Yahoo! Voice hacked; 400,000+ login credentials dumped online

Hackers belonging to a hacking collective called D33Ds Company have retrieved and dumped login details of more than 400,000+ user accounts in plain text. A post on Trustedsec stated, "The passwords contained a wide variety of email addresses including those from yahoo.com, gmail.com, aol.com, and much more." Interestingly, the post adds that the affected website is a sub-domain of yahoo.com, and that the compromised server may be Yahoo! Voice a.k.a Associated Content. "The affected website was only named as a sub-domain of yahoo.com. However, digging through and searching for the hostname, the attacker forgot to remove the hostname “dbb1.ac.bf1.yahoo.com” (credit to Mubix for the hostname find)," Trustedsec wrote. The most worrisome bit here is that the passwords that were stored were completely unencrypted, and as you're reading this, 400,000+ login credentials (comprising usernames and passwords) have been exposed.

It has been brought to light that the hackers used a union-based SQL injection attack to get away with the information stored in the database. The post on Trustedsec also put forth a glimpse of what the data leaked online looks like (can be seen in the image below). 

Screenshot of a part of the details compromised

A note at the end of the dump reads, "We hope that the parties responsible for managing the security of this sub-domain will take this as a wake-up call and not as a threat. There have been many security holes exploited in webservers belonging to Yahoo! Inc. that have caused far greater damage than our disclosure. Please do not take them lightly. The sub-domain and vulnerable parameters have not been posted to avoid further damage."

Reporting on the issue, Ars Technica's Dan Goodin wrote that the union-based SQL injection hacking technique used here affects inadequately secured web applications that do not "properly scrutinize text entered into search boxes and other user input fields". He added, "By injecting powerful database commands into them, attackers can trick back-end servers into dumping huge amounts of sensitive information."

Security breach, such as the case in point or the LinkedIn database leak, is emerging as a worrying trend. LinkedIn recently suffered a data breach where passwords of some of the social network's members were compromised. At the time of the incident, LinkedIn engineer Vicente Silveira confirmed on the website's blog that some passwords were "compromised". "We are continuing to investigate this situation," he said.

Image credit: Trustedsec