Yandex denies hack, blames source code leak on former employee

guest · Jan 26, 2023

By Bill Toulas @billtoulas - January 26, 2023

A Yandex source code repository allegedly stolen by a former employee of the Russian technology company has been leaked as a Torrent on a popular hacking forum.
Click to expand...

Yesterday, the leaker posted a magnet link that they claim are 'Yandex git sources' consisting of 44.7 GB of files stolen from the company in July 2022. These code repositories allegedly contain all of the company's source code besides anti-spam rules.

Software engineer Arseniy Shestakov analyzed the leaked Yandex Git repository and said it contains technical data and code about the following products: [...]
Click to expand...

Shestakov also shared a directory listing of the leaked files on GitHub for those who want to see what source code was stolen.

"There are at least some API keys, but they are likely only been used for testing deployment only," said Shestakov about the leaked data.
In a statement to BleepingComputer, Yandex said their systems were not hacked, and a former employee leaked the source code repository.
Click to expand...

guest · Jan 30, 2023

Massive Yandex code leak reveals Russian search engine’s ranking factors
Details show how the world's fourth-largest search engine ranks webpages.
By Kevin Purdy - January 30, 2023

Nearly 45GB of source code files, allegedly stolen by a former employee, have revealed the underpinnings of Russian tech giant Yandex's many apps and services. It also revealed key ranking factors for Yandex's search engine, the kind almost never revealed in public.
Click to expand...

The "Yandex git sources" were posted as a torrent file on January 25 and show files seemingly taken in July 2022 and dating back to February 2022. Software engineer Arseniy Shestakov claims that he verified with current and former Yandex employees that some archives "for sure contain modern source code for company services." Yandex told security blog BleepingComputer that "Yandex was not hacked" and that the leak came from a former employee. Yandex stated that it did not "see any threat to user data or platform performance."

The files notably date to February 2022, when Russia began a full-scale invasion of Ukraine. A former executive at Yandex told BleepingComputer that the leak was "political" and noted that the former employee had not tried to sell the code to Yandex competitors. Anti-spam code was also not leaked.
Click to expand...

While it's not clear whether there are security or structural implications of Yandex's source code revelation, the leak of 1,922 ranking factors in Yandex's search algorithm is certainly making waves. SEO consultant Martin MacDonald described the hack on Twitter as "probably the most interesting thing to have happened in SEO in years" (as noted by Search Engine Land). In a thread detailing some of the more notable factors, researcher Alex Buraks suggests that "there is a lot of useful information for Google SEO as well."
Click to expand...

You can search and click through all the factors on Rob Ousbey's compiled search tool. You might notice that nearly 1,000 of the ranking factors have the tag "TG_DEPRECATED," and more than 200 are listed as "TG_UNUSED." Because the code is from February 2022 and was grabbed in July 2022, Yandex's search has certainly changed since.
Click to expand...

Log in or Sign up

Yandex denies hack, blames source code leak on former employee

guest Guest

guest Guest

Log in or Sign up

Yandex denies hack, blames source code leak on former employee

guest Guest

guest Guest

Useful Searches