Hacker News Reader

Seems to be an intentional honeypot. That said, the storing the binary code on an innocent image host was a nice find that wouldn't have happened had the attack been blocked immediately. Pretty nice win for that image host to learn to strip images and they can stop hosting malware...

> So unless the attacked application uses a superuser for database access (which is a big security hole to begin with) or uses a superuser account with a weak password and allow superuser access from the outside, I don't see how this could be exploited.

It can't be exploited if the security "best practices" are used. But I've come across situations where people were using "sa" as the account for production SQL Server connections because they just didn't know any better. Things are much better in the linux/bsd world where there is generally more competence and people tend to know what they are doing.

Having said that, things are getting better. IT/developers are much more mindful of security concerns today than 10 years ago.

Look for the wide open MongoDB then most recently Memcached servers, it's possible for many people just don't secure their internet connected DB server. The Shodan result mentioned in the article proved.