Telco denies cracker SQLi raid

A US telco and TV service provider has denied claims a hacker group used a SQL injection attack to steal usernames and passwords and subsequently applied the logins to raid US$100,000 from bank accounts.

A spokesman for Sebastian said it found no evidence of attack. 

The hacker group claimed to have harvested plaintext credentials held by the company and created a 20-minute video it said chronicled the attack.

The attacker appeared to access Gmail accounts and bank accounts contained in PayPal.

Attackers then emptied Citibank accounts and set up illegal fund transfers.

The video was plausible but hacking crews were notorious for fabricating attacks.

SQL injection typically involves an attacker inputting SQL statements into an entry field that will force the system to execute potentially malicious commands.

A successful SQL injection exploit can read sensitive data from a database, modify that data, execute administration operations on a database or, in some cases, issue commands to an operating system, according to the Open Web Application Security Project (OWASP).

In July, cyber crooks were charged with hacking more than a dozen companies and using SQL injection to steal 160 million card numbers, causing hundreds of millions of dollars in financial losses.

This article originally appeared at scmagazineus.com