|
The Web Hacking Incidents Database
Last update:07 November 2007
List of incidents for 2005
Other years: 1999, 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007
There are 62 incidents for 2005
Date: 31 December 2005
Incident Type: Security Breach
WASC Threat Classification:
While lacking in technical details, this story is certainly juicy. It demonstrates well the business use of web site hacking. The downside is that the hacker got only a minimal punishment, which unless the incident itself is overrated in the media, is a very bad sign on how courts view computer crime.
References:
Date: 27 December 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Unknown
Web site used to file online for housing at KU was shutdown for lack of proper security measures to prevent visitors from viewing personal information about others
References:
Date: 24 December 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction, Insufficient Authentication
Janus mutual fund uses predictable identifier to authenticate its share holders enabling them to vote for others.
References:
Date: 22 December 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
An attacker can send an e-mail with a malicious script to a victim which is perform its actions immediately when the e-mail is read.
References:
Date: 21 December 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
User data stolen from an online game web site. The hacker tried to extort RPG by threatening to publish the users' data. The news item states that the hack was a result of a flaw in custom web site software.
References:
Date: 21 December 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
A redirection to an error page on Google.com includes values sent by the the user. This vulnerability allows phishers to send an e-mail with links to Google that will include their attack page.
References:
Date: 18 December 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
A malicious site can offer users a malformed RSS XML file to be included Yahoo RSS aggregation that would enable stealing Yahoo cookies
References:
Date: 14 December 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
Netcraft discovered an XSS vulnerability in NIST web site, which ironically hosts the U.S. National Vulnerability Database.
References:
Date: 09 December 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
A UK Church charity web site was hacked and at least 3000 credit card numbers where stolen. Credit card information is known to have been used by the hackers. While no specific details are given, the article indicates that the way site was hacked.
References:
Date: 05 December 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Abuse of Functionality, Cross-site Scripting
An XSS when receiving notification of an incoming IM message. Additionally it is possible to send an IM message to somebody who has blocked such messages by pretending to be answering a message from him.
References:
Date: 23 November 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
Inserting code in an HTML attachments enables changing the user interface of Yahoo mail, which may enable fraud.
References:
Date: 21 November 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
XSS in Google Base search function
References:
Date: 07 November 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization
References:
Date: 02 November 2005
Incident Type: Security Breach
WASC Threat Classification: Insufficient Authorization
Business wire allowed access to non published press releases.
References:
Date: 01 November 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
A high school student used SQL injection to break into the site of a Taiwanese information security magazine from the Tech Target group and steal customer's information.
References:
Date: 01 November 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
3,800 customer credit-card numbers were stolen in the attack on Guidance Software web site. This incident is made more severe since Guidance software is a provider of software for investigating security breaches and many of its clients are security and law enforcement agencies, some of them known to be affected.
As usual in such cases the actual way in which the information was stolen was not disclosed. A federal trade commission report on the incident, published only in 2007, revealed that the incident was a result on an SQL injection attack on Guidance servers. In a settlement with the FTC, Guidance agreed to implement a comprehensive information security program, including independent, third-party audits every other year for the next ten years.
References:
Date: 28 October 2005
Incident Type: Security Breach
WASC Threat Classification: Insufficient Authorization, Other
Configuration mistake left an unprotected unused virtual host. No details on the configuration problems given.
References:
Date: 21 October 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
XSS in Yahoo mail, Allows phishing
References:
Date: 21 October 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authentication
The software has a default password for teachers, enabling anyone to access the system with teachers privileges.
References:
Date: 18 October 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction
A bug in Gmail's authentication and session management allows direct login to anybodies account without requiring any involvement of the victim.
References:
Date: 10 October 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting, Other
References:
Date: 04 October 2005
Incident Type: Security Breach
WASC Threat Classification: Other
Script upload due to a scoop known vulnerability
References:
Date: 04 October 2005
Incident Type: Security Breach
WASC Threat Classification: OS Commanding
Exploited unpatched Twiki
References:
Date: 08 September 2005
Incident Type: Security Breach
WASC Threat Classification: Denial of Service, Unknown
Teen convicted of threatening an ISP with DOS attack, among other computer hacking activities
References:
Date: 07 September 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
A 12 years old guess login information of a woman and abused her account, stealing game items from her.
References:
Date: 29 August 2005
Incident Type: Security Breach
WASC Threat Classification: Abuse of Functionality
A player of an online game discovered that considerable delay hinted on the cards the dealer holds.
