Database security issues

null Mumbai Chapter - June 2013 Meet

1. Ravi Kant Rai
Database Security Issues

2. Major Security Vulnerabilities
Bugs in database software components (e.g. buffer overflows)
left un-patched
Lack of network isolation (external and internal)
Improper security configuration
Use of default user accounts and passwords
Use of null passwords
Excessive privileges

3. Major Threats
Application Vulnerability
Internal Employees

4. Mitigating Risk
Application Vulnerabilities

5. Default username Password
While Default Installation of Database there are default
username/password created

Vendor username Password
Oracle HR HR
My sql ROOT
Ms sql-server SA SA

6. Exploitation

7. Exploitation

8. Audit
Oracle Database 11g now offers a way to quickly identify
users with default passwords, implemented in the rather
ludicrously simple way of checking a single data dictionary
view
DBA_USERS_WITH_DEFPWD

9. Solution
Lock all Default username and passwords

Password Policy must be in place for all users

Lockout policies

Password life time must be configured

10. Least Privilege
Least Privilege account
should be allocated to all
application user.
It will Mitigate risk of data
loss.

11. Privileges

12. Public Privileges
ORACLE FUNCTIONS
Oracle supplies over 1,000 functions in about 175 standard
database packages that potentially can be exploited in a SQL
injection attack.


SELECT TRANSLATE('' ||
UTL_HTTP.REQUEST('http://192.168.1.1/') || '',
'0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ',
'0123456789') FROM dual;

13. Auditing
For Oracle’s built-in auditing functionality, you must not only
determine the rationale behind the turning on of auditing, but also
the level of auditing and its impact on system resources. Oracle
auditing gets turned on as soon as you set the AUDIT_TRAIL
we can audit the following:
Statement Auditing: Audits on the type of SQL statement used,
such as any SQL statement on a table.
Privilege Auditing: Audits use of a particular system privilege,
such as CREATE TABLE
Object: Audits specific statements on specific objects such as
ALTER PROFILE on the DEFAULT profile.

14. Architecture Review (Oracle)

15. Secure Network Architecture

16. Application Security
Solution

17. Major Threat
SQL Injection
A SQL injection attack consists of insertion or "injection" of
a SQL query via the input data from the client to the
application
A successful SQL injection exploit can read sensitive data
from the database, modify database
SQL Injection attacks occur when the data entered in the
application is from an untrusted source and that same data is
used to dynamically construct a SQL Query.

18. SQL Injection

19. Error

20. Solution
Error Based Trigger could be a solution for SQL Injection.
The most powerful protection against SQL injection attacks
is the use of bind variables.
Every passed string parameter should be validated.
The PL/SQL Gateway can be configured to display varying
levels of error messages.

21. Thanks