4 ms·
So what you're saying is not only did he access the database without authorization, he also exfiltrated their customers' data and processed that? Yeah, my symp
by hnbad 3y ago
So what you're saying is not only did he access the database without authorization, he also exfiltrated their customers' data and processed that?
Yeah, my sympathies just evaporated. He crossed a line when he used the credentials he didn't have legitimate access to. But then he kept running. At that point how he exactly gained access to the credentials is almost irrelevant.
- nikeee 3y ago> he also exfiltrated their customers' data and processed that? AFAIK he did not mention if he created the hashes using the DB or locally. I suspect that he used a built-in function of MySQL to hash the data on the server.
- hnbad 3y agoOkay, then he only exfiltrated the hashes. Hashing on the server still constitutes processing though.
- nikeee 3y agoWell yes, but it was done with the intention to provide the ability to the end users to check if they are affected. The original vendor may not be trusted in providing accurate information about that. At least there is some reason to believe that.