Slashdot Mirror
Why Old SQL Worms Won't Die
narramissic writes "In a recent ITworld article, Security researcher Brent Huston ponders how it is that versions of SQL worms dating back to 2002 represent nearly 70% of all malicious traffic on the Internet today. 'I have made a few attempts to backtrack hosts that perform the scans and at first blush many show the signs of common botnet infections. Most are not running exposed SQL themselves, so that means that the code has likely been implemented into many bot-net exploitation frameworks. Perhaps the bot masters have the idea that when they infiltrate a commercial network, the SQL exploits will be available and useful to them? My assessment team says this is pretty true. Even today, they find blank "sa" passwords and other age-old SQL issues inside major corporate clients. So perhaps, that is why these old exploits continue to thrive."
cut them in half and now you just have 2 worms! stop the madness!
It's hard to believe that's how Micronians are made. Why don't we see it right now by having you both kiss one another?
They just fade away... into am obscure mess of system tables/schema of new releases and older hardware and unpatched servers for old releases.
Besides, you can't kill what's isn't "alive"...
Ask not what you can do for your country. Ask what your country did to you
You mean that people are still exploiting 'exploits' that were never fixed? Shocking! And passwords will always be a problem. There will always be people who never change the default passwords so that will always be a viable mode of attack.
Lose: misplace or fail || Loose: not bound together
Presumably, the sysadmins at those companies are at least semi-competent, given that they've blocked SQL access from outside--but why is it that the various vulnerabilities have not been patched?
Is it perhaps because SQL is not something that is particularly high-profile patchwise, unlike operating systems and webservers? Or are unauthorized users running various SQL databases for internal department issues or whatnot, outside the official purview of the IT departments? Or perhaps is it a case that the administrators of the databases are simply unaware that they can be compromised in this fashion?
In Xanadu did Kubla Khan
A stately pleasure dome decree
Trying SA,"" is cheap. Why wouldn't you try it?
that you need to take a stick, wind it around the worm, and slowly pull the worm out over a period of a couple of months. If you pull too hard it will break. So you need to be patient. I think this is a metaphor for life and computers, though a little diethylcarbamazine will make the infestation much more pleasant.
Comment removed based on user account deletion
I've wondered about this before. Perhaps server software vendors need to come up with a better default password scheme than just a blank password, or even a static, generic password like 'admin', or 'linksys'. Something where a unique password is generated for every machine during installation, displayed to the user, then saved to a text document on their desktop or a standard 'repository' for the passwords (something like KeePass, Apple's keychain, etc, where you provide a master password to lookup the current password).
Something. I'm just brainstorming here, so I'm sure someone could come up with something that is better in the particulars, but the principal, I think, is good - don't use a known default password that is the same for every installation of a server product. That will shut down a heck of a lot of problems like this.
Actually, if you forced everyone, upon installing/activation/account generation to implement a passcode, then this would not be as much of a problem. (And by force, I mean this program will not install or run; or the user's account will not be created unless the user creates a password).
[insert witty comment here]
What can I say? Team 17 made it a fun, accessible, simple yet requiring thought and strategy. The later 3D versions had problems with the camera, and the humor never matched up to the original.
Most of mine lately are the windows RCP exploits and the exploit for old symantec overflows on port 2967. That, or I used to get a lot of traffic from SSH brute force attacks and malicious HTTP stuff... Do you mean RPC? (Not trolling, I was really confused and that's the explanation that makes most sense to mean.)
I can imagine a legacy system never getting patched because everyone is afraid that it won't boot up properly or they need it up 100% of the time.
I can imagine a blank password due to struggling with ignorant users and bad application coding.
Your metaphor is creepy. I won't be using it in any marketing campaigns.
If you mod me down, I shall become more powerful than you could possibly imagine.
The First of many...
Ask not what you can do for your country. Ask what your country did to you
I'm surprised by this article. I thought it was common knowledge that botnets are full of these old exploits. The guessed purpose is exactly what's going on. Worms these days don't spread as rapidly as they used to on the wild internet because botnets are serving a purpose -- they are making somebody money. If they spread like wildfire on the internet as a whole, they would attract too much attention, and get cleaned up. They can't get into most corporate networks using worm probes, either, but they can and do get in by exploiting browsers, as email attachments, and so forth. Once inside, they probe around looking for all manner of things. It's not just SQL exploits, either. I'd guess the sample data they looked at was biased somehow. Maybe some big botnet was running a sweep with those particular exploits during the sample period.
If you mod me down, I shall become more powerful than you could possibly imagine.
> I used to get a lot of traffic from SSH brute force attacks
/etc/hosts.deny. Good times.
Yup. One of the first bits I install on a new server is DenyHosts; "service denyhosts start" and an hour later there are a half dozen IPs in
The Army reading list
I used to get a lot of brute force SSH attacks as well when I was running a Linux server. I was glad that I ONLY allowed access via public key exchange and not passwords.
Because 0ld SQ00l never dies!!
*rimshot*
Ubuntu is an African word meaning 'I can't configure Debian'
Let's see. Viable infection vectors are still being used. This is kinda common sense. I expect to see a Phd paper on it next week.
Let's compare this to medical infection vectors. There is sexual, by touch, by air, by liquid/drink, or by food. I can't really think other disease transmission ways. We've got what millions of bacteria/viruses spreading by those means every second. As long as its still effective, it'll still be in use.
