Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Overview

Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's processing power against itself. This of course requires no botnet.

Question

I can't find much information about this new software. I would like to know what I need to patch MySQL in order to protect against this exploit.

share|improve this question
    
Is the Ref Ref tool actually exploiting a flaw in MySQL or is it taking advantage of a certain query construction? –  Casey Sep 1 '11 at 17:46
    
That's what I want to know. :) All the article says is that it causes MySQL to eat up processing power. My guess is both. –  k to the z Sep 1 '11 at 18:07

3 Answers 3

up vote 13 down vote accepted

If this http://www.refref.org/p/refref.html is the DOS i did some research.

mysql> select version();
+-----------+
| version() |
+-----------+
| 5.5.9     |
+-----------+
1 row in set (0.01 sec)

mysql> select benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f);
^CCtrl-C -- sending "KILL QUERY 193" to server ...
Ctrl-C -- query aborted.
+---------------------------------------------------------------------------+
| benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f) |
+---------------------------------------------------------------------------+
+---------------------------------------------------------------------------+
1 row in set (3.55 sec)

mysql> 

It does not crash the MySQL daemon it just seems to do what the benchmark function is suppose to do, it evaluate the expression 0x70726f62616e646f70726f62616e646f70726f62616e646f 99999999999 times which will take a lot of time. 0x70726f62616e646f70726f62616e646f70726f62616e646fis the ASCII string "probandoprobandoprobando" where "probando" is the latin word for "proving", i guess someone wanted to prove that the benchmark function work as it should.

So the original problem is to make sure your are protected against SQL-injection which should be quite easy if you use some sane database abstraction and don't build your own SQL queries with string concatenation etc.

share|improve this answer
    
There's a real answer, thank you sir. –  k to the z Sep 1 '11 at 18:18

For now you can simply block these types of attacks with a (.htaccess) rule:

RewriteEngine on
RewriteCond %{QUERY_STRING} .*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark) [NC]
RewriteRule .* - [R=406,L]

You can also look into setting up a global (mod_security) rule on your system to block these types of requests for all of your vhosts.

share|improve this answer
    
Does QUERY_STRING match the content of POST requests? –  Hendrik Brummermann Sep 17 '11 at 23:17
3  
Quite sure query string refer to the part after "?" for the requested resource. So it will not match on the POST content. But mod_security seams to be able to do it. Still the real solution is to do proper query construction. –  Mattias Wadman Sep 18 '11 at 21:39

It infects via SQL injection - so as long as your software is not vulnerable to SQL injection (and you don't expose your MySQL instance on the internet) you won't be vulnerable.

As to how you ensure that your system is not vulnerable to SQL injection ..... you've provided no information about what software you are running.

You have some unusual ideas about security. It's not a product you can buy or download. You shouldn't wait for someone to hacked before you start installing patches.

share|improve this answer
1  
I don't get that out of his question at all. He is asking about patching software, not buying security. –  Casey Sep 1 '11 at 15:45
1  
lol, just because I called RefRef software doesn't mean I thought it was proprietary or available to the public. However, this particular community might have a line on how it works. Understand that this is a zero day. It happened very recently. Mysql doesn't have a patch out for it yet (patches don't happen instantly). I'm talking about temporary custom patching. You can also never be fully protected against SQL injection. It's more about how much time someone has to spend to get around all your protection. You have some unusual ideas about how to read questions. –  k to the z Sep 1 '11 at 17:32
    
@ktothez, What do you mean by "you can never be fully protected against SQL injection"? (short of somebody just pumping sizable chunks of harmless data that eventually fill your disk) –  George Bailey Sep 1 '11 at 18:27
    
@George, that's more of a general statement about IT security. There will always be new ingenious ways to exploit a system and the protections from old exploits it uses. A system can never be "fully secure" unless it's in the middle of the sun in my opinion. The middle of the sun in this case is a server that is stand alone and isn't connected to anything...which isn't useful for anyone. –  k to the z Sep 1 '11 at 18:35
    
but you can be protected against sql injection. –  Casey Sep 1 '11 at 20:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.