Allphones hack exposes staff passwords

Powered by SC Magazine
 

Hacker claims 703 accounts listed.

Telecommunications retailer Allphones has had hundreds of staff usernames, passwords and company administrator logins exposed following a hacking attack.

The breach occurred when the company's web administration interface was accessed through a SQL injection attack that targeted the Allphones website. 
 
The affected webpage
The affected webpage
 
SC Magazine Australia informed the Allphones website designer of the breach including the vulnerable link and a captured HTML page of the admin console.
 
Further vulnerable links were later discovered and shut down, and affected accounts were disabled. 
 
Table names were visible on the administration console which was accessed by the hacker using the Havij SQL injection tool.
 
SC sighted a file that contains a sample of clear text staff usernames and passwords, along with store names, and a string of what appeared to be email addresses and passwords used to access the Allphones 'webclub' customer loyalty program.   
 
The hacker claimed 703 staff credentials were listed, along with 23,077 entries in the Allphones webclub. The sample contained 40 listings and many more duplicate entries. Four adminstrative passwords were also exposed.
 
Allphones has more than 170 locations across Australia, according to its website.
 
Allphones has been contacted for comment.

Copyright © SC Magazine, Australia


Allphones hack exposes staff passwords
Credit: Allphones Facebook page
 
 
 
Top Stories
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
The CISO’s dilemma: Do you trust your partner’s partner?
[Blog post] How far down the chain do you check?
 
 
Credit: Allphones Facebook page
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 320

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 125

Vote