Most embarrassingly, the Director of Product Management's WordPress password was set to a four digit number... his ATM PIN perhaps? Several accounts had passwords like "qa". The irony is that they weren't compromised by means of their ridiculously simple passwords, but rather flaws in the implementation of their site.
Sun SQL disclosureMySQL's parent company Sun/Oracle has also been attacked. Both tables and emails were dumped from their databases, but no passwords.
It does not appear to be a vulnerability in the MySQL software, but rather flaws in the implementation of their websites.
I'm not a bad enough dude, but I am an edgy little shit. I'll do what I can.
Sarge
Title: The Self-Titler
Joined: Aug 14 2010
Posts: 598
Posted:
Mar 27 2011 08:31 pm
Isn't MySQL injection one of the first things website security guys are taught to guard against, right after not keeping passwords in HTML source? Nice.
