November 16, 2009

Yahoo jobs site security hole found on hacker forum

SQL injection attack could reveal customer account details

By John E. Dunn

Yahoo raced last Thursday to close a potentially serious vulnerability that could have exposed customer data from its online jobs website, a security company has revealed.

According to Israeli security company Imperva, which discovered the security hole being discussed on a known criminal forum, the vulnerability was a variant of the standard SQL injection attack known as blind SQLi, and could have revealed customer account details and possibly payment data.

This is theoretically less serious than a straight SQL injection attack because the attacker needs to infer returned information using carefully-crafted SQL queries to the target database, as opposed to simply seeing the results directly. However, according to Imperva's CTO, Amichai Shulman, this is no longer the hurdle it once might have been.

"Instinctively, one would say that this is not as significant. But there are automated tools that could use it [the returned data] to extract the entire database," he said.

Reported to Yahoo on Thursday morning (GMT) the search giant had put in place a fix by the afternoon, which Shulman suggested hinted at the seriousness of the breach.

"They were very responsive. On a previous incident it took ages but this time they were very fast," said Shulman.

It is impossible to say whether data had been harvested from Yahoo, but Shulman suspected that the forum on which the exploit was being discussed was more likely a means of selling the technical elements of the hack on to others who might in turn sell it again.

"SQL injection is a major thorn in the side for the website hosting community. It can be tackled with careful research and high levels of security. Unfortunately, some site operators overlook this simple fact at high risk," said Shulman.

Jobs websites are a major target for criminals because they attract high traffic volumes. Attacks take two routes, either going after the data held in internal databases for its intrinsic value, or just using the sites themselves to host further attacks. The infamous case of Monster.com from 2007, attackers managed to achieve both in separate incidents.

Newsletters

Sign up to our Weekly Round-Up for the past week’s not-to-be-missed news analysis and insight delivered straight to your inbox.