Allphones hacked, staff passwords exposed

By Darren Pauli on Mar 6, 2012 10:55 AM
Filed under Networks

Hacker claims 703 accounts listed.

Telecommunications retailer Allphones has had hundreds of staff usernames, passwords and company administrator logins exposed following a hacking attack.

The breach occurred when the company's web administration interface was accessed through a SQL injection attack that targeted the Allphones website.


The affected webpage

SC Magazine Australia informed the Allphones website designer of the breach including the vulnerable link and a captured HTML page of the admin console.

Further vulnerable links were later discovered and shut down, and affected accounts were disabled.

Table names were visible on the administration console which was accessed by the hacker using the Havij SQL injection tool.

SC sighted a file that contains a sample of clear text staff usernames and passwords, along with store names, and a string of what appeared to be email addresses and passwords used to access the Allphones 'webclub' customer loyalty program.

The hacker claimed 703 staff credentials were listed, along with 23,077 entries in the Allphones webclub. The sample contained 40 listings and many more duplicate entries. Four adminstrative passwords were also exposed.

Allphones has more than 170 locations across Australia, according to its website.

Allphones has been contacted for comment.

Allphones hacked, staff passwords exposed

Credit: Allphones Facebook page

hacking, data breach, havij, sql injection

Allphones

Havij, SQL Injection, hacking

Readers of this article also read...

Ads by Google

What are your thoughts on this article? Add your comment below.

To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.

NOTE: You must be a registered member of SC Magazine to post a comment.

Click here to login | Click here to register

comments powered by Disqus