📸 Photo

HOSTILE TAKEOVER

SQL command—in a search query, for example. If a visitor to a music site enters “Sinatra” in the search box, the website’s software will ask the database to look for matches.

SELECT titles FROM music_catalog

WHERE artist = ‘Sinatra’;

An SQL injection vulnerability occurs when the software doesn’t properly sanitize the user’s input before including it in a database command. Punctuation is the real killer. If a user in the above scenario searches on “Sinatra’; DROP music_catalog;” it’s tremendously important that the apostrophe and semicolons not make it through. Otherwise, the database server sees this.

SELECT * FROM music_catalog

WHERE artist = ‘Sinatra’; DROP music_catalog;’;

As far as the database is concerned, that’s two commands in succession, separated by a semicolon. The first command finds Frank Sinatra albums, the second one “drops” the music catalog, destroying it.

SQL injection is a standard weapon in every hacker’s arsenal—the holes, even today, plague websites of all stripes, including e-commerce and banking sites. And in 2005, the forum software used by TalkCash and ScandinavianCarding was a soft target.

To exploit the bug on TalkCash, Max registered for a new account and posted a seemingly innocuous message on one of the discussion threads. His SQL attack was hidden in the body of the message, the font color set to match the background so nobody would see it.

He ran a search query designed to find the post, and the buggy forum software passed his command to the database system, which executed it, INSERTing a new administrator account just for Max. A similar attack worked at ScandinavianCarding.

On August 14, Max was ready to show the carding world what he was