![](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2017\/05\/tcdisrupt-ny17-8489.jpg?w=738\")
<\/p>\n<\/p>\n
Being the\u00a0chief information security officer at the company that\u2019s suffered the biggest (known) data breaches in history isn\u2019t the kind of fame most CISOs would be looking for. But it\u2019s Yahoo\u2019s Bob Lord\u2019s bag. His\u00a0LinkedIn<\/a>\u00a0profile\u00a0includes the line: \u201cI lead the Paranoids, the information security team at Yahoo.\u201d<\/p>\n \u201cI think I may have broken a record,\u201d said Lord, during an on stage interview with TechCrunch\u2019s Frederic Lardinois here at TechCrunch Disrupt New York, discussing how many breach notification emails the company\u00a0had to send to users after it uncovered two massive\u00a0hacks.<\/p>\n \u201cHundreds of millions of emails \u2014 I do not know the exact number,\u201d he added.<\/p>\n Last fall<\/a>\u00a0Yahoo revealed that a state-sponsored hack\u00a0had affected at least 500 million accounts, with (as it turned out) the information stolen at least as early as January\u00a02014 and utilized until at least December 2016.<\/p>\n The news of that huge hack\u00a0was topped a few months later when Yahoo also revealed it had suffered an even more massive hack, in August 2013, of more than one billion user accounts. This breach\u00a0was only disclosed last December<\/a>. While Lord joined Yahoo in November 2015.<\/p>\n So how did it feel when Lord\u00a0uncovered\u00a0the first of these massive breaches? Not great, clearly.<\/p>\n More specifically, he\u00a0said it felt a bit like this:<\/p>\n \u201cIf you\u2019re familiar with that effect that Alfred Hitchcock perfected \u2014 where things look like they\u2019re sort of telescoping out. And you can still see everything but you still have this weird parallax going on,\u201d he said. \u201cI remember feeling that when I was putting all of the different pieces together. And that\u2019s not a great feeling.\u201d<\/p>\n This March<\/a> the US Department of Justice announced the indictment of four defendants for the 2014 Yahoo hack \u2014 confirming prior reports of Russian intelligence agency involvement. Yahoo had initially reported that the attack was \u201cstate-sponsored\u201d \u2014 so how had the company\u00a0known that so early on in their investigation of the breach?<\/p>\n \u201cWe have the benefit of having a group within our\u00a0organization, that\u2019s called the Paranoids, that really specializes in tracking APT attackers against our users. And so we actually had world class experts who knew what sort of things to look for and how to chase down leads to try to figure out who was behind these attacks,\u201d said Lord.<\/p>\n Were they paranoid enough, quipped\u00a0Lardinois? \u201cI think if you ask other people in our company they will tell you that the Paranoids earn their reputation every day,\u201d responded Lord. \u201cBut hopefully we\u2019re strategic and we\u2019re good partners \u2014 and not just paranoid delusionals.\u201d<\/p>\n He\u00a0wouldn\u2019t go into technical specifics about how the attackers broke in \u2014 suggesting people read the DoJ indictment \u2014 but said\u00a0they used \u201cnumerous tactics\u201d.<\/p>\n \u201cThere\u2019s a specific set of steps that attackers have to go through, that they must go through in order for them to achieve their goals\u2026 So whatever machine they break into is not the machine that they want 99.9% of the time. So then they have to go move from machine to machine to find the thing that they\u2019re looking for,\u201d he noted.<\/p>\n Given that the attackers got into Yahoo\u2019s systems in 2014, why did it take the company so long to discover the breach?<\/p>\n \u201cThese campaigns can run for an extended period of time,\u201d responded\u00a0Lord. \u201cThese aren\u2019t smash and grab attacks. These are long term plays \u2014 and when you really start to figure that out if you haven\u2019t done that sort of work before it\u2019s a little startling.\u201d<\/p>\n Yahoo\u2019s board also wanted\u00a0answers on that question, he added, noting that it commissioned a study \u201cto try to go back in time and put the pieces together\u201d.<\/p>\n Far fewer details have emerged about the massive 2013 Yahoo hack. Lord\u00a0said\u00a0the problem for that investigation is a lack of evidence because of how much time passed between the intrusion and its\u00a0discovery.<\/p>\n \u201cWe know very little. To date, we\u2019ve turned over as many rocks as we can possibly find, to further than investigation but to date we\u2019ve not been able to find the source of that intrusion, to understand how it happened, to understand who it was. It is likely to stem from the 2014 attack \u2014 but again, there\u2019s not enough information, not enough evidence for us to really say anything more at this point,\u201d he said.<\/p>\n \u201cPart of it has to with with logs and other information that\u2019s acquired\u2026 You really have to find ways to keep logs for a much longer period of time than you would normally do. And in fact if the average time between intrusion and detection is six months, depending on who you listen to, you\u2019re going to need to have to double that in order to account for other factors in your investigations.\u201d<\/p>\n Because of this lack of evidence, Lord said\u00a0Yahoo may \u201cpotentially\u201d never know how the 2013 intrusion happened.<\/p>\n For the 2014 hack, Russian cybercriminals have been accused by the DoJ of working alongside FSB agents. Although one apparently also managed to manipulate Yahoo search results<\/a> for the phrase \u201cerectile dysfunction medications\u201d to\u00a0funnel clicks\u00a0to an online pharmacy\u00a0that paid commissions to traffic-drivers \u2014 in order to make himself some money on the side.