We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Flaw uncovered on Yahoo job site

Vulnerability open to SQL attack

A serious vulnerability that could have exposed customer data was uncovered in Yahoo's job website last week, says Imperva.

According to Israeli security company, which discovered the security hole being discussed on a known criminal forum, the vulnerability was a variant of the standard SQL injection attack known as blind SQLi, and could have revealed customer account details and possibly payment data.

This is theoretically less serious than a straight SQL injection attack because the attacker needs to infer returned information using carefully-crafted SQL queries to the target database, as opposed to simply seeing the results directly.

However, according to Imperva's CTO, Amichai Shulman, this is no longer the hurdle it once might have been.

"Instinctively, one would say that this is not as significant. But there are automated tools that could use it [the returned data] to extract the entire database," he said.

Reported to Yahoo last Thursday morning, the search giant had put in place a fix by the afternoon, which Shulman suggested hinted at the seriousness of the breach.

"They were very responsive. On a previous incident it took ages but this time they were very fast," said Shulman.

It is impossible to say whether data had been harvested from Yahoo, but Shulman suspected that the forum on which the exploit was being discussed was more likely a means of selling the technical elements of the hack on to others who might in turn sell it again.

"SQL injection is a major thorn in the side for the website hosting community. It can be tackled with careful research and high levels of security. Unfortunately, some site operators overlook this simple fact at high risk," said Shulman.

Jobs websites are a major target for criminals because they attract high traffic volumes. Attacks take two routes, either going after the data held in internal databases for its intrinsic value, or just using the sites themselves to host further attacks.

Broadband speed test

PC security advice

See also: Yahoo, Google on China porn list

IDG UK Sites

Sony Xperia Z3+ release date, price and specs: The Xperia Z4 for the UK

IDG UK Sites

Why Intel’s vision of the future is a future I want to live in

IDG UK Sites

10 amazing, creative uses of tech – and the brands behind them

IDG UK Sites

Jony Ive 'semi-retired' into new role: kicked upstairs as Chief Design Officer