Security and why you need to review yours.

Security and why you need to
review yours.
David Busby
Percona Live London 2013

Who am I?
David Busby
●
Remote DBA for Percona
●
January 2013
●
13 some years as a sysadmin
●
Paranoid when it comes to security, and
legal agreements.
●
Ju-Jitsu instructor (Ni Dan)
●
Helps to teach children computing.
●

www.percona.com

Agenda
What’s an “attack surface” and how to limit
it.
●
Why password complexity is important.
●
Why rigid grants are important.
●
SELinux: why you should be using it.
●
What's a CVE and why should you care?
●
0-days, and F.U.D
●
5.6 Security features
●
Q&A
●

www.percona.com

Agenda cont.
Some prizes.
●
And a disclaimer.
●
My opinions expressed may not reflect
those of my employer .. and so on
●

www.percona.com

What’s an “attack surface”?
●

Points in your system which could be
attacked.
application
●
database
●
physical systems
●
network
●
your employees
●
hosting provider
●

●

hosting providers employees

www.percona.com

Reducing your “attack
surface”
●

Application

Sanitize ALL user inputs
●
CSRF / XSRF tokens
●
W.A.F
●

●

●

I.P.S
●

●

e.g. mod_security

Do not leave an I.P.S in I.D.S mode.

security auditing
●

Do not rely on scanning software.
●

●

Penetration Testing.

M.A.C
●

SELinux
www.percona.com

surface”
●

Database
●

Limit network exposure (no access from the
internet)
●

Network segregation from application (hardware or
vlan)

Selective grants
●
Complex passwords
●
I.P.S
●
Avoid “identified by 'the_plain_password'” SQL.
●

●

●

Appears in history files e.g. ~/.mysql_history

M.A.C
●

SELinux (notice a pattern here?)
www.percona.com

surface”
●

Physical Systems
Limit physical access.
●

●

●

●

Challenge “implied trust”.
●
Barclays £1.3m “haul”
●
could have been avoided.
●
Uniform / badge != identification.
●
Security “mantraps”.
Don't rely on biometrics
●
Just ask the MythBusters on “unbeatable fingerprint
readers”
Remove uneeded service / application.
●
Your rackmount server really doesn't need bluetooth.

Image credit: http://news.bbcimg.co.uk/media/images/70014000/jpg/_70014486_co607-13device.jpg

www.percona.com

surface”
●

Network
●

Selective ACL
●

Specify which hosts may access the DB network and
limit the ports.
●

●
●
●

●

Application nodes do not need access to SSH on the db servers
for instance
iptables -N MySQL
iptables -I INPUT -j MySQL
iptables -A MySQL -s <application_node_range> -p tcp --dport
3306 -m comment --comment “application range access to
MySQL” -j ACCEPT

Network isolation
●

Application systems separated from DB servers.
www.percona.com

surface”
●

Employees (Layer 8 / Meat ware).
●

Awareness Training
●

Most people want their company to have a high profile.
●

●

●

Linkedin, Facebook etc ...
●
Finding this much information used to be hard.
●
Tools (e.g. Maltego) makes information gathering easier.
Customer relations, Improve sales.

Makes them easier to target.
●

Call $company pretend to be $employee on the road, ask for
some otherwise restricted information.
●
“Social engineering” Fancy term for conning people.
●
“phishing” / “spear phishing”
●
“Run this program as root / administrator for free stuff!”
www.percona.com

surface”
●

Employees (cont)
●

B.Y.O.D?
●

$employee uses $phone for work.
●
●

●

$phone is $employee property.
$employee uses $phone for:
●
email, vpn, intranet, sms/ push notifications.
●
Bank application, e-payment (e.g. google wallet).
$phone is now a more attractive target.
●
Physical attacks.
●
Theft, lock screen bypasses, debug abuse (p2p-adb etc.),
N.F.C.
●
Remote attacks.
●
Karma / Jaessegar
●
Bluetooth

image credit: http://securityreactions.tumblr.com/post/65286584262/byod-good-plan

www.percona.com

surface”
●

Employees (cont)
●

Do not blindly trust devices.
●

●

●

Malicious H.I.D devices.
●
Teensy duino HID prototypes, have evolved.
●
DLP Bypass
Malicious thunderbolt chain devices.

Challenge identity, and “implied trust”.
●
●

It’s OK to ask for proof of identity!
We do this for all systems, why not people?
●

“Hello I am calling from the computer security centre about the
virus on your windows machine...”
●
Exploiting “implied trust”
●
“Would you like a christmas tree in your bank account sir?”
(Fonejacker)
www.percona.com

surface”
●

Certain allowances must be made.
●

Trust in Service / Hosting Provider.
●

Some steps can be taken.
●
Challenge identity if conctated, and verify.
●
Documentation on security measures / compliance.
●
●

●

You get some for a S.L.A ... get one for security!
Most have some P.C.I compliance at least.

Trust in mobile networks ... (though note GSM
and 3G have been proven to be broken).

www.percona.com

Why rigid grants are important
●

How often do you see an application with
"ALL PRIVILEGES ON *.*" ?
cacti
●
phpmyadmin
●

How about "WITH GRANT OPTION"?
●
We also need to be concerned with:
Super_priv, Create_routine_priv, Insert_priv
●

Image credit: http://upload.wikimedia.org/wikipedia/en/8/8c/The_Keymaker.jpg

www.percona.com

Why rigid grants are important
●

Super
●

●

FILE && Create routine
●

●

We’re going to abuse this to inject malicious UDF shortly.

Insert_priv
●

●

kill any process, stop/reset slaves, write to read only etc
(part of all).

_could_ be used to create users, and access permissions
by inserting into mysql schema tables.

WITH GRANT OPTION
●

no application should need to create grants.

www.percona.com

Why password complexity is
important
●

So let's consider

I'm an attacker; I've compromised your web
application.
●
I've been able to grab a "hashdump".
●
A dump of the mysql.users table containing the
password hashes.
●
Or I'm "sniffing" MySQL traffic from the
application host hoping to capture the
"handshake" of a privileged user.
●

●

More complex requires hash table regeneration due to
changing salt.
www.percona.com

important
●

Authentication handshake in brief.

client opens tcp connection to server.
●
mysqld sends greeting with salt (challenge)
●
client uses salt and replies with a sha1 sum
"password"
●

●

●

SHA1(password) XOR SHA1(salt <concat>
SHA1(SHA1(password)))

MySQL 5.5 password hashes
●

SHA1(SHA1(password))

www.percona.com

important

www.percona.com

important
●

We're going to recover the passwords for
the following:
●
●
●
●

D306CEB16052CBB8539617888512E58CA68EN1AD1
CB7DFF0540F8C51BF178A1502A286FB8F4A2691E
E8820BB0161312465DBB69D9E2A1A73841B63B62
B415DD9C4FB5EF59FE80C4FEBC1F9C715E6E97C4

www.percona.com

important
●

Be honest, who is thinking this right now?

image credit: http://securityreactions.tumblr.com/post/52788324439/when-i-told-a-former-director-i-could-still-crack-his

www.percona.com

important
●

Demo: oclHashcat mysql5 4 hashes < 1
second
●

sha1(sha1(password))

www.percona.com

important
●

Know thy “enemy” (and make them your
friend)
●

oclHashcat
●
●

uses openCL for GPU based hash calculation.
easily runs 270M/s+ brute force MySQL5 hashes
●
●

●

Tested on a Radeon 7750 Fedora 18 x86_64
Many supported hashes

pre-computed hash tables
●

Stored hashes derived from
●
●

●

Dictionaries / wordlists
public password list leaks

My table has ~151M (and growing) unique words
●

Generated from public lists (mostly skullsecurity.org)
●

●

Extended using John the ripper.

You do not want your password on that list!

www.percona.com

important
●

Know thy enemy cont:
●

CPU vs GPU
●

●
●

GPU processing has greater parallelism resulting in
much faster hash rates, CPU hashing is still fast.
John the ripper, hashcat (+variants), pyrit
Python CPU example (nyancrack)
●
Pre computed hash tables != Rainbow tables.

www.percona.com

important
●

nyancrack

python multiprocessing (~360K/s MySQL5)
●
variable threads
●
modular extension
●
no openCL support (yet)
●
low memory overhead
●

●
●

●

peak 1015mb consumed producing a 6.1GB file.
tuneable memory usage feature planned.

