Microsoft Warns of Cyber Attacks Attempting to Breach Cloud via SQL Server Instance

Microsoft has detailed a new marketing campaign in which attackers unsuccessfully tried to go laterally to a cloud atmosphere by a SQL Server instance.

“The attackers originally exploited a SQL injection vulnerability in an software within just the target’s ecosystem,” security scientists Sunders Bruskin, Hagai Ran Kestenberg, and Fady Nasereldeen mentioned in a Tuesday report.

“This authorized the attacker to acquire entry and elevated permissions on a Microsoft SQL Server occasion deployed in Azure Virtual Equipment (VM).”

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

In the upcoming phase, the risk actors leveraged the new permissions to attempt to shift laterally to supplemental cloud resources by abusing the server’s cloud identity, which may possibly possess elevated permissions to likely have out various malicious actions in the cloud that the id has access to.

Microsoft reported it did not obtain any proof to recommend that the attackers efficiently moved laterally to the cloud means working with the system.

“Cloud products and services like Azure use managed identities for allocating identities to the numerous cloud sources,” the researchers reported. “All those identities are employed for authentication with other cloud means and solutions.”

The starting up position of the attack chain is an SQL injection in opposition to the databases server that enables the adversary to operate queries to gather information about the host, databases, and network configuration.

In the observed intrusions, it truly is suspected that the software focused with the SQL injection vulnerability experienced elevated permissions, which permitted the attackers to permit the xp_cmdshell solution to launch operating technique instructions to commence to the up coming period.

This included conducting reconnaissance, downloading executables and PowerShell scripts, and setting up persistence by means of a scheduled activity to start a backdoor script.

Facts exfiltration is accomplished by getting edge of a publicly obtainable instrument identified as webhook[.]web page in an energy to remain beneath the radar, because outgoing targeted visitors to the services is considered reputable and not likely to be flagged.

“The attackers tried using making use of the cloud identification of the SQL Server occasion by accessing the [instance metadata service] and getting the cloud identity entry important,” the scientists said. “The request to IMDS identity’s endpoint returns the security credentials (identification token) for the cloud identification.”

The top aim of the procedure appears to have been to abuse the token to complete numerous functions on cloud resources, which includes lateral motion across the cloud surroundings, whilst it finished in failure thanks to an unspecified mistake.

The improvement underscores the developing sophistication of cloud-centered attack tactics, with negative actors consistently on the lookout for around-privileged processes, accounts, managed identities, and databases connections to carry out additional malicious activities.

“This is a approach we are familiar with in other cloud services this kind of as VMs and Kubernetes cluster but haven’t viewed ahead of in SQL Server instances,” the researchers concluded.

“Not adequately securing cloud identities can expose SQL Server circumstances and cloud methods to identical pitfalls. This approach gives an opportunity for the attackers to achieve higher impression not only on the SQL Server situations but also on the involved cloud means.”

Identified this report interesting? Abide by us on Twitter  and LinkedIn to browse extra exclusive content material we post.