5 ms·
I'm not sure whether it's that easy. AFAIK he had a customer that wanted him to investigate why the customer's system was flooded with some data. He ran the con
by nikeee 3y ago
I'm not sure whether it's that easy. AFAIK he had a customer that wanted him to investigate why the customer's system was flooded with some data. He ran the connector to some other service that the data seemingly originated from and observed a connection being opened to a remote MySQL server in plain text in his firewall.
He took a look at this and saw that the credentials used were equal across all tenants of the MySQL DB. So it wasn't just his' customer's data that was exposed, it was the data of all tenants.
AFAIK he then created some hashes of user data and exported this, so he could report this to the authorities and give users the ability to check whether they were listed in the system that had to be considered compromised. The DB exposed data of around 700k end users. He also contacted the company that runs that DB about this issue.
The vendor of that connector then issued a new client that used TLS, which he also circumvented to show that the issue is still valid.
He is also accused of decompiling the client software to obtain the password. IIRC, he instead claimed to just have opened the file in notepad.
- hnbad 3y agoSo what you're saying is not only did he access the database without authorization, he also exfiltrated their customers' data and processed that? Yeah, my sympathies just evaporated. He crossed a line when he used the credentials he didn't have legitimate access to. But then he kept running. At that point how he exactly gained access to the credentials is almost irrelevant.
- nikeee 3y ago> he also exfiltrated their customers' data and processed that? AFAIK he did not mention if he created the hashes using the DB or locally. I suspect that he used a built-in function of MySQL to hash the data on the server.
- hnbad 3y agoOkay, then he only exfiltrated the hashes. Hashing on the server still constitutes processing though.
- nikeee 3y agoWell yes, but it was done with the intention to provide the ability to the end users to check if they are affected. The original vendor may not be trusted in providing accurate information about that. At least there is some reason to believe that.