6 ms·
Israeli Cyber Experts Uncover Attack on 85,000 MySQL Servers
- base3 6y agoPuff piece with no technical details. This reads like a press release.
- nobody9999 6y ago>Puff piece with no technical details. This reads like a press release. Fair enough. Here's a better link: https://threatpost.com/please_read_me-ransomware-mysql-servers/162136/ https://threatpost.com/please_read_me-ransomware-mysql-serve... I am unable to change the URL in the submission. Perhaps someone with appropriate privileges could do so?
- SlipperySlope 6y agoBrute force password attack on a [public] MySQL TCP port. Prevented by configuring MySQL for localhost connections only? Then if need be, set up a SSH tunnel to the port from other servers.
- itsthefnlacctdn 6y agoI'd like to think they are trying to balance the negative rep they've been getting from NSO in the media lately. Israeli are known to keep a firm grip on narratives.
- sacks2k 6y agoThis has been going on for at least a couple of years. I ran into it with redis servers last year. They search for servers with simple/no passwords, lock up the data, and demand BTC to get it back.
- achillean 6y agoI've stopped writing blog posts on it because it's still going on and there's not much new to add: https://blog.shodan.io/its-still-the-data-stupid/ https://blog.shodan.io/its-still-the-data-stupid/ You can search for Redis instances that have disabled authentication and have a "crackit" key stored in them which is created by one of those Redis malware bots: https://beta.shodan.io/search?query=crackit https://beta.shodan.io/search?query=crackit I'll add that the vendors have actually gotten much better! Redis and MongoDB both now have good, secure defaults. And I believe both will throw you a huge warning if you're listening on 0.0.0.0 w/out authentication.
- 1cvmask 6y agoI love the favicon map: https://faviconmap.shodan.io/ https://faviconmap.shodan.io/
- achillean 6y agoSomething I didn't expect were the number of developers that hadn't heard of favicons before. Got quite a few people asking what those icons were. Btw there are security use-cases around them as well nowadays (ex. detecting phishing websites).
- 1cvmask 6y agoDo the crooks forget to add favicons to their phishing sites? Favicons can be a single image or multiple images. Here is a good recent thread on it on HN. Will put the map there as well come to think of it. https://news.ycombinator.com/item?id=25520655 https://news.ycombinator.com/item?id=25520655
- achillean 6y agoNo, very often they do add the favicons! That makes it easier to locate websites that are outside of your expected IP space but are pretending to belong to you. For example: https://beta.shodan.io/search?query=http.favicon.hash%3A708578229+-org%3Agoogle+port%3A80+http.status%3A200 https://beta.shodan.io/search?query=http.favicon.hash%3A7085... It takes a bit more refining to get a good list of results; the general idea is to find websites that look like the real deal but are located somewhere on the Internet where you didn't expect to find them.
- tarsinge 6y agoI got the same thing with Postgres. It was on a toy project learning Docker Compose, naively used PORTS instead of EXPOSE on the DB container. Also the CPU of the Postgres process was at 100% so maybe I got some crypto miner too.
- easytiger 6y agoThe amount of brute forcing attempts on servers of all and any kinds I run is absolutely nuts. But yes they are often trying only a small number of common accounts/passwords. I keep meaning to sit down and do a bit of analysis on the source of the connections.
- jstarfish 6y agoYou'll find most of them coming from M247 or other anonymous-VPN relays.
- Jerry2 6y agoHere is the source of all these articles with actual technical info on the attack: https://www.guardicore.com/labs/please-read-me-opportunistic-ransomware-devastating-mysql-servers/ https://www.guardicore.com/labs/please-read-me-opportunistic...
- jlgaddis 6y agoAs noizejoy pointed out [0]: > That site’s history with HN [1] isn’t exactly confidence inspiring. Unfortunately, guardicore.com's "reputation" [2] isn't much better! Of all the articles on this topic linked in this thread, the one from ThreatPost [3] is probably the "most reputable" as far as I'm concerned. -- [0]: https://news.ycombinator.com/item?id=25524954 https://news.ycombinator.com/item?id=25524954 [1]: https://news.ycombinator.com/from?site=srnnews.com https://news.ycombinator.com/from?site=srnnews.com [2]: https://news.ycombinator.com/from?site=guardicore.com https://news.ycombinator.com/from?site=guardicore.com [3]: https://threatpost.com/please_read_me-ransomware-mysql-servers/162136/ https://threatpost.com/please_read_me-ransomware-mysql-serve...
