Intel Website Hacked With SQL Injection

A Romanian hacker who goes by the handle "unu" has struck again: This time, he demonstrated how a SQL injection vulnerability left personal information in the form of passports exposed on an Intel Website.

Unu, who previously exposed SQL injection vulnerabilities in The Wall Street Journal and Kaspersky Lab's Websites, this time focused on an Intel site that runs online registrations for channel partner events. The site, which is currently down, has a message posted that it's offline for maintenance.

An Intel spokesperson says the company has taken down the site and is "investigating the matter."

In his blog post on the Intel site's vulnerability, unu says: "Not only is the website vulnerable to sql injection but it also allows load_file to be executed making it very dangerous because with a little patience, a writable directory can be found and injection a malicious code we get command line access with wich we can do virtualy anything we want with the website: upload phpshells, redirects, INFECT PAGES WITH TROJAN DROPPERS, even deface the whole website."

Unu was able to hack into the front-end Web application and then discovered that server administrators had their passwords stored in clear text, according to the post.

"Intel is Intel, users' personal data is user personal data, so this vulnerability normally should not happen," he says.

Security experts at Praetorian Security Group who analyzed Unu's hack say most alarming about it is a screenshot that appears to show people who registered for an event, along with their passport numbers, birth dates, and credit card types. "Unu acknowledges that he simply is not showing the credit card numbers, expiration dates, and CW/CID codes but they are also in the table," they blogged.

Daniel Kennedy, a partner with Praetorian, says the site had been defaced before by someone else. "So Intel or the supporting vendor has to take a long look at who besides Unu could have been in that database," Kennedy says.

"Intel realistically has to notify everyone who could be affected ... this is passport and credit card data," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.