<\/p>\n So\u00a0how exactly was the hacker able to manipulate Yahoo search results?<\/p>\n Lord again wasn\u2019t keen to provide too much detail \u2014 reiterating\u00a0the extended campaign of activity the attackers engaged in in order to work through systems to gain access to different credentials.<\/p>\n \u201cAgain, these are long term compromises where they worked hard flying under the radar, they worked hard to get the access that they were specifically tasked with. But it is now clear that in hindsight that these guys could have got actual tech jobs \u2014 they were very good,\u201d he said.<\/p>\n \u201cModifying production systems is hard when you\u2019re trained and under supervision. One would imagine that\u2019s a difficult thing to pull off without detection and to do that for a period of time so you have to say that \u2014 I stay away from the word \u2018sophisticated\u2019 because I think that word is very loaded\u2026 but I think that these were definitely skilled individuals,\u201d he added.<\/p>\n It\u2019s harder for people to say this kind of person is attacking you\u2026 Because now we have more evidence that there\u2019s a spectrum in place.<\/p>\n<\/blockquote>\n<\/div>\n \u201cAnd moving back and forth between their criminal activities and their state-sponsored activities is now part of that conversation that we should be having. And it muddies the water \u2014 because it\u2019s harder for people to say this kind of person is attacking you, this kind of person is attacking you. Because now we have more evidence that there\u2019s a spectrum in place. So I think that makes the conversation much more interesting. But it does muddy the waters a fair amount.\u201d<\/p>\n The reputational damage to Yahoo associated with such massive\u00a0hacks has knocked some $350M off its\u00a0sale price<\/a> (the company is in the process of being acquired by Verizon \u2014 the parent company of TechCrunch\u2019s parent company, AOL). \u201cSecurity professionals are rarely surprised by this kind of thing,\u201d said Lord, when asked what it was like going to Verizon with details about the breaches.<\/p>\n \u201cIf you\u2019ve been in this business for more than a few years you\u2019ve had your skirmishes, so I think the question is always really can you get enough of a root cause analysis to remediate? Can you demonstrate that there are any improvements in place and that the attackers are out of the network?\u201d<\/p>\n If all these illegal hacks weren\u2019t\u00a0enough to damage\u00a0Yahoo on the user trust front, a report last fall<\/a>\u00a0revealed it\u00a0had\u00a0developed a custom program for US intelligence agencies to scan all users\u2019 incoming emails for specific queries. CEO Marissa Mayer reportedly did not believe Yahoo would win a legal challenge against the demand to develop the custom program and therefore chose not to fight it.<\/p>\n Asked about the security culture under Mayer, Lord said in his experience at least there was never an issue being given adequate resources. \u201cFor me the culture was vibrant,\u201d he said.<\/p>\n \u201cWhat matters is how the business thinks about security from a strategic standpoint, and how people are engaged in their daily activities,\u201d he\u00a0added, telescoping out to discuss\u00a0security generally. \u201cSo if you think the security team can go off in a corner and secure everything you\u2019re wrong \u2014 it has to be a company wide initiative across all the different layers to be able to be effective.\u201d<\/p>\n So is Lord\u00a0sure\u00a0there\u2019s no hackers inside Yahoo\u2019s system now, asked Lardinois? \u201cYou\u2019re asking me to prove a negative,\u201d he objected. \u201cIt\u2019s hard to prove a negative.\u201d<\/p>\n But, on the balance of a \u201cpreponderance of circumstantial evidence\u201d, he suggested similar\u00a0types of attacks have been mitigated\u00a0\u2014 on account of the programs Yahoo now has in place to reduce the chance\u00a0of an exploit.<\/p>\n \u201cCertainly the specific techniques are technically not possibly today,\u201d he added.<\/p>\n","protected":false},"excerpt":{"rendered":"\n\n
![\"\"](\"https:\/\/tctechcrunch2011.files.wordpress.com\/2017\/05\/tcdisrupt-ny17-8489.jpg?w=680\")
Being the chief information security officer at the company that’s suffered the biggest (known) data breaches in history isn’t the kind of fame most CISOs would be looking for. But it’s Yahoo’s Bob Lord’s bag. His LinkedIn profile includes the line: “I lead the Paranoids, the information security team at Yahoo.” Read More<\/a><\/p>\n\n<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>
<\/img><\/a>\n<\/div>\n
<\/p>\n","protected":false},"author":5817,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[25],"tags":[59,66,26],"class_list":["post-340980","post","type-post","status-publish","format-standard","hentry","category-technology","tag-media","tag-techcrunch","tag-technology"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/users\/5817"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/comments?post=340980"}],"version-history":[{"count":0,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/posts\/340980\/revisions"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/media?parent=340980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/categories?post=340980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/asmawisham\/wp-json\/wp\/v2\/tags?post=340980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}