Database Security 3.0

Black Hat 2010

I’m back from Las Vegas caught up with my e-mail, well sort of. And finally I got some time to sort out my thoughts about Black Hat 2010. I had skipped 2009 and was excited to get back to Caesars Palace, meet colleagues and friends and listen to some great presentations.

Let’s just say it’s gotten big– almost overwhelming.  

There are now 22 tracks, compared to 14 in 2008. Also the vendor section has really grown. What used to be a couple of booths at the side of the hallway is now a dedicated hall with almost every security vendor showing a presence.

As usual, right after registration on Tuesday night, I sat down and started marking up the talks I was interested in. With so many tracks there was no shortage of interesting topics at the same time slot. Since there were no database specific talks on the first day, I had a great opportunity to expand my horizon and check out some areas that I’m only somewhat familiar with. The short:

· Security and forensics in the cloud and corporate virtual environments is an up and coming field with some interesting and new challenges. Do you know where your data is? How many copies of it exist in the cloud on different continents? Which laws apply regarding privacy, security and forensics in different countries? What are the challenges involved with using public clouds? 

· SCADA, especially Smart Grid stuff is just plain scary at this point. There’s a race to the market with new inexperienced startups that don’t have money for security and big corporations that are equally unaware of security best practices. With thousands of vulnerabilities in critical infrastructure components -- soon they will also be in a smart meter at your home. This makes hacking the grid seem like a close reality. I guess it’s time to stock up on candles.

· Even hackers still think there is free money to be had in Vegas. Why else would Barnaby Jacks presentation about hacking into ATM’s have filled the room to the gills? This was probably one of the most entertaining of all the talks I attended. Watching an ATM’s screen turn into a slot machine and spit out funny money was great!  In reality, he was really just hacking WinCE, so it’s not like he was breaking into Fort Knox. Of course he did not reveal the PoC code of his attacks, no blue print to free money for this audience.

· Dan Kaminsky is still on the DNS crusade. His talk was a huge sell for replacing existing DNS with DNSSEC. He is also getting really hip calling all his latest projects PhreeBird, PhreeShell, PhreeLoad and finally PhreeGP. Phreaky!

· System privileges through token kidnapping. Windows is getting better with security, but the really good hackers can still find more stuff. Cesar Cerrudo had probably the most hard core technical talk that I went to. Good stuff.

· Oracle DBMS. Oracle is releasing plenty of patches every quarter and it’s still a favorite amongst security researchers. Two great talks were “Hacking and Protecting Oracle Database Vault” by Esteban Martinez Fayo and “Hacking Oracle from Web Apps” by Sumit Siddharth.

· Browsers are still bad. Finally one of my favorite presenters, Jeremiah Grossman, presented on “Breaking Browsers: Hacking Auto-Complete” with vendor patches coming out just before his talk. Now that’s the kind of Black Hat action I like.

That’s it for today. Keep coming back from more posts on database security and vulnerability issues that I find interesting. 

Ask TeamSHATTER – checking ADMIN_RESTRICTIONS is enabled

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has starting taking database security and vulnerability questions. Our first question was submitted by @jedimercer asking:

How can I verify ADMIN_RESTRICTIONS is enabled on an Oracle Database when I can access the TNS listener but I do not have database credentials?

In order to check the ADMIN_RESTRICTIONS flag, it usually requires proper credentials to the Oracle database. However, there is an unofficial way to work around this if you have access to the listener. Trying to set the LOG_STATUS will return a TNS-12508 error if the ADMIN_RESTRICTIONS flag is set.

See the following example from the lsnrctl prompt:

LSNRCTL> SHOW LOG_STATUS

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC)))

LISTENER parameter "log_status" set to ON

The command completed successfully

LSNRCTL> SET LOG_STATUS ON

Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC)))

TNS-12508: TNS:listener could not resolve the COMMAND given

First, get the current status of the LOG_STATUS flag and then try to set it to that same status. You’re not trying to change any settings here – you just want to know if you can.

In the case that the SET LOG_STATUS command succeeds, the ADMIN_RESTRICTIONS flag is not set.

Do you have a question for Team SHATTER? Leave us a question in the comments space below or @TeamSHATTER on Twitter.

