Website flaw exposed a Canadian ISP’s entire customer database

guest · Oct 1, 2018

Website flaw exposed a Canadian ISP’s entire customer database
October 1, 2018
https://techcrunch.com/2018/10/01/altima-telecom-server-flaw-customer-data-exposed/

Canadian internet provider Altima Telecom has fixed a flaw in its website that could have given an attacker full access to its customer database.

The customer database was connected to the company’s website, but could be remotely accessed with a blind SQL injection attack. Daley Borda, founder of Underdog Security, found the bug and reported it to TechCrunch, which we passed on to Altima.

The database contained 427 tables, containing millions of records on customers — including billing data, support tickets, and other user data, according to Borda. Although the researcher could probe the database by entering commands into his browser’s address bar, he said that a malicious attacker could easily dump its contents and download the entire database.

He also found several database columns storing credit card data, including card numbers, expiry dates, security codes, and addresses.
Click to expand...

Log in or Sign up

Website flaw exposed a Canadian ISP’s entire customer database

guest Guest

Log in or Sign up

Website flaw exposed a Canadian ISP’s entire customer database

guest Guest

Useful Searches