Hello and welcome to the Thursday, March 19th,

2006 edition of the Sands and the Storms Center's Stormcast.

My name is Johannes Ulrich, recording today from Jacksonville, Florida.

And this episode is brought you by the Science.edu graduate certificate program in penetration

testing and ethical hacking. In diaries today, I wrote up scans that we're seeing against our

honeypots against Adminor. Adminor is a PhD script that allows you to administer your database.

It works for MySQL and Postgres, I believe.

And it's similar in its approach, kind of, to PHP My Admin.

If you're familiar with PHP My admin,

it's one of the big targets out there,

had a very rich history of vulnerabilities.

And it's sort of not the first and original web-based database admin tool.

Adminer takes a different approach and so far that it's just one PHP file.

It's very feature-rich and has actually a pretty good security history.

There have been a couple of vulnerabilities, but far less and the far lower in severity than what

we have with PHP My Admin.

So why are attackers scanning for it?

Well, the weakness that we still have is passwords.

Now, Adminer does not really have the user, usually set up passwords for the tool

itself. Instead, it just uses the databases access control system, and that actually makes

quite a bit of sense. It even offers an optional module that allows you to have some two-factor

authentication, and that's something you should definitely consider, even though it deviates module that allows you to have some two-factor authentication.

...