Whether it is through manual poking and
prodding or the use of security testing tools, malicious attackers
employ a variety of tricks to break into SQL Server systems, both inside
and outside your firewall. It stands to reason then, if the hackers are
doing it, you need to carry the same attacks to test the security
strength of your systems. Here are 10 hacker tricks to gain access and
violate systems running SQL Server.
1. Direct connections via the Internet
These connections can be used to attach to SQL Servers sitting naked
without firewall protection for the entire world to see (and access).
DShield’s Port Report shows just how many systems are sitting out there
waiting to be attacked. I don’t understand the logic behind making a
critical server like this directly accessible from the Internet, but I
still find this flaw in my assessments, and we all remember the effect
the SQL Slammer worm had on so many vulnerable SQL Server systems.
Nevertheless, these direct attacks can lead to denial of service, buffer
overflows and more.
2. Vulnerability scanning
Vulnerability scanning often reveals weaknesses in the underlying OS,
the Web application or the database system itself. Anything from
missing SQL Server patches to Internet Information Services (IIS)
configuration weaknesses to SNMP exploits can be uncovered by attackers
and lead to database server compromise. The bad guys may use open
source, home-grown or commercial tools. Some are even savvy enough to
carry out their hacks manually from a command prompt. In the interest of
time (and minimal wheel spinning), I recommend using commercial
vulnerability assessment tools like QualysGuard from Qualys Inc. (for
general scanning), WebInspect from SPI Dynamics (for Web application
scanning) and Next Generation Security Software Ltd.’s NGSSquirrel for
SQL Server (for database-specific scanning). They’re easy to use, offer
the most comprehensive assessment and, in turn, provide the best
results. Figure 1 shows some SQL injection vulnerabilities you may be
able to uncover.
Figure 1: Common SQL injection vulnerabilities found using WebInspect.
0 comments:
Post a Comment