References:
Date: 21 August 2005
Incident Type: Security Breach
WASC Threat Classification: OS Commanding
Sites where defaced by utilizing an issue in an XMLRPC library used by PHP
References:
Date: 18 August 2005
Incident Type: Security Breach
WASC Threat Classification: Insufficient Authentication
References:
Date: 12 August 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction, Insufficient Authentication
A web site flaw could have allowed a user to view another subscriber's balance of remaining airtime minutes and the number of minutes that customer had used in the current billing cycle
References:
Date: 03 August 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Weak Password Recovery Validation
Weak password recovery procedure at Citrix
References:
Date: 01 August 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
References:
Date: 31 July 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
Official answer from Blogger. "This was not the result of a hack attempt but of a subtle bug that occurred because our Developer's Network blog is a special case [it's got two names, 'code.blogger.com' and 'code.blogspot.com'].
References:
Date: 30 July 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction, Insufficient Authentication
While not strictly web security, this discussion of hotel rooms TV application security is a very good example of the dangers of our networked society
References:
Date: 29 July 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
A bug in an eBay site allowed Phishers to redirect users to their own servers after feeling details at the genuine eBay site
References:
Date: 29 July 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
References:
Date: 28 July 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Path Traversal
References:
Date: 26 July 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
A man hacked into a competing web site
References:
Date: 15 July 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
References:
Date: 07 July 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
The hacker who penetrated Kakaku.com was arrested after breaking into Club Tourism International Inc. Hacking was done in order to earn money to pay for tuition.
References:
Date: 06 July 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
Microsoft UK site defaced due to server misconfiguration
References:
Date: 05 July 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization, OS Commanding, SQL Injection
A person who discovered an SQL injection vulnerability in a USC system and informed security focus about the flaw was criminally charged with breaking into the system.
References:
Date: 01 July 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Known Vulnerabity
An audit of a major Environmental Protection Agency contract management system uncovered significant security lapses that, if exploited by hackers, could have serious consequences for the agency's operations, assets and personnel. The audit focused on lack of monitoring for known vulnerabilities on these systems.
References:
Date: 27 June 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction
References:
Date: 05 June 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
References:
Date: 04 June 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
References:
Date: 03 June 2005
Incident Type: Security Breach
WASC Threat Classification: Unknown
The web site was modified to include password stealing code
References:
Date: 27 May 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authorization
Files containing sensitive information left unprotected on the web server
References:
Date: 25 May 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
References:
Date: 18 May 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
References:
Date: 05 May 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Insufficient Authentication
Extranet system accessible to the public
References:
Date: 03 May 2005
Incident Type: Security Breach
WASC Threat Classification: SQL Injection
This incredible story from our friends at Zone-H shed light on one of those defacement attacks, which usually go unexplained. This time an infamous Saudi-Arabian hacker abused SQL injection vulnerability in Internet Explorer Administration Kit web site. And guess what type of SQL injection: A login form SQL injection!
References:
Date: 10 April 2005
Incident Type: Security Breach
WASC Threat Classification: Cross-site Scripting, Worm
The Samy worm at my space is now a classic, both a sophisticated attack and a well documented one, it became a case study in the web application security field. Recently Robert Hansen (RSnake) wrote a very interesting blog entry about Samy and what happened to him since.
References:
Date: 10 March 2005
Incident Type: Security Breach
WASC Threat Classification: Insufficient Authorization
References:
Date: 08 March 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Unknown
An undisclosed application security issue on Cisco web site required resetting passwords for all registered users.
References:
Date: 03 March 2005
Incident Type: Security Breach
WASC Threat Classification: Content Spoofing, Cross-site Scripting
References:
Date: 02 March 2005
Incident Type: Security Breach
WASC Threat Classification: Credential/Session Prediction
Parameter tampering to jump into someone else's account data
References:
Date: 23 February 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Credential/Session Prediction
Parameter tampering enabled jumping into someone else's account data on PayMaxx Inc. site
References:
Date: 22 February 2005
Incident Type: Security Breach
WASC Threat Classification: Insufficient Authentication, OS Commanding, Weak Password Recovery Validation
Details remain sketchy, but news reports include social engineering, a guessable secret question for password recovery, and a known vulnerability is BEA WebLogic
References:
Date: 16 February 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
An Israeli public debates site called Hyde Park has an XSS vulnerability that exposes session cookies.
References:
Date: 01 February 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Directory Indexing, Information Leakage, Insufficient Authentication
Multiple misconfiguration problems such as browsable directories, physical path revealing and default or weak passwords
References:
Date: 14 January 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Cross-site Scripting
An XSS was found in Froogle
References:
Date: 12 January 2005
Incident Type: Vulnerability Disclosure
WASC Threat Classification: Unknown
Parameter tampering enabled exposing sensitive information in G-Mail
References:
This work is licensed under the Creative Commons Attribution License. To view a copy of this license, visit http://creativecommons.org/licenses/by/2.5/ or send a letter to Creative Commons, 559 Nathan Abbott Way, Stanford, California 94305, USA.
|
