Slashdot Mirror
Hacker Grabs 150k Adobe User Accounts Via SQL Injection
CowboyRobot writes "Adobe today confirmed that one of its databases has been breached by a hacker and that it had temporarily taken offline the affected Connectusers.com website. The hacker, who also goes by Adam Hima, told Dark Reading that the server he attacked was the Connectusers.com Web server, and that he exploited a SQL injection flaw to execute the attack. 'It was an SQL Injection vulnerability, somehow I was able to dump the database in less requests than normal people do,' he says. Users passwords for the Adobe Connectusers site were stored and hashed with MD5, he says, which made them 'easy to crack' with freely available tools. And Adobe wasn't using WAFs on the servers, he notes. Tal Beery, a security researcher at Imperva, analyzed the data dump in the Connectusers Pastebin post and found that the list appears to be valid and that the hacked database was relatively old."
Great job, Adam! WTG!
http://it.slashdot.org/comments.pl?sid=3250037&cid=41978225
Management at Adobe needs to get their technical **** together.
A shocking revelation
http://xkcd.com/327/
You'd think they'd use security they had more experience with, like rot-13.
SQL injection? what is this, 1993?
.
The Kruger Dunning explains most post on
although they did a good job verifying the DB I have to wonder why the hacker mentioned this...
Can someone post pics of Tal Berry? She sounds like a hot Israeli computer geek, and I'm sure I won't be disappointed.
Poor network security standards.
A simple Web Application Firewall would have prevented that.
If they can't do something as simple as secure thier own website, thier products are even worse.
http://www.securityweek.com/authors/tal-beery
Mit der Dummheit kämpfen Götter selbst vergebens
Tal Beery, a security researcher at Imperva, analyzed the data dump in the Connectusers Pastebin post and found that the list appears to be valid and that the hacked database was relatively old.
Color me puzzled... How the heck does Mr Beery have the slightest damn clue that the list appears to be valid and that -- even more incredibly -- the database was relatively old? He's hacking it every day?
I keep reading headlines one right after another about security hacks. And I feel like I'm getting warning fatigue*, I cannot comprehend how you IT security people are dealing with it. For me I got some computers that ***never*** connect to internet, and damned if I put critical stuff in The Cloud.
*Warning fatigue: Described in the book, "Breaking The Mishap Chain" http://www.nasa.gov/connect/ebooks/break_mishap_chain_detail.html where authors describe when crews of a B1 flight test kept getting caution warnings that were not urgent so habitually ignored even though one of those warnings was center-of-gravity parameter. Ignoring this warning was serious as it caused aircraft to go out of control when wings were swept and aircraft not balanced.
mfwright@batnet.com
What's a WAF? I found Wife Acceptance Factor but it seems doubtful this is the correct answer given the context!
Adobe is found guilty of wasting billions of their windows customers CPU processes with their "update me now?" tsr...
09 F9 11 02 9D 74 E3 5B - D8 41 56 C5 63 56 88 C0 45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
And shot.
There's really no security team in place at Adobe, is there?
The price is always right if someone else is paying.
A simple once-per-year post reminding us that ALL of our private data has been sucked out of insecure online databases and is being sold on the Russian (or Indonesian or Egyptian or Chinese or Pennsylvanian) black-market should suffice.
If Adobe and its products were put to death, what would replace Photoshop and Illustrator for print work? What vector animation tool would replace Flash CS?
It is pretty scary that many people write their frontends in a technology made by these people. And they think that gives them extra security!
Adobe has crappy security. I've recently had the misfortune of having to work with Flash. I had to send files to the server from the client. Flash had some annoying restriction that you can't send a file to the server unless the user opened a dialog to pick a file. But guess what? It didn't matter because you can still send the files if you use don't use a convenience method. There stupid security measure wasted a half hour of my time. And it does nothing for security because I'm completely new to Flash and I still beat the measure.
Democracy Now! - your daily, uncensored, corporate-free
...I thought they were called "Researchers"
Now I'm all confused.
When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
Strikes again!
Thank goodness I too precautions.
Adobe's level of public irresponsibility is crazy. Every week new vulnerabilities are found in Flash and Reader – more often, and more serious security holes, than in Windows, even though Windows is a whole OS and these programs should be much easier to keep bug-free in comparison. And now we find that they can't even keep their own internal databases safe. Preventing SQL injection really isn't that difficult; there are plenty of websites that tell you what you need to do. Just using parameterized queries will weed out most of the common SQL exploits. How much of Adobe's programming is being conducted now by people who just don't have any fucking idea what they're doing?
There really needs to be a good alternative to Photoshop (no, GIMP doesn't count). Flash needs to be phased out as quickly as possible, and people need to stop using Adobe Reader if at all possible, and try to move away from any Reader-specific PDF "features". Most people who use the full version of Acrobat are wasting their money (it's amazing how many people have it installed just so they can print to PDF, when there are free programs that do the exact same thing just as well).
http://www.md5crack.com/ uses google to find MD5 strings that have been indexed. No algorithm required.