Application Security // Database Security
1/5/2012
01:38 AM
Connect Directly
RSS
E-Mail
50%
50%

AntiSec Hacks Signal Same Old, Same Old In Database Insecurity

Hacktivist group takes down two law enforcement associations with ease

News of an AntiSec hack of law enforcement associations on both coasts earlier this week showed that while it might be a new year, we can pretty much expect lots of the same with respect to database security in 2012. The same insecure configurations. The same cleartext storage of passwords and sensitive information in unprotected databases. The same abysmal access control and password management practices. And, of course, the same embarrassing attacks that maybe by the year 3012 will spur organizations to make some changes in the way they approach the basics of database security.

"We're just not learning from the successful attacks that keep happening," says Josh Shaul, CTO of Application Security Inc. "It's astounding. It seems like almost anywhere Anonymous aims their targets to go out and penetrate, they're able to break in without any difficulty. It just makes me wonder what happens when people who want to do this for criminal purposes -- more than hacktivist reasons, but to actually steal from organizations -- if it is just as easy for them?"

This time around, AntiSec went after the email systems for New York State police chiefs and the website for the California Statewide Law Enforcement Association (CSLEA). The hacktivist group publicly dumped loads of stolen database information from both attacks on New Year's Eve.

In the former case, the group dumped a password file with MD5 hashed passwords and residential addresses for more than 300 police chiefs in New York, plus personal information and residential addresses for more than 1,000 more law enforcement personnel. In the latter case, AntiSec completely shut down and defaced CSLEA's website, putting up a snarky missive about its conquest on the site and dumping all of the information stored in its membership roster of 2,500 members, including passwords and credit card numbers stored in cleartext.

In its message, the group said that even as CSLEA administrators sniffed evidence of the breach and made changes to shut down the attacks, it was too little too late.

"They finally decided to set a root mysql password, but we got the new one: 'vanguard,'" AntiSec wrote. "We noticed that you got rid of the credit card table, and most of the users in your database. Still haven't figured out how to safely hash passwords though: we really loved your change from ‘redd555 to ‘blu444. Clever."

[Segmenting, hardening, encrypting, insuring, and planning -- a few good New Year's resolutions for database administrators. See 7 Housekeeping Duties For Better Database Security In 2012.]

While the details of exactly how the group broke into CSLEA's database aren't clear, Shaul says it is a good bet that the attack built on a SQL injection to first gain access.

"That's their typical M.O. If it's not SQL injection, then sometimes it is file-inclusion-type exploits," he says. "They like SQL injections because it's easy to find, easy to exploit, and it is all over the place."

Jeremy Conway, managing partner at SudoSecure, agrees with Shaul that these attacks are the same old attacks dressed in new clothing. He believes the industry needs to stop looking for fancier technology to stop these types of attacks and get down to the basics of database security.

"If you're not implementing the basic stuff right, then you're not going to implement these cool gadgets that everybody is selling. I think we spend way too much money and put way too much confidence on the latest, greatest blinky light thing that's going to tell us when this stuff happens," Conway says. "No matter what you throw in front of the database -- you can put a shiny, new object and call it an APT protector or whatever you want to call it -- but it doesn't matter if you don't do the basic stuff."

So in the CSLEA breach, that would mean hashing passwords and working on better segmenting the database information.

"Segmentation of the database is probably one of the best things organizations can do, based on what we've seen from penetration-testing organizations in the past," Conway says. "Little things like that could go a long way instead of just trying to build that brick wall right up to the database."

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.