Is password information dumped from the MySQL user table sensitive?

Question

Assume I have dumped MySQL user list using

SELECT user, host, password, ssl_type FROM mysql.user;

The result looks like this:

+------------------+-----------+-------------------------------------------+----------+
| user             | host      | password                                  | ssl_type |
+------------------+-----------+-------------------------------------------+----------+
| admin            | %         | *blablablablablablablablablablablablablaa | ANY      |
+------------------+-----------+-------------------------------------------+----------+

Should this information be considered sensitive? Can an attacker use the password information to access the MySQL database? It seems the password is hashed, therefore it is not directly usable, but perhaps it can be still exploited somehow, e.g. to help creating rainbow tables for my server, or something like this?

Answer 1

Yes, it's sensitive information. It's a password hash leak.

Attackers will supply this information to a bruteforce application (there are some tailored just for MySQL) and retrieve the password.

Not only this, but the % on the host field means that if your MySQL port (3306 by default) is not firewalled, the attacker can access it as admin from anywhere.

Consider locking the admin account just for localhost, and never disclose a password hash, no matter how confident you are on the difficulty of breaking such hash.

Answer 2

Not only are the passwords themselves inherently sensitive (as the other answers rightly point out as the primary risk) ... but the information that they contain is often sensitive as well.

Once the hashes are cracked, many passwords contain birthdays, children's names, phone numbers, de-facto answers to security questions, street addresses ... even Social Security numbers!

We remember what matters to us - and what is personal to us. This makes for passwords with great UX ... but they're terrible from a security perspective.

This psychology of password selection should be held as a constraint. Since many users choose passwords this way, they should be handled and protected accordingly.

Answer 3

It is possible to obtain the original password from a hash using a password cracking tool, such as John the Ripper or hashcat. These tools simply try a lot of passwords in a brute-force attack. This could take a long time depending on the complexity of the password.

Answer 4

Yes it's sensitive. An attacker can attempt to "crack" the hash through bruteforce attempts or dictionary attacks. In all the cases I've seen MySQL passwords are salted, but if they aren't a pre-computed hash table or rainbow tables can be used to accelerate the process

Furthermore, if that hash was obtained through a SQL injection vulnerability (Highly probable) it may be possible for an attacker to attempt to insert or update data in the table, depending on how the query was made. If this is possible, the attacker can simply add a new user or change the admin password hash with a hash of an already known password, skipping completely the cracking step

Answer 5

if an attacker is able to get the hash of a password, like in the way you described above, then yes it is possible to attempt to find the collision of that hash using rainbow tables if salting hasn't been used.

If salting has been used, then the difficulty of cracking passwords becomes much more difficult.

EDIT: Just to be clear - when I refer to salting, I meant it in salting can be done by an external tool / process, and simply stored in the database, and not that MySQL had any input in the process besides storing the values. Apologies to those confused!