למי שלא הספיק לראות לפני שלושה ימים נפרץ HSBC בנק בצרפת על ידי
פעולת SQL INJECTION להלן תיאור הפריצה :
In February 2008, HSBC was named the world’s most valuable banking brand by The Banker magazine. As of April 2, 2008, according to Forbes magazine, HSBC was the fourth largest bank in the world in terms of
assets ($2,348.98 billion), the second largest in terms of sales ($146.50 billion), the largest in terms of market value ($180.81 billion). It was also the most profitable bank in the world with $19.13 billion in net income in 2007.
In Europe HSBC SA operates around 380 branches in France since the takeover of Credit Commercial de France, primarily operating under the HSBC brand. HSBC France is now the HSBC Group’s lead bank in the Eurozone, focusing on certain capital market products for a global audience, and high net worth and international business in France.
HSBC is one of world’s strongest banks by some measures.” … I quote from wikipedia. Hard power, especially as regards security of database, where an ordinary unsecured parameter allows full access to all the bank’s database. Very serious and dangerous, especially with a bank that has internet banking. The server is mssql and the error does not apear in page, like in mysql, so I will print this kind of screens. First we see available databases and some tables from the internet database:
Being mssql server, exploiting the vulnerability, we can access the whole server.In this print screen we can see those partitions and directories:
On the E partition we have the backup,where we can find all internet b. data:
Again important admin accounts passwords are stored in CLEAR TEXT:
Although, I’ve proposed to show everything on my blog and I will not blur print screens, I made an exception this time.I have not published syntax and the vulnerable parameter, as it was not secure and I would be jeopradized more data and more accounts.Probably many innocent people had suffered.What did i do?I had no contact address on website to report problems and i sent an email to webmaster, to admin, abuse and security.I got the answer? NONE, except some messagess automatically generated wich they have announced me as Mr X or Mr Y are gone on vacation !!!
Is unbelievable as a big bank not to find a competent person to answer mail, to ask more, possibly to thank for things reported.We can assume that nobody has read my email, but i see the distinguished gentlemen from HSBC France to visit my blog.Nobody was interested to ask who is the vulnerable parameter. I do not mind me, but the parameter was not secure.This parameter is not secure even now.THE PARAMETER IS NOW VULNERABLE.I wait. I expect to be contacted. I wait untill monday,then I will publish the vulnerable parameter and the syntax.Can so they will move their disgusting ass.And to show that vulnerability is real and not secured, i have never done a print screen today:
