Skip to main content

Ganna.com Hacked

Gaana.com -- One of India's most popular music streaming service with more than 10 Million registered users and 7.5 Million monthly visitors -- has reportedly been hacked, exposing the site’s user information database.

A Pakistani hacker, who claimed responsibility for the hack, claims that details of over 10 Million users of Gaana service including their username, email addresses, MD5-encrypted password, date of births, and other personal information has been stolen and made available in a searchable database.

At the time of writing, Gaana website is currently down for maintenance without any official statement provided yet. As of now, the site displays, "Site is down due to server maintenance. We will be back shortly. Kindly bear with us till then."


Details of 10 Million Users Available in a Searchable Database:



The hacker, nicknamed Mak Man, posted the link to a searchable database of Gaana user details on his Facebook page, with images of the service's admin panel.


By exploiting an SQL injection vulnerability in Gaana website, Mak Man managed to gain access to the details of its 10 Million users. The hacker has also posted a screenshot of SQL exploit he used to get access to the data on Facebook.

Mak Man claimed that he reported the vulnerability by providing full details of the flaw to Gaana.com before. However, the company didn’t respond to his report and ignored, which results in the breach of innocent users personal information.

Flaw Reported to the Company, but Ignored:

It sounds really weird that Gaana from one of India’s biggest internet companies, Times Internet Limited, is vulnerable to such attacks. And even weird when such a reputed company is ignoring vulnerabilities reported to them, putting millions of users at risk.

Most of the data breaches occur because of such behaviour of the companies when hackers and bug hunters responsibly report them flaws but they ignore the issues, encouraging hackers to go public with the details of their customers.

Times Internet CEO Satyan Gajwani replied to the hacker's post on Facebook later and apologised that the company hadn't responded to the security concerns raised by Mak Man.
"I don't think your intention is to expose personal information about Gaana users, but to highlight a vulnerability," Gajwani added. "Consider it highlighted, and we're 100% on it. Can I request that you take down access to the data, and delete it completely?"
Gajwani then took to Twitter and said that the company is considering the issue seriously and taking steps to fix it. He also said there is no financial or sensitive information lost. He also encourages all customers to reset their passwords as soon as possible.



However, simply changing passwords to your Gaana account would not solve the problem, as it will reflect in the leaked database. You are advised to better deactivate your accounts until the issue is resolved. Besides this, change your email, Facebook and Twitter passwords if you are using the same as on Gaana.

Comments

Post a Comment

Popular posts from this blog

Here Are 7 Brilliant Cheat Sheets For Linux/Unix

There's nothing better than a cheatsheet when you are stuck and need a reference. So here bringing to you 7 brilliant free cheat sheets.  1. Unix Tool Box : An incredibly exhaustive reference for all things Linux. This document is a collection of Unix/Linux/BSD commands and tasks which are useful for IT work or for advanced users. 2. One page Linux Manual : Great one page reference to the most popular Linux commands, it is a summary of useful Linux commands. 3. Linux Reference Card : One great reference published by FOSSwire. 4. Linux Command Line Cheat Sheet : This is an interestingly sorted and helpful cheat sheet by cheatography. 5. Linux Command Line Tips : This is a linux command line reference for common operations. Cleanly sorted and well described. 6. Treebeard’s Unix Cheat Sheet : A great reference that shows command comparisons with that of DOS. So if you are someone who was a DOS user and has switched to Linux, this is the best one too have! 7. Linux Shor
34 comments
Read more

Extracting Administrator Passwords Using LCP

Extracting Administrator Passwords Using LCP Link Control Protocol (LCP) is part of the Point-to-Point (PPP) protocol In PPP communications, both the sending and receiving devices send out LCP packets to determine specific information required for data transmission. ■ Use an LCP tool ■ Crack administrator passwords Tools Needed ■ A computer running Windows Server 2012 ■ A web browser with an Internet connection ■ Administrative privileges to run tools                ■ You can also download the latest version of LCP from the link         http: / www.lcpsoft.com/engl1sh/1ndex.htm ■ If you decide to download the latest version, then screenshots shown     might differ ■ Follow the wizard driven installation instructions ■ Run this tool in Windows Server 2012 ■ Administrative privileges to run tools ■ TCP/IP settings correctly configured and an accessible DNS server Overview of LCP LCP program mainly audits user account passwords and
11 comments
Read more

Ten Important Rules Of Ethical Hacking

The world of ethical hacking too is bound by a set of rules and principles, here are 10 crucial ones!   Time and again we have been bringing you valuable resources on ethical hacking since we know and understand the nature of things as far as security goes. Ethical hacking is picking up steam each day with more and more organisations spending heftily to maintain the sanctity of their systems and data. As such, ethical hacking is a glorious career option in the current scheme of things. 1.Set your goals straight To begin with, an ethical hacker must start thinking like the intruder. He must be able to identify the loopholes on the target access points or networks that are prone to attack, he must be aware of the repercussions of these loopholes and how the intruder can use it against the same. An ethical hacker then has to find out if anyone at the target notice the intruder's attempts to carry out his/her acts. Finding out and eliminating unauthorised wireless access point
124 comments
Read more