• News
• New
• Index
• About

Please see this page for a list of accounts that were likely affected.

I woke up this morning to seeing usual SQL errors in my error log. A script that did not have the highest security was discovered by someone and they have been extracting account info.

I must ask everyone to change their password as soon as possible to be safe.

I'll update this as I continue my investigation.

As early as January 27th, an individual began attacking an SQL Injection vulnerable script. Their quires indicate knowledge of the Account Table, and attempts to extract user names, passwords and emails.

The script has been taken offline, the IP banned, and data preserved to examine.

I'll be replaying some of their hacks to confirm if they succeeded in extracting information.

~~~~

The attacks I've investigated from yesterday largely change the page title and returned no results.

The attacks today, they were modifying the SQL query in a way that crashed the page.

As of yet, I am unable to confirm any information was stolen.

It's possible they were stopped in time.

~~~~

Since I have logs of every request they made, I am currently replaying those to find out for sure if they were able to access our data. And if so, what data they were able to take. Will update again after examining 168384 requests.

~~~~

This appears to have been a ＂blind sql injection＂ attack. Using boolean questions, an attacker can extract the contents of a table bit by bit. Literally. They can then reassemble those bits into a copy of the tables contents. Such attacks are quite stealthy, and leave little trace of the data extracted since each request is equivalent to a binary response.

The attacker was first see [27/Jan/2022:15:39:24 +0000]

They extracted information on the database structure followed by a count of the number of members.

They then proceeded to extract the email address and hashed password from our user database.

Given the sequential nature of their attack, it was possible to identify the 442 accounts most likely to have been affected

The attacker was stopped [28/Jan/2022:11:07:46 +0000] and the affected script taken offline.

~~~~

Going forward, here is the plan:

Step 1
Do an audit of all scripts, looking for anything that is vulnerable to SQL Injection, and either take down or patch the script.

Step 2
Encrypt email addresses and apply encryption to password hashes to make the data as useless as possible should it be stolen.

Step 3
More eyes looking out for early warning signs that sql injection is taking place.

--
Rei