After the big scandal regarding usa.kaspersky.com data breach posted for the first time here on hackersblog by our former member “unu”, TinKode, a rising grey-hat pentester, strikes a new domain of this security vendor. Probably we will see a new wave of informations and discussions about this subject via web, and another uber specialist will come and make a crappy security audit that leaves Cross Site Scripting vulnerabilites open.

Here is the original source with delicious details about this intrusion.

http://unu123456.baywords.com/2009/11/23/symantec-exposed-passwordsserials-sql-injection-full-database-access/

http://countermeasures.trendmicro.eu/symantec-hacked-full-disk-and-databse-access/

This  vulnerability was patched but  I don’t know why the screenshots uploaded by TinKode on imageshack were deleted. Maybe TinKode will provide me those screenshots again.

Anyway, the bug was located at http://careers.yahoo.com/eprofiles.php?id=

Just a link http://www.theregister.co.uk/2009/11/12/spears_twitter_hack/

http://unu1234567.baywords.com

TinKode reported to us another sql injection vulnerability in one of Yahoo! subdomains.  From what I saw looking at the screenshots provided by him it’s another blind sql injection but, since we don’t test anymore high risk bugs in another systems without the owners consent, I couldn’t say for sure how much damage can do a possible attacker if this vulnerability is exploited.

This is not the first and probably not the last sql injection vulnerability discovered by a romanian pentester in Yahoo! subdomains. Looking back at our articles we can see that Yahoo! is dealing with a big list of vulns, too many for a huge company with billions of members. We are not here to judge them, but this is a fact: Yahoo! needs a full security audit to prevent those things happen so often.

First time it was a big “wooow” for us to find a sql injection vuln in their domains, but now this is too damn usual. It’s like we are talking about Yahoo! xss’s, everybody can have or discover a piece of that, even a 12 year old kid, with an experience of 6 months in “hacking” bussiness. And this is sad. I can handle with xss attacks, I can protect my ass against them, but it’s impossible to mitigate a sql injection from my user side. This is what worries me right now. But enough with this emo speech.

Yahoo! staff was notified and we are waiting to see the vulnerability fixed before the screenshots will be made public on HackersBlog.

Those two(?) vulnerabilities  are NOT confirmed. Read more about usa.kaspersky.com vulnerabilities here.

Source: http://rstcenter.com/forum/17628-kaspersky.rst

Credit: NeOh

http://sla.ckers.org/forum/read.php?3,5180

Screenshots:

• http://i44.tinypic.com/vnjl10.png
• http://i41.tinypic.com/25j9zle.png
• http://i37.tinypic.com/294t26t.png
• http://i35.tinypic.com/qnpf9y.png
• http://i38.tinypic.com/23r5mw.png
• http://i37.tinypic.com/2rfe92u.png
• http://i35.tinypic.com/a57s5e.png

Author: TinKode a.k.a. cOde.breaker

Video/screenshots source: http://rstcenter.com/forum/17443-nasa-gov-proof.rst