Following Adobe user forum breach, hacker claims he has access to Yahoo servers(thenextweb.com)
thenextweb.com
Following Adobe user forum breach, hacker claims he has access to Yahoo servers
http://thenextweb.com/insider/2012/12/16/following-adobe-user-forum-breach-hacker-claims-he-has-access-to-some-yahoo-servers/?fromcat=all
5 comments
Something doesn't add up here, or at least there's pieces missing:
1) Source code show (presumably the attacker's?) shows MySQL usernames/passwords (as implied by variable names)
2) SQL injection attack screen shows errors in System.Data.SqlClient namespace - this is SQL Server: http://msdn.microsoft.com/en-us/library/system.data.sqlclien...
Might mean nothing. Article says the attacker had access to 12 databases, so maybe it's a mix of different platforms. Still, the 2 screenshots really don't corroborate one another.
1) Source code show (presumably the attacker's?) shows MySQL usernames/passwords (as implied by variable names)
2) SQL injection attack screen shows errors in System.Data.SqlClient namespace - this is SQL Server: http://msdn.microsoft.com/en-us/library/system.data.sqlclien...
Might mean nothing. Article says the attacker had access to 12 databases, so maybe it's a mix of different platforms. Still, the 2 screenshots really don't corroborate one another.
This is not the first time i have heard of people having full access to yahoo servers for a substantial amount of time.
It's reassuring that every company keeps (.*) very seriously.
Also, the apparent SQL injection is on a yahoo.net domain which Yahoo uses for untrusted third-party stuff mostly. The fact that the error seems to be from ASP is further evidence that this is very likely some third-party hosted app that doesn't actually have much to do with Yahoo and likely poses no danger to Yahoo users beyond the ones using this particular third-party service, whatever it is.