Why Should You Care About Crypto Mining on Your SQL Servers?

by Feb 16, 2021

Categories

Tags

Administration agent-based monitoring Agentless Monitoring alert responses alert thresholds alerting Alerts Amazon Aurora Amazon EC2 Amazon RDS Amazon RDS / Aurora Amazon RDS for SQL Server Amazon Redshift Amazon S3 Amazon Web Services (AWS) Analytics application monitoring Aqua Data Studio automation availability Azure Azure SQL Database azure sql managed instance Azure VM backup Backup and recovery backup and restore backup compression backup status Backup Strategy backups big data Blocking bug fixes business architecture business data objects business intelligence business process modeling business process models capacity planning change management cloud cloud database cloud database monitoring cloud infrastructure cloud migration cloud providers Cloud Readiness Cloud Services cloud storage cloud virtual machine cloud VM clusters code completion collaboration compliance compliance audit compliance audits compliance manager compliance reporting conference configuration connect to database cpu Cross Platform custom counters Custom Views customer survey customer testimonials Dark Theme dashboards data analysis Data Analytics data architect data architecture data breaches Data Collector data governance data lakes data lineage data management data model data modeler data modeling data models data privacy data protection data security data security measures data sources data visualization data warehouse database database administration database administrator database automation database backup database backups database capacity database changes database community database connection database design database developer database developers database development database diversity Database Engine Tuning Advisor database fragmentation database GUI database IDE database indexes database inventory management database locks database management database migration database monitoring database navigation database optimization database performance Database Permissions database platforms database profiling database queries database recovery database replication database restore database schema database security database support database synchronization database tools database transactions database tuning database-as-a-service databases DB Change Manager DB Optimizer DB PowerStudio DB2 DBA DBaaS DBArtisan dBase DBMS DDL Debugging defragmentation Demo diagnostic manager diagnostics dimensional modeling disaster recovery Download drills embedded database Encryption End-user Experience entity-relationship model ER/Studio ER/Studio Data Architect ER/Studio Enterprise Team Edition events execution plans free tools galera cluster GDPR Getting Started Git GitHub Google Cloud Hadoop Healthcare high availability HIPAA Hive hybrid clouds Hyper-V IDERA IDERA ACE Index Analyzer index optimization infrastructure as a service (IaaS) infrastructure monitoring installation Integrated Development Environment interbase Inventory Manager IT infrastructure Java JD Edwards JSON licensing load test load testing logical data model macOS macros managed cloud database managed cloud databases MariaDB memory memorystorage memoryusage metadata metric baselines metric thresholds Microsoft Azure Microsoft Azure SQL Database Microsoft PowerShell Microsoft SQL Server Microsoft Windows MongoDB monitoring Monitoring Tools Monyog multiple platforms MySQL news newsletter NoSQL Notifications odbc optimization Oracle PeopleSoft performance Performance Dashboards performance metrics performance monitoring performance schema performance tuning personally identifiable information physical data model Platform platform as a service (PaaS) PostgreSQL Precise Precise for Databases Precise for Oracle Precise for SQL Server Precise Management Database (PMDB) product updates Project Migration public clouds Query Analyzer query builder query monitor query optimization query performance Query Store query tool query tuning query-level waits Rapid SQL rdbms real time monitoring Real User Monitoring recovery regulations relational databases Releases Reporting Reports repository Restore reverse engineering Roadmap sample SAP Scalability Security Policy Security Practices server monitoring Server performance server-level waits Service Level Agreement SkySQL slow query SNMP snowflake source control SQL SQL Admin Toolset SQL CM SQL code SQL coding SQL Compliance Manager SQL Defrag Manager sql development SQL Diagnostic Manager SQL Diagnostic Manager for MySQL SQL Diagnostic Manager for SQL Server SQL Diagnostic Manager Pro SQL DM SQL Doctor SQL Enterprise Job Manager SQl IM SQL Inventory Manager SQL Management Suite SQL Monitoring SQL Performance SQL Quality SQL query SQL Query Tuner SQL Safe Backup SQL script SQL Secure SQL Security Suite SQL Server sql server alert SQL Server Migration SQL Server Performance SQL Server Recommendations SQL Server Security SQL statement history SQL tuning SQL Virtual Database sqlmemory sqlserver SQLyog Storage Storage Performance structured data Subversion Support tempdb tempdb data temporal data Tips and Tricks troubleshooting universal data models universal mapping unstructured data Uptime Infrastructure Monitor user experience user permissions Virtual Machine (VM) web services webinar What-if analysis WindowsPowerShell

Many different types of malware are floating around out there. Some of the variants are purely destructive and are designed to simply delete data. This type of malware is often sent out randomly by societally-challenged hackers who thrive on causing trouble anonymously. All computer systems should be protected by antivirus software to help prevent infection with this kind of dangerous malware.