On the Ground at Burton Catalyst 2010

This is not your father’s analyst conference. In fact probably not your grandfather’s either. Strong focus on technology? Check. Without the other stuff. And it was no surprise that 90% of the attendees held technical positions.

Despite the madness of ComicCon happening simultaneously, Catalyst 2010 (not quite over yet) took a number of technology industry issues and dissected them down to a granular level.

Of note, I attended two 4-hour workshops. One on securing cloud environments and another focused on building security into the software development lifecycle (SDLC).

Ramon Krikken and Kirk Knoernschild put together a formidable model and plenty of backup around building out software that is developed and published with secure code.

As a result of so many organizations NOT developing software that is free of vulnerabilities or exploitable code, they pointed out that technologies like Database Activity Monitoring (DAM) are rising in demand because of the simple fact that once vulnerabilities are discovered or exploited, they can’t be remediated immediately – and for the fact that its very difficult to ‘get it right’ in the SDLC, 100%.

Its no shocker that in an anecdote, the analysts talked about a situation where one of them in their former life as a developer worked for a company that had a system set up with a single user ID/PW connector to the dev/test database. The developers weren’t granted access to the production db’s, but found out how to access it as someone had outputted that ID/PW to the log files. Otherwise ONE person owned the ID/PW’s to production, and despite the fact that the developers knew how to gain access by just going to the log files, no one raised the issue. What if there was a rogue developer with an axe to grind?

It all speaks to the sensitive nature of the database itself, and the critical information that resides in there. It brings up the fact that there are often process issues associated with access controls to the database also. What if that one person with the keys to the kingdom was hit by a bus? Does business cease to exist as a result? Contingency planning anyone?

All in all, fascinating and informative presentation by both analysts, and you can probably find more out about their research by heading to Burton’s site. I’d recommend getting yourself to a Catalyst conference at some point based on the technology knowledge you’ll walk away with.

Part II will address the cloud security workshop which was equally as informative.

Team SHATTER Database Vulnerability 10 of 10 – Unencrypted Sensitive Data - At Rest And In Motion

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Today’s post wraps up the Top 10 List with #10, Unencrypted Sensitive Data - At Rest and in Motion.

Encryption is an important part of housing sensitive data. Network traffic should also be encrypted to ensure that the passwords used to access sensitive, critical data cannot be seen by traffic. We’ve talked about how important it is to create strong passwords in our first post of the series, if they are visible to network traffic, it’s as bad as keeping your admin passwords set up or leaving a list of all your passwords on a post-it on your desk.

Any information that goes over the network or stored in the database should be encrypted and kept from prying eyes. Some network configurations and database management systems might allow for critical information to be sent in clear text. To ensure this doesn’t occur, make sure you have the latest version of software and turn off text indexing.

The Team SHATTER Vulnerability of the Day series on Twitter provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Team SHATTER Database Vulnerability 9 of 10 – Unpatched Databases

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Organizations house sensitive data – typically in databases. In response to the ever-changing vulnerabilities that are being exploited by attackers, database vendors release patches to ensure sensitive information in databases is protected from threats.

The good news.  Most vendors provide patch updates on a fairly regular basis. For instance, Oracle provides a critical patch update (CPU) every quarter. The most recent Oracle CPU was just released last Tuesday that provided patches to 13 database specific vulnerabilities. Team SHATTER was credited in the release for identifying 3 vulnerabilities. Once a vulnerability is publicly disclosed, whether a vendor has released a patch or not, Team SHATTER updates its vulnerability knowledgebase with workaround details to ensure databases are as secure as possible.

Now for the bad news. Once these patches are released they should be patched – at least the most critical vulnerabilities. If left unpatched, hackers can reverse engineer the patch, or can often find information online on how-to exploit the unpatched vulnerabilities, leaving a DBMS even more vulnerable that before the patch was released.

In our last post we discussed the SQL Slammer worm – this is a great example of what can happen when organizations don’t patch database vulnerabilities. 

Many organizations don’t implement patches right away – some even wait a year or more. The most common excuses are the downtime involved with implementing patches and the time involved with testing these patches to make sure they don’t affect the production software. Whatever the excuse may be, organizations should use database activity monitoring to manage the gap between patches on its databases containing critical information PII data.

The Team SHATTER Vulnerability of the Day series on Twitter provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Team SHATTER Database Vulnerability 8 of 10 – Denial of Service

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Today’s topic is Denial of Service.

