4 ms·

But only with a modified MySQL server.

DougBTX 8y ago
Or rephrased, this is an attack on a vulnerable MySQL client by a malicious MySQL server, rather than a more typical “client attacks server” threat.
- kijin 8y ago
  It sounds similar to the recently discussed scp vulnerability [1] where a malicious SSH server could drop files onto the client. [1] https://news.ycombinator.com/item?id=18909289 https://news.ycombinator.com/item?id=18909289
- weknowbetter 8y ago
  "Server attacks client" is pretty common with web browsers. Probably more common than the other way around. Much less common with Database clients of course.
ryebit 8y ago
Yeah, i definitely think common workflow rarely involves connecting to untrusted servers. But... If server gets hacked, connecting in to see why your site is down could steal files before you know what happened. Even better if hack isn't visibly causing problems. Though that seems really indirect and unproductive an attack vector. But sounds great for a honeypot. Put up an easy-to-hack WordPress server, and when attacker connects to mysql, start downloading all the PII files you can think of from the client.
- iancarroll 8y ago
  And of course, this article is about how the Adminer database tool was weaponized with this vulnerability to steal data.
- zAy0LfpBZLC8mAC 8y ago
  What is it with this concept of "(un)trusted servers" that people throw around here all the time that seems to build on the assumption that the world consists only of entities that are to be distrusted and those that should have full access to and control over all your information and resources? No, just because I don't expect my client to kill me, does not mean that therefore there is no reason to be concerned about a rogue employee of theirs being able to gain access to any other of my clients' servers that I have access to by patching an exploit into their MySQL server. Nor is it reasonable to assume that everyone is on top of their IT security and their infrastructure is only under their own control, and that includes your own organization once it grows beyond one or two people. If that is the kind of mental model you are working with, your IT security probably is shit. Even the slightest external vulnerability anywhere in your systems or the systems of people whose systems you access/(co-)manage is going to grant an attacker total control over your organization if that is how you manage security.
- ivanhoe 8y ago
  Is there really such thing as a trusted server? Any server could have been hacked, it's not something that's under your control, so it's better to be a bit more paranoid about this.
deleted 8y ago
[deleted]
joelhaasnoot 8y ago
If you're running a e-commerce site, why would you connect to a rogue MySQL server? I've never had that urge...
gpvos 8y ago
Yes, so if your server has been hacked, you now also have been hacked. It's not the most common scenario, but it would be good to protect against it in the interest of defense-in-depth.

Or rephrased, this is an attack on a vulnerable MySQL client by a malicious MySQL server, rather than a more typical “client attacks server” threat.

kijin 8y ago
It sounds similar to the recently discussed scp vulnerability [1] where a malicious SSH server could drop files onto the client. [1] https://news.ycombinator.com/item?id=18909289 https://news.ycombinator.com/item?id=18909289
weknowbetter 8y ago
"Server attacks client" is pretty common with web browsers. Probably more common than the other way around. Much less common with Database clients of course.

ryebit 8y ago

Yeah, i definitely think common workflow rarely involves connecting to untrusted servers. But... If server gets hacked, connecting in to see why your site is down could steal files before you know what happened. Even better if hack isn't visibly causing problems. Though that seems really indirect and unproductive an attack vector. But sounds great for a honeypot. Put up an easy-to-hack WordPress server, and when attacker connects to mysql, start downloading all the PII files you can think of from the client.

iancarroll 8y ago
And of course, this article is about how the Adminer database tool was weaponized with this vulnerability to steal data.
zAy0LfpBZLC8mAC 8y ago
What is it with this concept of "(un)trusted servers" that people throw around here all the time that seems to build on the assumption that the world consists only of entities that are to be distrusted and those that should have full access to and control over all your information and resources? No, just because I don't expect my client to kill me, does not mean that therefore there is no reason to be concerned about a rogue employee of theirs being able to gain access to any other of my clients' servers that I have access to by patching an exploit into their MySQL server. Nor is it reasonable to assume that everyone is on top of their IT security and their infrastructure is only under their own control, and that includes your own organization once it grows beyond one or two people. If that is the kind of mental model you are working with, your IT security probably is shit. Even the slightest external vulnerability anywhere in your systems or the systems of people whose systems you access/(co-)manage is going to grant an attacker total control over your organization if that is how you manage security.
ivanhoe 8y ago
Is there really such thing as a trusted server? Any server could have been hacked, it's not something that's under your control, so it's better to be a bit more paranoid about this.

deleted 8y ago

[deleted]

joelhaasnoot 8y ago

If you're running a e-commerce site, why would you connect to a rogue MySQL server? I've never had that urge...

gpvos 8y ago

Yes, so if your server has been hacked, you now also have been hacked. It's not the most common scenario, but it would be good to protect against it in the interest of defense-in-depth.