Adobe Hacker Says He Used SQL Injection To Grab Database Of 150K User Accounts

http://www.darkreading.com/database-security/167901020/security/attacks-breaches/240134996/adobe-hacker-says-he-used-sql-injection-to-grab-database-of-150-000-user-accounts.html

by wglb • 14 years ago

12 9 14 years ago

darkreading.com

drivebyacct2• 14 years ago

I've never been a fan of the idea that programming be treated like other professional work like Architects or some such where people are held liable for accidents resulting from their work, but at the same time, I'd be very much down for some public shaming of people that implemented unsalted, or even salted, MD5 hashing for password storage.

You should know better or you should know well enough to stay away from security. It's like the people stumbling into a mailing list and asking "How should I write my own password hashing function" alongside more-or-less, "How do I do string comparisons in this language". I let out a whimper as I read that post.

mvkel• 14 years ago

Not only that, it's pretty pathetic to be susceptible to an injection attack anyway.

Though, I suppose it would be easy to find a hacking target based on which services email you your password in plain text if you forget it.

kurrent• 14 years ago

you'd be even hard pressed to find a well upvoted and accepted answer on stackoverflow that suggested to do this type of implementation

billirvine3• 14 years ago

Help me here. With the plethora of similar ill-gotten gains being posted to pastebin, why is it still alive -- and more importantly -- why is there an Adobe ad on their home page?

krapp2• 14 years ago

People do post things besides SQL dumps there. It provides a really convenient and valuable service.

You should be more concerned that Adobe was so easy to hack. Especially considering the existence of Creative Cloud, and its overlap with the Business Catalyst service.

billirvine3• 14 years ago

> It provides a really convenient and valuable service.

(@@) <--- eye-roll emoticon (not often used)

Sure. Just like the "report abuse" link actually does something.

Right now, 4 of the "public pasts" in the sidebar are ill-gotten materials. I realize it's not always that way... but is often enough.

As for the "creative cloud," it's actually more expensive than buying the software.

And yeah, security is really important, but so is using strong passwords on the Interwebz.

malkia• 14 years ago

His name is Johnny Tables!

Adobe Hacker Says He Used SQL Injection To Grab Database Of 150K User Accounts

Related Stories