Pizza Lovers Suffer Data Breach From Hell 164
Posted
by
samzenpus
from the hell-of-a-breach dept.
from the hell-of-a-breach dept.
netbuzz writes "Some 230,000 New Zealanders have been informed that their personal information has apparently fallen into the hands of hackers who compromised the network of a locally famous food chain, Hell Pizza. The company says it suspects 'a rogue employee,' but one security expert says Hell's ordering portal is 'about 50 steps of fail.' Several New Zealand celebrities are among the victims and at least one is taking the matter in stride, musing: 'My Twitter has been hacked, my Facebook has been hacked and I'm pretty sure half of New Zealand has my phone number already. I have nothing bad to say about Hell.'"
Re:SQL Injection (Score:5, Interesting)
"I'd like to order a large, thin crust, double cheese, pepperoni and drop table..."
No clear the table before you place your order so your pizza gets the priority it deserves.
Hell Pizza is Awesome! (Score:4, Interesting)
It's actually brilliant pizza -- easily the best pie I've ever had outside of the USA (or Italy). Inventive topping combinations and skillfully made. I wish they'd open a franchise here in California.
Re:Risky.Biz Explaination (Score:3, Interesting)
Risky.Biz
... The Flash client makes queries which are hard-coded in the .swf (this is dumb as it means SQL Injection is effectively a 'feature' of the store).
Their webdesign company is called "Inject Design Ltd.". Go figure ...
You could easily alter the query string to show the hashes stored in the MySQL users table. I figured out the version of MySQL was 4.0 (Debian Sarge) - and the hashes in this version are very weak, cracking them would take less than a couple of hours.
I'm unsure what hashes he is talking about here. Password hashes? What was the weak hash algorithm?
What I don't understand... (Score:4, Interesting)
Any shop that tries to get that kind of information out of me gets a flat refusal. Likewise, any venue that tries to take my fingerprints or iris scan.
Re:Security audits? (Score:3, Interesting)
I wouldn't be surprised if they just had IT security audits done by KPMG and Ernst & Young while the data was being pulled out by the truckload through a gaping hole, just like the Latvian banks...