On Thursday night, UK ISP TalkTalk fell victim to a massive hack on its servers, during which unencrypted user data, including credit and debit card details, may have been stolen. TalkTalk CEO and Dido Harding – or Baroness Harding of Winscombe as she’s known in her role as Conservative Peer and Non-Executive Director of the Bank of England – has confirmed that parties claiming to be responsible for the hack have attempted to blackmail the company, bemoaning the emergence of “cyber-criminals” to the BBC yesterday.
It seems, though, that TalkTalk needs to take its share of responsibility for the hack, since the technique used was rudimentary and more than 15 years old. According to developer Tim Almond, the hackers used an SQL injection to compromise TalkTalk’s servers, the application of which is “like leaving a door unlocked in an office building” on the part of the ISP.
“It was using a technique called a SQL Injection attack,” Almond says. “Without going into detail of how it works, this is a very well-known and in computing years, a very old attack. I first had it explained to me in the early part of the 2000s.”
To make it clear that TalkTalk was negligent in not protecting against such an attack (let alone not encrypting user data), Almond says, “Many people wouldn’t even think of trying it because they wouldn’t expect a large website to miss it,” adding, “if you have good security policies, SQL Injection attacks shouldn’t be a problem.”
