Weak SQL Server Passwords Enable Brute-Force Takeover and Malware Deployment
Written by AI from the linked story. Not reviewed by an editor. How this works
Attackers successfully brute-forced internet-facing Microsoft SQL Server instances using a dictionary of just 2,700 common passwords, highlighting that many organizations are still running database services with weak or default credentials directly exposed to the internet. Once inside, adversaries leveraged T-SQL — a legitimate database feature — to execute system commands, download a Monero cryptocurrency miner, and install the Gh0st RAT remote access trojan. This matters because a compromised database server provides attackers with both a persistent foothold and potential access to sensitive data stored within. The attack is entirely preventable: strong, unique passwords combined with network-level restrictions on database exposure would have stopped it before it started.
Tactical Insight
Immediate actions
- Enforce strong, unique passwords (minimum 16 characters) on all SQL Server accounts and disable or rename the default 'sa' account immediately.
- Remove Microsoft SQL Server from direct internet exposure by placing it behind a firewall or VPN, allowing access only from trusted IP ranges.
- Audit all SQL Server instances for enabled xp_cmdshell and other dangerous extended stored procedures, disabling any that are not operationally required.
Long-term improvements
- Implement a privileged access management (PAM) solution to rotate and vault database credentials automatically.
- Maintain a continuously updated inventory of all internet-facing services and schedule regular attack surface reviews.
- Apply the principle of least privilege to all SQL Server logins, ensuring application accounts cannot execute OS-level commands.
Detection measures
- Deploy authentication failure alerting to flag accounts that experience more than five failed logins within a short window, triggering an automatic account lockout.
- Monitor SQL Server logs for unusual use of T-SQL system procedures (e.g., xp_cmdshell, sp_configure) and outbound network connections from the database process.
- Integrate SQL Server audit logs with a SIEM to correlate brute-force attempts across multiple database hosts in real time.