Attacks Against Database By: Behnam Hossein Ami RNRN i { }

Top 10 Database Attacks 1)Excessive Privilege Abuse 2)Legitimate Privilege Abuse 3)Privilege Elevation 4)Database Platform Vulnerabilities 5)SQL Injection 6)Weak Audit 7)DOS 8)Database Communication Protocol Vulnerabilities 9)Weak Authentication 10)Backup Data Exposure } Privilege Attacks

1)Excessive Privilege Abuse  University operator … Query-Level Access Control 2)Legitimate Privilege Abuse  Export patient record Control volume of data retrieved 3)Privilege Elevation  Use buffer overflow to become admin IPS and Query-Level Access Control

Miserable Part …

4. Database Platform Vulnerabilities  Vulnerabilities in operating systems  0 Day Attacks  Unpatched Systems

Windows server 2008 Year # of Vulnerabilities DoS Code Execution Overflow Memory Corruption Sql Injection XSS Directory Traversal Http Response Splitting Bypass something Gain Information Gain Privileges CSRF File Inclusion # of exploits Total % Of All

Windows server 2008

Year # of Vulnerabilities DoS Code Execution Overflow Memory Corruption Sql Injection XSS Directory Traversal Http Response Splitting Bypass something Gain Information Gain Privileges CSRF File Inclusion # of exploits Total % Of All Windows server 2012

Windows 8.1

SQL Server2005 sp3 Year # of Vulnerabilities DoS Code Execution Overflow Memory Corruption Sql Injection XSS Directory Traversal Http Response Splitting Bypass something Gain Information Gain Privileges CSRF File Inclusion # of exploits Total98631 % Of All

SQL Server2005 sp3

MySQL

MySQL

Wappalyzer

5. SQL Injection;--

Pentest Monky.NET MSSQL Injection Cheat Sheet Oracle SQL Injection Cheat Sheet MySQL SQL Injection Cheat Sheet …

SQLmap a cool tool

6. Weak Audit Problems of usual database audit tools – Lack of User Accountability – Performance Degradation – Separation of Duties

7. DOS Drawback of the “account locking” feature DDOS Control in source

DDOS Targets

8. Database Communication Protocol Vulnerabilities SQL is standard  No standard exists for: – Creating Client session – Conveying commands from client to server – Conveying data and status from server to client

9. Weak Authentication  Brute Force Strong Authentication, Biometric,… Integration Failed login Detection  Social Engineering  Direct Credential Theft password complexity check

10. Backup Data Exposure

The best Solution for all problems…

GOD Mr. Pour & U Special TNX to: