How This SQL Command Blew Up a Billion Dollar Company

A story of the Heartland Payment Systems breach from 2007-2009, the world's largest at the time. The specific details of how everything went down is unknown, so this is built on top of the USSS/FBI advisory, and various articles. The FBI advisory (see the third source) covered dozens of breaches that occurred in the late 2000s, all of which had the same attack pattern (Windows, SQL Server, xp_cmdshell, etc). But it's theoretically possible that Heartland was the odd one out, and that everything in this video is wrong ☺️

Sources:

Assumptions:
- In the hackers' conversation at 1:05, I arbitrarily chose Gonzalez as the "boss" since he's the only one with a Wikipedia page and I suppose has the longest resume.
- For 1:38, Amazon does not use a relational database for its product listings, and therefore no SQL queries are used in reality. But this is a relatable and simple example.
- At 2:38, whether or not Heartland used the 2000 version of SQL Server is a guess. The above Research Gate paper "Heartland Data Breach Analysis" says 2000 is likely as the website was developed 8 years prior. I believe xp_cmdshell was also first introduced in SQL Server 2000, so it could not have been a version prior to that one.
- Whether or not the web portal was connected to SQL Server with sysadmin credentials is also a guess (5:03). It is possible that the role was not sysadmin, but was granted permission to execute xp_cmdshell for unknown reasons (sysadmin can grant other roles permission to use xp_cmdshell)
- Heartland's use of NTLM (7:07) is also a guess. Many companies would have not switched over at the time, and the FBI advisory points out the use of fgdump, which is specifically used for NTLM.
- It is alluded to at 9:02 and onward, but credentials and privilege escalation could have also been obtained through other means.
- The whole "privilege escalation + hop through various hosts" illustration at 9:18 could be completely wrong, and is the biggest gap in the story. This is just the simplest way the payment network could have theoretically been reached. For all we know the hackers actually did exploit Microsoft Office to hack into the mainframe.
- Heartland never specifically said what the packets contained (9:34), but they mentioned everything that *wasn't* leaked, like SSNs, so the assumption here is that packets contained everything that they didn't say wasn't leaked.
- There's a HSM (hardware security module) section in the FBI advisory as well, but I figured that wasn't too important as the primary issue mentioned throughout every article is the unecrypted in-flight data.

Error corrections:
- 3:17 dll files literally contain machine code, usually compiled from C or C++

Chapters:
0:00 Brief introduction of Heartland
0:44 The Beginning
1:34 SQL and SQL injection
2:37 Heartland's use of SQL Server
5:41 Almost Caught?
6:13 Jump to the payment network
9:57 Attack shut down, public disclosure
10:48 The Perpetrators
11:24 Preventive measures
12:54 Conclusion

Music:

[kevinfaang]

Edit: I've since realized that no one reads the description. Pls read the description for extra notes/corrections. If you reply to this comment with any corrections I will add it to the description.

Original comment:
Is the audio quality worse in this video than the last one? Didn't notice with my headphones/speakers, just my phone. Feels like there's too much midrange

[FlabbyTabby]

1990's teaching people how to create web servers:

- Create SQL database
- Create webpage and give it direct access to said database
- Expose CRUD logic directly as UI

[unknownusername]

"Recommendation: use passwords" had me do a double take

[DonaldSubert]

There were a lot of failure points, here, but the fact that they didn't guard against SQL injection is inexcusable. This company that handles credit card data is less secure than my student project that let you report celebrity sightings.

[adamdapatsfan]

As a former T-SQL dev who wrote many stored procs, I can confirm that it is indeed just SQL with a fancy hat.

[matthewstandridge]

This video is insanely good and for such a small channel. This channel is going to skyrocket.

[thekillercow]

Quite hilarious that a company working with sensitive data didn't prepare for the most basic of attacks - SQL injection

[devvy]

"And windows will continue to support it until the heat death of the universe" gotta love microsoft

[DomskiPlays]

What I like is not just that the video is great but you provide sources and clarifications in the description. Love to see it!

[HenryLoenwind]

Number 0: Don't build your SQL by concatenating data and code. SQL has supported placeholders since...um...forever. (Back in the days before dynamic SQL, statements had to be compiled and installed together with the programs. Building them dynamically wasn't even an option.) Using string operations to form SQL commands is simply inexcusable.

(And it also is wasteful. The server can cache the access plans for commands with placeholders, but if you concat in the data, you're sending a completely different command every time.)

[Rain_MG]

I like how companies show off their fancy security features when some parts of their system rely on software that was written by cavemen on walls in prehistoric times

[joelhaggis]

SQL injection is the software equivalent of breaking a lock by hitting it with a hammer. Which is to say, the fact that it works as often as it does (i.e. at all) is extremely alarming.

[byronk]

I was relatively new in the payments industry when this occurred. Now over 15 years on this has been a great trip down memory lane with a well articulated story line. You’ve got a new subscriber.

[jmms]

this is super informative and funny at the same time. Absolutely love it

[MozenBee]

I don't usually post comments on youtube.
But your video is of extremely high quality. Very comprehensive and well thought out.
As soon as a question popped out in my brain you would immediately answer it right after.
Good job, sir.

[allakn]

you're such a high value subscription for me, I love your content. you make normally dry technical stuff interesting and comical. never change mate.

[insanitydefined]

Love your style, rhythm, content -- everything!! Please keep posting videos like these!!

[testengineeringdaily]

I was watching one of your other videos and the failure analysis presented here is just as good as what the UCSB does on their investigations and recommendations.

Great video, and good job!

[JetJockey]

I use SQL Sprocs and Shell via Task Scheduler to automate all kinds of stuff.

Files land in a network folder, task scheduler behaves like a cron and fires a shell script every x minutes.

Shell scans dir for files, finds them, bundles data into JSON, sends via REST to endpoint, etc.

It works well in some very specific scenarios, most of the time you get cockblocked by airlocker or solarwinds

[jwillisbarrie]

Thanks for adding actual captions for the Deaf