Yahoo, seems to have the worst email security on the planet when they aren't actively writing tools for the NSA to snoop your email. Now they are claiming the "state actor" that hacked 1 billion accounts was able to access email accounts without a password by using forged cookies.

Our outside forensic experts have been investigating the creation of forged cookies that could allow an intruder to access users’ accounts without a password. Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account.

How is this technically possible? I assume they were forging session cookies? That means they could only attack active sessions and they must know the cryptographic cookie generation scheme? Even knowing the cookie generation scheme, wouldn't it still be guessing... I mean can they generate a session cookie and get it correct the first time or does it take many guesses?

What else can the attacker do with the account. For instance, why did they not change the passwords on the accounts so only they could access them?

  • 1
    Without having more information, any answer would be entirely speculative and quite likely wrong. There's just not enough detail here to offer an educated guess. – Xander Feb 19 '17 at 22:37
  • It's entirely possible that session cookies are predictive, have weak entropy, or something else that would make forging them easy. But I back Xander's statement that without technical details to base an answer off of, it's speculative and most likely would be incorrect for the scenario. – h4ckNinja Feb 19 '17 at 22:43
  • 1
    According to theregister.co.uk/2017/02/16/yahoo_forged_cookie_hack_risk "...believes ... an unauthorized third party accessed the company's proprietary code to learn how to forge cookies." – Aedazan Feb 19 '17 at 22:44

Browse other questions tagged or ask your own question.