Tag - David Busby

Tips for avoiding malware from a lesson learned

In a recent article on the Percona blog, I recommended readers to a tool called CamStudio for making technical screen recordings. The blog post was very popular and got 300+ Facebook likes in a short time. Providentially though, a reader commented that the installer (as downloaded from the project website) installed “pretty annoying adware […]

Read more

Percona security update: oCERT and SSL improvements

We have recently become a member of oCERT to aid in allowing responsible disclosure for Percona products and services as can be seen on their members page.
We are presently working on the verbiage for the responsible disclosure program, and we are also investigating establishing a bug bounty program. In the mean time you can […]

Read more

Percona Security Advisory CVE-2015-1027

Contents

Summary
Analysis
Mitigating factors
P.O.C
Acknowledgments

Summary
During a code audit performed internally at Percona, we discovered a
viable information disclosure attack when coupled with a MITM attack
in which percona-toolkit and xtrabackup perl components could be
coerced into returning additional MySQL configuration information.
The vulnerability has since been closed.
Timeline
2014-12-16 Initial research, proof of concept exploitation and report completion
2015-01-07 CVE reservation request to Mitre, […]

Read more

What stopped MySQL? Tracing back signals sent to MySQL

Have you ever had a case where you needed to find a process which sent a HUP/KILL/TERM or other signal to your database? Let me rephrase. Did you ever have to find which process messed up your night? ūüėČ If so, you might want to read on. I’m going to tell you how you […]

Read more

How to test if CVE-2015-0204 FREAK SSL security flaw affects you

The¬†CVE-2015-0204 FREAK SSL vulnerability abuses intentionally weak “EXPORT” ciphers which could be used to perform a transparent Man In The Middle attack. (We seem to be continually bombarded with not only SSL vulnerabilities but the need to name vulnerabilities with increasing odd names.)
Is your server vulnerable?
This can be tested using the following GIST
If the […]

Read more

GHOST vulnerability (CVE-2015-0235) Percona response

Cloud security company Qualys announced Tuesday the issues prevalent in glibc since version 2.2 introduced in 2000-11-10 (the complete Qualys announcement may be viewed here). The vulnerability, CVE-2015-0235, has been dubbed “GHOST.”
As the announcement from Qualys indicates, it is believed that MySQL and by extension Percona Server are not affected by this issue.
Percona is […]

Read more

File carving methods for the MySQL DBA

This is a long overdue blog post from¬†London’s 44con Cyber Security conference back in September. A lot of old memories were brought to the front as it were; the one I’m going to cover in this blog post is: file carving.
So what is file carving? despite the terminology it’s not going to be a […]

Read more

How to close POODLE SSLv3 security flaw (CVE-2014-3566)

Padding Oracle On Downgraded Legacy Encryption
First off, the naming “convention” as of late for security issues has been terrible.¬†The newest vulnerability (CVE¬≠-2014-3566) is nicknamed POODLE, which at least is an acronym and as per the header above has some meaning.
The summary of this issue is that it is much the same as the earlier […]

Read more

‘Bash Bug’ giving you Shellshock? CVE-2014-6271 update

The media train is in full steam today over the the CVE-2014-6271 programming flaw, better known as the “Bash Bug” or “Shellshock” – the original problem was disclosed on Wednesday via this post. Firstly this issue exploits bash environment variables in order to execute arbitrary commands; a simple check for this per the Red […]

Read more

Systemtap solves phantom MySQLd SIGTERM / SIGKILL issue

The¬†Percona Managed Services team recently faced a somewhat peculiar client issue. We’d receive pages about their MySQL service being unreachable. However, studying the logs showed nothing out of the ordinary…. for the most part it appeared to be a normal shutdown and there was nothing in anyone’s command history nor a cron task to […]

Read more