Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 6 down vote favorite
2

Overview

Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit Mysql using the server's processing power against itself. This of course requires no botnet.

Question

I can't find much information about this new software. I would like to know what I need to patch in order to protect against this exploit. Thanks in advance guys.

UPDATE

If it wasn't obvious, I'm talking about a patch for Mysql.

share|improve this question
Is the Ref Ref tool actually exploiting a flaw in MySQL or is it taking advantage of a certain query construction? – Casey Sep 1 '11 at 17:46
That's what I want to know. :) All the article says is that it causes MySQL to eat up processing power. My guess is both. – k to the z Sep 1 '11 at 18:07

3 Answers

up vote 11 down vote accepted

If this http://www.refref.org/p/refref.html is the DOS i did some research.

mysql> select version();
+-----------+
| version() |
+-----------+
| 5.5.9     |
+-----------+
1 row in set (0.01 sec)

mysql> select benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f);
^CCtrl-C -- sending "KILL QUERY 193" to server ...
Ctrl-C -- query aborted.
+---------------------------------------------------------------------------+
| benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f) |
+---------------------------------------------------------------------------+
+---------------------------------------------------------------------------+
1 row in set (3.55 sec)

mysql>

It does not crash the MySQL daemon it just seams to do what the benchmark function is suppose to do, it evaluate the expression 0x70726f62616e646f70726f62616e646f70726f62616e646f 99999999999 times which will take a lot of time. And 0x70726f62616e646f70726f62616e646f70726f62616e646fis the ASCII string "probandoprobandoprobando" ("probando" is the latin word for "proving").

So the original problem is to make sure your are protected against SQL-injection which should be quite easy if you use some sane database abstraction and don't build your own SQL queries with string concatenation etc.

share|improve this answer
There's a real answer, thank you sir. – k to the z Sep 1 '11 at 18:18
up vote 2 down vote

For now you can simply block these types of attacks with a (.htaccess) rule:

RewriteEngine on
RewriteCond %{QUERY_STRING} .*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark) [NC]
RewriteRule .* - [R=406,L]

You can also look into setting up a global (mod_security) rule on your system to block these types of requests for all of your vhosts.

share|improve this answer
Does QUERY_STRING match the content of POST requests? – Hendrik Brummermann♦ Sep 17 '11 at 23:17
3  
Quite sure query string refer to the part after "?" for the requested resource. So it will not match on the POST content. But mod_security seams to be able to do it. Still the real solution is to do proper query construction. – Mattias Wadman Sep 18 '11 at 21:39
up vote 1 down vote

It infects via SQL injection - so as long as your software is not vulnerable to SQL injection (and you don't expose your MySQL instance on the internet) you won't be vulnerable.

As to how you ensure that your system is not vulnerable to SQL injection ..... you've provided no information about what software you are running.

You have some unusual ideas about security. It's not a product you can buy or download. You shouldn't wait for someone to hacked before you start installing patches.

share|improve this answer
1  
I don't get that out of his question at all. He is asking about patching software, not buying security. – Casey Sep 1 '11 at 15:45
1  
lol, just because I called RefRef software doesn't mean I thought it was proprietary or available to the public. However, this particular community might have a line on how it works. Understand that this is a zero day. It happened very recently. Mysql doesn't have a patch out for it yet (patches don't happen instantly). I'm talking about temporary custom patching. You can also never be fully protected against SQL injection. It's more about how much time someone has to spend to get around all your protection. You have some unusual ideas about how to read questions. – k to the z Sep 1 '11 at 17:32
@ktothez, What do you mean by "you can never be fully protected against SQL injection"? (short of somebody just pumping sizable chunks of harmless data that eventually fill your disk) – George Bailey Sep 1 '11 at 18:27
@George, that's more of a general statement about IT security. There will always be new ingenious ways to exploit a system and the protections from old exploits it uses. A system can never be "fully secure" unless it's in the middle of the sun in my opinion. The middle of the sun in this case is a server that is stand alone and isn't connected to anything...which isn't useful for anyone. – k to the z Sep 1 '11 at 18:35
but you can be protected against sql injection. – Casey Sep 1 '11 at 20:21
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.