Telegraph thanks hackers for site breach

 

Gallery

By Stuart Turton

Posted on 9 Mar 2009 at 12:41

The Telegraph has thanked HackersBlog for exposing a flaw in its database that could have exposed thousands of subscriber passwords and personal details.

Hackersblog posted proof of a SQL injection attack on the Telegraph over the weekend, laying bare subscriber email addresses and unencrypted passwords.

In a message on the site, the hackers behind the attack claim: "Besides numerous interesting tables there is one that contains email addresses of those receiving the newsletter. A real treasure for spammers."

The Telegraph says the issue is being investigated and thanked the site for bringing the issue to its attention. "The hack interrogated database tables behind one of our partner sites and exposed a weakness in the way that particular site had been coded," says Paul Cheesbrough, chief information officer for Telegraph Media Group.

"We immediately took the impacted site down on Friday, and the two-year-old third party code is being re-written to eliminate the issues that hackersblog.org brought to our attention."

"Hackers are rarely embraced as being friends but in this instance it's important to thank the team at hackersblog.org for bringing these issues to our attention. We've listened, and we're working with the partner site to sort out the cause of the problem."

Hackersblog is making a name for itself by exposing exploits on high-profile targets, and has already embarrassed a number of security companies including Kaspersky and F-Secure.