Skip to content

Crime

All Your (Data)base Are Belong to Us: Characterizing Database Ransom(ware) Attacks,

Kevin van Liebergen, Gibran Gomez, Srdjan Matic, e Juan Caballero
Proceedings of the Network and Distributed Systems Security Symposium (NDSS 2025)
https://doi.org/10.14722/ndss.2025.241887.

  • We perform the first systematic study of database ransom(ware) attacks. In this class of attacks, the attackers identify target database servers by scanning the IPv4 address space or by using Internet scanning engines.
  • They can scan for target servers on default database ports (e.g., 3306/TCP for MySQL, 9200/TCP for Elasticsearch).
  • Once a target is located, the attackers connect to the database server and try to login by leveraging the lack of authentication, using default credentials, or guessing weak credentials.

  • If they manage to log in, they examine the databases the compromised account has access to, optionally exfiltrate the database contents, drop the content of those databases, and leave a ransom note (e.g., by creating a new database table with a catchy name) with instructions on how to get the data back. The note provides ransom payment details.

  • We obtain data about 60,427 compromised Elasticsearch, MySQL, and MariaDB servers (identified by their IP address) collected by the LeakIX Internet scanning engine over 3 years from May 2021
    until April 2024.

  • We group the infections into 91 campaigns run by 32 groups. It reveals a dominant group that is responsible for 35 campaigns and 76% of the server infections

  • In total, database ransom attacks have received $498K.

  • The dominant group has generated 90% of all measured revenue.
  • The requested ransom amounts are small with 94.4% of all deposits being at most $1,000. Small ransom amounts are likely used to incentivize payments in case the victim has doubts about the data being returned.

  • As recently demonstrated, revenue estimates are affected by limited coverage from the Internet scanning engines and can be up to 39 times higher in reality.

  • Newly infected servers keep appearing with over 6K infected IPs in March 2024, a 60% increase over one year earlier.

  • Our honeypots get infected by database ransom attacks in 14 hours since connected to the Internet.
  • Weak authentication is two orders of magnitude higher in Elasticsearch servers compared to MySQL servers.
  • Elasticsearch only introduced strong default credentials in version 8.0, released in February 2022. After 2.5 years, scanning data shows that only 7.6% Elasticsearch servers run 8.x versions, compared to 92.4% running older versions. Thus, adoption of up-to-date Elasticsearch software with secure default installation is slow, likely leading to servers with weak authentication and vulnerable to database ransom attacks.