MySQL.com compromised

MySQL.com (the official site for the MySQL database) was compromised via (shocking!) blind SQL injection. A post was sent today to the full disclosure list explaining the issue and dumping part of their internal database structure.

Vulnerable Target : http://mysql.com/customers/view/index.html?id=1170
Host IP : 213.136.52.29
Web Server : Apache/2.2.15 (Fedora)
Powered-by : PHP/5.2.13
Injection Type : MySQL Blind
Current DB : web


It seems their customer view application was used as the entry point. This is where the attackers were able to list the internal databases, tables and password dump. If you have an account on MySQL.com, we recommend changing your passwords ASAP (especially if you like to reuse them across multiple sites).

What is worse is that they also posted the password dump online and some people started to crack it already. Some of the findings are pretty bad, like the password used by MySQL’s Director of Product Management, it is only 4 numbers long. Multiple admin passwords for blogs.mysql.com were also posted.

The folks at MySQL have yet to say anything about this attack, but we will post more details as we learn more about it.

40 comments
  1. It is amazing how many big names on the web were hacked in recent times:

    #google
    #comodo
    #rsa (emc)
    #gawker
    #sourceforge
    #php
    #apache
    #tripadvisor
    #mysql

    Did I miss some?

  2. the bigger the target the more people will want to bring it down just to prove they can. what gets me is that if you wanna break it for personal gain, do it, use what you find. i don’t get the point in posting the passwords from these sites on the interwebs for schmucks who can’t steal it themselves. people need to regain some pride at least. i forget where i heard it, but “keep what you kill” comes to mind.

  3. One thing I don’t understand: the dump contains the password hash and (in a few cases) the cracked password. How were they able to crack it from the hash?
    I mean, they could’ve found a password what would generate that hash, but they actually found the original key.

    1. I’m guessing they used a rainbow attack. They simply work out the hashing algorithm used, and then proceed to try different passwords. They would usually start with the most common passwords, and then may proceed to try randomly put together passwords. If the hashes match, they’ve got the password.

      If this was the attack they used, then either MySQL.com didn’t use salt on their passwords (bad idea) or the hackers got access to the salt.

Comments are closed.

You May Also Like