Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't know that deleting it will do much good. Most web apps for performance reasons don't actually do a delete against the database, rather mark a record as deleted and perhaps run a batch job later to clean deleted records from the database. If you've got access to the database via SQL injection, you'll have access to all those "deleted" records as well. Even of you go through the website and update each field with empty, anonyomoua, or incorrect data; I suspect there's a high chance of backups being available to anyone who's 0wned their servers...

My advice would be to assume any data Sony has about you is already in the hands of attackers, and do whatever you can to minimize the usefulness of that to the attackers (which largely means ensure the password you used at any Sony site isn't useable anywhere else online)



Alternatively, you could SQL inject their databases yourself and personally delete your information.


Anything less would not qualify as due diligence!


Remember, these people make websites vulnerable to SQL injections in the year 2011. They might not have the best backup strategies.


Heh - yeah maybe... I was imagining a shared hosting cpanel account with a bunch of dated backup.tgz files sitting in the home directory which only ever get removed when the webhost complains about disk space usage...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: