01/21/08 - RIAA Web site apparently hacked over the weekend

DiGiJeff · 01-21-2008, 03:04 PM

RIAA Web site apparently hacked over the weekend
By Scott M. Fulton, III, BetaNews
January 21, 2008, 11:18 AM

An old-style SQL ********* hack is the suspected culprit in a malicious attack on the RIAA's Web site. During the weekend, its framework was still going, though its content had been erased.

For well over a decade, malicious users have known how to pass unchecked SQL queries through Web forms, in what is called a SQL ********* attack. With unsecured databases, it's an almost ridiculously simple hack, not really displaying any real skill or prowess on the part of the malicious user. But last weekend, one hack was notable particularly for its target.

The Recording Industry Association of America's Web site was apparently wiped completely clean of its press releases and textual content over the weekend, as screenshots posted Sunday to the Technology Expert's blog indicate.

Injected in place of the RIAA's usual press announcements, the photo evidence shows, was a link to one of the more trafficked pirated content sites on the Web.

Links posted to the Web site Reddit.com apparently invited the user to perform what's euphemistically called a "slow query." The link read, "This link runs a slooow SQL query on the RIAA's server. Don't click it; that would be wrong." Among the hundreds of comments posted there in response to that link were several congratulatory messages, plus a few curious comments blaming the RIAA -- perhaps without much evidence -- for using open source database software that could be more easily hacked, if only to point out the irony of the Association wanting to bypass paying licensing fees.

But the history of SQL ********* queries goes further back than even MySQL. In 1998, I participated in a commercial demonstration of a SQL ********* query very similar to the one suspected of wiping clean the RIAA's text files, doing the very same thing to a dummy Web site using an Oracle database, set up for the purpose of being attacked. Oracle had been invited to witness a staged attack for itself, though had declined to do so. Since that time, certainly, Oracle and its competitors have established many security measures to prevent this kind of attack.

The concept of the SQL ********* query is explained here. Essentially, it's a primordial form of the buffer overflow exploit that plagues Web browsers even today, through the use of malformed URLs. In this case, SQL queries are divided into explicit sections, where the SELECT instruction is used to retrieve records from tables and recordsets based on explicit criteria. That criteria is expressed in the WHERE clause of the instruction, and it is that clause which can often be intentionally malformed in such a way that an operable instruction (such as DROP TABLE) is embedded where the RDBMS would normally expect to find conditional expressions (such as date < "12/31/07").

Due to the MLK holiday on Monday, the RIAA's spokespeople were unavailable for comment. As of this morning, the RIAA's Web site appeared to be fully functional, though it's unclear whether its Webmasters have been able to thwart the culprit query permanently or are just continually restoring the site from backups.

Hip Hop 4 Life · 01-21-2008, 05:01 PM

hahaha!!! funny shit

ya boy Mike · 01-21-2008, 05:08 PM

lmaoooo if riaa got hacked then shit we can hack almost every government website

C. Sense AKA L.J. · 01-21-2008, 05:10 PM

irony...greatness

JONyayo177 · 01-21-2008, 06:50 PM

Live Free Or Die Hard Shit

Seatown · 01-21-2008, 07:03 PM

good fuck em

RedBrickz86 · 01-21-2008, 07:31 PM

hahaahhahahaaahaha

GMNRecordsCT3 · 01-21-2008, 08:34 PM

lol... i didnt notice... prolly cuz i dont like them lol...

ez4menyou · 01-21-2008, 08:56 PM

damn that shit is hilarious

Zhiwai · 01-21-2008, 11:23 PM

Props on this

Lil TraVieSo · 01-22-2008, 01:04 AM

nerds

, why exactly waste ur time hacking a site if u're nt going to get any oney out of it?

