Garden-Variety Cybercrooks Breached Yahoo, Says Security Firm

The hackers who stole the data of hundreds of millions of Yahoo users two years ago were two cybercriminal gangs, InfoArmor reported Wednesday.

That finding contradicts the notion that state-sponsored actors were behind the attack, which Yahoo suggested earlier this month when it disclosed the breach.

Further, the number of users’ records stolen is closer to 1 billion than to the 500 million Yahoo acknowledged, according to InfoArmor.

However, much of the data is useless, the firm said.

The Wrong Stuff

Someone with the handle “Peace_of_Mind” had offered data on 200 million Yahoo users for sale on the black market, but “the data previously published by Peace_of_Mind is fake,” said Andrew Komarov, chief intelligence officer at InfoArmor.

“This has been confirmed by us and Yahoo,” he told the E-Commerce Times.

The confusion around Peace-of-Mind’s offering came about because some of the decrypted passwords offered were legitimate, Komarov explained.

After extensive analysis and cross-referencing against its own data breach intelligence systems, InfoArmor determined the dump was based on multiple third-party data leaks unrelated to Yahoo.

Money-Making Motive

InfoArmor found the real data dump earlier this month and validated it, but this “is a new and different dataset that was distributed through closed sources,” Komarov said.

All the data in the new dump received earlier this month is validated and legitimate, he added, although it “also includes disabled accounts and bots.”

Two criminal gangs, Hell Forum and Group E, were involved in the Yahoo breach, InfoArmor found. The two gangs are linked through a proxy with tessa88, a middleman reselling data stolen from LinkedIn and other companies.

The hackers took data from about 1 billion Yahoo users, based on InfoArmor’s analysis of several high-profile breaches of files containing Yahoo and other accounts, Komarov said.

“Group E was responsible for the attack … and sold the stolen data for about (US)$300,000,” Komarov disclosed. “Hell Forum is an underground forum.”

State-Sponsored Buyer

One of Hell Forum’s members, ROR[RG], previously hacked Ashley Madison, AdultFriendFinder and the Turkish National Police database, according to InfoArmor.

There are more than 100 different parts to the data Group E had, and the files are organized alphabetically by the names of user accounts, InfoArmor noted. Group E obtained the whole database at once and parsed it to proxies.

“We were able to obtain a sample of the database,” Komarov said, but he declined to provide further details “so as not to jeopardize this and other investigations.”

One of the buyers of the Yahoo data was an Eastern European state-sponsored group, he revealed. Two others were spammer groups.

InfoArmor is certain the data was stolen before December 2014.

However, the hack still poses some risk to consumers, the firm warned, because many people reuse passwords for multiple accounts.

Middleman Scorned

Far from being a hacker, Peace_of_Mind is really a middleman who put up the fake Yahoo data for sale on the underground marketplace The Real Deal.

Peace_of_Mind is currently on the outs with tessa88, who in turn has been banned from several underground forums because of the poor quality of the data provided, Komarov said.

“It seems like the relationship is strained at the moment. However, this doesn’t mean they won’t cooperate with one another in the future. These are cybercriminals.”

Responsibility Dodge?

It’s likely Yahoo blamed state sponsored attackers because “it’s nearly impossible to defend against a state-sponsored hack and it becomes a State Department or Defense Department issue and typically doesn’t carry the stigma of negligence,” suggested Rob Enderle, principal analyst at the Enderle Group.

“A criminal attack doesn’t have these protections and you’re assumed to have been part of the cause,” he told the E-Commerce Times.

Yahoo top management, including CEO Marissa Mayer, refused to fund security initiatives, which may have led to the departure of security czar Alex Stamos, according to The New York Times.

The Yahoo case might trigger an SEC investigation, Enderle speculated, “and those typically don’t end well.”