mysql.com hacked, user accounts exposed

MySQL.com was hacked over the weekend and user accounts were exposed and posted on pastebin.com. Believe it or not, the hack used a blind SQL injection exploit.

Romanian "grey hat" hackers got into the back end database and were able to extract "easy to guess" login credentials from the site by comparing password hashes with known dictionary passwords. These login crededtials were then posted publicly here.

This information revealed that MySQL.com had lax security, it even showed that the manager for WordPress at MySQL used a four digit number as his password!

Quote:

---

[2] = Robin Schumacher is MySQL's Director of Product Management and
has over 20 years of database experience in DB2, MySQL, Oracle, SQL
Server and other database engines. Before joining MySQL, Robin was
Vice President of Product Management at Embarcadero Technologies.
-------------------------------------------------------------------
http://blogs.mysql.com/robin/wp-login.php

Email : rschumacher@mysql.com
Username : admin
Password : d1ac549dbfdec4a0d49baec903648bb4
Cracked : 6661

---

Although this grey hat hacking was done to prove a point, it does remind us all that secure passwords and keeping your software up to date are both very important!

Wow. That's some scary stuff. Thanks for the heads up Luke.