MySQL.com (the official site for the MySQL database) was compromised via (shocking!) blind SQL injection. A post was sent today to the full disclosure list explaining the issue and dumping part of their internal database structure.
Vulnerable Target : http://mysql.com/customers/view/index.html?id=1170
Host IP : 213.136.52.29
Web Server : Apache/2.2.15 (Fedora)
Powered-by : PHP/5.2.13
Injection Type : MySQL Blind
Current DB : web
It seems their customer view application was used as the entry point. This is where the attackers were able to list the internal databases, tables and password dump. If you have an account on MySQL.com, we recommend changing your passwords ASAP (especially if you like to reuse them across multiple sites).
What is worse is that they also posted the password dump online and some people started to crack it already. Some of the findings are pretty bad, like the password used by MySQL’s Director of Product Management, it is only 4 numbers long. Multiple admin passwords for blogs.mysql.com were also posted.
The folks at MySQL have yet to say anything about this attack, but we will post more details as we learn more about it.
Moe O
Pilar Garcia
Denis Sinegubko
Luke Leal
Allison Bondi
Ben Martin
Rianna MacLeod
Fernando Barbosa
40 comments
Shocked 😎
Irony, thy name is MySQL.
It is amazing how many big names on the web were hacked in recent times:
#google
#comodo
#rsa (emc)
#gawker
#sourceforge
#php
#apache
#tripadvisor
#mysql
Did I miss some?
If someone is smart enough to build it, someone is smart enough to break it.
@ first i thought it was an early 0401 joke but it seems to be real
the bigger the target the more people will want to bring it down just to prove they can. what gets me is that if you wanna break it for personal gain, do it, use what you find. i don’t get the point in posting the passwords from these sites on the interwebs for schmucks who can’t steal it themselves. people need to regain some pride at least. i forget where i heard it, but “keep what you kill” comes to mind.
alert(‘dumb test’);
ACHEIVEMENT UNLOCKED!!!
“What is worse is that they also posted the password dump online and some people started to crack it already.”
For the idiot who written this: You can’t start to extract in 10 min so many things via BSQLi.
If you read his post from: http://tinkode27.baywords.com/mysql-com-fr-it-de-jp-full-disclosure-hacked-by-tinkode-and-ne0h/ you can see that he found this vuln by long time ago, and had access to these accounts. DOH, idiots…
One thing I don’t understand: the dump contains the password hash and (in a few cases) the cracked password. How were they able to crack it from the hash?
I mean, they could’ve found a password what would generate that hash, but they actually found the original key.
I’m guessing they used a rainbow attack. They simply work out the hashing algorithm used, and then proceed to try different passwords. They would usually start with the most common passwords, and then may proceed to try randomly put together passwords. If the hashes match, they’ve got the password.
If this was the attack they used, then either MySQL.com didn’t use salt on their passwords (bad idea) or the hackers got access to the salt.
What the…
http://en.wikipedia.org/wiki/Rainbow_table
http://en.wikipedia.org/wiki/Salt_(cryptography)
my sql projects and my sql online live interactive training at http://bit.ly/wXKHod
Just check it out sql-injection-tutorial…..
http://freaktrickz.wordpress.com/2012/09/27/sql-injection-tutorial-website-hacking/
https://freaktrickz.wordpress.com/
Comments are closed.