6 ms·

It's amazing that in 2018 people leave databases publicly exposed.

by jacob019 9y ago

maffydub 9y ago
I think this was a honeypot, so you want to expose it to make it an easy (or at least easier) target, don't you?
- FLUX-YOU 9y ago
  Correct, here is part 1 and 2: https://www.imperva.com/blog/2018/02/database-attacks-sql-obfuscation/ https://www.imperva.com/blog/2018/02/database-attacks-sql-ob... https://www.imperva.com/blog/2018/02/deep-dive-database-attacks-part-ii-delivery-execution-malicious-executables-sql-commands-sql-server/ https://www.imperva.com/blog/2018/02/deep-dive-database-atta...
- goshx 9y ago
  By the end of the article the author mentions that there are thousands (700k+) exposed installations.
  - merb 9y ago
    Yeah exposed to the internet. While most of them were from AWS RDS probably. Which actually forbids using untrusted Languages.
chillidoor 9y ago
Shit happens. Sometimes it's an oversight, sometimes it's accidental, sometimes it's from ignorance to the dangers. Sometimes it's even a honeypot, like this time :)
oneweekwonder 9y ago
Up until late 2017 mongodb ransomware issue was still a issue[0]. [0]: http://www.zdnet.com/article/mongodb-ransacking-starts-again-hackers-ransom-26000-unsecured-instances/ http://www.zdnet.com/article/mongodb-ransacking-starts-again...
xyrouter 9y ago
I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly? I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic. I guess exposing web-apps on the Internet is a risk we need to accept because it has to be available to users of the Internet. But we should not expose anything else that we don't need to? Is that the reason why exposing databases publicly is considered best practice. I would like to know what experienced professionals think about this.
- brightball 9y ago
  A web app has a connection to a database that can be limited to its exact permission needs, input can be sanitized, database execution can be limited to exactly what the interface has available. Apps can also use connection pools to manage limits of the database. If the database itself is publicly exposed, even if a read only connection with access to an empty table is provided an attacker could simply max out the connection pool to kill your application. If a vulnerability was published or a password with more access was available they can not only access all of your data but they can corrupt it and/or delete it. SQL injection has been pretty trivial to stop for a couple of decades now.
- yjftsjthsd-h 9y ago
  I think you've hit it; never expose anything without good reason, and the database doesn't need to be exposed. This is compounded because, while apps can have injection vulnerabilities, I expect it to be easier to sanitize things at that level rather than exposing the database but expecting it to filter things enough. Or if you prefer: The failure mode of an app is that it passes raw (escapable) queries to the database. If you expose the DB, then raw queries are the starting line.
- james-mcelwain 9y ago
  > But we should not expose anything else that we don't need to? Yes. Why would you ever need public logins from the open internet to your production database? Even if you need to ability to log in from a random computer, there are better ways, like requiring the use of a vpn so logins are always coming from a white listed ip.
3pt14159 9y ago
It’s because of the stupid overhead that SSH has out of the box and the complexity of installing and managing db certs. A db admin will say “eh it’s fine; we’ll just use iptables to restrict it to prod server” and then somewhere along the way they’ll get a second prod server and someone junior will somehow fuck it up then the whole thing is open. It’s really hard to move fast and stay secure. You have to nail so many things and you’re either running out of money or running out of time 99% of the time.
- s73v3r_ 9y ago
  I'm going to strongly disagree with that point. You can; you just have to prioritize security.

It's amazing that in 2018 people leave databases publicly exposed.

maffydub 9y ago

I think this was a honeypot, so you want to expose it to make it an easy (or at least easier) target, don't you?

FLUX-YOU 9y ago
Correct, here is part 1 and 2: https://www.imperva.com/blog/2018/02/database-attacks-sql-obfuscation/ https://www.imperva.com/blog/2018/02/database-attacks-sql-ob... https://www.imperva.com/blog/2018/02/deep-dive-database-attacks-part-ii-delivery-execution-malicious-executables-sql-commands-sql-server/ https://www.imperva.com/blog/2018/02/deep-dive-database-atta...
goshx 9y ago
By the end of the article the author mentions that there are thousands (700k+) exposed installations.
- merb 9y ago
  Yeah exposed to the internet. While most of them were from AWS RDS probably. Which actually forbids using untrusted Languages.

chillidoor 9y ago

Shit happens. Sometimes it's an oversight, sometimes it's accidental, sometimes it's from ignorance to the dangers. Sometimes it's even a honeypot, like this time :)

oneweekwonder 9y ago

Up until late 2017 mongodb ransomware issue was still a issue[0]. [0]: http://www.zdnet.com/article/mongodb-ransacking-starts-again-hackers-ransom-26000-unsecured-instances/ http://www.zdnet.com/article/mongodb-ransacking-starts-again...

xyrouter 9y ago

I want to know why exposing databases on the Internet publicly is considered a problem. Is it because a vulnerability found in a database would allow to exploit the database directly? I ask this because people expose web-apps on the Internet publicly too and an SQL injection vulnerability on the web-app would also be equally catastrophic. I guess exposing web-apps on the Internet is a risk we need to accept because it has to be available to users of the Internet. But we should not expose anything else that we don't need to? Is that the reason why exposing databases publicly is considered best practice. I would like to know what experienced professionals think about this.

brightball 9y ago
A web app has a connection to a database that can be limited to its exact permission needs, input can be sanitized, database execution can be limited to exactly what the interface has available. Apps can also use connection pools to manage limits of the database. If the database itself is publicly exposed, even if a read only connection with access to an empty table is provided an attacker could simply max out the connection pool to kill your application. If a vulnerability was published or a password with more access was available they can not only access all of your data but they can corrupt it and/or delete it. SQL injection has been pretty trivial to stop for a couple of decades now.
yjftsjthsd-h 9y ago
I think you've hit it; never expose anything without good reason, and the database doesn't need to be exposed. This is compounded because, while apps can have injection vulnerabilities, I expect it to be easier to sanitize things at that level rather than exposing the database but expecting it to filter things enough. Or if you prefer: The failure mode of an app is that it passes raw (escapable) queries to the database. If you expose the DB, then raw queries are the starting line.
james-mcelwain 9y ago
> But we should not expose anything else that we don't need to? Yes. Why would you ever need public logins from the open internet to your production database? Even if you need to ability to log in from a random computer, there are better ways, like requiring the use of a vpn so logins are always coming from a white listed ip.

3pt14159 9y ago

It’s because of the stupid overhead that SSH has out of the box and the complexity of installing and managing db certs. A db admin will say “eh it’s fine; we’ll just use iptables to restrict it to prod server” and then somewhere along the way they’ll get a second prod server and someone junior will somehow fuck it up then the whole thing is open. It’s really hard to move fast and stay secure. You have to nail so many things and you’re either running out of money or running out of time 99% of the time.

s73v3r_ 9y ago
I'm going to strongly disagree with that point. You can; you just have to prioritize security.