Why the Belgian Cyber Security Guide Must Be Extended? Example with MySQL!

A few days ago, I attended an event organized by the Chamber of Commerce in Belgium (ICC Belgium) and the Federation of Enterprises (FEB) to announce with great ceremony the release of the first Belgian Cyber Security Guide. Honestly, this is a great initiative! In the audience, many many infosec professionals were present but not many “business owners“. That’s not a surprise… Ok, I’ll mitigate, it’s also part of our daily job to promote security to C-levels. Even if the message is still not yet received by the target audience, that’s the goal of a “security awareness” process which can be resumed as:

while(true) { repaeat_message(); }.

An endless loop…

The document content is quite good and resume lot of useful information that everybody should follow, even you, your family and friends. To briefly resume, the document is based on a top-ten “must do” security actions:

• Action 1: Implement user education & awareness
• Action 2: keep systems up to date
• Action 3: Protect information
• Action 4: Apply mobile device security
• Action 5: Only give access to information on a “need to know” basis
• Action 6: Enforce safe surfing rules
• Action 7: Use strong passwords and keep them safe
• Action 8: Make and check backup copies of business data and information
• Action 9: Apply a layered approach against viruses and other malware
• Action 10: Prevent, detect and act

My advice is download it, read it and promote it!

But the guide is not complete and could be extended. The actions listed above focus on the end-user and his device(s) – pc/laptop/mobile devices.  In my humble opinion, the guide is lacking some advices regarding our networks and infrastructures. Recently, while surfing here and there, I landed on a MySQL database server publicly available. For infosec professionals, our first reaction is always: “WTF, why is this server facing the wild Internet?“. A few months ago, I scanned for recursive DNS servers in Belgium. To build this first report, I compiled a huge list of Belgian IP addresses. I reused my list of subnets and did the same exercise now with MySQL servers. I scanned the huge pool of IP addresses against the port TCP/3306. What are my findings?

• 10.263.320 IP addresses scanned
• 2.325 IP addresses were running a MySQL server (read: successfully generated a 3-way handshake and replied with the MySQL protocol)
• 0,02% of the IP space was running MySQL
• Only 829 MySQL servers prohibited the connection (“xxx is not allowed to connect to this MySQL server“).
• A lot of IP addresses reported were dynamically assigned (ADSL, etc)

What about the detected versions? The top-ten is:

Based on all MySQL servers found, here is the repartition:

Just for the information, the oldest server found is still running a MySQL 3.23.41-nt. Just have a look at the vulnerabilities discovered for this release. I don’t see why a database server (whatever the type/brand is) must be facing the wild Internet.

Conclusion: I would like to see more advices added to the Belgian Cyber Security Guide about network design and infrastructure. And if this topic looks too deep, just add a suggestion to request the help of professionals to design your network infrastructure. My goal is not to be alarmist but even if you follow up carefully the advices listed in the current document, you are still vulnerable if your resources are directly exposed to the wild! My $0.02…