Adobe shutters forum site following breach and data leak
Posted on 15 November 2012.
Adobe has confirmed that the records leaked on Tuesday by an Egyptian hackers were part of a database containing user information and login credentials for, a forum site for users of its Adobe Connect Web conferencing platform.

The hacker leaked 202 complete records of Adobe employees and 230 of users employed by the US military, government, NASA and a number of educational institutions.

The leaked password have been easily cracked due to the fact that Adobe used the flawed MD5 hashing algorithm to hash them, hasn't salted them and used a single iteration of MD5. The fact that many of them weren't complex enough in the first place only compounded the problem.

The forum site in question has been taken down on Tuesday, and Adobe is in the process of resetting the leaked and compromised passwords, and advising affected users on how to set up a new - and better - password once the forum is back online.

The company has still not shared details on how the breach happened, but claims that other Adobe services - including the Adobe Connect conferencing service itself - were not affected in any way.

UPDATE: It seems that the hacker exploited an SQL injection vulnerability in the server to execute the hack. "Somehow I was able to dump the database in less requests than normal people do," he commented for Dark Reading.


Over 225,000 Apple accounts compromised via iOS malware

Researchers from Palo Alto Networks and WeipTech have unearthed a scheme that resulted in the largest known Apple account theft caused by malware. All in all, some 225,000 valid Apple accounts have been compromised.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Sep 1st