MC B STREETZ · 01-22-2008, 02:00 AM

fuck da riaa

Georgiapower912 · 01-22-2008, 04:59 AM

Quote:

Originally Posted by Zhiwai

Props on this

somebody was probaly trying to lie about an artists sales

PokemonMaster · 01-22-2008, 02:05 PM

Quote:

Originally Posted by Georgiapower912

somebody was probaly trying to lie about an artists sales

COUGH COUGH JAYZ COUGH COUGH

01-21-2008, 03:04 PM	#1
DiGiJeff Creator and Owner Join Date: Jan 2004 Location: Colorado Posts: 42,707 Repped: 350 Repped 16,436 Times in 2,285 Posts Blog Entries: 5 Neg Reps: 17 Neg Repped at 73 Times in 21 Posts	01/21/08 - RIAA Web site apparently hacked over the weekend 01/21/08 - RIAA Web site apparently hacked over the weekend RIAA Web site apparently hacked over the weekend By Scott M. Fulton, III, BetaNews January 21, 2008, 11:18 AM An old-style SQL ******* hack is the suspected culprit in a malicious attack on the RIAA's Web site. During the weekend, its framework was still going, though its content had been erased. For well over a decade, malicious users have known how to pass unchecked SQL queries through Web forms, in what is called a SQL ***** attack. With unsecured databases, it's an almost ridiculously simple hack, not really displaying any real skill or prowess on the part of the malicious user. But last weekend, one hack was notable particularly for its target. The Recording Industry Association of America's Web site was apparently wiped completely clean of its press releases and textual content over the weekend, as screenshots posted Sunday to the Technology Expert's blog indicate. Injected in place of the RIAA's usual press announcements, the photo evidence shows, was a link to one of the more trafficked pirated content sites on the Web. Links posted to the Web site Reddit.com apparently invited the user to perform what's euphemistically called a "slow query." The link read, "This link runs a slooow SQL query on the RIAA's server. Don't click it; that would be wrong." Among the hundreds of comments posted there in response to that link were several congratulatory messages, plus a few curious comments blaming the RIAA -- perhaps without much evidence -- for using open source database software that could be more easily hacked, if only to point out the irony of the Association wanting to bypass paying licensing fees. But the history of SQL ***** queries goes further back than even MySQL. In 1998, I participated in a commercial demonstration of a SQL ***** query very similar to the one suspected of wiping clean the RIAA's text files, doing the very same thing to a dummy Web site using an Oracle database, set up for the purpose of being attacked. Oracle had been invited to witness a staged attack for itself, though had declined to do so. Since that time, certainly, Oracle and its competitors have established many security measures to prevent this kind of attack. The concept of the SQL ******* query is explained here. Essentially, it's a primordial form of the buffer overflow exploit that plagues Web browsers even today, through the use of malformed URLs. In this case, SQL queries are divided into explicit sections, where the SELECT instruction is used to retrieve records from tables and recordsets based on explicit criteria. That criteria is expressed in the WHERE clause of the instruction, and it is that clause which can often be intentionally malformed in such a way that an operable instruction (such as DROP TABLE) is embedded where the RDBMS would normally expect to find conditional expressions (such as date < "12/31/07"). Due to the MLK holiday on Monday, the RIAA's spokespeople were unavailable for comment. As of this morning, the RIAA's Web site appeared to be fully functional, though it's unclear whether its Webmasters have been able to thwart the culprit query permanently or are just continually restoring the site from backups. __________________ DiGi Jeff Original Creator of HHBoard / No longer an admin Follow me on Twitter http://www.twitter.com/digijeff www.digijeff.com

01-21-2008, 05:08 PM	#3
ya boy Mike Veteran Join Date: Jul 2006 Location: QUEENS Posts: 4,848 Repped: 678 Repped 142 Times in 66 Posts Neg Reps: 1 Neg Repped at 16 Times in 15 Posts	lmaoooo if riaa got hacked then shit we can hack almost every government website __________________ You'll think im spellin' Iverson when the beef all done, cuz I'll leave you on the IV in the ER, SON-40 Cal

01-21-2008, 05:10 PM	#4
C. Sense AKA L.J. Still a Buc Join Date: May 2006 Location: Tampa Bay Posts: 4,476 Repped: 371 Repped 403 Times in 174 Posts Neg Reps: 14 Neg Repped at 24 Times in 18 Posts	irony...greatness __________________ 20100426

