Tag: security

Do you have a login on any of your SQL Server instances that is named “default”? If you do, you might have an issue with the MrbMiner malware that has infected a number of SQL Server instances. This adds a login with the name of default and the password of “@fg125kjnhn987.”.

Stop and double check your instances now. If you use SQL Monitor, you can also add this custom metric to your alerts to look for this on an ongoing basis.

I don’t know this is a SQL Server problem. It’s really a user/administrator issue. This works by looking for weak passwords, which is always a problem. It’s also an issue if you have an exposed SQL Server connected directly to the Internet. Shodan shows lots of SQL Servers on the Internet, and if you own any, you might be sure you have *very* strong passwords.

Or remove them from public Internet access.

While this is easy to detect, what if the login were stevejones? Can you detect if logins are added to your SQL Server. Sure you can, but would you really notice something strange? On my instances, where I add all logins, I would. In many organizations where I’ve worked, more than one person added logins, and logins could be added on a regular basis. Often these are associated with tickets in some system, like Jira, but even if they are, would you know an extra one got added?
I bet most people wouldn’t notice, especially across their estate and with a team of administrators.

That’s a problem, and it’s one where we ought to perhaps have good controls in place. There are a few places I know where every change is submitted to a pipeline of sorts, meaning that everything is logged, and given the integration with release management tools and ticketing systems, things could be audited. Maybe more importantly, approved logins could be added to a list that might be compared with the actual list on a server.

Possible, but not necessarily simple to implement or get right. Maybe the low tech solution I’d use is a daily report that included changes from the previous day. All administrators could check it to be sure any new logins were added by one of them.

You should know how to secure your SQL Server. Implement strong controls, and be sure that you periodically audit for anything unusual. At the very least, ensure you have monitoring so that any unusual or strange activity might be detected.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.

It wasn’t that long ago that Firewall was released. In it, a security executive has his family taken hostage, with the plot being that the executive will help the criminals rob the bank that he’s spent years protecting or his family will be killed.

While I haven’t heard of this extreme happening in the real world, I wonder how far away we are from this. Recently, there was a less violent attempt at hacking, with someone offering a Tesla employee over US$1mm to slip ransomware into their network. The idea would have been to threaten Tesla with data release unless they paid up. The details are interesting, and supposedly the ransomware cost US$250,000 to build, but another company paid US$4.5mm to criminals, so maybe this would have been very profitable.

I’m sure there have been some shady offline attacks against companies and their executives or privileged staff. I hope there haven’t been any violent ones, but I am sure that something has happened somewhere in the world.

Ultimately, I bet that the best defense might be to limit the knowledge of who can access sensitive data, and perhaps even ensure that no one can. Only systems, and that all queries, all access, and certainly all backups, are handled by some automated system, logging everything. This might not prevent this movie plot from coming true, but maybe you’d get a similar ending, with the criminals caught quickly because some system logged the action and alerted people.

Security is a tough world to work in and think about constantly. Many of us know this, dealing with the stress and concern on a regular basis. Hopefully none of us add in the moral dilemma that might come from an actual criminal contacting us. If they did, hopefully all of us would be able to do the right thing.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.

A short while ago, Twitter got hacked. I wrote about this, as did Denny Cherry. I think Denny’s piece was more interesting, as he speculates about the security measures that Twitter may, or may not, have had in place.

One of the things Denny brings up is air-gapping administrative machines. I’ve rarely seen this in organizations, and perhaps see this less and less in the pandemic world. There are some high security places that do this, but could your organization do this? How many of us use cloud or co-location facilities where we can’t even physically enter the premises?

I suppose we can use some strong network security controls, perhaps even requiring static IP addresses for people at home and specific routes for certain administrators. I do know some companies that do require specific laptops for access, with limited software, but this certainly isn’t the norm. Too often a general laptop used for most work performs double duty as an administrative workstation with access to production data.

Another thing Denny mentions is jump hosts, without any cut/copy/paste functionality from the remote machine to the host. This is something I am starting to see from customers, even smaller ones, as a way of limiting the chance of ransomware or some security breach. Multi-factor authentication gets an administrator onto a remote desktop session on a jump host, from which they can access production systems with limited tools. This certainly isn’t perfect, and it is annoying for administrators, but it is a good security layer, and it forces organizations to use good, compliant, database DevOps practices to deploy changes.

Perhaps the best part of Denny’s article is the title of the last section: good security shouldn’t be user friendly. It shouldn’t be for administrators. While we might make things slightly easier for average users, anyone that can access bulk amounts of data, especially in a privileged fashion, should have strong security, which is a bit cumbersome. I think the hassles of strong security would be a good thing for more of us to have to deal with. Hopefully more organizations will start taking better precautions and reduce the chance of attack.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.