Situation
We found out that one of our (MySQL) databases has been compromised through SQL-injection. The injection vector was a query that was vulnerable to SQL-injection due to string-concatenation in its WHERE
clause.
The MySQL-user for the web application in question ran with fairly limited privileges (SELECT
, DELETE
, UPDATE
, INSERT
) on a single database along with the information_schema
database. The database-server is only accessible from whitelisted machines (no unrestricted internet access).
As far as we can see, the attacker performed all interaction with our database through HTTP GET
requests to the vulnerable web application. We have secured the webserver's access and error logs which clearly show all attempted queries. The unfortunate thing is that the attacker had access to our database for approximately 3 days. As such, I think we must assume that our whole database has been mapped and most data of interest has been downloaded by the attacker.
At the time of discovery the attack was still ongoing; it has been stopped and the vulnerable WHERE
clause has been replaced by a prepared statement placeholder (as it should have been all along). Given that the attack was still ongoing, I think I can assume they did not yet manage to get all data. After the vulnerability got fixed, we rotated the 'passwords'1 for all users that had access to this database server.
The data
The database in question is the datastore for a webshop. There is no payment information in the database (all payment transactions are handled by a (thirdpary) payment provider) and user passwords have been hashed with BCrypt with a quite decent workfactor.
The database does contain customer orders (along with address information), products, stock, etc.
Questions
The hole has been plugged, what technical2 steps should be taken now (other than rotating the MySQL user credentials, which we have already done)?
Since we have the log files with all query attempts, it should be possible to figure out exactly what tables have been dumped.
What is a viable tool for pulling this information from a combined 1 GB of webserver access and error log files?What are the common malicious uses of stolen data such as this? Phishing attacks aimed at the webshop's customers?
1: 32 character long, printable ASCII, random strings.
2: There is definitely a judicial, communications and PR part to this issue, but this question focusses solely on the technical part of the incident.