European Space Agency Website ESA.int Hacked, FTP And Email Passwords Leaked
The website of the European Space Agency (ESA) has been hacked into and a list of FTP accounts, as well as email addresses and passwords for administrators and editors have been leaked. The www.esa.int Web server was compromised by a well known Romanian grey hat hacker who uses the online moniker of TinKode.
The hacker posted details of the compromise on his blog in full disclosure style. However, the method he used was not revealed. The published data includes FTP accounts for a range of ESA subsites with passwords in clear text. A list of database users with hashed passwords was also disclosed, together with the SHA1-hashed server root password.
The site administrator and editor credentials were exposed in plain text, as well as email addresses and passwords corresponding to website user accounts. The passwords are in readable form, but TinKode took the measure of partially hiding them before publishing. There is also a list of associated proxy user names and passwords.
At the time of writing this article the www.esa.int website remains on line so it is not clear if the agency was alerted of the compromise in advance or not. TinKode is known for exposing vulnerabilities in high profile websites, the latest of which was an SQL injection in MySQL.com.
His past targets include Sun Microsystems (now Oracle), the Royal Navy, the U.S. Army and Kaspersky Portugal. ESA is not even TinKode’s first space agency, the hacker previously compromising several NASA websites.
His full disclosure style can sometimes lead to abuse. For example, an XSS vulnerability he revealed in YouTube’s commenting system went on to be exploited by 4chan users to harass Justin Bieber fans.
Credit: Softpedia.com News
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.