Hacker News new | past | comments | ask | show | jobs | submit login

No, RDS does not give users the SUPER or FILE privileges, which are required for this exploit.

The whole thing is a bit overblown, given that application users at any security-minded company won't have either of these two privileges either.




So yeah, that means roughly 80% percent of the sites on the internet will be affected, but not the 20% that employ competent, well staffed infosec teams. Good to know :)

Seriously though, almost every vulnerability that gets disclosed can have the "this is all overblown, and any security minded company won't have this problem", and yet we are all dealing with the long tail of malicious software and services hosted on vulnerable infrastructure...


You don't need a large specialized infosec team to know the following:

* Don't give SUPER or FILE privs to your application's mysql user

* Don't allow mysql to accept connections from the public internet

* Avoid SQL injection through use of bind variables

This is pretty elementary stuff, and just doing any 2 of the 3 above will prevent this exploit from being usable. (unless the attacker has SSH access to your hosts, but in that case, you should already consider your entire environment to be compromised.)




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: