Unknown threat actors are using brute-force attacks to try and get into poorly secured, internet-exposed Microsoft SQL Server databases.
The Redmond software giant has issued a warning explaining how databases with weak passwords might get compromised:
"The attackers achieve fileless persistence by spawning the sqlps.exe utility, a PowerShell wrapper for running SQL-built cmdlets, to run recon commands and change the start mode of the SQL service to LocalSystem," the Microsoft Security Intelligence team revealed (opens in new tab).
(opens in new tab)Servers targeted
In other words, the attackers are using the sqlps.exe tool, which is a legitimate program, and not malware, as a Living Off The Land Binary (LOLBin).
"The attackers also use sqlps.exe to create a new account that they add to the sysadmin role, enabling them to take full control of the SQL server (opens in new tab). They then gain the ability to perform other actions, including deploying payloads like coin miners."
Sqlps is a tool that comes bundled with Microsoft SQL Server, and allows users to load SQL Server cmdlets. Bleeping Computer claims that by using the tool as a LOLBin, attackers can run PowerShell commands without being detected by antivirus programs or similar cybersecurity solutions.
What’s more, the tool leaves almost no traces, as it bypasses Script Block Logging.
> Attacks on Remote Desktop Protocol have soared (opens in new tab)
> Millions of remote desktop accounts are being attacked every week (opens in new tab)
> Stop using '123' as your Windows server password, users warned (opens in new tab)
System administrators can do a number of things to defend their premises from such attacks, first and foremost - by not exposing them to the internet. In case the database (opens in new tab) must be online, the second-best solution is a strong password that can’t be guessed, or brute-forced. That means, having a password with at least eight characters, both uppercase and lowercase, as well as numbers, and symbols.
Also, admins are advised to place the server behind a firewall (opens in new tab).
Finally, they can enable logging and keep an eye out for suspicious or unexpected activity, or recurring login attempts.
- These are the best internet security suites right now (opens in new tab)
Via: BleepingComputer (opens in new tab)
