How to Defend Internet-Exposed Databases from Ransomware
Summary
Attackers can abuse weakly protected, internet-exposed databases to steal or destroy data using legitimate database commands. The article outlines exposure reduction, strong authentication, backups, and checks for ransom-note indicators.
Key points
- Attackers may find exposed databases through internet-wide scans, then exploit missing authentication, default credentials, or weak passwords.
- Rather than deploying malware, attackers can copy data, issue destructive database commands, and leave ransom demands in a new table or collection.
- The article warns that database access may also enable privilege escalation, remote code execution, and lateral movement.
- Keep production databases on private networks and restrict access to trusted application servers; route remote administration through a secured host with MFA.
- Use strong, unique credentials, disable passwordless access, and maintain regular backups in a separate, access-controlled location; test recovery.
- Continuously scan for exposed or misconfigured resources and check databases for suspicious names such as README_TO_RECOVER.
Article Details
- Defense Focus
- Prevent and detect ransomware-style attacks against exposed or misconfigured database servers, including destructive database commands and ransom-note artifacts.
- Detection Methods
- Continuously scan the environment to identify publicly exposed database instances and misconfigurations.
- Check databases for newly created tables, collections, or databases with ransom-note names such as README_TO_RECOVER.
- Use agentless scans to look for database ransom-note indicators and alert when evidence is found.
- Data Sources
- Database contents, including table, collection, and database names and ransom-note records
- Database exposure and configuration findings, including authentication settings and reachable ports
- Platforms
- Wiz Dynamic Scanner
- Defensive Actions
- Place database servers in private network segments and restrict firewall or security-group access to trusted application servers.
- Route remote administrator access through a secure host or jump server protected by MFA rather than exposing database ports to the Internet.
- Disable passwordless access and use strong, unique credentials and MFA.
- Make regular automated backups of critical data, test recovery, and store backups separately with access controls.
MITRE ATT&CK
T1046 · Network Service DiscoveryAttackers scan the Internet for exposed database ports, including 3306 and 5432, and fingerprint reachable database services.T1078 · Valid AccountsAttackers authenticate to database servers using default or weak credentials when those credentials permit access.T1110.001 · Password GuessingAttackers test default username-and-password combinations and attempt to brute-force weak database passwords.T1485 · Data DestructionAfter access, attackers issue destructive SQL commands such as DROP DATABASE or bulk DELETE to make database data unavailable.T1565.001 · Stored Data ManipulationAttackers alter database contents by creating ransom-note tables or collections and inserting ransom messages.
Vendors
Products
Amazon Aurora MySQLenvironments with incidents. Traditional relational databases like MySQL and its variants (such as Amazon Aurora MySQL and MariaDB) are also being compromised but less frequently.Apache Hadoopby several research groups over the years, including campaigns targeting MySQL, PostgreSQL, MongoDB, Hadoop, CouchDB, and Elasticsearch.CouchDBresearch groups over the years, including campaigns targeting MySQL, PostgreSQL, MongoDB, Hadoop, CouchDB, and Elasticsearch.Elasticsearchgroups over the years, including campaigns targeting MySQL, PostgreSQL, MongoDB, Hadoop, CouchDB, and Elasticsearch.MariaDBincidents. Traditional relational databases like MySQL and its variants (such as Amazon Aurora MySQL and MariaDB) are also being compromised but less frequently.MongoDBreported by several research groups over the years, including campaigns targeting MySQL, PostgreSQL, MongoDB, Hadoop, CouchDB, and Elasticsearch.MySQLactivity has been reported by several research groups over the years, including campaigns targeting MySQL, PostgreSQL, MongoDB, Hadoop, CouchDB, and Elasticsearch.PostgreSQLhas been reported by several research groups over the years, including campaigns targeting MySQL, PostgreSQL, MongoDB, Hadoop, CouchDB, and Elasticsearch.RedisTo determine the overall risk to cloud environments, we compared the security posture of five popular database servers: PostgreSQL, MySQL, MariaDB, MongoDB, and Redis.Wiz Dynamic ScannerThe Wiz Dynamic Scanner detects publicly exposed instances of the database servers mentioned above wherever they may be located in your environment, and continuously checks for misconfigurations and vulnerabilities.