MySQL.com compromised

40 comments

1. Shocked 😎

2. Pingback: Securing SQL Server » Blog Archive » MySQL.com compromised via SQL Injection attack. Someone should have read Chapter 6.

3. Irony, thy name is MySQL.

4. It is amazing how many big names on the web were hacked in recent times:

   #google
   #comodo
   #rsa (emc)
   #gawker
   #sourceforge
   #php
   #apache
   #tripadvisor
   #mysql

   Did I miss some?

5. If someone is smart enough to build it, someone is smart enough to break it.

6. @ first i thought it was an early 0401 joke but it seems to be real

7. Pingback: MySQL.com compromised | Sucuri « aFblog
8. Pingback: MySQL.com compromised by SQL injection | i.justrealized

9. the bigger the target the more people will want to bring it down just to prove they can. what gets me is that if you wanna break it for personal gain, do it, use what you find. i don’t get the point in posting the passwords from these sites on the interwebs for schmucks who can’t steal it themselves. people need to regain some pride at least. i forget where i heard it, but “keep what you kill” comes to mind.

10. Pingback: MySQL.com被SQL注入攻击，用户密码数据被公布 | El4pse>和谐渗透小组-因为理想远大,所以放弃娱乐.

11. alert(‘dumb test’);

12. ACHEIVEMENT UNLOCKED!!!

13. “What is worse is that they also posted the password dump online and some people started to crack it already.”

    For the idiot who written this: You can’t start to extract in 10 min so many things via BSQLi.
    If you read his post from: http://tinkode27.baywords.com/mysql-com-fr-it-de-jp-full-disclosure-hacked-by-tinkode-and-ne0h/ you can see that he found this vuln by long time ago, and had access to these accounts. DOH, idiots…

14. Pingback: SecuriTeam Blogs » mysql.com hacked… via blind sql injection
15. Pingback: Objetivos de ataque: grandes empresas y administraciones públicas « segjsm

16. One thing I don’t understand: the dump contains the password hash and (in a few cases) the cracked password. How were they able to crack it from the hash?
    I mean, they could’ve found a password what would generate that hash, but they actually found the original key.

    1. I’m guessing they used a rainbow attack. They simply work out the hashing algorithm used, and then proceed to try different passwords. They would usually start with the most common passwords, and then may proceed to try randomly put together passwords. If the hashes match, they’ve got the password.

       If this was the attack they used, then either MySQL.com didn’t use salt on their passwords (bad idea) or the hackers got access to the salt.

       1. What the…

          1. http://en.wikipedia.org/wiki/Rainbow_table

             http://en.wikipedia.org/wiki/Salt_(cryptography)

17. Pingback: MySQL Web site falls victim to SQL injection attack | World news
18. Pingback: MySQL.com被SQL注入攻击，用户密码数据被公布，开源界又杯具了！
19. Pingback: MySQL website falls victim to SQL injection attack | World news
20. Pingback: Hackean sitios de Mysql.com con inyección SQL | Ventiao | El mundo cambia, todo cambia, entérate
21. Pingback: MySQL website falls victim to SQL injection attack « news4geeks.net
22. Pingback: MySQL Web site falls victim to SQL injection attack - Internet, networking and IT security news and headlines from around the web. - darkcode 2 IT Security & Network Security – News
23. Pingback: MySQL website falls plant to SQL injection attack |
24. Pingback: Episode 352 – IPv6 DoS, $IPv4, EU, MySQL, Dumpster Diving, BofA & SCADA | InfoSec Daily
25. Pingback: Episode 352 – IPv6 DoS, $IPv4, EU, MySQL, Dumpster Diving, BofA & SCADA » 信息安全播客
26. Pingback: MySQL Web site falls victim to SQL injection attack - Internet, networking and IT security news and headlines from around the web. - darkcode 2 IT Security & Network Security – News
27. Pingback: MySQL.com compromised
28. Pingback: MySQL.com invadido, pasmem, por SQL injection! | 4 Friends Technology
29. Pingback: MySQL.com被SQL注入攻击，用户密码数据被公布 | laura's site
30. Pingback: Blog de 3ld3r » Oracle demuestra sus intenciones sobre Postgres..
31. Pingback: Boot up: Engadget team jumps to SB Nation, and more | Trade Bloggers
32. Pingback: Documentos internos de Oracle y el futuro de PostgreSQL « Conocimiento Libre (o lo que está detrás del Software Libre)
33. Pingback: MySQL.com compromised via blind SQL injection (!) « code2hell
34. Pingback: MySQL Website Falls Victim to SQL Injection Attack | simplesitetutorials.org

35. my sql projects and my sql online live interactive training at http://bit.ly/wXKHod

36. Just check it out sql-injection-tutorial…..
    http://freaktrickz.wordpress.com/2012/09/27/sql-injection-tutorial-website-hacking/

37. https://freaktrickz.wordpress.com/

Comments are closed.