388 VIEWS
Pinterest LinkedIn LINE

(UPDATE 1) Yahoo! Voice and Yahoo! Voices appear to be different services, so I updated that point. The conclusion remains unchanged—which means Yahoo! Voice should also take care in addressing this issue.

There has been an uproar over passwords leaking from Yahoo! in the United States.

 

Yahoo! US has long faced business problems and lost many employees, leaving it unable to keep up with system maintenance. Thus, when I first heard the news, I thought, “Ah, they finally did it.” Recently I have been giving talks in various places arguing that authentication should be entrusted to organizations with specialist teams. The fact that Yahoo!, itself an authentication provider (Identity Provider, IdP), did this had a very large impact on me personally [1].

Hawk of Evoluzio, who is deeply knowledgeable about this field, also posted the following tweet.

Idpからのパスワード流出はインパクトがでかいね。 やっぱり、パスワード自体に依存するのをそろそろ考えなおさないといけない気がする（って前から言ってるけど） http://bit.ly/OBiEG3
(Source) https://twitter.com/neohawk/status/223568581332439041

On closer inspection, however, the situation seems somewhat different.

First, regarding the source and circumstances of the leak, usernames and passwords were reportedly extracted from a service called Yahoo! Voices [2] through a SQL UNION injection [3]. The email addresses reportedly included not only Yahoo! addresses but Hotmail addresses as well. On reflection, however, this is extremely strange. Why?

Yahoo! Voices uses federated authentication with Yahoo!’s authentication service (and now with Google and others too). That means there should be no passwords there to steal. You cannot steal something that does not exist. Something is wrong.

I therefore investigated what Yahoo! Voices actually is.

The Origins of Yahoo! Voices

Yahoo! Voice is a platform provided by Yahoo! for publishing user-written articles. It began in Denver, Colorado, in January 2005 as a service called “Associated Content,” operating under the domain www.associatedcontent.com. Yahoo! later acquired it in May 19, 2010 for 90 million US dollars [4], and it now bears the name Yahoo! Voices.

A screen from January 2006 shows that users registered an email address and password and used them to write articles.

 

In other words, the Associated Content service itself contained email-address and password combinations, and those were what leaked. That is why fewer than 5% matched current passwords on Yahoo!’s authentication server. (This route is also the only way to explain the presence of Hotmail addresses. No such accounts currently exist on Yahoo!’s authentication server.)

This Is a Classic Problem of a Website That Did Not Entrust Authentication to a Specialist Service

If this reasoning is correct, this was a classic case of passwords leaking from an amateur authentication website, a pattern repeatedly seen recently [5]. The additional misfortune in this case is that the site responsible carried the Yahoo! brand, even though it was actually operated by another company that Yahoo! had acquired. In news coverage and the public mind, it will still be “Yahoo!” Consequently, Yahoo!’s authentication business will suffer serious damage.

If there are lessons, they are these 2 points.

  1. Do not operate your own authentication. Properly managing authentication is difficult. Use third-party authentication and discard passwords.
  2. Exercise great care when bringing a site that uses its own password authentication under your brand. As a rule, discard that service’s passwords and confirm that no remnants remain.
It goes without saying that SQL injection and similar issues must also be addressed properly. [6]

Revision History

  • 2012/7/13 10:17 (Japan time): First draft, Tokyo.
  • 2012/7/14 04:52 (Denver time): Draft 2. After @eyou_i pointed out that Yahoo! Voice and Yahoo! Voices differ, I revised the text to refer to Yahoo! Voices. Thanks, eyou_i. The history and conclusion remain unchanged. Denver, Colorado.

[1] That said, Yahoo! US is an IdP that failed to obtain US government Level 1 certification (1 is the lowest and 4 the highest).

[2] According to Y!’s statement, the leak involved an old file from Yahoo! Contributor Network. According to a CNET article, Yahoo! Voices was the consumer-facing brand, Yahoo! Contributor Network the internal name, and Associated Content its former name.

[3] According to a CNET article. The obtained file also reportedly contained dbb1.ac.bf1.yahoo.com.

[4] According to Crunchbase. (Source: http://www.crunchbase.com/company/associatedcontent )

[5] By contrast, the LinkedIn case was a leak from an IdP, so it is necessary to distinguish properly between IdPs run by amateurs and those run by professionals. Review, certification, and ratings will be important for that purpose.

[6] On the 15th (local time), Yahoo! announced that the incident had been resolved. Since only an old file had remained, the response was straightforward. (Reference: http://japan.cnet.com/news/service/35019264/ )

 

Related posts