Dark Reading is part of the Informa Tech Division of Informa PLC
This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.
A Romanian hacker who goes by the handle "unu" has struck again: This time, he demonstrated how a SQL injection vulnerability left personal information in the form of passports exposed on an Intel Website.
Unu, who previously exposed SQL injection vulnerabilities in The Wall Street Journal and Kaspersky Lab's Websites, this time focused on an Intel site that runs online registrations for channel partner events. The site, which is currently down, has a message posted that it's offline for maintenance.
An Intel spokesperson says the company has taken down the site and is "investigating the matter."
In his blog post on the Intel site's vulnerability, unu says: "Not only is the website vulnerable to sql injection but it also allows load_file to be executed making it very dangerous because with a little patience, a writable directory can be found and injection a malicious code we get command line access with wich we can do virtualy anything we want with the website: upload phpshells, redirects, INFECT PAGES WITH TROJAN DROPPERS, even deface the whole website."
Unu was able to hack into the front-end Web application and then discovered that server administrators had their passwords stored in clear text, according to the post.
"Intel is Intel, users' personal data is user personal data, so this vulnerability normally should not happen," he says.
Security experts at Praetorian Security Group who analyzed Unu's hack say most alarming about it is a screenshot that appears to show people who registered for an event, along with their passport numbers, birth dates, and credit card types. "Unu acknowledges that he simply is not showing the credit card numbers, expiration dates, and CW/CID codes but they are also in the table," they blogged.
Daniel Kennedy, a partner with Praetorian, says the site had been defaced before by someone else. "So Intel or the supporting vendor has to take a long look at who besides Unu could have been in that database," Kennedy says.
"Intel realistically has to notify everyone who could be affected ... this is passport and credit card data," he says.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio
Recommended Reading:
Latest Comment: It's a technique known as breaking out of the sandbox kids.
Special Report: Computing's New Normal, a Dark Reading PerspectiveThis special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Tweet This
17 Comments
