Racial slurs discovered in leaked Yandex source code

The code excerpts were part of a 44.7 gigabyte tranche of internal company code leaked online earlier this week.

Russian tech giant Yandex apologized on Friday for racial slurs uncovered in the company’s source code. The apology came in response to the discovery of multiple references to the N-word in the company’s code base after it leaked online. “We deeply regret that this word ever appeared in our internal codes,” the Yandex press office told CyberScoop in an email Friday.

A researcher who goes by the name “Wacky Fruit” on Twitter posted screenshots Thursday showing the use of the word in multiple places. “Yandex, R U F*** serious?!,” they tweeted.

According to the Yandex press office, the code in question appears “to be old fragments differing from the current version of the company’s repository and would never have affected any of the company’s services.” The company called the incident a “blatant violation of our corporate ethics” and said it is conducting a review to understand “how this happened” and to take measures to “to ensure this does not happen again.”

A link to the repositories containing Yandex code totaling nearly 50 gigabytes was posted to a popular hacked database forum Thursday. The leaked files date to Feb. 24, 2022 — the day of the Russian invasion of Ukraine — and contain source code for almost all of the company’s major services, but no user data, the researcher Arseniy Shestakov wrote on his personal website Thursday.

Yandex is one of the biggest technology companies in Russia, offering a wide array of services such as search, maps, email, delivery on demand, voice assistance and autonomous vehicles, among other things. “Within country it provide wider range of services than Google,” Shestakov wrote on his blog. “Imagine one company that replace Google, Uber, Amazon, Netflix and Spotify.”

Grigory Bakunov, a former Yandex systems administrator and developer, told Bleeping Computer that the motive of the data leak was political, given that the date on the files and that the person who posted it had apparently not tried to sell it to competitors. Bakunov also said that although the company says the code is not the current version, “it might be up to 90% similar.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• FBI raises alarm over deceptive phishing campaign targeting prominent people

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure