In Ironic Twist, MySQL's Own Database Is Hacked Via SQL Injection
Open-source database company's customer names, passwords revealed following database attack
Hackers have posted an email to the Full-Disclosure mailing list that describes the breach of numerous MySQL websites, along with information from MySQL's database, including usernames and passwords.
Details on vulnerabilities in the websites of Sun Microsystems, MySQL's parent company, were also released by the same group of hackers.
MySQL, which offers open-source database software and services for enterprises, is a leading provider of tools for small and midsize businesses. In an ironic twist, the attackers used a database-borne tactic -- SQL injection -- to reveal elements of the database company's own database of users and employees, including email addresses and passwords.
The SQL injection attack was initially found by "TinKode" and "Ne0h" of Slacker.Ro, according to a posting of some of the stolen data on pastebin.com. The data was subsequently published by "Jackh4x0r."
Among the published data are tables with customer and partner information as well as internal network details. Hashes from the database -- some already broken -- also were posted.
"It does not appear to be a vulnerability in the MySQL software, but rather flaws in the implementation of their websites," said Chester Wisniewski, senior security adviser at Sophos, in a blog about the breach.
A posting on XSSed.com also gives details on a cross-site scripting (XSS) vulnerability affecting MySQL.com since early January that reportedly still has not been repaired.
Have a comment on this story? Please click "Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
You May Also Like
Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024Why Effective Asset Management is Critical to Enterprise Cybersecurity
May 21, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024