An attack on MySQL's login protocol

TL;DR

This paper demonstrates that MySQL's challenge-response login protocol is insecure, allowing eavesdroppers to impersonate users after minimal observation, and discusses implications and statistical findings.

Contribution

It presents a practical attack on MySQL's authentication protocol, revealing its vulnerabilities and analyzing potential implementation issues.

Findings

Eavesdroppers can impersonate users after observing a few protocol executions.

The attack algorithm is detailed and proven effective.

Statistical analysis supports the attack's feasibility.

Abstract

The MySQL challenge-and-response authentication protocol is proved insecure. We show how can an eavesdropper impersonate a valid user after witnessing only a few executions of this protocol. The algorithm of the underlying attack is presented. Finally we comment about implementations and statistical results.