Shell-Shocked? Hackers Set Their Sights on Yahoo
Once word gets out about a potentially massive – and lucrative – vulnerability, you can bet it won’t be long before the sharks start circling.
Yahoo got firsthand evidence of this fact during a recent run-in with a band of Romanian hackers. Several of the search and content giant’s servers were discovered by a security sweep to contain malicious code. It’s believed the hackers had targeted Yahoo with the goal of exploiting the Shellshock vulnerability which has been making the rounds of late.
Shellshock is a weakness which could, in theory, allow a cyber-crook to take over an affected computer. Some experts have theorized Shellshock could be an even bigger threat than Heartbleed, which took the tech world by storm earlier this year.
However, Yahoo had already patched its servers against Shellshock. When the hackers realized this, they didn’t throw in the towel and move on to more noble pursuits. Instead, they looked for another point of weakness and it seems like they found one.
At first it appeared that Yahoo had fallen victim to the Shellshock bug itself. It was only later that the actual scope of the attack was realized. Since Shellshock wasn’t an option, the hackers changed their tactics and went after a different flaw, this one in Yahoo’s monitoring script.
The servers the hackers invaded were used to provide live streaming video for Yahoo’s sports and news services. Despite the breach, Yahoo has stated that no user data was accessed or stolen.
“At this time we have found no evidence that the attackers compromised any other machines or that any user data was affected. This flaw was specific to a small number of machines and has been fixed,” Yahoo CISO Alex Stamos said in a statement.
What’s the lesson here? Hackers are flexible. They also don’t like doing a lot of work for nothing. Just because they come in with a plan of attack, it doesn’t mean they’re going to stick to it, especially if sticking to it means coming up empty handed. That means a company’s security systems need to be able to adapt to a wide range of different attack strategies – and able to alert the appropriate person at the first sign of something fishy going on.
On top of that, anytime a vulnerability or a weakness makes headlines the way Shellshock has or Heartbleed did, hackers are going to come out of the woodwork to try it out to see what they can get their hands on.
That’s why it’s so important for digital security and IT pros to keep their eyes peeled for smaller liabilities while they’re patching their systems against larger, attention-grabbing threats. The more infamous risks may be the thing that draw hackers in, but they likely won’t turn a blind eye towards a smaller opening if it’s the only access point they can find.
To learn about how Arraya Solutions can help keep your company’s data safe and alert you in case something were to go wrong, please visit www.ArrayaSolutions.com or reach out to your Arraya sales representative today.
