Sponsored By

In Ironic Twist, MySQL's Own Database Is Hacked Via SQL Injection

Open-source database company's customer names, passwords revealed following database attack

Hackers have posted an email to the Full-Disclosure mailing list that describes the breach of numerous MySQL websites, along with information from MySQL's database, including usernames and passwords.

Details on vulnerabilities in the websites of Sun Microsystems, MySQL's parent company, were also released by the same group of hackers.

MySQL, which offers open-source database software and services for enterprises, is a leading provider of tools for small and midsize businesses. In an ironic twist, the attackers used a database-borne tactic -- SQL injection -- to reveal elements of the database company's own database of users and employees, including email addresses and passwords.

The SQL injection attack was initially found by "TinKode" and "Ne0h" of Slacker.Ro, according to a posting of some of the stolen data on pastebin.com. The data was subsequently published by "Jackh4x0r."

Among the published data are tables with customer and partner information as well as internal network details. Hashes from the database -- some already broken -- also were posted.

"It does not appear to be a vulnerability in the MySQL software, but rather flaws in the implementation of their websites," said Chester Wisniewski, senior security adviser at Sophos, in a blog about the breach.

A posting on XSSed.com also gives details on a cross-site scripting (XSS) vulnerability affecting MySQL.com since early January that reportedly still has not been repaired.

Have a comment on this story? Please click "Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author(s)

Tim Wilson, Editor in Chief, Dark Reading

Contributor

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one of the top cyber security journalists in the US in voting among his peers, conducted by the SANS Institute. In 2011 he was named one of the 50 Most Powerful Voices in Security by SYS-CON Media.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights