A Kurdish hacker codenamed “MuhmadEmad” from the hacktivist group “KurdLinux_Team” have managed to gain unauthorized access to Dell’s official website subdomains and leave them defaced.
The exploit had allowed hackers to inject into the web site's database and get the hashed/encrypted password of admins which would then be cracked to gain access to the website admin control panel, allowing hackers to do anything with the website.
Dell investigated the incident and put down the hacked server, the subdomains remain inaccessible.
Source: http://www.tapscape.com/dell-official-website-subdomains-hacked-kurdish-hackers/
TPRM report: https://scoringcyber.rankiteo.com/company/delltechnologies
"id": "del133327522",
"linkid": "delltechnologies",
"type": "Cyber Attack",
"date": "06/2016",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Technology',
'name': 'Dell',
'type': 'Corporation'}],
'attack_vector': 'SQL Injection',
'data_breach': {'type_of_data_compromised': ['Admin hashed/encrypted '
'passwords']},
'description': "A Kurdish hacker codenamed 'MuhmadEmad' from the hacktivist "
"group 'KurdLinux_Team' managed to gain unauthorized access to "
'Dell’s official website subdomains and leave them defaced. '
"The exploit allowed hackers to inject into the website's "
'database and get the hashed/encrypted password of admins, '
'which would then be cracked to gain access to the website '
'admin control panel, allowing hackers to do anything with the '
'website. Dell investigated the incident and put down the '
'hacked server, the subdomains remain inaccessible.',
'impact': {'data_compromised': ['Admin hashed/encrypted passwords'],
'systems_affected': ['Dell’s official website subdomains']},
'motivation': 'Hacktivism',
'response': {'containment_measures': ['Taking down the hacked server']},
'threat_actor': 'MuhmadEmad (KurdLinux_Team)',
'title': 'Dell Website Subdomains Defaced by Kurdish Hacker',
'type': 'Website Defacement',
'vulnerability_exploited': 'Database Injection'}