Hackers Are Selling More Than 85,000 MySQL Databases On a Dark Web Portal

An anonymous Slashdot reader writes: For the past year, hackers have been breaking into MySQL databases, downloading tables, deleting the originals, and leaving ransom notes behind, telling server owners to contact the attackers to get their data back. If database owners don't respond and ransom their data back in nine days, the databases are then put up on auction on a dark web portal.
"More than 85,000 MySQL databases are currently on sale on a dark web portal for a price of only $550/database," reports ZDNet: This suggests that both the DB intrusions and the ransom/auction web pages are automated and that attackers don't analyze the hacked databases for data that could contain a higher concentration of personal or financial information. Signs of these ransom attacks have been piling up over the course of 2020, with the number of complaints from server owners finding the ransom note inside their databases popping up on Reddit, the MySQL forums, tech support forums, Medium posts, and private blogs.

Notes inside their Databases

[oldgraybeard]

Ok maybe there should have been some security?

Seriously, though.

[kurkosdr]

Every security professional having to work with stingy accountants, moronic management and techbro developers who don't want to take security seriously should print that article out and say "Look!". Then they can start explaining the benefits of pen-testing.

Re:

[ShanghaiBill]

The companies with compromised data didn't fail to listen to their security professionals. They didn't have security professionals. Why would they hire an expert, pay them a salary, and then ignore them? The story behind these ransoms is almost always the clueless leading the blind.

Re:

[kurkosdr]

After all the high-profile ransomware cases in the mainstream news last year, even the dumbest of companies have a security expert now. The problem is that more often than not he is a middle-level guy with no real power to change anything. For example, they cannot say "everyone should stop what they are doing, and we are patching our years-old PHP server and implementing a third-party anti-SQL-injection filter for our input, I mean, since we cannot use prepared statements because our code assembles the quer

and for remote read only where is the ransom note?

[Joe_Dragon]

and for remote read only where is the ransom note?

Re:

[oldgraybeard]

Good point!

Would be funny if some hacker

[oldgraybeard]

wanna be, paid 550 for someone's raspberry pi testing database ;) After all it mentioned being automated.

Re:

[Geek On The Hill]

This article actually has me thinking about building some honeypots exposing databases with tantalizing names, of staggering size, and containing utterly useless, weakly-encrypted data. I'd get a serious case of the giggles every time I thought about the end buyer spending the time and resources needed to decrypt something like the 1961 Sears Roebuck catalog.

Re:

[oldgraybeard]

fun idea ;)

Re:

[ShanghaiBill]

databases with tantalizing names

CIAmolesInRussia.db
IranianCentrifugeLocations.db
DonaldsLittleBlackBook.db
SlovenianSupermodelNudes.db
MoscowHotelRoomUrinePhotos.db
NASAfakeMoonLanding1969.db
BidensPlanToStealTheElection.db

Who's leaving these things exposed?

[grasshoppa]

Are you seriously telling me that here we are, 2020, and folks are still leaving critical services exposed to unsecured networks unnecessarily? Why? Now a days you'd have to go out of your way to open those ports up, so what are people trying to accomplish?

Re:Who's leaving these things exposed?

[bobstreo]

Are you seriously telling me that here we are, 2020, and folks are still leaving critical services exposed to unsecured networks unnecessarily? Why? Now a days you'd have to go out of your way to open those ports up, so what are people trying to accomplish?

Probably the outsourcing vendor they replaced all the DB employees with. If you want your DB services "secured" it costs extra.

Re:

[gweihir]

Probably the outsourcing vendor they replaced all the DB employees with. If you want your DB services "secured" it costs extra.

That may be one factor. But a lot of this is simply people with no clue what they are doing combined with significant arrogance. Just think of all the unsecured S3 buckets, for example. If you have a minimal clue how things work, you make very sure it is protected, and then you test it. Funny thing, one of the most secure (while working perfectly fine) firewall configs I have so far analyzed was by a guy that was actually a printer and that said he had only a minimal clue. But this person did read up on stu

Re:

[onepoint]

Most people that work on, or in a printing press process are rather 3-D smart, I met a guy that made a specific mathematical formula/model to account for the diameter of roll while printing and the speed adjustment needed. These guys read manuals all the time to make sure the press run's correctly. so I am not surprised about the firewall setting being tight as can be for what the guy could understand and operate.

Re:

[gweihir]

That sounds like a good explanation. This guy really impressed me and he did a lot better than many computer engineers and CS types in other companies that should really have known better.

Re:

[onepoint]

I set up a friends print shop network back in the 80's ( novell networks ) simple, nothing fancy, I just watched these guys and women run the press machines with some real analog grace and style, and you could see that they had check list for running the entire operation run.
They used kitchen timers to know when to check certain things and simple experience solutions.
It stuck with me for my lifetime.

Can I Has A Free Database?

[zenlessyank]

Oh Goody! I found a Yellow Pages. Look at all these addresses and names. This must be illegal as hell to have!!

Porn?

[PPH]

Any good porn databases? Volume discounts available?

Asking for a friend.

Re:

[theskipper]

Just curious, is your friend Mike in accounting? Because he just asked me to post the same thing.

Ransom?

[Bigbutt]

Hmmm. Pay $1,000,000.00 to some hacker for your database. Or. Log in to the dark web, search, and pay $550.00. Tough choice.

[John]

Real data or fake data?

[DidgetMaster]

I wonder how many of those databases have anything in them worth anything at all. Just like easy passwords for user accounts on websites that I couldn't care less if someone hacked anyway; I have certainly created test databases with dummy data in them before. Who cares about security when all the names, addresses, and social security numbers in your table are just randomly generated values?