- noizejoy 6y agoThat site’s history with HN[0] isn’t exactly confidence inspiring. [0] https://news.ycombinator.com/from?site=srnnews.com https://news.ycombinator.com/from?site=srnnews.com
- tzs 6y agoYou cannot infer anything useful about that site from that. All of those prior submissions were from user 'dulo'. If you check their history, all 153 submissions of theirs are dead. This includes submissions from such publications as the Washington Post, USA Today, Popular Science, Fortune, Slate, a whole bunch of newspapers from fairly major cities, and much more. Most of them seem to be reasonable submissions, too. They were all within about a month or so of each other, starting right after the account was created, and mostly happened in large batches. It seems highly likely they tripped some anti-spam or anti-flooding detector and the user was perma-banned and all their submissions instantly killed.
- noizejoy 6y agoIf I was paid to “promote” a dodgy publication, I would certainly mask my efforts by submitting many respectable links. So, if the only submitter of that site (until this submission) got marked for unsavoury HN activities, it rather strengthens the case against that site. Coupled with the current top comment[0], I’m inferring quite a bit about that site. [0] https://news.ycombinator.com/item?id=25524177 https://news.ycombinator.com/item?id=25524177
- blisterpeanuts 6y agoIt's discouraging that so many companies don't back up their data.
- TedShiller 6y agoOr that they’re still using MySQL instead of Postgres
- oliwarner 6y agoAnd that they're leaving database servers globally accessible. I do understand the need for network access but I'd never rely on the authentication frameworks (of any database server) to handle this. Limited network access or a front-end API (itself with limited access). Never expose your data source if you don't have to.
- mbiondi 6y agoAgreed, it's interesting that there are this many databases exposed directly to the internet. Hasn't anyone heard of defense in depth and proxy servers?
- kjaftaedi 6y agoThe article said nothing about data backups. They say the victims are buying their data back to prevent it being sold to a third-party.
- blisterpeanuts 6y agoFrom the article: "Once they’re in the database, they steal the data, send it to their own servers and then delete it from the local machines," Harpaz continued. "The victim has to pay a ransom for the data to be returned." Elsewhere in the article: "Once hackers manage to steal the data, it is posted on a website and sold to the highest bidder unless the victim agrees to pay a ransom of roughly $500." I conclude that we're both right :) They delete "from the local machines" which I interpret to be the victim's server. If the victims had had data backups, as simple as a daily cron task that calls mysqldump, presumably they would be unconcerned about restoring their data. However, they would still worry about their data being sold. Since there's zero guarantee that the thieves will take down the data for the $500 fee, it seems pointless to pay them. They could come back in a month and say "you owe us another $500". Or just go ahead and sell the data anyway.
- FreshFries 6y agoTechnical "details": “The attack starts with a password brute-force on the MySQL service. Once successful, the attacker runs a sequence of queries in the database, gathering data on existing tables and users,” said Ophir Harpaz and Omri Marom, researchers with Guardicore Labs, in a Thursday post. “By the end of execution, the victim’s data is gone – it’s archived in a zipped file which is sent to the attackers’ servers and then deleted from the database.”
- FDSGSG 6y agoHow does one "uncover" a noisy ransomware attack?
- kjaftaedi 6y agoNot opening your databases to the internet and not using dictionary based passwords would be a good start. Other than that you need to invest time and effort into an IDS that suits your environment.
- tyingq 6y agoI wonder if they've found some targeted way of cracking mysql passwords. Perhaps some large hosting services use a predictable way to hand out passwords? 85,000 sounds like perhaps a lot of wordpress database instances.
- cblconfederate 6y ago--skip-networking
- Something1234 6y agoWhat are you talking about?
- mike22 6y agoThe command line flag to mysqld that tells it to start without network protocols enabled. At that point you can only connect from a process local to that server (https://dev.mysql.com/doc/refman/8.0/en/server-system-variables.html#sysvar_skip_networking https://dev.mysql.com/doc/refman/8.0/en/server-system-variab...), so this attack vector is closed. But with poorly secured SSH/Apache/PHP/WordPress on the box it’s still trivial to get pwn’ed...
- tinus_hn 6y agoDoes MySQL still listen to the internet by default?
- Just1689 6y agoFor some time now, having installed it, it does not listen by default on 0.0.0.0 (all addresses) but instead on 127.0.0.1 - so the answer is no.