1. GreenSQL Yuli Stremovsky Email/MSN/Gtalk: stremovsky@gmail.com http://www.greensql.net/

2. Agenda What is SQL Injection? DEMO: Backdoor web server GreenSQL: Detailed Description DEMO: GreenSQL Other solutions Future plans

3. What is SQL Injection ? Legitimate Query: SELECT * from users where username = ‘Alice’ and password = ‘123456’ Injected SQL code: SELECT * from users where username = ‘Alice’ and password = ‘123456’ or ‘1’=‘1’

4. SQL Attacks Hazards Bypass Login page Read files Write Files Dump sensitive information Execute system commands Create database back door New Attack: Distribution of Trojans

5. Demo: Attack MySQL commands –select “text” into outfile “file.txt” Find directory with write permissions –templates_c / templates / temp –images / files / cache

6. C99 Web shell

7. Simple Web Shells Execute system commands Simple Web shell: –system() function –$_GET['cmd'] –$_POST['cmd'] –$_REQUEST['cmd']

8. MySQL Attack DEMO More info here: http://www.greensql.net/publications/backd oor-webserver-using-mysql-sql-injection Demo

9. What is GreenSQL? GreenSQL is a database firewall solution Protects against SQL injection attacks Management console MySQL built in support

10. GreenSQL Diagram

11. GreenSQL Architecture Reverse Proxy Number of databases Number of backend DB servers Deployment options: –Can be installed together with the DB server –Can be installed on specialized server

12. How Query is Blocked Empty result is sent back to application Application can continue gracefully No TCP reset is send No errors is generated

13. GreenSQL Advantages Multiple modes –simulation / learning / active protection Easy Management Pattern Recognition (signatures) Heuristics (risk calculation) Open Source

14. GreenSQL Advantages 2 Cross Platform Rapid Deployment Well established Web application independent The only free security solution for MySQL User Friendly WEB GUI/Management tool

15. Supported modes Simulation mode Block suspicious commands –Based on overall query risk Learning mode –Whilelist patterns of used SQL command patterns Block new commands –Missing queries in Whitelist will be blocked.

16. Easy Management Management GUI IT Orientation Automatic Configuration –Learning Mode –Blocking mode

17. Pattern Recognition Detects administrative commands like: –create table/database –drop table/database –alter table structure Detects information disclosure commands –version() / current_user() / show tables Detects privileged commands –kill() / create_user() / load_file()

18. Example

19. Heuristic Analysis Access to sensitive tables increases risk query (users, accounts, credit information) SQL Comments Empty password string OR token UNION token SQL tautology (true statement) –or 1=1

20. Examples - Blocked

22. Whitelist

23. Positive & Negative Security Positive Security –Learning mode –Whitelist Negative security –Pattern recognition –Heuristic Analyses

24. Multiplatform support Linux based: –CentOS / OpenSUSE / Fedora / Mandrake –Debian / Ubuntu BSD based –FreeBSD Windows (beta)

25. Rapid Deployment Pre-build packages for popular Linux distributions and for FreeBSD Simple installation and configuration scripts Two configuration files –General configuration / DB settings –MySQL patterns

26. Not only for Web Apps Defense in depth methodology IT oriented Support legacy applications Does not require application configuration change Can be configured to listen on the original DB socket which database uses a different one.

27. Open Source Free Open Source GPL License MySQL support

28. Well established Hundreds of newsletter subscribers A bunch of the security reviews and hundreds bug fixes Active support forum Production version A bunch of blog reviews Sourceforge version for more that a year. Featured by popular resources: –http://www.linux.com/http://www.linux.com/ –http://www.phpmagazine.net/http://www.phpmagazine.net/ –http://www.tecchannel.de/http://www.tecchannel.de/

29. Console - DEMO Demo version is available here: http://demo.greensql.net/

30. Related OS Solutions Snort IDS/Prelude ModSecurity PHPIDS MySQL built in security Kernel IDS solutions

31. Snort Network Level inspection TCP/ICPM reset Evasion of signatures SSL support ???

32. ModSecurity HTTP Traffic Apache Module Signature based Positive security

33. PHPIDS Signature bases Requires code change

34. Kernel IDS SE Linux Korset Control API functions

35. MySQL built in security Database / table user access rights Admin permission (FILE) GTANT Permission to –Max queries/connections/updates per hour SSL Additional Commands: –skip-show-databases

36. Future Version DB User permissions Support for PostgreSQL Higher heuristic detection More reports

37. Thank You Yuli Stremovsky Email/MSN/Gtalk: stremovsky@gmail.com More info: http://www.greensql.net/http://www.greensql.net/

38. Google Database Firewall