5 ms·
"The Guardium alert was triggered by a query from an administrator's account to return the count of rows from a table in the database," Sorenson said. S
by jak92 8y ago
"The Guardium alert was triggered by a query from an
administrator's account to return the count of rows from a
table in the database," Sorenson said.
Such queries are considered dangerous because the software
that runs on top of a database doesn't usually need to make
them.
Really?
- ekimekim 8y ago"Dangerous" is probably the wrong word - anomalous is a better one. Most software doesn't need to know, say, how many entries there are in the Users table. It generally is querying for a specific user, or a range of users with some particular property. It sounds like they had some software watching for any out-of-the-ordinary queries, which they then manually verified with the apparent person who was executing them. When that person had no idea what they were talking about, that's when the red flags went up.
- sigi45 8y agoYour example with the user table is a little bit 'bad'. Because yes i like to see statistics as an admin on how many user acounts are there :P
- deleted 8y ago[deleted]
- SlowRobotAhead 8y agoWell put. I think that anything I personally do while logged into a database when viewed from any higher level going to look anomalous. That said, I wonder if what’s going on here is that the admin account was never supposed to be used directly, so that’s why the alert triggered.
- bluntfang 8y agowell gosh i hope you're not running queries on the command line on a production database.
- EpicEng 8y agoSo you routinely log in as an admin and run sql queries directly on a production DB? That seems quite a bit more "bad" than the example.
- JetSpiegel 8y agophpMyAdmin or something might run on behalf of the administrator and do these queries.
- kakwa_ 8y agoI do it several times per day. When you are maintaining a piece of garbage application, completely undersized, absurdly opened in term of filtering and extremely badly designed, it's the only way to manage this mess, not to mention the times when I have to fix the DB by hand, replaying, with some manual tweaks, queries normaly executed by the application. And unfortunately, I don't think that's so uncommon.
- munk-a 8y agoIt's not particularly common but I've been in some what of a similar situation. If you're a senior techy person I'd suggest taking a bit of time to either find a new position (as I'm sure all of HN would echo, simply for your sanity) or I'd suggest taking that time to assemble a report about how your spend your hours each day and make sure it bubbles up past your manager to someone who deals with money. That sort of situation is constantly costing the company money for no good reason, it'd be fiscally sound to spell out these costs and contrast them with any estimates you could assemble on making the application start working again. Manually replaying queries is expensive, terrible, terrifying, and can potentially break data-integrity really badly.
- ethbro 8y ago> assemble a report about how your spend your hours each day and make sure it bubbles up past your manager to someone who deals with money Assumes poster works at a company where management cares past "Does it work?" That's less rare than it used to be, but HN sometimes underappreciates how much of the economy is still governed by companies with CFOs who couldn't tell you the first thing about their enterprise infrastructure.
- deleted 8y ago[deleted]
- snazz 8y agoThat is strange. If it came from an administrator account, it didn’t come from the software “that runs on top of the database”.
- jak92 8y agoExactly. But an administrator actually may have a use for doing a count statement.
- wyldfire 8y agoSo then an administrator wouldn't be surprised or concerned if an auditor asked them "Hey did you issue this query the other day?"
- snazz 8y agoThat part seems logical, but the query on its own shouldn’t be cause for concern.
- ars 8y agoUse the word "atypical" instead. If your audit system knows that this application never runs such queries, and today it did, it knows something changed and flags it.
- windwake12 8y agoAll properly configured applications should be running with least required db credentials, limiting what they can do. That Accenture was monitoring all administrative level queries against the db makes perfect sense in a locked down production environment.
- wyldfire 8y agoYour question is unclear. IBM designed this product to audit for things that look like signs of an attack/probing and if it generated a lot of false alerts, the product would be worthless. How often do you design a database query to get the count of all rows from a table? It sounds like an uncommon use case, but probably one you could mute from the audit if you do it intentionally.
- ceejayoz 8y ago> How often do you design a database query to get the count of all rows from a table? Any time I paginate a list, so it can show the "x of y pages"?
- omouse 8y agoYou aren't keeping the count somewhere else, in a cache, let's say?
- ceejayoz 8y agoSure, but even if you're caching, you're presumably populating that "how many users do we have" widget's cache at least once a day or so.
- ars 8y agoSpecifically in this case, there's no reason to show a list of all of the users in the system. What would you do with a list with millions of rows? A search makes more sense here.
- ceejayoz 8y ago> What would you do with a list with millions of rows? Not much, but that doesn't mean folks won't. https://stackoverflow.com/questions https://stackoverflow.com/questions says "17,335,212 questions " and the pagination goes "1 2 3 4 5 … 346705", if you want a real-world example.
- bradjohnson 8y ago
- jsight 8y agoSince the table in question isn't mentioned in that quote, is it possible that what was really anomalous was a number of similar queries on somewhat unusual tables? Meaning, something that indicated some software was doing queries that were both unusual and somewhat high frequency?
- cmroanirgo 8y agoMy db security is rather lax, and wouldn't notice an anomalous row count, and certainly wouldn't generate a "red flag" as a result. Anyone know of some lightweight foss monitoring tools that are in this arena? (for single server MySQL setups).
- xemdetia 8y agoFor single host MySQL setups there is the mysql audit plugin and related configuration. It's not perfect but if you already have other SIEM/alert infrastructure it should glue in OK. You'll want to test it to make sure it doesn't interfere with expected SLA's.
- bahmboo 8y agoYou point out what alarmed me. An unknown entity had admin access. That's 5 alarm stuff....but they waited 3 days to look into it. Pasted here again because formatting: "As part of our investigation into the alert, we learned that the individual whose credentials were used had not actually made the query,"
- munk-a 8y agoYea... that's like saying "Oh yea, this attacker did have root access and we checked the logs of what he did and apparently he just logged in and then three hours later he edited some log file and logged out... it's weird he didn't do anything while on the server..."
- borumpilot 8y agoThat is just regular DAM (Database Activity Monitoring). I know few companies use it on even fewer DB's but it can really help to identify "rogue access" to your data. It takes (a lot) of time to tone it down to your specific needs and DB access, but once it is up and running it can trigger at the right time (as in the article). There are different kinds of DAM, inline just reading the network traffic, missing the direct access accounts would have from the DB server itself, and the ones that monitor the DB service memory directly. Of course you could start way cheaper / simpler with some proper logging from the DB software itself. It is a growing security area that is a nice (once tamed) additional information source.