газета

INSIDE THE RUSSIAN HACK OF YAHOO: HOW THEY DID IThttp://www.itnews.com/article/3181485/hacking/inside-the-russian-hack-of-yahoo-how-they-did-it.htmlThe U.S. Federal Bureau of Investigation has been investigating the intrusion fortwo years, but it was only in late 2016 that the full scale of the hack became apparent.On Wednesday, the FBI indicted four people for the attack, two of whom are Russianspies.The hack began with a spear-phishing email sent in early 2014 to a Yahoo companyemployee. It's unclear how many employees were targeted and how many emailswere sent, but it only takes one person to click on a link, and it happened.Aleksey Belan, a Latvian hacker hired by the Russian agents, found Yahoo's userdatabase and the Account Management Tool, which is used to edit the database.

Heinstalled a backdoor on a Yahoo server that would allow him access, and inDecember he stole a backup copy of Yahoo's user database and transferred it to hisown computer.The database contained names, phone numbers, password challenge questions andanswers and, crucially, password recovery emails and a cryptographic value uniqueto each account.

It's those last two items that enabled Belan and fellow commercialhacker Karim Baratov to target and access the accounts of certain users requested bythe Russian agents, Dmitry Dokuchaev and Igor Sushchin.The account management tool didn't allow for simple text searches of user names,so instead the hackers turned to recovery email addresses. Sometimes they were ableto identify targets based on their recovery email address, and sometimes the emaildomain tipped them off that the account holder worked at a company or organizationof interest.Once the accounts had been identified, the hackers were able to use stolencryptographic values called "nonces" to generate access cookies and then access toa user email account without the need for a password.Throughout the process, Belan and his colleague were clinical in their approach. Ofthe roughly 500 million accounts they potentially had access to, they only generatedcookies for about 6,500 accounts.

So clinical was the attack that when Yahoo firstapproached the FBI in 2014, it went with worries that 26 accounts had been targetedby hackers. It wasn't until late August 2016 that the full scale of the breach began tobecome apparent and the FBI investigation significantly stepped up.In December 2016, Yahoo went public with details of the breach and advisedhundreds of millions of users to change their passwords..