[unixhero]

Moral of the story. For my sake:

Check the access logs.

Regularly.

[peterwwillis]

Why, are you bored? They can just access the db from an internal host that already has connections and exfiltrate from there. That's part of why people retrieve data using holes in web apps - it looks like a spike in normal traffic.

[unixhero]

I'm sharing my takeaway after reading this. Access logs are fun to some people ;)