Think of a washing machine. The more clothes you put in it, the more work it needs to do. If you overfill it with clothes, it gets overwhelmed and stops working. The same thing happens with a Denial of Service attack. It creates so much traffic on a site, a server or even sections of the internet that it cannot function and shuts down.

The most infamous DoS involving database servers was in 2003 when a computer worm called the SQL Slammer compromised more than 75,000 servers and slowed internet traffic to a halt.

The problem – unpatched Microsoft SQL Server databases.

The SQL Slammer vulnerability was fixed by Microsoft fairly quickly – six months before the attack surfaced. Unfortunately, many DBAs didn’t patch their databases timely and because of it, the Slammer took down the internet.

To mitigate risk and ensure critical databases stay up and running, be sure to patch all databases with the latest vendor patches once they are available. 

The Team SHATTER Vulnerability of the Day series on Twitter provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Team SHATTER Database Vulnerability 7 of 10 – Privilege Escalation

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Today’s topic is Privilege Escalation.

In any well configured Database Management System (DBMS), accounts are restricted to only perform the actions and access the data that they require to perform their job functions. For anybody with malicious intent, this is like being at a candy store, but you’re stuck in the room that only has oatmeal cookies. There could be a whole database with millions of credit card numbers, but you only have access to the organizations marketing folder.

Of course, too often, the locks to the candy store are easy to pick.

A privilege escalation attack is when the attacker is using a known vulnerability in a DBMS that allows a user account with restricted privileges to execute instructions or query data that that typically requires higher privileges. Thus unlocking the locks in the candy store. 

There are different common vulnerabilities that allow for privilege escalation. Sometimes misusing a function that runs under a sysdba, sa or similar security context. In other cases it is done by exploiting vulnerabilities that allow a low-privileged account to grant itself more rights.

To protect against these types of attacks, it is important to always keep your DBMS updated with the latest security patches available from the vendor, as well as continuously monitor for known attack signatures.

The Team SHATTER Vulnerability of the Day series on Twitter provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Team SHATTER Database Vulnerability 6 of 10 – Buffer Overflows

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

The first five installments of this series have been mostly about configurations and best practices, finally, we are making it to the good stuff.

Buffer Overflows. Now what exactly are they?

A buffer overflow is when the input to a function contains more data than the input buffer can hold. If the size of the input is not checked during the copy to that buffer, adjacent memory that is used for other purposes might get overwritten. In most cases, this will be more or less random and can lead to unpredictable behavior, like crashing the server. However, if an attacker is able to also change the code execution pointer to the location of the overwritten memory, it is possible to execute any kind of malicious code using the context of the DBMS process. This could lead to a potential total compromise of the system, resulting in loss of sensitive information and overall security.

To protect against these types of attacks, it is important to always keep your DBMS updated with the latest security patches available from the vendor, as well as monitoring for known attack signatures.

The Team SHATTER Vulnerability of the Day series on Twitter provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Update from the 2010 Gartner Security Summit

June in Washington, DC. That means Gartner’s IT Security & Risk Management Summit.

This year’s theme really seems to be linking risk with security, and trying to figure out some sort of formula to determine where you need to implement the multi-layered solutions to protect IT assets. No surprise, because they combined what was formerly the Risk Management Summit with the IT Security Summit.

A second trend I noticed was the consistent theme of taking a data-centric approach to security. Which got me wondering, what approach wouldn’t be data-centric? Possibly FUD creeping in here. And yes a third topic that I’m not sure anyone really knows what to say about is IT security considerations in the cloud.

The wealth of competing sessions to choose from made for some tough choices for which ones to attend.

Monday I attended a user roundtable focusing on the implementation of security and risk platforms in the cloud. Pretty interesting session where Archer/EMC presented some roundtable questions to what was mostly a room of about 15 information security end users. As a vendor it was interesting to hear some different approaches to cloud computing and security.

What’d I walk away with? Well there was certainly a consensus that depending on whether or not you are deploying cloud/virtualized environments, the most critical aspect is ensuring your cloud provider/msp contract is triple and quadruple-checked so that you know what you can do from a capacity perspective that could dictate how you deploy security solutions.