Why not have MySQL calc the hashes?
●

SLOW!
●

< 500 hash / second in limited testing.
www.percona.com

important
●

Conclusion?

Complexity increase time for recovery.
●
cost vs reward.
●
“most” attackers want the quick win.
●
Reduces “exposure”
●

●

If it's going to take N time to recover the password.
●
Increased likelyhood of discovering breach before
recovery.
●
Changing of passwords, renders recovered
credentials useless.
●
Also remember to “plug the hole”.

www.percona.com

SELinux: why you should be
using it.
●

Let's deal with the what before the why.
SELinux is a M.A.C which uses “labels”
●
We're going to look at the more common
"targeted" policy
●

●

●

not covering MLS / Strict

/etc/selinux/config
●
●

SELINUX=enforcing
SELINUXTYPE=targeted

www.percona.com

using it.
●

Labels
●

selinux contexts applied to files, ports
●
●

●

user:role:type:level(optional)
targeted policy really only looks at the "type"

Type enforcement (policies)
●

A process running with X context
●
●

is allowed to access a resource with the Y context
but not Z context.

image credit: https://i.chzbgr.com/maxW500/1659454208/hE5C2A3CB/

www.percona.com

using it.
●

You want mysql to be able to access.
/var/lib/mysql (mysqld_db_t)
●
/var/log/mysql (mysql_log_t)
●
*:3306
(mysql_port_t)
●

●

But you probably do not want MySQL
accessing
/etc/passwd (passwd_file_t)
●
/etc/shadow (shadow_file_t)
●
http_port_t , ssh_port_t
●

www.percona.com

using it.
●

So how do I get the current contexts?
●
ls -z
●

ps -z

●
●

system_u:system_r:mysqld_t:s0

Id -z

●
●

●

unconfined_u:object_r:mysqld_db_t:s0
/var/lib/mysql/ibdata1

unconfined_u:unconfined_r:unconfined_t:s0s0:c0.c1023

Many standard linux utilities take the -Z
arguments.
www.percona.com

using it.
●

Most peoples experience of SELinux seems
to be: "So I `setenforce 1` and ..."

image credit: http://securityreactions.tumblr.com/post/53675346932/hey-guys-check-out-this-new-exploit

www.percona.com

using it.
●

setenforce 0 == Permissive != OFF

Useful for debugging.
●
Always go back to setenforce 1 == Enforcing
●

●

New tools make things easier.
setroubleshoot-server
●
libselinux-python
●
e.g. from (coming next) demo:
●

●

“MySQL connection failed Can't connect to MySQL
server on '172.16.33.3' (13)”
●

OS error code 13: Permission denied

www.percona.com

using it.
●

Using SELinux is easier than you might
think.
●

A couple of “gotchas” to be aware of.
●
●

●

New files / dirs inheret contexts
Moved files / dirs keep their original contexts

Let’s go over to quick examples.
●

●

PHP Web app can not connect to MySQL on a remote
system.
MySQL fails to start with non standard datadir.

www.percona.com

using it.
●

selinux sebool httpd can network connect
db

www.percona.com

using it.
●

placeholder “none standard datadir
location”

www.percona.com

using it.
●

Ok SELinux is useable, still why should I
care?
Additional layer of security.
●
Mandatory Access Control
●

●

Arrests “out of context” behaviour.

Discretionary Access Control “trusts running
software” - assumes it should access everything
the user can.
●
Let’s see how bad things could get.
●

www.percona.com

using it.
●

“Perfect storm” example.
●

Webapp has command injection.
●

●

Or has a vulneraility such as CVE-2012-1823
●
PHP CGI command injection.
(Also has SQL injection but we’re not going to attack it
in this example).

SELinux is Permissive / OFF
●
Bad grants (ALL PRIVILEGES ON *.*)
●
We’re going to.
●

●
●
●

Deploy a php shell.
Deploy a UDF.
Have some fun with command line via mysql ...
www.percona.com

using it.
We're abusing everything we have allready
outlined as being “bad”.
●
Some steps are purposely skipped!
●

●

●

Code will be made available @ Github
●

●

This isn’t a “how to hack”
Most of it.

LEGAL DISCLAIMER!

This is on a local VM environment only.
●
For informational purposes only.
●
Use at your own risk.
●

www.percona.com

using it.


