Feeds

Kaspersky hacker: Database exposed for days

Security Co. mum on Jedi mind trick

  • alert
  • submit to reddit

Top three mobile application threats

Some 24 hours after a hacker claimed to hack a Kaspersky website and access a database containing proprietary customer information, the security provider issued a terse statement confirming it had experienced a security issue.

"On Saturday, February 7, 2009, a vulnerability was detected on a subsection of the usa.kaspersky.com domain when a hacker attempted an attack on the site," read the statement, which was released Sunday afternoon.

"The site was only vulnerable for a very brief period, and upon detection of the vulnerability we immediately took action to roll back the subsection of the site and the vulnerability was eliminated within 30 minutes of detection. The vulnerability wasn't critical and no data was compromised from the site."

That tells part of the story, but here's the part Kaspersky leaves out. According to an admin named Tocsixu at the site that exposed the breach, the hacker who originally discovered the vulnerability did so days earlier and only went public after getting no response from more discreet communiques with Kaspersky employees.

"I have sent emails to info@kaspersky.com, forum@kaspersky.com, and webmaster@kaspersky.com warning Kasperky [sic] about the problem but I didn't get any response," Unu, the hacker, said in an email. "After some time, still having no response from Kaspersky, I have published the article on hackersblog.org regarding the vulnerability."

Tocsixu also took issue with the characterization that the data wasn't actually compromised or that it wasn't critical.

"This vulnerability could have been critical if it were to be exploited by someone bad intended because several sensitive informations could have been extracted, like usernames, emails, passwords, codes, mysql users & passwords, etc.," Tocsixu told El Reg.

"Indeed, no data was compromised from the site because that is not Unu's (our) intention. No sensitive information from the site was stored, legit Kaspersky users can rest assured."

Kaspersky has repeatedly declined to provide details about the breach, including how long its website was vulnerable or exactly when it closed the vulnerability. It didn't respond to email requesting comment on Tocsixu's claims.

SQL injections are like Jedi mind tricks. With the wave of a hand and a discreetly placed suggestion - in this case SQL database commands buried deep inside a long URL - hackers are able to turn weak-minded websites against themselves. Often, the compromise is fairly innocuous and comes in the form of a simple site defacement. Not so with the SQL injection that visited Kaspersky.

It allowed any Jedi knight who knew the secret passphrase to trick the website into dumping entire tables in its database.

"This was a typical UNION injection attack that enables SELECT statements to be poisoned with information from foreign tables," according to one Reg reader account that was confirmed by Tocsixu.

The reader, who was able to duplicate the attack Unu laid out here, continued:

"Once you find the number of columns in the initial SELECT statement (using ORDER BY injection attacks) you can basically get access to the information_schema database, find out table and column names and then you're home free. Big whoopsie for Kaspersky. This was active the entire day yesterday [Saturday]."

No doubt, it's been a tough week for Kaspersky, and it sure didn't help that many of the company's employees happened to be in Puerto Rico this weekend for a partner conference. But Kaspersky does itself no favors by being so stingy with details of this attack. And as is now clear, hackers bearing proof of the pwnage are more than willing to do the talking. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.