We recently heard that a massive leak of Yahoo passwords has been floating on the interwebs for a few days. According to Ars Technica, the dump is from Yahoo Voice and the data was released in clear-text (yes, clear text in 2012). It seems they were not storing the passwords securely.
We got access to the dump and we can confirm that this leak is valid. We can not however confirm it is from Yahoo, the password analysis does not have many “Yahoo’s” in it (we’ll explain later).
That said, we recommend all Yahoo users to change their passwords ASAP! Specially on other services that you are reusing the same passwords. Better safe than sorry.
*You can check here if your account was part of the leak: http://labs.sucuri.net/?yahooleak
Yahoo Leak Analysis – Overview
The link contains passwords for 453,411 Yahoo Voice accounts, from which 342,481 are unique.
Unique accounts: 453,411
Unique passwords: 342,481
The accounts are from multiple email providers, including Yahoo, Gmail, Hotmail and others. This is the list of where most accounts were:
There are also passwords from multiple .GOV and .MIL addresses, which can be very dangerous if their users were reusing passwords:
[number of accounts] [domain]
Leak Analysis – Password Analysis
A lot of users were using weak passwords, with “123456” and “password”, being the most common. Those were the top used passwords:
[number of accounts] [password]
Yes, it is a sad day when you see users using “password” and “123456” as their account passwords.
The size distribution is interesting, with 26% of the accounts using a password with 7 characters in size.
1 Character: 116 accounts
2 Characters: 69 accounts
3 Characters: 301 accounts
4 Characters: 2747 accounts
5 Characters: 5322 accounts
6 Characters: 65,600 accounts
7 Characters: 119,125 accounts
8 characters: 65,957 accounts
9 characters: 54,755 accounts
10 characters: 21,218 accounts
11 characters: 21,729 accounts
12 characters: 2,656 accounts
I can’t see why Yahoo would allow passwords so small (with 1 or 2 characters), but some people were using them. The longest password in the dump had 30 characters and only 294 accounts had a password with more than 20 characters.
What is interesting is that only 104 accounts had “yahoo” as part of the password. That’s strange, since we would expect this number to be a lot higher on a Yahoo leak:
[number of accounts] [password]
Because of that we can’t confirm the dump is indeed from Yahoo, but interesting nonetheless. We will post more details when we have them.
If you have more info, please email us so we can update – email@example.com
Actually, the leak is of Yahoo! Voices, formerly Associated Content and of the Yahoo! Contributor Network. None of us have been officially notified as of yet by Yahoo staff.
As Virtual Copy notes in these comments, Yahoo Voices / the Yahoo Contributor Network, from which the leak came, had acquired Associated Content, a user-contributed-articles site similar to eHow.com. That might explain why 101 passwords were the word “associated” (and perhaps why 164 were “writer”), and might also explain why so few have the word “yahoo” in them.
I submitted several articles to Associated Content and I looked at the list and found my old email and a currently still used password (since changed!). When Yahoo acquired Associated Content, I don’t remember being clearly notified–just couldn’t find the site anymore. Now I see that I am a “contributor” but that I have no articles listed. However, my articles are still online and I can find them with a search. I regret all of it-what a hassle.
I signed up many years ago to AC and did several articles, some of which were picked up by larger media. I should have known something was up when i began to no longer get payments for views. It took hours to get my account back under my control…and i am SO furious today to get at least four emails giving me advice on how to keep my accounts secure…LOL!
The Freaking IRONY.
Ya know we would not even BE in this position if YAHOO had followed its own B.S. advice!
How dare they contact me and give me a lecture about password security when my account had an ENORMOUS, very extremely specialized password.(20+ characters)..which i can now no longer used because of those ridiculous D-Bags.
I feel like this is the bosco episode of Seinfeld…and the joke is all on us.
If there was a way i could delete those “contributions” and my account from AC right now. I would F do it without hesitation. I am so flipping hot right now.
This is exactly why Yahoo is in the toilet. May the Gods give us mercy enough to see the day when the shit finally gets flushed.
firstname.lastname@example.org already hacked but but your result show good. How its possible? Check just for fun or not?
my acct was hacked too but it says on ur verification that my acct is good .. any explanation on this?
How do you know your account was hacked? All of my email addys showed up as good, but now I’m wondering.
if your looking at removing malware and spyware also then stopzilla is a
Comments are closed.