Imperva discovers emerging attack vector

“Our research suggests that we will soon see autonomous malware targeting internal databases within organizations – which we believe would lead to a greater risk of infection and compromise within a network,” said Amichai Shulman, chief technology officer at Imperva. “Organizations need to take the risks posed by cloud services into consideration as they decide which data they want to store externally, and adopt a mitigation strategy accordingly.”

While the perceived risk of cloud services is already high, the report identifies two factors in particular that increase risk to corporate data: the relative ease of accessing cloud databases, as well as the ease of quickly turning a legitimate foothold on these servers into a privilege escalation attack. Key findings also include:
? Malware is now capable of connecting to both local and remote databases to retrieve, manipulate and exfiltrate information.
? Malware can leverage DBaaS for botnet management (e.g., Command & Control as well as Dropper functionality).
? Cloud databases are prone to attacks via both privilege escalation and exposed vulnerabilities, as opposed to on-premise databases, which are mostly compromised via privilege escalation.