01-21-2008, 06:50 PM	#5
JONyayo177 Join Date: Dec 2007 Location: BX Posts: 342 Repped: 179 Repped 25 Times in 4 Posts Neg Reps: 0 Neg Repped at 0 Times in 0 Posts	Live Free Or Die Hard Shit __________________ LOOK OUT FOR IRON MAN 2008

01-21-2008, 07:31 PM	#7
RedBrickz86 Gettin It! Join Date: Oct 2007 Location: ~Home Of The Red Bird~Louisville Kentucky Posts: 1,314 Repped: 545 Repped 89 Times in 29 Posts Neg Reps: 0 Neg Repped at 0 Times in 0 Posts	hahaahhahahaaahaha __________________ ~Kill r' "B" Killed~..... ~REAL NIGGAS DO REAL THINGZ~.. ~REAL RECOGNIZE REAL~ ~GO HEAD,LET EM' HATE~

01-21-2008, 05:01 PM	#2
Hip Hop 4 Life Join Date: Jan 2008 Location: None of Your Damn Business Posts: 155 Repped: 23 Repped 0 Times in 0 Posts Neg Reps: 0 Neg Repped at 0 Times in 0 Posts	hahaha!!! funny shit

01-21-2008, 07:03 PM	#6
Seatown Veteran Join Date: May 2006 Location: Sea-Town Posts: 2,161 Repped: 715 Repped 49 Times in 35 Posts Neg Reps: 21 Neg Repped at 7 Times in 4 Posts	good fuck em

01-21-2008, 08:34 PM	#8
GMNRecordsCT3 Macaroni wit the Cheeesse Join Date: May 2005 Location: Wash Heights, NYC Posts: 17,615 Repped: 6,784 Repped 2,310 Times in 619 Posts Neg Reps: 203 Neg Repped at 50 Times in 40 Posts	lol... i didnt notice... prolly cuz i dont like them lol... __________________ myspace.com/bummydavis - soundclick.com/gmnproductions "The name on my car insurance is YOUR FUKIN FAULT!!"

01-21-2008, 08:56 PM	#9
ez4menyou Join Date: Mar 2005 Location: va all day baby Posts: 871 Repped: 165 Repped 27 Times in 11 Posts Neg Reps: 7 Neg Repped at 4 Times in 4 Posts	damn that shit is hilarious

01-21-2008, 11:23 PM	#10
Zhiwai G_unit_soldier_Chang Join Date: Jan 2006 Location: Puerto Rico Posts: 9,469 Repped: 15 Repped 49 Times in 8 Posts Neg Reps: 0 Neg Repped at 0 Times in 0 Posts	Props on this

01-22-2008, 01:04 AM	#11
Lil TraVieSo i lean like a gringo Join Date: Mar 2007 Location: From the 310 to the 714 Posts: 966 Repped: 52 Repped 294 Times in 60 Posts Neg Reps: 2 Neg Repped at 3 Times in 2 Posts	nerds, why exactly waste ur time hacking a site if u're nt going to get any oney out of it? __________________ WELL IF MY TIME HAS COME THEN I AIN'T GONNA RUN I'D RATHER DIE ON MY FEET THAN ON MY KNEES LIKE A PUNK(STOMPER-HARD TIMES)

01-22-2008, 02:00 AM	#12
MC B STREETZ YAYO'S ADVOCATE/HYPE MAN Join Date: Nov 2006 Location: FIND ME IN YA CRIB WIT DA NINA WHERE DA MONEY AT Posts: 18,199 Repped: 3,566 Repped 21,974 Times in 2,200 Posts Neg Reps: 58 Neg Repped at 51 Times in 45 Posts	fuck da riaa __________________ "I'M A LOUDMOUTH NIGGA BUT MY RUGER SILENT" -TONY YAYO A.K.A TALK OF NEW YORK "ALL YAYO ENEMYS ARE ALL OF MY ENEMYS" - MC B STREETZ A.K.A YAYO'S NINJA

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode