Active Security Honeypot for MySQL and PostgreSQL protecting databases from ransomware attacks
summary
Creates a high-interaction MySQL honeypot that records real attack attributes, then converts it into an atomic honeypot that actively exploits old clients to retrieve attacker tools. Uses Python Mysql-mimic, compiles shared-library payloads, and implements three real CVE exploits (including a 2019 client RCE and a charset bypass) to trigger remote code execution on vulnerable clients; demos show successful payload delivery and execution (calculator pop), proving the prototype works against legacy MySQL/MariaDB clients.
AI-written summary · about
chapters (15)
- 0:00MySQL security honeypot intro
- 3:01Why databases are prime targets
- 6:49High-interaction MySQL honeypot setup
- 8:57Atomic honeypot for ransomware defense
- 10:03MySQL client RCE vulnerability
- 17:01Directory traversal in MySQL client
- 21:22Buffer overflow in plugin names
- 24:17Social engineering with malicious files
- 26:49Bypassing 2019 MySQL client fix
- 28:15MySQL dump command execution
- 30:47Active security honeypot tool
- 31:332023 rogue MySQL plugin demo
- 32:40Character set bypass demo
- 33:01MySQL dump version stream exploit
- 33:41PostgreSQL honeypot future
related talks
22mPostgreSQL Threats and Attacks in the Wild
26mWeb Honeypot Project
01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability Detection
30mHow to Deploy Honeypots into your Kubernetes
26mLooking at 4 years of web honeypot attacks: tactics, ...
31mWeb Application Honeypot Threat Intelligence
32mPostgreSQL Security: Defending Against External Attacks
22mIntegrating Security Measures Throughout Development