Allphones hacked, staff passwords exposed

By Darren Pauli on Mar 6, 2012 11:05 AM
Filed under Security

Hacker claims access to 703 accounts.

Telco retailer Allphones has become the latest victim of a hack attack which saw hundreds of staff usernames, passwords and the company's administrator logins exposed.

The breach occurred when the company's web administration interface was accessed through a SQL injection attack that targeted the Allphones website. 
 
The affected webpage
The affected webpage
 
CRN sister site SC Magazine Australia informed the Allphones website designer of the breach, including the vulnerable link and a captured HTML page of the admin console.
 
Further vulnerable links were later discovered and shut down, and affected accounts were disabled. 
 
Table names were visible on the administration console which was accessed by the hacker using the Havij SQL injection tool.
 
SC sighted a file that contains a sample of clear text staff usernames and passwords, along with store names, and a string of what appeared to be email addresses and passwords used to access the Allphones 'webclub' customer loyalty program.   
 
The hacker claimed 703 staff credentials were listed, along with 23,077 entries in the Allphones webclub. The sample contained 40 listings and many more duplicate entries. Four adminstrative passwords were also exposed.
 
Allphones has more than 170 locations across Australia, according to its website.
 
The retailer did not respond to request for comment by the time of publication.  
 
Follow us on Facebook and Twitter
 

Copyright © SC Magazine, Australia

Allphones hacked, staff passwords exposed Credit: Allphones Facebook page
 
 
 
 
 
Top Stories
 
10 things we learned this week
Dick's chic Move, how Microsoft Finnish-ed Nokia and more family time for $1.29m.
 
100 Android apps, 150m downloads exposed to Heartbleed
Affected apps include chart toppers in the Google Play store.
 
Sign up to receive CRN email bulletins
   FOLLOW US...
Latest Comments
Polls
Are Chromebooks ready for the enterprise?

CRN Magazine

Issue: 325 | March 2014

CRN Magazine looks in-depth at the emerging issues and developments for the channel, and provides insight, analysis and strategic information to help resellers better run their businesses.