Security company Barracuda Networks was embarrassed after a hacker broke into its database and stole names and e-mail addresses of employees, channel partners and sales leads.
Security software producer Barracuda Networks was hit by a
SQL injection attack launched on April 9 while the company's own Barracuda
Web Application Firewall was offline for scheduled maintenance, Michael Perone,
executive vice president, wrote April 12 on the corporate blog.
The attacker uncovered email addresses of select Barracuda
employees with their passwords as well as name, email address, company
affiliations and phone numbers of sales leads generated by the company's
channel partners. Barracuda does not store any financial information in that
"The bad news is that we made a mistake," Perone said.
Barracuda's firewall was accidentally put into passive
monitoring mode, which means it lets all the traffic through without doing any
analysis or blocking and was essentially doing nothing since late evening April
8. This gave the attacker sufficient time to poke around via an automated
script to crawl the site.
It took approximately two hours of "nonstop" probing before
the intruder discovered a SQL injection flaw in a PHP script used to display
customer case studies. That error allowed the attacker entry into the database
used for marketing programs and sales lead development efforts. The customer
case study database was on the same system as the one used for marketing
The initial reconnaissance attempts came from one IP
address, and another IP address joined the attack three hours later, Perone
While the exposed employee passwords were encrypted, they
were stored using the MD5 hashing algorithm, which is considered to be an
outdated encryption method. The good news is the hashes were "salted," making
them harder to crack using commonly available tools.
The incident is highly embarrassing for Barracuda, as it
provides security services to its corporate customers. Barracuda learned the
hard way that a Website can't be left unprotected for a full day and companies
can't be complacent about coding practices or other processes just because
there is a firewall in place to block threats. Finally, even if the database
itself is secure, coding vulnerabilities elsewhere can compromise the data.
"Security companies don't always practice what they preach,
leaving themselves vulnerable to attacks like this," Jason Reed, director of
security and compliance at SystemExperts, told eWEEK.
SQL injection flaws are usually introduced in the Website
because the developers are in a hurry to implement features, Reed said.
Applications shouldn't be using an administrator account to connect to the
database and it shouldn't use direct SQL statements in scripts. Separating out
code from data prevents attackers from passing in malicious SQL code.
The attacker, under the name Fdf, posted the email addresses
and other stolen information as proof of the attack on a Tumblr blog. Since
this is the only post currently on the "HMSec Full Disclosure" blog, it's safe
to say that Fdf created the Tumblr blog specifically for this attack. Fdf also
thanked nine other individuals and "other Malaysian hackers" on the post.
Fdf obtained a full list of databases on the server and
viewed the contents of at least five tables on one of the databases using a
blind SQL injection attack.
A blind SQL injection attack means the errors and results
from the malicious SQL queries are not displayed directly to the attacker.
Instead, the attacker has to write complicated code to expose little bits of
the data at a time and then re-create the information. Oracle's MySQL.com and
Sun.com sites were both recently targeted by blind
SQL injection attacks
Barracuda apologized for the incident in the blog post and
said it was notifying affected individuals.