Be Excellent To Each Other

We’ve received an email from Bitterwallet reader Dan who told us how with a smidgeon of curiosity, some basic snooping and a few clicks of his mouse, he’d found himself staring at a 3 database containing almost 80,000 names and addresses of UK citizens.

Is your real name "SELECT * FROM customers"?

*checks MaliA's geek credentials*

IMPOSTOR! Call the guards!

I'm not a geek. I understand very little about how computers work, except that if the magic smoke escapes, this is a BAD thing. And something about typing "sudo" in when one wants something to do stuff.

I suppose I am to computers that What-A-Mess is to counting. I know that tehre are some things which come in order, but after that, I've an diea of what they might do, but no idea where (eg. Direct injection of hostile python script, Java, CSS, database tables).

but I'm quite happy with it that way.

Shouldn't he be banned from running a Linux box then?

When they want to get information on the boy, their software would use a SELECT query and put the name of the child in the conditions to be met, something like

This would return all the information for the student with that name.
What Bobby Tables' name does is close that query using the characters ');
Then it deletes the student table (DROP TABLE students;)
Then it comments out the rest of the original using the hyphens --
So the query the software has now looks like this:
or
Sanatising an input (in laymans terms) would escape the ' in Bobby's name, and the query would look like:

And that would work fine.

However, I'd argue that you don't need the brackets around the SELECT query, and so Bobby's name would actually throw an error when it hit the closing bracket, and return nothing.

So, in conclusion, that comic is wrong.

However, I'd argue that you don't need the brackets around the SELECT query, and so Bobby's name would actually throw an error when it hit the closing bracket, and return nothing.

Richard says: it's an INSERT innit
Richard says: not a SELECT
Matt says: oh yeah, could be
Richard says: SQLPWNED

You're right, but also very wrong. When entering the students names this exploit would be part of an INSERT INTO students (col, col, col) VALUES (..,..,..). The close bracket closes the VALUES( statement.

Ignore.

Ignore.

Be assured, readers, that the Doc and I are debating this on MSN right now. It's exciting stuff.

[edit]DAMNIT I was *just* too slow

Grim... has told me what this said. You cannot hide behind your Time Total Change Machine! SQLPWNED to you too!

Haha. I realised seconds after posting it that I was, in fact, being a cunt and not thinking 4thDimensionally.

OH HAI I WAS JUST PASSING

She's not a porn star, she's the blond daughter from "8 Simple Rules".

She was a treat until she opened her mouth. See also: Tweedy.

If you mean Cheryl, we're gonna have a falling-out.
I love a soft north-eastern accent.

If you mean Cheryl, we're gonna have a falling-out.

I love a soft north-eastern accent.

Dull fact! Despite playing the older sister in Eight Simple Rules, she's actually younger that the actress who played her sibling.
Carry on!

Following on from our earlier story where we revealed how the personal details of almost 80,000 3 Mobile customers could easily be viewed online, the company have plugged the leak and removed any access to the database.

index-cut-225x300 3 hide their customer database again. Sensible really.The ease with which Bitterwallet reader Dan was able to access this classified information was staggering to be frank. It all stemmed from an email he was sent from 3, advertising their mobile broadband service. Possibly out of sheer boredom but probably out of the curiosity that most of the web-savvy among us possess, Dan right-clicked on the dongle picture and looked for the image source.

This threw up a URL, which led him to a directory of folders where the images that 3 use in their mailouts were stored. Nothing so damning so far. But one of the folders therein looked a little bit more intriguing. Named ‘BB LAPTOP ANTON,’ its contents amazed Dan, as well as us when we saw them. Three CSV files, listing the names and addresses of what we assumed were customers of 3. A grand total of 79,035 of them (excerpt below). Either way, it was data that should have been kept strictly confidential and certainly not accessible to any net user with a little bit of nous.

3 have subsequently removed the info from public view and hopefully the mistake won’t be repeated. It would be interesting to see what the Information Commissioner might have to say about it all though…

A 3 spokesman has contacted us regarding the security leak and said, “The information referred to has now been removed from the Internet. We’re still in the process of investigating, however our initial research indicates that, in all probability, this is not a list of 3 UK customers. Less than 5% of names on initial investigation are 3 customers.


“We’re clearly still concerned that there could be any compromise of consumer data associated with the marketing of our products and we are doing everything in our power to find out where this information has come from. What is important to note is that the data only consisted of names and addresses - no consumer financial information was exposed at any point.”

who the fuck are they and why did 3 have their information at all

If they're not 3 customers, who the fuck are they and why did 3 have their information at all, never mind online?

Er, there's nothing stopping 3 from having your details when you're not a customer.

Posting them on the Internet was rather shoddy of them, fair enough.

Ah, people missing the "DO NOT SELL" checkboxes on forms and that, mm.

You'd be surprised at just how easy it is to get someone's info. There's a high chance that I could get hold of yours if you PM me your real name

SELECT * FROM peopleIthoughtWouldBeTaller SORT BY volume