I think of net security sort of like keeping a eco system healthy and without too many hostile diseases/organisms about.
Humans don't have to worry about too many predators because we kill off any thing that tries to kill us. We've only recently become aware of microscopic things trying to kill us. So it's not surprising if we'd try to kill off all the diseases that usually attack us before they get us. We aren't too good at it, yet. There is a part of me that thinks that one of the reasons that we'll finally crack nano machines is that we'd have our unofficial war on all disease and spend trillions on it.
Now apply that thinking to the virtual world. Currently, we can only be economically hurt by ID theft through security breaches. I guess there is potential to get really upset if your medical info or other private stuff is leaked in a breach, but we generally can live through it and since we do "live through it" we can scream bloody murder at the people/companies responsible to stop that behavior in the future. Worse comes to worse we can even take political action and get the government to do something.
Our whole virtual ecosystem isn't very old. Wait for it to get a few decades older and then let's see if these same attacks are still around. How many attacks from the 70s or 80s are still floating around and effective? I wouldn't be surprised it all to find 90s stuff targetting win95/win98 computers still around.
You apparently did a little too much LDS during college.
The safer(imo) is to make the product do almost nothing until the default password is changed. However, most vendors like to advertise "works out of the box!" so the odds of this happening are about 0....
Monstar L
Yeah, too much of those Latter Day Saints can really ruin your life.
Escher was the first MC and Giger invented the HR department.
And why shouldn't some malicious attacker use every single exploit they've ever written/downloaded/stolen in their botnet payload? It's not like they're really concerned about bandwidth or CPU loads.
UTF-8: There and Back Again
Uh.....so what is so special about SQL? Why are SQL worms so prevalent compared to C worms, or PHP worms, or Java worms, etc...?
... but surely they're easier to spot. If you're pasting values into an SQL string instead of using named/positional parameters, you're vulnerable. That sort of thing should be much easier to do an automated search for in your source than buffer size tracking through C sources.
OK, so SQL injection doesn't require the kind of in-depth knowledge to exploit that buffer overflows in C do, so I imagine SQL exploits might be easier to craft to begin with
Also, does anyone else think the following does not make much sense: "Most [botnet hosts that perform the scans] are not running exposed SQL themselves..."? Why not "...running badly-written SQL..." or "vulnerable SQL"? Seems like a really weird choice of words.
Why doesn't the gene pool have a life guard?
I used to use denyhosts on a remote machine until I nearly locked myself out while trying to set up a svn+ssh client (I had the syntax wrong).
The only reason I wasn't locked out is because I had an open SSH session currently in progress.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
For hardware like home NAT routers and the like, I'd just print the default password on the label, right next to the serial number -- or just use the serial number as the default password.
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
Instead of disabling passwords completely to stop the brute force SSH attacks, I disable password authentication but leave public key and keyboard-interactive enabled. Keyboard-interactive is just a fancy way to request a password by default, but won't work with the brute force attacks I've seen so far. It's not going to work forever, but seems to be effective for now.
> I nearly locked myself out while trying to set up a svn+ssh client
:-)
Yeah, that's a bad feeling. But the good thing is that you can usually ssh in from some other subnet. Unless you've already set up AllowHosts or something, in which case, yeah, a drive to the colo is in your near future
The Army reading list
Besides, it's hard to teach an old worm new tricks.
Blood to blood contact (fairly rare, thankfully -- mostly of a concern to medical workers)
.ru namespace look like a threat-free Eden.)
Parasitic infection (mosquito is carrier of malaria, mosquito bites you, etc)
Pathogen touches skin (thankfully, we're pretty robust against this, but it worths for some pathogens and for folks with weakened immune systems. You might be familiar with planter's warts, athlete's foot, etc.)
Pathogen enters through compromise in skin (nick finger, open floodgates)
etc, etc
Basically, all you need for an infection is to get a pathogen inside a cell it can infect. A vector can be anything that compromises your body's numerous and insanely effective defenses against that happening. (Oh sure, we get sick fairly frequently from our point of view, but we're walking around in a lethal organic soup for every minute of our lives. That tabletop you just disinfected makes the
Help poke pirates in the eyepatch, arr.
I just run the sshd on a different port. That way if someone targets my sshd, I KNOW something unusual is going on.
:).
If someone writes a "zero day" worm, they are likely to stick to the default ports to maximize the spread speed. So that means I have more time to fix the affected service.
There are people who think obscurity isn't useful, and there are people who genuinely have more time to read Slashdot
I have several SQL Server 2000 boxes that are totally unpatched -- they're at the RTM level. They are theoretically vulnerable to Slammer, I have to have faith that my network security guys know what they're doing.
Yes, I've jumped through the hoops, put in requests, submitted an action plan along with a failure plan. He hasn't done anything. So there my servers sit, vulnerable.
At least I have the paperwork to show that I tried.
It's not good because serial Numbers are err.... serial.
You could of course print a somewhat random formula to be used as a hash function to be fed with the serial. The user would have to calculate this by hand to find out the default password. Anything involving partial differential equations would nicely fit this purpose with the advantage of being utterly user-friendly.
Your ad could be here!
Doesn't matter if they're sequential -- if there are a hundred thousand Linksys WRT54Gs out there, that's a hundred thousand passwords you'll have to try for each router you're attacking.
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.