<story><title>Yahoo Hacked</title><url>http://webcache.googleusercontent.com/search?q=cache:I8s8KmZhwXMJ:www.futuresouth.us/yahoo_hacked.html+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;client=firefox-a</url></story><parent_chain><item><author>secalex</author><text>Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions.&lt;p&gt;Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock.&lt;p&gt;Three of our Sports API servers had malicious code executed on them this weekend by attackers looking for vulnerable Shellshock servers. These attackers had mutated their exploit, likely with the goal of bypassing IDS&amp;#x2F;IDP or WAF filters. This mutation happened to exactly fit a command injection bug in a monitoring script our Sports team was using at that moment to parse and debug their web logs.&lt;p&gt;Regardless of the cause our course of action remained the same: to isolate the servers at risk and protect our users&amp;#x27; data. The affected API servers are used to provide live game streaming data to our Sports front-end and do not store user data. At this time we have found no evidence that the attackers compromised any other machines or that any user data was affected. This flaw was specific to a small number of machines and has been fixed, and we have added this pattern to our CI&amp;#x2F;CD code scanners to catch future issues.&lt;p&gt;As you can imagine this episode caused some confusion in our team, since the servers in question had been successfully patched (twice!!) immediately after the Bash issue became public. Once we ensured that the impacted servers were isolated from the network, we conducted a comprehensive trace of the attack code through our entire stack which revealed the root cause: not Shellshock. Let this be a lesson to defenders and attackers alike: just because exploit code works doesn’t mean it triggered the bug you expected!&lt;p&gt;I also want to address another issue: Yahoo takes external security reports seriously and we strive to respond immediately to credible tips. We monitor our Bug Bounty (bugbounty.yahoo.com) and security aliases (security@yahoo.com) 24x7, and our records show no attempt by this researcher to contact us using those means. Within an hour of our CEO being emailed directly we had isolated these systems and begun our investigation. We run one of the most successful Bug Bounty programs in the world and I hope everybody here will participate and help us keep our users safe.&lt;p&gt;We’re always looking for people who want to keep nearly a billion users safe at scale. paranoids-hiring@yahoo-inc.com</text></item></parent_chain><comment><author>tszming</author><text>&amp;gt;&amp;gt; Yahoo takes external security reports seriously&lt;p&gt;Few weeks ago, I reported to your team that some of the yahoo servers&amp;#x27; SSL cert were expired, acknowledged but no one want to fix it (until I post it here and finally get them updated...your site was showing security warning to your users for 2 weeks)&lt;p&gt;One of your awesome engineers replied the issue with expired SSL cert: &amp;quot;there do not appear to be any security implications as a direct result of this behavior&amp;quot;</text></comment>
<story><title>Yahoo Hacked</title><url>http://webcache.googleusercontent.com/search?q=cache:I8s8KmZhwXMJ:www.futuresouth.us/yahoo_hacked.html+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;client=firefox-a</url></story><parent_chain><item><author>secalex</author><text>Howdy, Hacker News. I’m the CISO of Yahoo and I wanted to clear up some misconceptions.&lt;p&gt;Earlier today, we reported that we isolated a handful of servers that were detected to have been impacted by a security flaw. After investigating the situation fully, it turns out that the servers were in fact not affected by Shellshock.&lt;p&gt;Three of our Sports API servers had malicious code executed on them this weekend by attackers looking for vulnerable Shellshock servers. These attackers had mutated their exploit, likely with the goal of bypassing IDS&amp;#x2F;IDP or WAF filters. This mutation happened to exactly fit a command injection bug in a monitoring script our Sports team was using at that moment to parse and debug their web logs.&lt;p&gt;Regardless of the cause our course of action remained the same: to isolate the servers at risk and protect our users&amp;#x27; data. The affected API servers are used to provide live game streaming data to our Sports front-end and do not store user data. At this time we have found no evidence that the attackers compromised any other machines or that any user data was affected. This flaw was specific to a small number of machines and has been fixed, and we have added this pattern to our CI&amp;#x2F;CD code scanners to catch future issues.&lt;p&gt;As you can imagine this episode caused some confusion in our team, since the servers in question had been successfully patched (twice!!) immediately after the Bash issue became public. Once we ensured that the impacted servers were isolated from the network, we conducted a comprehensive trace of the attack code through our entire stack which revealed the root cause: not Shellshock. Let this be a lesson to defenders and attackers alike: just because exploit code works doesn’t mean it triggered the bug you expected!&lt;p&gt;I also want to address another issue: Yahoo takes external security reports seriously and we strive to respond immediately to credible tips. We monitor our Bug Bounty (bugbounty.yahoo.com) and security aliases (security@yahoo.com) 24x7, and our records show no attempt by this researcher to contact us using those means. Within an hour of our CEO being emailed directly we had isolated these systems and begun our investigation. We run one of the most successful Bug Bounty programs in the world and I hope everybody here will participate and help us keep our users safe.&lt;p&gt;We’re always looking for people who want to keep nearly a billion users safe at scale. paranoids-hiring@yahoo-inc.com</text></item></parent_chain><comment><author>legohead</author><text>Patched twice?  There are 7 known shellshock exploits (and 30 patches) so far.. &lt;a href=&quot;https://shellshocker.net/&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;shellshocker.net&amp;#x2F;&lt;/a&gt;&lt;p&gt;Not knocking on you or anything, just more interested to know if all exploits have been patched against, more than the # of patches applied.</text></comment>