8

Overview

Anonomous claimed responsibility today for the Denial of Service attack against wikileaks. They are using a new software called RefRef. It seems to exploit MySQL using the server's processing power against itself. This of course requires no botnet.

Question

I can't find much information about this new software. I would like to know what I need to patch MySQL in order to protect against this exploit.

Improve this question
2
  • Is the Ref Ref tool actually exploiting a flaw in MySQL or is it taking advantage of a certain query construction?
    – Casey
    Sep 1, 2011 at 17:46
  • That's what I want to know. :) All the article says is that it causes MySQL to eat up processing power. My guess is both.
    – k to the z
    Sep 1, 2011 at 18:07

3 Answers 3

Reset to default
13

If this http://www.refref.org/p/refref.html is the DOS i did some research.

mysql> select version();
+-----------+
| version() |
+-----------+
| 5.5.9     |
+-----------+
1 row in set (0.01 sec)

mysql> select benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f);
^CCtrl-C -- sending "KILL QUERY 193" to server ...
Ctrl-C -- query aborted.
+---------------------------------------------------------------------------+
| benchmark(99999999999,0x70726f62616e646f70726f62616e646f70726f62616e646f) |
+---------------------------------------------------------------------------+
+---------------------------------------------------------------------------+
1 row in set (3.55 sec)

mysql>

It does not crash the MySQL daemon it just seems to do what the benchmark function is suppose to do, it evaluate the expression 0x70726f62616e646f70726f62616e646f70726f62616e646f 99999999999 times which will take a lot of time. 0x70726f62616e646f70726f62616e646f70726f62616e646fis the ASCII string "probandoprobandoprobando" where "probando" is the latin word for "proving", i guess someone wanted to prove that the benchmark function work as it should.

So the original problem is to make sure your are protected against SQL-injection which should be quite easy if you use some sane database abstraction and don't build your own SQL queries with string concatenation etc.

Improve this answer
0
2

For now you can simply block these types of attacks with a (.htaccess) rule:

RewriteEngine on
RewriteCond %{QUERY_STRING} .*(/\*|union|select|insert|cast|set|declare|drop|update|md5|benchmark) [NC]
RewriteRule .* - [R=406,L]

You can also look into setting up a global (mod_security) rule on your system to block these types of requests for all of your vhosts.

Improve this answer
2
  • Does QUERY_STRING match the content of POST requests?
    – Hendrik Brummermann
    Sep 17, 2011 at 23:17
  • 3
    Quite sure query string refer to the part after "?" for the requested resource. So it will not match on the POST content. But mod_security seams to be able to do it. Still the real solution is to do proper query construction.
    – Mattias Wadman
    Sep 18, 2011 at 21:39
1

It infects via SQL injection - so as long as your software is not vulnerable to SQL injection (and you don't expose your MySQL instance on the internet) you won't be vulnerable.

As to how you ensure that your system is not vulnerable to SQL injection ..... you've provided no information about what software you are running.

You have some unusual ideas about security. It's not a product you can buy or download. You shouldn't wait for someone to hacked before you start installing patches.

Improve this answer
6
  • 1
    I don't get that out of his question at all. He is asking about patching software, not buying security.
    – Casey
    Sep 1, 2011 at 15:45
  • 1
    lol, just because I called RefRef software doesn't mean I thought it was proprietary or available to the public. However, this particular community might have a line on how it works. Understand that this is a zero day. It happened very recently. Mysql doesn't have a patch out for it yet (patches don't happen instantly). I'm talking about temporary custom patching. You can also never be fully protected against SQL injection. It's more about how much time someone has to spend to get around all your protection. You have some unusual ideas about how to read questions.
    – k to the z
    Sep 1, 2011 at 17:32
  • @ktothez, What do you mean by "you can never be fully protected against SQL injection"? (short of somebody just pumping sizable chunks of harmless data that eventually fill your disk)
    – 700 Software
    Sep 1, 2011 at 18:27
  • @George, that's more of a general statement about IT security. There will always be new ingenious ways to exploit a system and the protections from old exploits it uses. A system can never be "fully secure" unless it's in the middle of the sun in my opinion. The middle of the sun in this case is a server that is stand alone and isn't connected to anything...which isn't useful for anyone.
    – k to the z
    Sep 1, 2011 at 18:35
  • but you can be protected against sql injection.
    – Casey
    Sep 1, 2011 at 20:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .