SQL Monitor Security Vulnerability

Answers

• webpursuits Posts: 1 New member

  October 16, 2018 2:54PM

  I received the same...legit?

  0 · Share on Twitter
• jeffchirco Posts: 8 Bronze 1

  October 16, 2018 2:56PM edited October 16, 2018 2:59PM

  I received as well and I agree the email looks like a phishing attempt.  I forwarded it to my rep. Glad I wasn't the only one to think this.

  0 · Share on Twitter
• Russell D Redgate › Posts: 1,324 Diamond 5

  October 16, 2018 3:05PM edited October 16, 2018 3:06PM

  The announcement is legitimate.
  

  Have you visited our Help Centre?

  1 · Share on Twitter
• DarienA Posts: 2 New member

  October 16, 2018 3:07PM

  Came to search for this very topic, this email looks sketchy as heck, I'll be emailing my sales rep to point out the issues with it. 

  0 · Share on Twitter
• mikewerts Posts: 1 New member

  October 16, 2018 3:12PM

  This is indeed legit.  The following link show upgrade notes for 8.0.19 but doesn't mention security...
  
  https://documentation.red-gate.com/sm8/release-notes-and-other-versions/sql-monitor-8-0-release-notes?_ga=2.104009344.1887869072.1539701317-1721444002.1519999268

  0 · Share on Twitter
• jeffchirco Posts: 8 Bronze 1

  October 16, 2018 3:15PM

  Pretty funny that the vulnerability is about being tricked into visiting a malicious link but that is exactly what the email wanted us to do.

  4 · Share on Twitter
• TMowbray Posts: 10 New member

  October 16, 2018 3:17PM

  Can someone from RG comment as this looks really odd and I have logged it with our service desk as a phishing attempt. The from is supposedly CEO Tony Payne, yet your site info has another name....I too looked at the hubspotemail as a funny address to follow, same for the link that was supposedly to your site. This needs to be officially corrected before I will believe it.
  
  
  
  
  

  0 · Share on Twitter
• BryanEargle Posts: 3 Bronze 1

  October 16, 2018 3:23PM

  Agree it's weird, looks like the release notes now mention the security fix - guess it was added after release notes were originally posted?

  0 · Share on Twitter
• Alex B Redgate › Posts: 1,158 Diamond 4

  October 16, 2018 3:35PM

  Hi all,
  
  Yes, the links are legitimate - as @Russell D above indicates - they are going through our hubspot which makes these somewhat unsavory looking links.  The links posted above are direct to the pages themselves and are where the hubspot links are directed.
  
  The email is from Tony Payne COO (Chief Operations Office) which is correct; Simon Galbraith is the CEO.
  
  We agree that the links look extremely suspicious (especially given the circumstances) and we have fed this back to our internal teams.
  
  Also, the release notes have just been updated with the extra information now that the email has been released as seen above.
  
  My apologies for the confusion and scare!
  
  Kind regards,
  Alex

  Product Support Engineer | Redgate Software
  
  Have you visited our Help Center?

  4 · Share on Twitter
• kfrazier Posts: 2 New member

  October 16, 2018 3:40PM

  I emailed my rep last week due to receiving an email from with hubspotemail link. I think they are using hubspot as a marketing tool to track clicks. This is shady and I refuse to click on these links. I have to manually find the answers. I think it is a very poor decision on red-gate's part as everyone is getting training not to click on links like this and companies are doing test to see who does click on links like this and sending them for training or discipline.  If anybody of any power is reading this please stop this is a very poor practice. 
  

  2 · Share on Twitter
• jeffchirco Posts: 8 Bronze 1

  October 16, 2018 3:47PM

  I agree kfrazier. We do the same training here.
  

  0 · Share on Twitter
• Sian Posts: 1 New member

  October 16, 2018 3:59PM

  Does anyone know in what version of SQL Monitor this security vulnerability was introduced?

  0 · Share on Twitter
• DarienA Posts: 2 New member

  October 17, 2018 9:38AM

  This is the email I sent to my sales rep today:
  
  

  Hey William I received this email today and to my eye it looks very suspect. I did find confirmation on your website that it is legit: https://www.red-gate.com/products/dba/sql-monitor/entrypage/security-vulnerability-october-2018?_hsenc=p2ANqtz-97lQw3tt0suK3nMLAp3VN8zzIu5Ct1J7DDYs05efPgPd4NVY3JSuZPbj02ZVKN6D94EWGgvdIJsaRapf4T1Dp9lMqotp8yO5bWEpDt2GbGSDe4Hs4&_hsmi=66718880&_ga=2.130576393.783027082.1539702323-301011559.1538759718

   

  But let me point out some concerns:

   

  1. No company logos in the email
  2. Generic formatting
  3. No email disclaimers (which some company’s include in their emails)
  4. None of the url’s in the email when viewed actually point back to red-gate.com.

   

  Now when looking at the header information it does look this came from your email servers and I did find in your support forums conversations about the email which directed me to the above url.

   

  While the below email is personalized with my name that could simply be a case of your customer db being compromised (which thankfully isn’t the case here).

   

  I hope that you folks will give more thought into how your format these types of notifications going forward.

  
  
  

  0 · Share on Twitter
• Markus Posts: 26 Bronze 2

  October 17, 2018 4:38PM

  I upgraded to 8.0.19 late yesterday after it was confirmed that this was legit.  Running fine here.
  

  0 · Share on Twitter
• Russell D Redgate › Posts: 1,324 Diamond 5

  October 18, 2018 2:20PM

  Sian said:

  Does anyone know in what version of SQL Monitor this security vulnerability was introduced?

  Since it's been a web-app, so v1.0 of SQL Response, as it was back then.

  Have you visited our Help Centre?

  0 · Share on Twitter