Security Experts Alarmed by Exposed Database Servers

• By Jabulani Leffall
• 11/16/07

Responding to a soon-to-be released study revealing that as many as a half a million database servers aren't protected by firewalls, security experts contend the findings constitute a call to action for security pros and database administrators everywhere.

David Litchfield, managing director of UK-based NGSSoftware, plans to publish the full survey report on Monday on his Website, Databasesecurity.com. Using a sample group of 157 SQL servers and 53 Oracle Database servers, Litchfield based his conclusions on the Ant Census from the University of Southern California's Information Sciences Institute. The census is a project that's mapped more than 4.3 billion IP addresses, collecting data to get a snapshot of the Internet. Based on those addresses, he projected that there are approximately 368,000 Microsoft SQL Servers and about 124,000 Oracle database servers directly accessible on the Internet, the report found.

"When you see something like this, it certainly does seem alarming," said Gil Kirkpatrick, an Expert in Residence for Phoenix-based IT consultancy NetPro. "Even though with surveys like this you want to know how many of the servers included were inactive or honey pots or non-relevant, I still don't see why anyone wouldn't want to protect their database."

Entry into a database server can give a hacker a doorway into a company's IP domain; it could even serve as a conduit to eventually taking control of the entire network. Equally concerning is that the number of exposed SQL servers has increased considerably from the 210,000 in Litchfield's last such report, in 2005.

"I'm surprised at the number of SQL servers that are exposed like that," said Ben Greenbaum, senior research manager with Symantec Security Response. "What this says is that many organizations don't have good patching policies and have adopted an "if-it works-don't-break-it' attitude."

Litchfield, who wrote the proof-of-concept code that later morphed into the "Slammer" worm that ravaged SQL servers four years ago, called the patching of SQL servers "atrocious." He also found that approximately 82 percent of the SQL servers were using older SQL versions, from SQL Server 2000 and back. Moreover, service pack updates were notably absent on most of the machines included in calculating the findings.

A Microsoft spokesman pointed out, via e-mail, that the findings don't mean that SQL server is inherently unsafe. "NGS Security has released a paper in which they looked for database servers directly accessible from public internet. No new vulnerabilities for SQL Server were found. Database and system administrators should ensure that the host firewall is configured properly, in accordance with local security policies," the statement read. The company further suggests that network administrators ensure that perimeter access is configured properly, and that interior hosts are not exposed to unwanted traffic. In most cases, that means blocking access to port 1433/TCP from outside the network perimeter.

John Heidemann of USC's ISI said he didn't know enough about Litchfield's technique to endorse or debunk the findings, but stressed that it's impossible to determine from the ANT Census exactly how many servers are vulnerable. Still, he added that Litchfield's work is a reminder that IT pros should take common sense steps.

"It is easy to take a skewed survey if one is not careful. It is also easy to take a valid survey, but then project incorrectly and end up with inaccurate estimates. If (Litchfield's) methodology is correct, it sounds like there are perhaps a lot of people that need to be more diligent."

Security gurus agree that despite the fact the survey findings may not have included an adequate control group for offline servers, honeypot or decoy servers, every last machine should be patched and behind a firewall whether deployed in production or not.

"Some people may say this is no big deal, but if the stars are aligned, I can do some serious damage through a SQL server entry point," said Eric Schultze, chief technology officer of St. Paul, Minn.-based Shavlik Technologies. "But I can get in on your company network, hack into a government network and look like the hacking is being done from your company. People haven't really thought about SQL servers, but these findings are a wake-up call."