English
The Internet threat alert status is currently normal. At present, no major epidemics or other serious incidents have been recorded by Kaspersky Lab’s monitoring service. Internet threat level: 1

Who needs my SQL server?

VitalyK
Kaspersky Lab Expert
Posted August 25, 13:40  GMT
Tags: Malware Statistics, Vulnerability Statistics, Microsoft
0.2
 

We all know that cybercriminals will target anything and everything they can reach. And at Kaspersky, we also know that a lot of IT admins don’t look after their Internet resources. Sad but true – ask an admin if their servers are protected, and you’ll often get the answer, “Oh, come on, who needs my SQL server?”

A few months ago we set up a new honeypot (http://www.mwcollect.org) in our Japanese research centre in Tokyo. The honeypot is mainly used to collect malicious Windows executables, which it does pretty well by emulating shellcode when it finds network exploits. A side effect of using the honeypot to listen on all ports is that we get statistics (as well as unexpected data) coming in on various network ports of the host, which has a global IP address.

This graph shows the number of attacks and unwanted connections on specified ports of our server. It shows the ten ports most commonly used, but even the least commonly targeted port (in this case, port 1130) gets about 16 connections a day.

Here’s a table of the common services using each port:

Hopefully, this proves what seems to us to be obvious – there’s someone on the Internet who wants your SQL server! (And a few other things besides…) And the data above shows that there are a lot of bad guys looking for backdoored orphaned hosts on the internet. Some of them are trying to find Backdoor.Win32.Noknok, while others are trying to break in through legitimate services like Radmin and Windows Remote Desktop.

Maybe you’re wondering just who it is who is looking for badly protected resources? Here’s another graph with those details, showing how many connections different countries make to our honeypot every day:

Take a minute to compare it to the previous graph! You can see that the number of MSSQL attack attempts is mirrored by attacks coming from China. And recently, South Korean hosts have joined this massive attempt to exploit the service.

Running a honeypot helps us get valuable data; we’re kept busy analyzing it and crunching the numbers, and finally, it’s a cheap form of entertainment. Our honeypot is running on 500MHz Pentium III CPU with 384 Mb RAM, which nowadays probably costs less than $100. So if you’re thinking of throwing out some really old, slow hardware, consider setting up a honeypot! ;-)


5 comments

Newest first
Threaded view
 

fp

2010 Aug 28, 02:40
0
 

Attacks on daily basis

Here is extraction from KIS 2011 I got daily two or three times, not neceserly from the same address. I am private user not company.

26.08.2010 22:19:14
Unknown Denied: Intrusion.Win.MSSQL.worm.Helkern UDP from 61.128.110.96 to local port 1434

My Internet Session is on HSDPA of one Austrian provider and the modem is chinese (ZTE) about which I always got from KIS 2011 (an false postive or maybe not ?? ) but I am not so sure what that (modem) software do. It is splited in few applications with granted access to OS kernel.
[UPDATE]
a few ip addresses from which comes the attack:
118.213.78.20
122.225.100.154
219.149.194.245
61.128.110.96
118.213.78.20
122.225.100.154
219.146.143.208
61.128.110.96
61.142.12.86
59.44.87.31
219.150.223.253

Edited by Filip Prlja, 2010 Aug 28, 10:00

Reply    

Costin Raiu

2010 Aug 31, 21:11
0
 

Re: Attacks on daily basis

Hi Filip!

Helkern (aka Slammer) spreads over UDP connections to port 1434, interestingly, this is different from Vitaly's observations which are regarding port 1433 TCP.
Helkern is currently part of the Internet background noise, with most infected machines in Korea and China indeed. In theory, you should be OK if you do not run MS-SQL and/or have an updated version.
Cheers,

Reply    

Thiago Marques

2010 Aug 27, 16:39
1
 

SQL Attacks

I have found a lot of Malware Banker in Brazil that uses MSSQL to store all stolen data, but they uses their own databases. It's possible that they're looking for it for this purpose.

Reply    

wapa

2010 Aug 27, 15:53
1
 

SQL attacks

It would ineed be very interesting to see details on the types of these attacks. Maybe a little MSSQL Server-Emulator could be built for this.

Reply    

Costin Raiu

2010 Aug 26, 14:21
0
 

SQL attacks

Hi!

Did you research what kind of attacks are you seeing on the port 1433? Are these password bruteforcing attacks or machines infected with Worm.Java.Spida.a and other similar worms?

Reply    
If you would like to comment on this article you must first
login


Bookmark and Share
Share

Analysis

Blog