Adobe shutters forum site following breach and data leak
Posted on 15 November 2012.
Adobe has confirmed that the records leaked on Tuesday by an Egyptian hackers were part of a database containing user information and login credentials for Connectusers.com, a forum site for users of its Adobe Connect Web conferencing platform.

The hacker leaked 202 complete records of Adobe employees and 230 of users employed by the US military, government, NASA and a number of educational institutions.

The leaked password have been easily cracked due to the fact that Adobe used the flawed MD5 hashing algorithm to hash them, hasn't salted them and used a single iteration of MD5. The fact that many of them weren't complex enough in the first place only compounded the problem.

The forum site in question has been taken down on Tuesday, and Adobe is in the process of resetting the leaked and compromised passwords, and advising affected users on how to set up a new - and better - password once the forum is back online.

The company has still not shared details on how the breach happened, but claims that other Adobe services - including the Adobe Connect conferencing service itself - were not affected in any way.

UPDATE: It seems that the hacker exploited an SQL injection vulnerability in the server to execute the hack. "Somehow I was able to dump the database in less requests than normal people do," he commented for Dark Reading.






Spotlight

Lessons learned developing Lynis, an open source security auditing tool

Posted on 15 October 2014.  |  Lynis unearths vulnerabilities, configuration errors, and provides tips for system hardening. It is written in shell script, installation is not required and can be performed with a privileged or non-privileged account.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Oct 20th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //