Scan Databases
Scan Databases [T1596.005]
Last updated
Scan Databases [T1596.005]
Last updated
Name: Scan Databases
ID: T1596.005
Tactics:
Technique:
Scan Databases () is a sub-technique within the MITRE ATT&CK framework under the broader "Search Open Technical Databases" () technique. It involves adversaries systematically scanning publicly accessible databases to gather sensitive information, credentials, or vulnerabilities. Attackers typically leverage automated tools and scripts to identify misconfigured databases, extract valuable data, or discover weaknesses that can be exploited in subsequent stages of an attack.
Scanning databases involves systematically probing public-facing database services and APIs to identify weaknesses, misconfigurations, or exposed sensitive data. Attackers typically perform the following steps:
Identification and Enumeration:
Use automated scanners (e.g., Shodan, Censys, ZoomEye) to locate publicly accessible databases.
Enumerate database types (e.g., MongoDB, Elasticsearch, MySQL, PostgreSQL, Redis) and versions to identify known vulnerabilities.
Fingerprinting and Profiling:
Determine database structure, schema, and potential sensitive data stored within.
Identify authentication methods or lack thereof (open databases with no authentication).
Exploitation and Data Extraction:
Attempt anonymous or weak authentication methods (default credentials, no passwords).
Extract sensitive data such as usernames/passwords, customer records, financial information, or intellectual property.
Reconnaissance Automation:
Scripts and automated tools continuously scanning IP ranges, cloud infrastructures, or known hosting services to discover new database instances.
Use of specialized tools like Metasploit modules, Nmap scripts, or custom Python scripts to automate database enumeration and exploitation attempts.
Continuous Monitoring and Persistence:
Attackers may periodically revisit databases to monitor for changes, new data, or additional vulnerabilities.
Establish persistent access or data exfiltration mechanisms once initial access is obtained.
Scanning databases typically occurs in the reconnaissance phase of an attack lifecycle, but can also be leveraged during later stages for continuous information gathering. Common scenarios include:
Initial Reconnaissance:
Attackers scan databases early in the attack lifecycle to identify vulnerable targets and gather initial intelligence.
Credential Harvesting:
Attackers look for exposed databases containing authentication credentials or sensitive user data to facilitate lateral movement or privilege escalation.
Data Leakage and Breach Operations:
Attackers target publicly exposed databases to perform direct data theft or leak sensitive information publicly.
Supply Chain Attacks:
Scanning databases to identify third-party or partner organizations with exposed data repositories, enabling indirect targeting of primary victims.
Opportunistic Attacks:
Automated scanning campaigns continuously search for open databases, exploiting discovered vulnerabilities or misconfigurations opportunistically.
Detection of database scanning activities involves monitoring, logging, and analyzing network and database access patterns. Common detection methods include:
Network Traffic Analysis:
Monitoring for anomalous spikes in inbound traffic targeting known or suspected database ports (e.g., TCP ports 27017 for MongoDB, 9200 for Elasticsearch, 6379 for Redis, 3306 for MySQL).
Identifying repeated connection attempts or scanning behavior from unknown or suspicious IP addresses.
Database Access Logging and Monitoring:
Implementing detailed logging of database access attempts, queries, and authentication events.
Analyzing logs for unusual query patterns, bulk data extraction attempts, or authentication failures.
Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS):
Deploying IDS/IPS rules to detect known scanning signatures, automated enumeration scripts, and known exploit attempts.
Leveraging threat intelligence feeds to identify IP addresses associated with known scanning campaigns.
Security Information and Event Management (SIEM) Solutions:
Correlating logs and alerts from database servers, network devices, and security appliances to identify scanning and exploitation attempts.
Alerting security teams on suspicious activities, failed authentication attempts, and unusual database query patterns.
Indicators of Compromise (IoCs):
Presence of known scanning tool signatures in network traffic (e.g., Shodan, Zmap, Masscan).
Unusual access patterns (e.g., high-frequency connection attempts, enumeration of multiple databases or tables).
Database logs showing repeated authentication failures or unauthorized query attempts.
Connections originating from known malicious IP addresses or threat actor infrastructure.
Early detection of database scanning activities is crucial due to the following potential impacts:
Sensitive Data Exposure:
Scanning and subsequent exploitation can lead to unauthorized disclosure of sensitive data such as personal identifiable information (PII), financial records, trade secrets, and intellectual property.
Credential Compromise:
Attackers may extract credentials stored within databases, enabling lateral movement, privilege escalation, and deeper network compromise.
Compliance and Regulatory Risks:
Data breaches resulting from database scanning and exploitation can lead to severe regulatory penalties, legal liabilities, and loss of customer trust.
Operational Disruption:
Unauthorized access and exploitation of databases can disrupt critical business operations, degrade service availability, and damage organizational reputation.
Early Warning and Prevention:
Detecting scanning activities during the reconnaissance phase enables defenders to proactively secure misconfigured databases, implement stronger authentication controls, and respond swiftly to prevent further exploitation.
Real-world examples illustrating database scanning attacks include:
MongoDB Ransomware Attacks:
Attackers used automated scanning tools to identify publicly accessible MongoDB instances without authentication.
Databases were compromised, data deleted or encrypted, and ransom notes left demanding cryptocurrency payments.
Elasticsearch Data Leaks:
Adversaries regularly scan and exploit open Elasticsearch databases, resulting in exposure of millions of sensitive records.
Notable incidents involved leaks of customer data, medical records, and financial information due to misconfigured Elasticsearch clusters.
Redis Database Exploitation:
Attackers identified publicly accessible Redis databases and exploited them to install cryptocurrency mining malware or remote access tools.
Automated scripts were used to scan IP ranges and rapidly exploit vulnerable Redis instances.
Shodan-based Reconnaissance:
Threat actors leverage Shodan to discover exposed databases across various industries, subsequently targeting identified databases for credential harvesting or data extraction.
AWS S3 Bucket Scanning and Data Exposure:
Attackers routinely scan AWS cloud environments for misconfigured S3 buckets and databases, resulting in massive data leaks and compromise of sensitive corporate data.
In each scenario, attackers leveraged automated scanning tools, exploited misconfigurations, and caused significant security incidents, highlighting the importance of proactive detection and mitigation strategies.