12/14/2014

#rexmundi analyzing the Xtra-Interim.be leak WITH 1000 NATIONAL REGISTRY NUMBERS

It is about 1000 persons

they used sql injections (several) which means that the programmers have set a database and a form without any securitychecks making mistakes that should have been corrected if one has followed whatever professional book (if you are a professional programmer)

it also means that the hosting of the site has no good application defense which means that it doesn't have a good firewall because otherwise even with these vulnerabilities it would have become more difficult to execute those attacks

If I have a site with that site, I would check my forms and databases because this is the third one

id,langID,hiant_id,cv,tel,naam,email,busnr,huisnr,straat,postcode,voornaam,gemeente,paswoord,

opmerking,rekeningnr,creationdate,nationaliteit,geboortedatum,geboorteplaats,preferred_jobs,

burgerlijke_stand,rijksregisternummer

not everybody filled in all these fields in the form and I would continue to say that there is no obligation to fill personal information or correct information (the only thing that is needed is your emailadres)

there are about 100 bankaccountnumbers (for the banks the files with the list is with the FCCU and the CERT.be if you would need to contact the people

there is no guarantee that these files will not be downloaded combined with or sold to other (criminal) networks

rex mundi didn't keep the promise to not publish the national registry numbers, this means that there are about 1000 of them leaked online (and to the underworld)

Permalink | |  Print |  Facebook | | | | Pin it! |

The comments are closed.