Ransomware attacks targeted hundreds of MySQL databases
Watch Out For Fake Fonts! And Other Small Business Tech News This Week
February 27, 2017
Can AMD Outrun Intel Once Again This Year?
March 3, 2017
Hundreds of MySQL databases were hit in ransomware attacks, which were described as “an evolution of the MongoDB ransomware attacks;” in January, there were tens of thousands of MongoDB installs erased and replaced with ransom demands. In the new attacks, targeted MySQL databases are erased and replaced with a ransom demand for 0.2 bitcoin, which is currently equal to about $234.
The attacks, which began on February 12 and lasted 30 hours, were all traced back to one IP address, 109.236.88.20; it belongs to WorldStream, a web hosting company based in the Netherlands. The web hosting company was notified of the attacks; GuardiCore suspects the attacker was “running from a compromised mail server which also serves as HTTP(s) and FTP server.”
GuardiCore reported that the attack starts with brute-forcing the root password for the MySQL database. Once logged in, the MySQL databases and their tables are fetched.
There are two variants of attacks. In one, a new table called “WARNING” is added to the existing database; it includes an email address, a 0.2 bitcoin ransom demand and a bitcoin address.In the other, a table called “PLEASE_READ” is added to a newly created database. GuardiCore added, “The attacker will then delete the databases stored on the server and disconnect, sometimes without even dumping them first.”
The ransom note labeled as “please_read” claims the database is backed up to the attacker’s servers. Victims are instructed to pay the 0.2 BTC ransom and to contact backupservice@mail2tor.com with an email listing either the affected IP or database name.
The other “warning” demands the 0.2 BTC payment be made and for victims to then visit a darknet site via the Tor browser. The site asks for the IP of the ransomed server to be entered before clicking to “check payment and get a link to the database dump.”
Two different bitcoin wallets were used, one for each version of the ransom message; at least some of the victims paid.
“Before paying the ransom,” GuardiCore wrote, “we strongly encourage you to verify that the attacker actually holds your data and that it can be restored. In the attacks we monitored, we couldn’t find evidence of any dump operation or data exfiltration.
GuardiCore recommended hardening MySQL servers to prevent the attack and to ensure the servers require authentication and use strong passwords. There are a plethora of articles online for how-to-secure MYSQL databases from attackers as well as those describing security best practices. There are also monitoring services, such as those available via GuardiCore.
Via: NetworkWorld : http://www.networkworld.com/article/3174306/security/ransomware-attacks-targeted-hundreds-of-mysql-databases.html
The attacks, which began on February 12 and lasted 30 hours, were all traced back to one IP address, 109.236.88.20; it belongs to WorldStream, a web hosting company based in the Netherlands. The web hosting company was notified of the attacks; GuardiCore suspects the attacker was “running from a compromised mail server which also serves as HTTP(s) and FTP server.”
GuardiCore reported that the attack starts with brute-forcing the root password for the MySQL database. Once logged in, the MySQL databases and their tables are fetched.
There are two variants of attacks. In one, a new table called “WARNING” is added to the existing database; it includes an email address, a 0.2 bitcoin ransom demand and a bitcoin address.In the other, a table called “PLEASE_READ” is added to a newly created database. GuardiCore added, “The attacker will then delete the databases stored on the server and disconnect, sometimes without even dumping them first.”
The ransom note labeled as “please_read” claims the database is backed up to the attacker’s servers. Victims are instructed to pay the 0.2 BTC ransom and to contact backupservice@mail2tor.com with an email listing either the affected IP or database name.
The other “warning” demands the 0.2 BTC payment be made and for victims to then visit a darknet site via the Tor browser. The site asks for the IP of the ransomed server to be entered before clicking to “check payment and get a link to the database dump.”
Two different bitcoin wallets were used, one for each version of the ransom message; at least some of the victims paid.
“Before paying the ransom,” GuardiCore wrote, “we strongly encourage you to verify that the attacker actually holds your data and that it can be restored. In the attacks we monitored, we couldn’t find evidence of any dump operation or data exfiltration.
GuardiCore recommended hardening MySQL servers to prevent the attack and to ensure the servers require authentication and use strong passwords. There are a plethora of articles online for how-to-secure MYSQL databases from attackers as well as those describing security best practices. There are also monitoring services, such as those available via GuardiCore.
Via: NetworkWorld : http://www.networkworld.com/article/3174306/security/ransomware-attacks-targeted-hundreds-of-mysql-databases.html
