Data breach exposes 5900 Shell customers
by Steve Ragan - Mar 18 2009, 15:00
Interested in a more interactive TTH? Join our Facebook Group
Want regular updates from The Tech Herald? Follow us on Twitter
Talkback
Add your comment (no registration required)
page: 1
What a rediculous and highly speculative conclusion to draw re: the nature of the attack. SQL Injection attacks against a contractor for Shell would be highly unlikely to succeed, unless the contractor was an absolute amateur and had zero knowledge of the most basic attack vectors.
Why not just say you dont know and leave it at that??
@Richard
'...based on past examples of similar attacks, it is a high probability that SQL Injection was used.'
Look at the past examples of how data like this was exposed.
Shell said a 3rd party hosted the data accessed.
Shell confirmed it was an online credit application.
The data accessed had to have been stored in a database, of which the largest platform is SQL.
Those three bits of established fact, plus the knowledge of SQLi and the motives of the criminals who use it, led me to make the comment of probability. However, for all anyone knows the data was stored in a clear text file. Yet, I still say database, as I want to give Shell a little more credit.
Thanks for taking the time to comment.
-Steve
@Steve,
The 3 'established facts' you point to merely suggest a high probability that a database was used to store the information. That's all.
Because you have no other facts, you must therefore guess at the contractor involved, guess at the technologies involved, guess at the motives of those involved and guess as to the nature of the attack. With so much guessing required I fail to see how a high probability of anything can be deduced.
Who is to say the attackers even went through the front door? The mere fact that prior attacks have in many cases, used SQL injection attacks, would in my opinion reduce the likelihood that such an attack would continue to work against a company like Shell. Database and platform vendors have spent considerable time, energy and effort over the last 3 years educating developers on best practices regarding web application development, particularly in the area of SQL Injection attacks.
With a 3rd party contractor involved, and therefore a likely need to cross a Shell to Contractor systems boundary, its just as likely that the attack occurred as the result of some improperly secured end point. In other words, I'd suggest it's more likely to have been some simple operator oversight than it is to be a gaping hole in the applications design.... especially when considering the players involved.
In the end I might be wrong, and you might be right, or we could both be wrong. Either way, considering they are based on an almost total absence of facts, there is nothing 'highly probable' about any of our speculations .
Seriously, I think you two don't have enough work to do!
For some reason i find scotts comment funny. This reminded me of how kaspersky ( a well establish security company ) was hacked via sql injection.
page: 1
Add your comment (no registration required)
Comment on this Story