Click here to receive your FREE subscription to Campus Technology
News
Security Experts Alarmed by Exposed Database Servers
11/16/2007
Responding to a soon-to-be released study revealing that as many as a half a million database servers aren't protected by firewalls, security experts contend the findings constitute a call to action for security pros and database administrators everywhere.David Litchfield, managing director of UK-based NGSSoftware, plans to publish the full survey report on Monday on his Website, Databasesecurity.com. Using a sample group of 157 SQL servers and 53 Oracle Database servers, Litchfield based his conclusions on the Ant Census from the University of Southern California's Information Sciences Institute. The census is a project that's mapped more than 4.3 billion IP addresses, collecting data to get a snapshot of the Internet. Based on those addresses, he projected that there are approximately 368,000 Microsoft SQL Servers and about 124,000 Oracle database servers directly accessible on the Internet, the report found.
"When you see something like this, it certainly does seem alarming," said Gil Kirkpatrick, an Expert in Residence for Phoenix-based IT consultancy NetPro. "Even though with surveys like this you want to know how many of the servers included were inactive or honey pots or non-relevant, I still don't see why anyone wouldn't want to protect their database."
Entry into a database server can give a hacker a doorway into a company's IP domain; it could even serve as a conduit to eventually taking control of the entire network. Equally concerning is that the number of exposed SQL servers has increased considerably from the 210,000 in Litchfield's last such report, in 2005.
"I'm surprised at the number of SQL servers that are exposed like that," said Ben Greenbaum, senior research manager with Symantec Security Response. "What this says is that many organizations don't have good patching policies and have adopted an "if-it works-don't-break-it' attitude."
Litchfield, who wrote the proof-of-concept code that later morphed into the "Slammer" worm that ravaged SQL servers four years ago, called the patching of SQL servers "atrocious." He also found that approximately 82 percent of the SQL servers were using older SQL versions, from SQL Server 2000 and back. Moreover, service pack updates were notably absent on most of the machines included in calculating the findings.
A Microsoft spokesman pointed out, via e-mail, that the findings don't mean that SQL server is inherently unsafe. "NGS Security has released a paper in which they looked for database servers directly accessible from public internet. No new vulnerabilities for SQL Server were found. Database and system administrators should ensure that the host firewall is configured properly, in accordance with local security policies," the statement read. The company further suggests that network administrators ensure that perimeter access is configured properly, and that interior hosts are not exposed to unwanted traffic. In most cases, that means blocking access to port 1433/TCP from outside the network perimeter.
Recommended Reading
- Tufts Grants Rights for Mileage-Increasing Transportation Technology to Electric Truck
Tufts University has optioned rights to a technology that can recharge the batteries of any hybrid electric and electric-powered vehicle while it is driven. The Tufts-developed technology could increase by 20 percent to 70 percent the miles per gallon or total driving range performance of vehicles like the Honda Civic, Ford Escape, and Toyota Prius hybrids and the Tesla Motors and Phoenix Motorcars electric vehicles.
- U Florida and Cyntellect Collaborate to Unlock Mysteries of Cancer Stem Cells
The University of Florida has entered into a research agreement with life sciences company Cyntellect. The university's Interdisciplinary Center for Biotechnology Research will work with the company to focus on a variety of research areas including the purification and analysis of cancer stem cells (CSCs), rare cells believed to be directly involved in propagating cancers.
- George Mason U Receives Grant To Deploy Intergraph Apps for Intelligence Curriculum
George Mason University (GMU) in Fairfax, VA has been awarded a grant from Intergraph to enable students enrolled in GMU's Geospatial Intelligence Graduate Certificate program to use the company's geospatial production and exploitation software as part of their core curriculum.
- Institute for Cyber Security at U Texas, San Antonio Opens Incubator
The University of Texas at San Antonio (UTSA) Institute for Cyber Security (ICS) has launched a new Internet security incubator. The incubator was developed to commercialize promising technologies that address major cyber security and privacy issues. The first companies to enter the incubator are Denim Labs and SafeMashups.
- ISO/IEC Publishes Office Open XML Standard
ISO/IEC has published the Office Open XML (OOXML) file format standard, formally known as ISO/IEC 29500:2008. It describes file formats originally designed by Microsoft for its Office 2007 productivity suite, which are used in presentation, spreadsheet and word processing applications.
- Dynamics NAV 2009 ERP Coming Next Month
Microsoft exec Kirill Tatarinov Wednesday described some new features to expect in the forthcoming Microsoft Dynamics NAV 2009 enterprise resource planning solution. He gave the keynote address at Microsoft's Convergence 2008 event in Copenhagen, Denmark.