Another interesting session was Gartner analyst John Pescatore’s prezo on cyber threats. A very interesting nugget I came away with was that apparently 90% of today’s attacks exploit vulnerabilities organizations already know about. This frankly reiterates why the IT security market exists in a way.

Perhaps the most interesting presentation was by AppSec customer Ed Bellis who walked through a business case for how Orbitz approaches IT security. As a broad-based approach, they employ the SCAP model of standards in how they protect data. Additionally, the dominant theme Ed continued to stress was automating most of the work that would typically saddle his security organization and burn up all his resources.

This was extremely interesting, not just seeing what the Orbitz approach is, which is a proactive, automated process. But seeing where the components fit in was key to understanding how a real defense-in-depth model works, i.e., how some of the components and solutions fit together in an enterprise environment.

As always, Jeff Wheatman presented some interesting ideas around establishing metrics through a risk management program. And in a separate prezo, he laid out his model of enterprise-class security protection. And Joseph Feiman used that enterprise model to illustrate the key aspects of deploying in the cloud.

It’s nice to see the attention that Database Activity Monitoring is getting as part of these enterprise models from the Gartner perspective. It’s clear how important DAM is – especially as a compensating control for CISO’s responsible for very large, sophisticated database environments.

Since you can’t prioritize and remediate every vulnerability immediately, DAM gives you the visibility into your databases so you can see everything that’s happening in your database instances while you are working on what you need to fix – so that you don’t become MORE vulnerable to attack. But again, nice to see Gartner recognize the DAM market as a critical component of an enterprise security deployment.

Lastly it was really nice meeting Abe Lincoln randomly.

Team SHATTER Database Vulnerability 5 of 10 – Check your configurations

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Once upon a time, Database Management Systems (DBMS) had only a handful of configuration options.  They did not allow the DBA many choices.  The options available were simple -  like what to name the database instance and which storage location to use for the data files.

Today, there are a myriad of configuration options – many related to performance and enhanced feature sets. There are also many options that are either direct security settings, or that impact security. Having the correct configuration settings could determine whether or not your critical business information is secure and whether it could be compromised.

In this week’s edition of our Database Vulnerability of the Day series, we highlight various configuration settings that have a security impact and that must be addressed when a new database is installed.

The Team SHATTER Vulnerability of the Day series on Twitter, provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Team SHATTER Database Vulnerability 4 of 10 – Minimize your attack surface

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Database Management Systems (DBMS) have extended far beyond the simple data storage systems that they were in the early 1970s and are now impressive software packages  in their own right.  They now offer many features to analyze and report on data, run Java and other extensible languages, and even have various levels of OS access built in.

These features provide database application developers with a lot more power when working with a DBMS.   The flipside of the coin is, the more power you give a developer, the more attack vectors you potentially expose to the bad guys.

Many of these features are optional and are not required by applications accessing a Database Management System. DBMS vendors like to include all the bells and whistles in order to up-sell opportunities.

In this week’s edition of our Database Vulnerability of the Day series, we will highlight various optional components and features that should be removed or disabled – unless there is a valid business reason to make them available.

In our Team SHATTER Vulnerability of the Day series on Twitter, we will provide you with what and how to check for to mitigate these risks. To stay informed on the Top 10 Database Vulnerabilities follow @TeamSHATTER on Twitter.

Team SHATTER Database Vulnerability 3 of 10 – Extensive User/Group Privileges

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Today’s topic is about extensive privileges assigned directly to users or indirectly through user groups.

There are two very important concepts that apply to information systems security controls: separation of duties and the principle of least privileges.

Separation of duties manages conflicts of interest and implements an appropriate level of checks and balances on an individual’s activities to ensure they do not have toxic privilege combinations.

The principle of least privileges requires that users have the least amount of privileges required to perform their specific tasks – only they the data they need and nothing more.

The process of collecting a comprehensive list of all rights that a user has can become a daunting task. Privileges aren’t typically just assigned directly to the users they also inherit privileges from groups or roles they belong to.

In this week’s edition of our Database Vulnerability of the Week series, we will highlight several important rights, privileges and common groups to look out for when reviewing user and group rights, as well as group memberships.

In our Team SHATTER Vulnerability of the Day series on Twitter, we will provide you with what and how to check for to mitigate these risks. To stay informed on the Top 10 Database Vulnerabilities follow @TeamSHATTER on Twitter.