TalkTalk Cyber attack

(26-10-2015 08:26 )Champion Wrote:  So much misinformation/disinformation you really don't know what to believe.

mmhmmm it's going to take them a long time to regain people's trust in their services and three attacks in one year is one too many I guess for many people

(26-10-2015 01:47 )HEX!T Wrote:  talk talk admitted they didnt use encryption.
now they have changed there tune and claim they have.

They didn't use encryption and they freely admit that. However, even if they had it would have made no difference, because the hacker would have been logged in as an authorised user and would have been able to bypass any encryption.

15 year old boy arrested in Country Antrim NI on suspicion of being involved in the attack

I wonder how many more arrests?

Slight sidenote :

I was checking some of the alternatives over the weekend, especially Plusnet who I have always liked the look of, despite their increasingly annoying tv ads! According to the Plusnet site, to switch to them, I would need to take a day off work to sit and wait for an engineer to come and plug in a modem to the phoneline. I emailed them to verify that this is actually the case, that they can't just send me the modem and let me deal with it. So far, two working days and no response! Looks like Plusnet is crossed off my list.

Vodafone is looking like next best for me.
My options are limited in my area, Virgin is out because of where I live in relation to the street, getting the telephone cable installed was a two man job, I can't be dealing with getting their cable installed as well. Many of the other vendors only seem to offer slower broadband around here, up to 38/40Mb. I could live with that if it was all that's available, but if I can get double that, like I have now, then why settle for less.

Anyhow, it's looking like they won't let people out of their contracts early, so it's not an immediate issue, but I will certainly be looking to jump ship when I can.

I notice the accounts page now has new information, and they are now saying they DON'T store credit card info unencrypted. Maybe should have told that to the boss before she went in front of the cameras the other day

then they told a big fat LIE then right, from when the attack first happened?

This article gives a pretty good rundown of the order of events and either the complete confusion, or deliberate misdirection offered by TT.

http://www.theregister.co.uk/2015/10/27/...nt_review/

I still haven't had so much as an email from them admitting there has been an incident.
What really concerns me is that the attack that happened was a simple SQL injection attack. That is so simple, its unforgivable that they weren't secured against it. Even my own site is secured against this type of attack.
This type of so called 'hack' is so basic even a 15 year old child could do it ... oh wait!

(and their claims that it was the website that was attacked not the data is bull, the website is the front-end to the data, this type of attack gives direct access to the data)

so is it possible the attack could have lasted no more than five minutes - or longer? and in that space of time would it have been possible to steal the alleged number of details that were reportedly stolen?

Companies need to do more to protect their systems, u can't have 15 year old kids managing to break in so easily, the sql injection is fairly simple to do but still the companies should be one step ahead of these hackers

(27-10-2015 22:07 )babelover48 Wrote:  so is it possible the attack could have lasted no more than five minutes - or longer? and in that space of time would it have been possible to steal the alleged number of details that were reportedly stolen?

It depends exactly how the attack was made. In theory, all you need to do is enter one very specific, and probably very long and detailed, web address into your browser, and it will return all the information in one big dump. Entering that address takes seconds, actually receiving the volume of data from the site may take some time, even this site can sometimes seem to take a couple minutes to return one legitimate web page.
It's quite possible this lad was actually running a script from a command line, which would send many different variations of possible addresses including different combinations of sql commands until it hit one that got the desired result, essentially a brute force approach. Such a script could send many addresses more or less simultaneously through different connections, so would run pretty damn fast. How long it would take to get a hit is down to pot luck as much as anything, could be seconds, could be several minutes, could be hours. This could be the reason for the DDOS attack, to try to hide that script hammering the site with its requests (although there now seems to be some confusion about the timing of the DDOS attack, or whether there really was one at all!).

So yes, it's possible it may have taken only 5 minutes, but its equally possible it may have taken 5 hours in total (the vast bulk of that time actually searching for the address, only a couple minutes or so for the final data dump).