We kept on hold the publication of the vulnerable parameter which would allow full access in ALL the databases of the main server, waiting for the issue to be solved. Today, all the vulnerable pages have been taken offline for maintenance and security testing and thus, we will continue with the full disclosure.

Because this was a blind Sql Injection, I cannot show you the results of the injection from the web page. I made two screenshots, showing that the parameter is vulnerable. In the first pic you can see that if you are using AND+1 = 1, which is always true, the entire content is displayed:

In the second pic were we use AND+1=2, which is always false, the page does not load.

Now, lets see which databases did we gain access to:

available databases [37]:
[*] BT
[*] BT_Argos
[*] BT_BB_Anywhere
[*] BT_BBAndLine
[*] BT_BroadbandOpenzone
[*] BT_Bundling
[*] BT_CallMeArgos
[*] BT_CallSave
[*] BT_CallSaveStaff
[*] BT_comparebroadband
[*] BT_dabsCallback
[*] BT_DigitalVaultPlus
[*] BT_DisneyComp
[*] BT_HomeITCall
[*] BT_HomeITInstall
[*] BT_ITCalculator
[*] BT_Main
[*] BT_MobilePicker_Flexible
[*] BT_NetProtectOrder
[*] BT_ppc
[*] BT_PrinceCaspian
[*] BT_recontracting
[*] BT_RecontractingGenZ
[*] BT_SecureAdmin
[*] BT_SimOffer
[*] BT_Tactical_oneclick
[*] BT_TellAFriend
[*] BT_Tinkerbell
[*] BT_TotalBroadband
[*] BT_VisionOrderJourney
[*] BTM00585
[*] Crayon_Utility
[*] master
[*] MobilePortal
[*] model
[*] msdb
[*] tempdb

First database “BT” is the most interesting one. Nonetheless, the others also yeld a wealth of important data about the users: personal data, passwords, etc.

The user and [censored for security reasons] can be easily extracted. They contain login data for different data bases (default_censored for security reasons). You can extract name and passwords for sysusers just as well. They give us direct access to the server.

Database: m*****
Table: s*****
[18 columns]
+————-+———–+
| Column | Type |
+————-+———–+
(Content removed for security reasons)

This blind SQL Injection grants us way more access to larger parts of the databases then the one used to find the previous vulnerability in BT.com. Using this vulnerability an attacker can access personal data of the users.

Dont rush to conclusions and start pointing figers before you see the next articles where we will show similar issues with other large telecommunication providers. As we said earlier, we dont take sides, but rather, want to show that the above mentioned vulns cand be found almost everywhere.

We would like to thank BT.com for the fair-play and manners they displayed in addressing this issue in the email we got from them.

We appreciate and support the mature and to the point attitude they have. It is very important for us.

————-

RO Version:

Am asteptat publicarea parametrului vulnerabil, care permitea full acces in TOATE bazele de date ale serverului principal, pana cei in cauza rezolva problema. Azi au fost trecute pe “offline” toate paginile vulnerabile pentru a se efectua testele de securitate si noi putem continua articolul precedent.

Fiind vorba de un blind sql injection nu va pot arata in imagini rezultatele injectiei din pagina web. Am facut doar doua screenshot-uri, din care reiese clar ca parametrul este vulnerabil. In prima poza se vede cum impunand conditia de baza AND+1=1, care este mereu adevarata, se incarca tot content-ul:

Iar in poza 2-a unde impunem conditia AND+1=2, care este totdeauna falsa, nu se incarca pagina.

Acum sa vedem la ce baze de date avem acces:

available databases [37]:
[*] BT
[*] BT_Argos
[*] BT_BB_Anywhere
[*] BT_BBAndLine
[*] BT_BroadbandOpenzone
[*] BT_Bundling
[*] BT_CallMeArgos
[*] BT_CallSave
[*] BT_CallSaveStaff
[*] BT_comparebroadband
[*] BT_dabsCallback
[*] BT_DigitalVaultPlus
[*] BT_DisneyComp
[*] BT_HomeITCall
[*] BT_HomeITInstall
[*] BT_ITCalculator
[*] BT_Main
[*] BT_MobilePicker_Flexible
[*] BT_NetProtectOrder
[*] BT_ppc
[*] BT_PrinceCaspian
[*] BT_recontracting
[*] BT_RecontractingGenZ
[*] BT_SecureAdmin
[*] BT_SimOffer
[*] BT_Tactical_oneclick
[*] BT_TellAFriend
[*] BT_Tinkerbell
[*] BT_TotalBroadband
[*] BT_VisionOrderJourney
[*] BTM00585
[*] Crayon_Utility
[*] master
[*] MobilePortal
[*] model
[*] msdb
[*] tempdb

Prima baza de date “BT” este cea mai interesanta, dar si celalalte ne ofera detalii importante despre utilizatori: date personale, parole, etc.

Se pot extrage cu usurinta name si [cenzurat din motive se securitate] care contin datele de logare pentru diferitele baze de date (default_cenzurat din motive se securitate). La fel de usor se pot extrage si name, password pentru sysusers. Aceste date ne permit logarea directa pe server.

Database: m*****
Table: s*****
[18 columns]
+————-+———–+
| Column | Type |
+————-+———–+
Continut inlaturat din motive de securitate

Accesul pe care ni-l da acest blind sql injection este mult mai mare decat cel oferit de vulnerabilitatea precedenta din BT.com. Folosindu-se de aceasta vulnerabilitate un atacator putea accesa datele personale ale utilizatorilor.

Nu va grabiti sa ii acuzati inainte de a vedea si urmatoarele articole referitoare la alti mari provideri in telecomunicatii. Asa cum am mai spus si inainte noi nu facem discriminari si incercam sa aratam ca vulnerabilitatile prezentate se pot intalni la scara larga.

Le multumim celor de la BT.com pentru fair-play-ul aratat in mailul pe care ni l-au trimis. Apreciem astfel de raspunsuri mature si la obiect si conteaza foarte mult pentru noi cand ni se multumeste.

Related Posts

• March 10, 2009 -- Sql Injection in BT.com – episode 1
• December 24, 2009 -- Forumul Andreei Balan spart
• December 22, 2009 -- Fun cu NemoExpres.ro
• December 11, 2009 -- Kaspersky Thailand hacked by TinKode
• December 11, 2009 -- Deface pe site-ul fundatiei Dan Voiculescu pentru Dezvoltarea Romaniei (fudv.ro)