The USA Network show Mr. Robot has drawn a good deal of praise for its accurate portrayal of hacking and computer security. So, naturally, the site for the show has drawn a slightly different sort of adoring fan—”white hat” hackers looking for security holes.
News of the vulnerability apparently piqued the interest of other hackers in the show’s fanbase. On May 13, another “white hat” hacker who calls himself corenumb poked around the site’s e-mail registration code and found that the PHP code behind it was vulnerable to a type of attack called blind SQL injection—an attack that embeds SQL commands into text sent to a website, bypassing error messages that would normally block those attacks. The vulnerability would have allowed a malicious attacker to execute SQL commands against the database used for the show’s e-mail list. Corenumb was able to retrieve information about the backend database and the server it runs on using SQLmap, an open source penetration testing toolkit used specifically for checking for SQL injection vulnerabilities.
NBC Universal responded quickly to corenumb’s alert, but Ars has not received confirmation that the vulnerability had been addressed. On the upside, at least USA Network is getting a bunch of penetration testing done for free.
Source: Ars Technica