Hacker Grabs 150k Adobe User Accounts Via SQL Injection 64
CowboyRobot writes "Adobe today confirmed that one of its databases has been breached by a hacker and that it had temporarily taken offline the affected Connectusers.com website. The hacker, who also goes by Adam Hima, told Dark Reading that the server he attacked was the Connectusers.com Web server, and that he exploited a SQL injection flaw to execute the attack. 'It was an SQL Injection vulnerability, somehow I was able to dump the database in less requests than normal people do,' he says. Users passwords for the Adobe Connectusers site were stored and hashed with MD5, he says, which made them 'easy to crack' with freely available tools. And Adobe wasn't using WAFs on the servers, he notes. Tal Beery, a security researcher at Imperva, analyzed the data dump in the Connectusers Pastebin post and found that the list appears to be valid and that the hacked database was relatively old."
Obligatory xkcd reference (Score:1, Funny)
MD5?! (Score:2, Funny)
Re:Adobe has bad security practices? (Score:5, Funny)
This is big news! Adobe has long been a dominant vendor in the market for atrocious desktop security; but here they are demonstrating their capacity for 'big data' and 'cloud-centric' server insecurity solutions. Even better, since the breach compromised the security of numerous individuals at third party companies, I'd say that this is a strong play for the lucrative 'managed insecurity' market enabled by the trend toward IT outsourcing...
I, for one, am downright bullish about Adobe's prospects for subtracting value from the software ecosystem in new and exciting markets!
Re:Unforgivable (Score:5, Funny)
SQL injection? what is this, 1993?
.
About right, I think they took security out of the budget in 1992.
Something tells me you will be disappointed... (Score:5, Funny)
http://www.securityweek.com/authors/tal-beery [securityweek.com]
Don't really need daily hacker updates anymore (Score:5, Funny)
Re:Unforgivable (Score:5, Funny)