U.S.A Attorney: “The sentence imposed reflects the seriousness of hacking for hire.”
As if business was not already tough enough for Yahoo trying to compete with the giant search engine Google, the company has been bogged down by security concerns. Last year, a 23-year-old Canadian man Karim Baratov went on a serial spear-phishing operation targeting Yahoo employees. Baratov is believed to have successfully compromised at least 500 million accounts.
He was arrested and taken to court, and he pleaded guilty last year. Now a federal judge in San Francisco has slapped him with a five-year prison-time and a $250,000 fine.
U.S. Attorney Alex Tse in a statement wrote:
“The sentence imposed reflects the seriousness of hacking for hire.
Hackers such as Baratov ply their trade without regard for the criminal objectives of the people who hire and pay them. These hackers are not minor players; they are a critical tool used by criminals to obtain and exploit personal information illegally. In sentencing Baratov to five years in prison, the Court sent a clear message to hackers that participating in cyber attacks sponsored by nation states will result in significant consequences.”
In his admission, Baratov said he was paid by the FSB (the Russian internal security service) to hack “webmail accounts of individuals of interest to the FSB.” After getting his target’s user account credentials, he sent them to his alleged co-conspirator, Dmitry Aleksandrovich Dokuchaev.
Baratov alongside other three men were indicted in late February 2017. However, the other three men are still in Russia. It is believed that the four men (and their unnamed accomplices) successfully gained access to Yahoo’s internal networks.
According to the FBI, Alexsey Belan – a co-defendant hacker in this case, who was already on the US’s wanted lists for a series of intrusions into networks of e-commerce sites – is alleged to have conducted a deep reconnaissance of Yahoo’s networks. While at it, Belan is alleged to have discovered to critical assets, the Yahoo’s User Database and an administrative tool, the Account Management Tool.
While the UBD does not necessarily give them everything, they require in accessing individual user accounts. It does give the FSB relevant information that can be used in locating and targeting specific accounts of interest. Additionally, the Account Management Tool can be used to make alterations to specific accounts, such as changing the passwords thus locking genuine users out.