Turkish hacker Jegand has carried out hacking attacks on three European Universities recently, including the Technical University of Dortmund on Wednesday 09.04.2021, gaining unauthorized access to sensitive personal information of teachers and students.
More News: Cybersecurity analysis Research results on the cyberattack in Cyprus
In recent times, there seems to be an underground cyberwar going on in Europe, with Turkey on the offensive. Turkish hackers and hacking groups are opening fire on state and private infrastructure in various European countries.
According to recent revealing investigations by SecNews, Cyprus is in their sights, which they attack at every opportunity. Moreover, they did not fail to mock in their own way the Prime Minister of Greece, Kyriakos Mitsotakis, through a defacement attack on the website of the Ministry of Finance of Libya.
Learn More:
Cyberattack on Larnaca Airport hermesairports.com by RootAyyildiz!
Turkish hacker, RootAyyildiz, "attacks" Kyriakos Mitsotakis via Libya!
Turkish hacker Jegand attacked the information systems of the Technical University of Turkmenistan, the Technical University of Dortmund, one of the largest universities in Germany, and the University of Cologne via Blind SQL Injection, according to exclusive information brought to the attention of SecNews. During these attacks, emails and passwords of admin accounts were stolen, granting unhindered access to databases with sensitive personal information of professors and students.
More specifically, as the hacker claims (not yet confirmed by SecNews at this time) among the breached data we find emails, full names, contact details, passwords, student grades, conversations and email correspondence between professors and students.
Below you will find the relevant screenshots that prove the validity of the attack. The snapshots concern the hacking attack on the Technical University of Dortmund.
Through the above screenshots we observe that the Turkish hacker carried out the successful attack on Wednesday 09.04.2021 and has the ability to tamper with data on the server, to add/remove websites or to spread malicious software to unsuspecting users who use the University's website! Additionally, it is not clear from the screenshots that have been provided regarding the type of personal data that has been extracted and is located on the targeted server.
His identity remains unknown to this day, but he is an aspiring hacker. The Turkish hacker maintains an account on social media , specifically on Instagram.
In a scathing statement on SecNews it says:
« …I used Blind SQL Injection in these attacks. When I say “in these attacks”, I mean attack on the Technical University of Turkmenistan, attack on the Technical University of Dortmund, one of the largest universities in Germany, and attack on the University of Cologne, one of the largest world-famous German universities. I detect the vulnerabilities manually. As you can see, all I target is a university. I specifically targeted universities in the attacks. Now I’m planning bigger attacks, like government agencies or famous brands…. »
Free Translation
“…I used Blind SQL Injection in these attacks. By “in these attacks” I mean the attack on the Technical University of Turkmenistan, the attack on the Technical University of Dortmund, one of the largest universities in Germany, and the attack on the University of Cologne, one of the largest world-renowned universities in Germany. I identified the vulnerabilities manually. As you can see, I am only targeting one university. Generally, I focus on hacking attacks on Universities. Now I am planning larger attacks, such as on government agencies or branded brands…”
See Also: Maybank - Beware of a new fake website circulating
TU Dortmund (Technical University of Dortmund)
The Technical University of Dortmund (Technische Universität Dortmund) is a university with over 20,000 students and over 3,000 staff. Dortmund TU is one of the most renowned technical universities in Europe, well known for its research activity in the departments of physics, chemistry, economics and electrical engineering. It is located a little outside the city centre and is divided into the northern and southern campus. It was founded in 1968 and has since played an important role in the scientific community.
Source: https://www.tu-dortmund.de/
SQL Injection
SQL injection is a code injection technique that allows an attacker to “run” SQL commands against a target server. A successful SQL injection attack allows the execution of any query on the target database, which means the ability to collect sensitive information, such as passwords, usernames, emails, credit card numbers, etc.
These attacks exploit vulnerabilities in web applications that communicate with backend servers that store databases. SQL stands for Structured Query Language. It is a programming language used to insert, manipulate, and retrieve data from an SQL database. Attackers can easily find out, with a few simple commands, if a page is vulnerable to an SQL injection vulnerability. If it is, they will be able to steal data, corrupt it, and even become administrators of the database server.
Learn more: Hackers sell 85,000 SQL databases on the dark web
Prevention measures
- Perhaps the most basic preventive measure is proper design, good construction, and constant monitoring of the database, so that it is not vulnerable to this specific attack.
- Restricting server configuration data: Restricting access to incorrect parameters can reduce the likelihood of an attack on the target server. While it does not offer 100% security, it is a first step in database security.
- Good knowledge of all SQL Servers on the network by administrators: First, administrators should know how many SQL servers are on the network. This process may not be as simple as it seems, as the majority of servers operate on dynamic TCP ports and usually these servers operate only when the user “needs” them. Therefore, some servers may not be active. To find all SQL Servers, SQL ping, SQL scan and more specialized software could be used.
- Continuous updates. Software companies frequently release updates to fix potential vulnerabilities. Therefore, organizations must make sure to update the applications, software, and systems they use in general to stay secure.
- Denying access to specific server ports by unknown users: It does not offer absolute security, especially against SQL injection attacks, but it is an important security measure for the entire network of a company or organization. For example, closing UDP Port 1434 [this port is used for mapping Microsoft SQL databases (Microsoft SQL monitor database)] and all TCP ports on which SQL Server “listens” can enhance security.
- Adopt strong admin passwords. Using a strong password can prevent brute force, SQL injection, and many other attacks. It is also recommended to change them frequently.
