Formspring breach COMPROMISES Formspring
The Formspring incident involved unauthorized access to the server and theft of user information.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Formspring had no idea they were breached”
Incident
incident:formspring_breach
Intrusion into Formspring involving stolen administrator credentials, installation of madnez.php, SQL queries, and theft of user records.
Intrusion into Formspring involving stolen administrator credentials, installation of madnez.php, SQL queries, and theft of user records.
“someone had SSH’d into the server from a Russian IP”
“They discovered all this in about one day”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | COMPROMISES | Formspring | Explicit | 86 |
| outgoing | INITIAL_ACCESS_VIA | SSH | Explicit | 86 |
| outgoing | INVOLVES | madnez.php | Explicit | 86 |
| outgoing | INVOLVES | SQL injection or database command execution | Explicit | 86 |
| outgoing | ASSOCIATED_WITH | Yevgeniy Nikulin | Attributed | 86 |
| incoming | RELATED_TO | LinkedIn data breach | Explicit | 86 |
Formspring breach COMPROMISES Formspring
The Formspring incident involved unauthorized access to the server and theft of user information.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“Formspring had no idea they were breached”
Formspring breach INITIAL_ACCESS_VIA SSH
The hacker obtained Formspring administrator credentials and logged into the server using SSH.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“the hacker got one of the admin usernames and passwords from Formspring’s server and logged in using SSH”
Formspring breach INVOLVES madnez.php
The hacker installed madnez.php on the Formspring server to maintain access.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“He was able to install a malicious program called madnez.php on the server so that he could get back in anytime he wanted”
Formspring breach INVOLVES SQL injection or database command execution
The hacker used the web administration panel to execute SQL commands and extract user information from the database.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“he was able to run SQL commands on the database and grabbed a large amount of user info”
LinkedIn data breach RELATED_TO Formspring breach
The LinkedIn, Dropbox, and Formspring cases shared indicators of compromise, including IP addresses, user agents, browsers, and operating systems.
Explicit Confidence 99% · Jack Rhysider EP 86 Details
“In all three attacks they found similar IOCs, or indicators of compromise; the same IPs, the same user agents, the same browser and OS”
Formspring breach ASSOCIATED_WITH Yevgeniy Nikulin
Kislitsin also said that Yevgeniy had the Formspring data with the goal of selling database dumps for money; this relationship is attributed to Kislitsin's statement.
Attributed Confidence 94% · Jack Rhysider EP 86 Details
“and had the Formspring [00:40:00] data, all with the goal to sell the database dumps on the black market for money”