Allow me to point out a little bit of irony in this headline , a website for one of the more popular open-source database alternatives gets completely compromised using blind SQL Injection. Ouch.


Someone going by the moniker "Jack haxor" posted this to the Full Disclosure mailing list just a little while ago , giving a nice explanation of what's happened and more importantly where the vulnerable target page is (customers/view/index.html) so others can go and play for themselves.


MySQL has (as of this writing) not issued a statement yet , which probably means they're scrambling to close up and clean up the mess , whatever that mess may be. Did the attacker get into anything more than just the databases behind the website? Maybe we'll know, maybe we won't -but this is at very least very unsettling for the open-source database organization. Hopefully they have clean, check-summed backups, right?



Oh, and if you're interested in seeing the handywork that resulted from this compromise , check out this pastebin.com link , I swear I had nothing to do with that rabbit/hat graphic.



Some take-aways from this one ,

1. Never re-use passwords across too many websites of different security levels
2. Use complex pass-phrases as much as possible so they're harder to crack
3. Back up, then check-sum your backups and keep them off offline in case you need a restore point
4. Hiding the SQL error from an attacker will still get you compromised (blind SQL injection)
5. Check your code , attackers don't sleep, and won't spare you just because you're an open-source, charitable project
6. It can happen to anyone, anywhere at any time

link ---> www3.hp.com/t5/Following-the-White-Rabbit-A/MySQL-WebSite-Hacked-by-Ironically-Blind-SQL-Injection/ba-p/25359">http://h30501.www3.hp.com/t5/Following-the-White-Rabbit-A/MySQL-WebSite-Hacked-by-Ironically-Blind-SQL-Injection/ba-p/25359

Full Disclosure here

--> http://pastebin.com/BayvYdcP
--> http://pastebin.com/7y9LymN3

+) Targets:

www.reman.sun.com
www.ibb.sun.com
www.mysql.com
www.mysql.fr
www.mysql.de
www.mysql.it
www-jp.mysql.com

nawa o!!!

I guess there are no exceptions

ogzille:

nawa o!!!

Na cRious wa. .

WebMonk:

I guess there are no exceptions

No exceptions o0. . .Check http://www.zone-h.org/archive/special=1

this is serious.

obviously these guys dont have "give up" in their books
i get at least 2 attacks daily on one of my age long projects, not a popular website

What happens if it's popular?