Demo “PHP cmd injection” -> “PHP CMD
Shell” -> “MySQL load UDF”

www.percona.com

using it.
●

Assuming everything went as planned ...

www.percona.com

What's a CVE and why should
you care?
●

Common Vulnerabilities and Exposures.
●

Common classification and notation of known
vulnerabilities.
●

●

CVE-2013-2094 perf_swevent_init() privilege escalation.

$vendors usually use this to classify vulnerabilities
reference in their erratas.
●
Not always used as intended however.
●
●

e.g. Oracle filed many CVE’s 2013-10-16 and 2013-07-17
CVE-2013-3826 -> CVE-2013-5867
●
“Unspecified vulnerability in Oracle <product> allows
remote/local attackers to affect
confidentiality/integrity/availability via unknown vectors”
●
No helpful information for ‘J.I.T’ / Vulnerability analysis.
www.percona.com

you care?
●

Information in an as intended CVE filing
can be used to:

Check $vendor erratas for relevant patches.
●
Contact $vendor with relevant information to
patch.
●
leverage J.I.T methods to mitigate risk.
●
e.g.
user_u selinux context blocks root shell from CVE
●

www.percona.com

you care?
●

Syntax is changing from Jan 2014

www.percona.com

you care?
●

Additional resources.
●
OSVDB
●
Open Source Vulnerability Database
●
Secunia
●
NVD
●
National Vulnerability Database

www.percona.com

0-days, and F.U.D
●

0-day
A attack leveraging an unknown vulnerability.
●
Some “claims” are just posturing.
●
If concerned search for p.o.c. code and test.
●

●

●

In a virtual lab environment.

“Hardening” is the best defense against the
unknown. (You lock your doors after all).
●
●
●

Reducing your attack surface is a good first step.
Prepare for the worst hope for the best.
“By failing to prepare, you are preparing to fail.” Benjamin Franklin.
www.percona.com

0-days, and F.U.D
●

0-days ... it's all about being prepared.
●

Be aware of potential unknowns.
●

●

If you use HA you prepare for system failiure after all.
●
Not much of a leap to prepare for security.

Build hardened systems, from the ground up.
●
Avoid the “foolish man who built his house on
sand”
●

Make management easy with $provisioning
●
●
●
●

Ansible
Puppet
Chef
Salt
www.percona.com

●

Password Expiration policy
●

●

Drops user into “sandbox” when expired.

Password Validate password plugin (
5.6 docs)
●

validate_password_policy = LEVEL
●

●

●

LOW / 0
●
length >= 8 chars
MEDIUM / 1 (Default)
●
LOW +
●
>= 1 number && >= 1 lowercase && >= 1 upper case.
STRONG / 2
●
LOW + MEDIUM +
●
substrings >= 4 chars must not appear in defined dictionary file.
www.percona.com

●

Password Validate password plugin cont.
●

Customizable :-)
●
●
●
●
●

●

validate_password_disctionary_file = ‘’
validate_password_length = 8
validate_password_mixed_case_count = 1
validate_password_number_count = 1
validate_password_special_char_count = 1

Circumventable :-(
●
●

@ another system: select PASSWORD('PLUK');
@ 5.6 system with validate_password_policy = MEDIUM
●
GRANT ALL PRIVILEGES ON *.* TO ‘pluk’@’localhost’
IDENTIFIED BY PASSWORD
‘*D306CEB16052CBB8539617888512E58CA68E1AD1’
www.percona.com

●

Pluggable authentication.
●

e.g. sha256_password (docs)

www.percona.com


●

Questions?

www.percona.com

Percona Live London
Sponsors (TBC)
Diamond Sponsors

Platinum Sponsors

www.percona.com

Percona Live London
Sponsors (TBC)
Exhibitor Sponsors

Additional Sponsors

Media Sponsors

www.percona.com

Annual Percona Live
MySQL Conference and Expo
The Hyatt Regency Hotel, Santa Clara, CA

April 1st-4th, 2014

Visit: http://www.percona.com/live/mysql-conference-2014/
www.percona.com

Security and why you need to review yours.

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Security and why you need to review yours.

Similar to Security and why you need to review yours. (20)

Recently uploaded

Recently uploaded (20)

Security and why you need to review yours.

Editor's Notes