. so, 100% security doesnt exist in practice.. Just developers should remember to encrypt password, use different passwords for different sites (i.e. create logical algorithm you can remember); – T.Todua Dec 26 '16 at 15:28

Use a separate computer to manage the site

Most data breaches do not involve the website being hacked. Instead, an internal workstation is hacked when the user visits a malicious web page; this is called "drive by malware". With one internal system compromised, "lateral escalation" is performed, until the attackers take control of a computer with access to the database. They can then extract and exfiltrate the data.

The reason this roundabout route is used is that many web sites are extremely difficult to hack directly. If the organisation takes reasonable precautions, there will be no known vulnerabilities, and it would require a "zero day vulnerability" to hack directly. In contrast, office IT environments are usually poorly secured, so this is the easier route for hackers to target.

The solution to this is to have entirely separate "privileged access workstations" that are "air gapped" from the Internet. This has been standard practice in classified military/intelligence networks for years, but is rare in commercial systems. The breach indicates that Yahoo are not doing that. While you could criticise them for that, they are only the same as many industry peers. However, as a small website, you can do things differently. Make sure your website is secured, and use a separate laptop for managing your site. Don't do any browsing from that laptop.

I've kept this answer high-level so it doesn't get too long. For further reading, look up some of the phrases I've included in quotes.

| improve this answer | |

Being big does not equal being better secured

Don't assume that becuase they are big and famous, everything they do is better than what you can do.

Nothing has changed - you can secure your small websites the same way you did before, perhaps better since you can learn from Yahoo's mistakes. Continually updating your password hashing, instead of using md5, would be a good start.

Sometimes, being big also means it takes a long time to update security measures, it wouldn't surprise me if "update password hashes" has been in somebodies to-do list for many years.

| improve this answer | |

Every website is at risk, 100% secure websites are a myth. Like already said here, a good thing is to learn from the mistakes of others (not only Yahoo) to put up better defenses. What yahoo did is terribly weak in terms of security. For example, MD5 hashes were already in 2013 known to be insecure. So what this learns is that you need to stay on top of security best practices and be aware about new vulnerabilities in the different parts of your website.

Another aspect to defend yourself is to know who your enemy is. In one of Yahoo's statements they say that it were nation state attackers. This category of attackers has a lot of money. And if you have the right amount of money you can break everything. But that will probably be not the kind of attacker you have to fear on your small website. More likely attackers are script kiddies who are out there to just have some fun trying to hack your website. Or any other attacker with a limited budget. But don't be mistaken they can do a lot of harm! But anyway this information gives you a good insight to make security trade-offs.

| improve this answer | |
  1. how can we secure website user information from hackers? Yahoo uses top level security...

I have no details on that operation, but I assume that there were flaws somewhere. Yahoo, like other major firms must always balance between security, cost and client expectations. Would you use a site if it required you to produce a valid certificate? Or a site that would ask a high fee to pay their security officers? That could enforce security, but also highly reduce audience, which is definitely not what want those major sites.

  1. Are we all at risk?

Yes. Or at least you should assume. Or more exactly, you should considere the threats for you site, the possible consequences and the cost of the mitigation processes. May be you will decide that nothing more than what already exists is worth the cost, but you will be aware of it.

  1. Are the current security solutions not enough to prevent an attack?

That is not the correct question. Best security practices should be obeyed, and in the great majority of hacking cases, one of them (at least) was not. But they cannot be enough for any threat, because some threats are little dependant of technology. Never forget that the real world also exists

TL/DR: For small sites, simply following best security practices should be done and should be enough. Things go more complex when the importance of data increases because physical protection comes to the scene.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.