While causing havoc may be enough for some hackers, others have found more lucrative ways to practice their craft. A glance at any IT security news source is likely to present new instances of ransomware, a particularly nasty type of malware favored by organized gangs of cybercriminals. In this type of attack, a system’s data is encrypted and made unavailable to its owners until a financial ransom is paid to the perpetrators.

Enterprise computing environments offer attractive targets for criminals wielding ransomware weapons. Finding important systems to infect increase the chances that the victims will pay the ransom to quickly regain access to their data. In recent months, the healthcare industry has been particularly hard hit by ransomware, further complicating the efforts to combat the coronavirus pandemic. 

One can reasonably compare a ransomware attack to armed robbery. There is no attempt to hide the fact that computing systems have been compromised. A successful ransomware attack requires the victim to be aware of the seriousness of the intrusion so they are willing to pay the ransom. It can’t be done quietly, which risks exposing the cybercriminals to legal repercussions.

A more subtle method of using malware for financial gain is hijacking computing systems for mining cryptocurrency such as Bitcoin. While mining for cryptocurrency in itself is a harmless activity, it is very resource-intensive. Complex mathematical calculations related to the blockchain are required to harvest Bitcoins or other forms of cryptocurrency.

In a sense, crypto mining creates value from thin air. Simply performing a bunch of intensive mathematical calculations ends up producing cyber currency that has real value. The problem is that it takes a lot of processing power to mine productively. This is where cybercriminals come in as they search for ways to increase their take from crypto mining. 

Targeted Crypto Mining

SQL Servers make inviting targets for illicit crypto mining. They are often well-provisioned with the kind of memory and processing power that miners like to see. Identifying a SQL Server system available for infection leads to some happy cybercriminals. Specifically going after database servers has become increasingly popular among underground crypto miners.

An extensive campaign called MrbMiner was discovered in September 2020 that downloaded crypto mining software on thousands of SQL Servers. The most common method of intrusion was compromising weakly protected administrator accounts. Once access had been obtained, crypto mining tools were installed, leading to degraded server performance. 

Why it Matters

The first and most obvious problem with allowing crypto mining processes to run on your SQL Servers is that their performance will be degraded. The CPU cycles and memory used by the crypto miners will reduce the resources available for database activity and will slow it down. The performance issues caused by crypto mining can also result in a lot of wasted time as DBAs struggle to identify the hidden source of the problem.

Another reason that having your SQL Servers crypto mined should alarm you is it indicates your systems have been accessed by malicious actors. Whether the intrusion is perpetrated by internal or external forces, nothing stops them from ratcheting up the stakes by stealing sensitive data or planting ransomware. Cybercriminals with the ability to deliver crypto-mining tools to your environment may also have other ideas in mind.

Protecting Your SQL Servers 

The first step in infecting a SQL Server with crypto mining malware is to gain access to the system. SQL Server DBAs tasked with protecting enterprise databases need to know who is accessing their systems and what activities they are performing. SQL Secure provides them with a tool to help even the playing field when faced with cybercriminals determined to compromise their systems.

With SQL Secure, DBAs can analyze users’ effective rights, identify surface areas prone to attack, and view server security properties. They can analyze the security of the operating systems hosting SQL Server instances and detect weak passwords that may leave the doors open for hackers. Predefined policy templates provide teams with realistic guidelines for protecting SQL Servers from unauthorized intrusion. 

Powerful reporting capabilities let you view security scorecards to quickly identify instances that need review. Custom reports can be generated for security audits and used as compliance evidence. All physical, visual, and cloud SQL Server instances in the environment can have security managed from a central console. Security data is stored in a centralized repository for use in reporting and analysis.

You should be concerned about crypto miners accessing your SQL Servers for the performance degradation and potential extracurricular activities they can engage in once successfully accessing the systems. It takes a concerted effort to protect enterprise SQL Server resources and SQL Secure will assist in hardening your SQL Server environment.