MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
kurtaubuchon.blogspot.com
MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
1–10 of 20 posts
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#2[deleted]
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#3I'm genuinely curious -
What are the reasons for exposing an SQL server directly to the internet? Obviously there's a bunch of people who have mis-configured and have accidently exposed their systems, but are there real-world reasons to expose a SQL server directly to the net?
I would think most people who are sharing datasets would do so with some sort of API - and there'd need to be room for rate limiting / blacklisting IPs and so on. I would never expose a SQL server directly to the net, and I'm really curious if there are reasons to do so?
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#4I'm genuinely curious - What are the reasons for exposing an SQL server directly to the internet? Obviously there's a bunch of people who have mis-configured and have accidently exposed their systems, but are there real-world reasons to expose a SQL server directly to the net? I would think most people who are sharing datasets would do so with some sort of API - and there'd need to be room for rate limiting / blackli…
In the case of hosted SQL solutions (Heroku, AWS, Azure) it makes sense if you don't want to have to place your servers inside the same network/provider or if you want developers to have access to the DB directly from their machines.
But regardless you should be locking down access to the SQL host by network ranges, but I'm not sure if all providers have that ability.
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#5I'm genuinely curious - What are the reasons for exposing an SQL server directly to the internet? Obviously there's a bunch of people who have mis-configured and have accidently exposed their systems, but are there real-world reasons to expose a SQL server directly to the net? I would think most people who are sharing datasets would do so with some sort of API - and there'd need to be room for rate limiting / blackli…
In a word "laziness."
It is just easier to log in and manage an SQL server if it is available on the internet. I know I'm certainly guilty of doing so for short periods when I'm off-site with no VPN and need to manage a server.
Some sysadmins just get lazy and leave it available on the internet with strong passwords 24/7, just so once in a blue moon they can log in and manage it. Or are doing some kind of site to site data migration and are tired of the VPN connection dropping.
I've done a site to site SQL migration across two Azure zones because doing it the "right" way was too complicated/time consuming/expensive. However once the data was copied across I changed the End Point config to protect the SQL server again.
I won't make excuses, it is just laziness/expedient. But that is human nature for you...
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#6Isn't the 440 figure disingenuous? Surely you must count UDP/TCP header size, which would bring the value closer to 21/461 ~= 22.
Still an interesting discovery. DDoS amplification is a security risk few people consider when developing applications.
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#7I'm genuinely curious - What are the reasons for exposing an SQL server directly to the internet? Obviously there's a bunch of people who have mis-configured and have accidently exposed their systems, but are there real-world reasons to expose a SQL server directly to the net? I would think most people who are sharing datasets would do so with some sort of API - and there'd need to be room for rate limiting / blackli…
In a word "laziness." It is just easier to log in and manage an SQL server if it is available on the internet. I know I'm certainly guilty of doing so for short periods when I'm off-site with no VPN and need to manage a server. Some sysadmins just get lazy and leave it available on the internet with strong passwords 24/7, just so once in a blue moon they can log in and manage it. Or are doing some kind of site to sit…
It really is simple to use ssh to tunnel a port; that is always how I access SQL Server remotely. Laziness indeed.
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#8Earlier quoted context omitted.
In a word "laziness." It is just easier to log in and manage an SQL server if it is available on the internet. I know I'm certainly guilty of doing so for short periods when I'm off-site with no VPN and need to manage a server. Some sysadmins just get lazy and leave it available on the internet with strong passwords 24/7, just so once in a blue moon they can log in and manage it. Or are doing some kind of site to sit…
It really is simple to use ssh to tunnel a port; that is always how I access SQL Server remotely. Laziness indeed.
If they are using MS SQL, chances are SSH isn't even in their toolset.
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#9Isn't the 440 figure disingenuous? Surely you must count UDP/TCP header size, which would bring the value closer to 21/461 ~= 22. Still an interesting discovery. DDoS amplification is a security risk few people consider when developing applications.
Agreed. As I see it there are two main design methods for overcoming this issue.
The first is better for 'anonymous' services; require the client to send a packet of the same size as the buffer they want to receive. It's network in-efficient but for small requests better than the delay in setting up an actual session. It eliminates the chance of amplification attacks.
The second is to establish /some/ kind of session. This might be as 'simple' as logging in, or it could just involve a few round trip communications that indicate the client /is/ listening to server replies. That eliminates every DDoS style except for a man in the middle capable amplification vectors; yet if MitM is possible then why bother with DDoS.
Re: MS SQL Server Resolution Service enables reflected DDoS with 440x amplification
#10Earlier quoted context omitted.
In a word "laziness." It is just easier to log in and manage an SQL server if it is available on the internet. I know I'm certainly guilty of doing so for short periods when I'm off-site with no VPN and need to manage a server. Some sysadmins just get lazy and leave it available on the internet with strong passwords 24/7, just so once in a blue moon they can log in and manage it. Or are doing some kind of site to sit…
It really is simple to use ssh to tunnel a port; that is always how I access SQL Server remotely. Laziness indeed.
You use SSH port tunnelling on a Windows Server to access MS SQL? I'd be surprised if that was "simple." But go ahead and explain it.