Distressed Yahoo!

Yahoo is a facing a lot of heat at the moment, with some recent events.

First, 500 million user accounts was stolen in 2014, and got dumped online recently. Then, there is news that Yahoo complied with a secret government order to search the incoming emails of all of its users. This secret initiative was not even known to its internal security team.

Verizon, who has been in talks to acquire Yahoo is now seeking a $1 Billion price cut. Hence, the timing of these revelations couldn't have come at a worse time for Yahoo. 

To make matters worse, to avoid users leaving its platform, Yahoo has disabled email-forwarding. This is totally in bad faith, which will only frustrate it's users.

Update 15-Dec-2016:
Yahoo says an additional 1 Billion users were impacted. This is insane!
More details from Krebs.

Update 14-Jun-2017:
The Verizon deal finally goes thru, and Yahoo's CEO resigns.

Update  04-Oct-2017:
Every single Yahoo account was hacked - 3 billion in all - link

Steal passwords from locked-screen computers

'Stupid simple' attack can steal credentials from locked Windows and Mac computers - no 0-day used!

200M yahoo accounts for sale for $1800

The hacker, who goes by the pseudonym "Peace" or "peace_of_mind," has uploaded 200 Million Yahoo! credentials up for sale on an underground marketplace called The Real Deal for 3 Bitcoins (US$1,824).

Story

Myspace & VK lose customer records

VK lost 100 M user records; and MySpace lost 427 M.
VK's dump is being sold for a measly 1 BTC (USD 570).

7m accounts compromised via Lifeboat hack

Lifeboat was hacked in January but opted not to notify users about the breach

Tool: KeeFarce

KeeFarce allows for the extraction of KeePass 2.x password database information from memory. The cleartext information, including usernames, passwords, notes and url's are dumped into a CSV file in %AppData%

Details here

BitDefender gets held at ransom for unencrypted passwords

It's a pity to see security companies forgetting basic security measures like hashed passwords!

LastPass Compromised

LastPass (a popular password management site) has been compromised. The company announced in their blog. Errata also has a good impact assessment on the topic.

5 Million Gmail Credentials Leaked

Not clear what is the source of this leak. Apparently Gmail says they were not compromised.

Update 20-Sep-14:
Seems like Google wasn't compromised, and majority of the leaked credentials are incorrect. Could be an old dump?!

Russian hackers steal 1.2B Web credentials

Criminals in Russia have amassed a huge database of 1.2 billion stolen user names and passwords and half a billion email addresses .... The data, believed to be the single biggest horde of stolen Internet identity information ever collected, was garnered from attacks that reached into every corner of the Web and hit around 420,000 sites, said Hold Security.

Full Story

We have Hold Security, the company who apparently broke this news, who is providing a free service to help you identify if your password has been compromised. Sounds like either a publicity stunt, or a pure bid to steal the passwords.

Aussie Apple Fans Get Pawned

A mysterious new scam has emerged targeting Antipodean iPhone, iPad and iMac users by locking their devices via “Find My iPhone” technology and holding them to ransom.

Full Story  &  Troy Hunt's Analysis

Tesco user credentials published

A hacker publsihed 2240 user accounts and cleartext password on pastebin. At the face of it looked like a breach of their servers. However, Troy investigated and has a different theory.

Yahoo Accounts breached - Change Your Password

Not much details provided by Yahoo, but change your password, just to be on the safe side

GitHub gets a brute force attack

While we aggressively rate-limit login attempts and passwords are stored properly, this incident has involved the use of nearly 40K unique IP addresses. 

The official post

Google knows YOUR WiFi Password!

Google has access to clear-text wifi passwords. Now considering there are 900 Million+ android devices, and each device would have multiple wifi passwords stored on them - do the maths!
Meaning all the good folks at NSA need to do is but send a request to Google asking for the wifi password of anyone, so that they could snoop in on their computers

Google Chrome's Password Storage

Stop storing passwords on Chrome. Looks like the passwords are not encrypted with a master password, and hence visible to anyone with physical access to your system.

Stealing Google Authentication

Single sign on is a boom - even for the hackers. A hacker shows how to steal authentication token

Ubuntu Forums Hacked - 2M Accounts Breached

UbuntuForums has been compromised and led to all the accounts credentials being stolen. The site (thankfully) discloses that the passwords were not stored in plain text, but doesn't mention if best-practices like salting were used. Sputn1k has claimed responsibility.

Update 24-Jul-13:
An email received from Ubuntu:

Tumblr Passwords Compromised

Tublr asks users to change their passwords. Some mobile app of theirs sent passwords in clear text

Security for the paranoid!

We all have 100s of accounts, with multiple passwords. So, how can we ensure user friendliness of a password manager, but from a truly [paranoid] security guy's point of view?

We are heading into a world of cloud computing where trust is going to be a huge issue. It is no longer simply a matter of trusting that the software you buy works as advertised.