BSidesRDU 2022 - Confused deputy problem for MySQL & PostgreSQL: a method for privilege escalation
BSidesRDU 2022
https://bsidesrdu.org/
NOTE: The above YouTube video title is a modification of the the name of the talk which has been adjusted for field length. Actual title is "Confused deputy problem for databases: a method for privilege escalation in MySQL and PostgreSQL"; presented by Alexander Rubin
BSidesRDU 2022 - Confused deputy problem for databases: a method for privilege escalation in MySQL and PostgreSQL - Alexander Rubin
Operation systems had a confused deputy based privilege escalations for ages. But does it exist in a database? Usually the database security is only discussed in the context of protecting the database from the internet.In the session I will demonstrate a number of cases where a simple select can be used to escalate privilege inside the database. I will also show a novel method of confusing some standard MySQL and PostgreSQL monitoring agents to retrieve private information (i.e. database passwords).
Theatre
Sat 2:00 pm - 2:30 pm
--
Alexander Rubin
Sr Database Engineer, RDS Red Team Lead, Amazon Web Services
Alexander is a Sr Database Engineer at Amazon Web Services (AWS), leading RDS Red Team.
Alexander was working as MySQL principal consultant/architect for over 15 years, started with MySQL AB in 2006 (company behind MySQL database), Sun Microsystems, Oracle and then Percona. His security pentest/red teaming interest started with playing CTFs and performing opensource security research. Alexander is leading RDS (relational database as a service) Red Team at Amazon Web Services.