Database Security 3.0

Black Hat 2010

I’m back from Las Vegas caught up with my e-mail, well sort of. And finally I got some time to sort out my thoughts about Black Hat 2010. I had skipped 2009 and was excited to get back to Caesars Palace, meet colleagues and friends and listen to some great presentations.

Let’s just say it’s gotten big– almost overwhelming.  

There are now 22 tracks, compared to 14 in 2008. Also the vendor section has really grown. What used to be a couple of booths at the side of the hallway is now a dedicated hall with almost every security vendor showing a presence.

As usual, right after registration on Tuesday night, I sat down and started marking up the talks I was interested in. With so many tracks there was no shortage of interesting topics at the same time slot. Since there were no database specific talks on the first day, I had a great opportunity to expand my horizon and check out some areas that I’m only somewhat familiar with. The short:

· Security and forensics in the cloud and corporate virtual environments is an up and coming field with some interesting and new challenges. Do you know where your data is? How many copies of it exist in the cloud on different continents? Which laws apply regarding privacy, security and forensics in different countries? What are the challenges involved with using public clouds? 

· SCADA, especially Smart Grid stuff is just plain scary at this point. There’s a race to the market with new inexperienced startups that don’t have money for security and big corporations that are equally unaware of security best practices. With thousands of vulnerabilities in critical infrastructure components -- soon they will also be in a smart meter at your home. This makes hacking the grid seem like a close reality. I guess it’s time to stock up on candles.

· Even hackers still think there is free money to be had in Vegas. Why else would Barnaby Jacks presentation about hacking into ATM’s have filled the room to the gills? This was probably one of the most entertaining of all the talks I attended. Watching an ATM’s screen turn into a slot machine and spit out funny money was great!  In reality, he was really just hacking WinCE, so it’s not like he was breaking into Fort Knox. Of course he did not reveal the PoC code of his attacks, no blue print to free money for this audience.

· Dan Kaminsky is still on the DNS crusade. His talk was a huge sell for replacing existing DNS with DNSSEC. He is also getting really hip calling all his latest projects PhreeBird, PhreeShell, PhreeLoad and finally PhreeGP. Phreaky!

· System privileges through token kidnapping. Windows is getting better with security, but the really good hackers can still find more stuff. Cesar Cerrudo had probably the most hard core technical talk that I went to. Good stuff.

· Oracle DBMS. Oracle is releasing plenty of patches every quarter and it’s still a favorite amongst security researchers. Two great talks were “Hacking and Protecting Oracle Database Vault” by Esteban Martinez Fayo and “Hacking Oracle from Web Apps” by Sumit Siddharth.

· Browsers are still bad. Finally one of my favorite presenters, Jeremiah Grossman, presented on “Breaking Browsers: Hacking Auto-Complete” with vendor patches coming out just before his talk. Now that’s the kind of Black Hat action I like.

That’s it for today. Keep coming back from more posts on database security and vulnerability issues that I find interesting. 

Team SHATTER Database Vulnerability 9 of 10 – Unpatched Databases

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

Organizations house sensitive data – typically in databases. In response to the ever-changing vulnerabilities that are being exploited by attackers, database vendors release patches to ensure sensitive information in databases is protected from threats.

The good news.  Most vendors provide patch updates on a fairly regular basis. For instance, Oracle provides a critical patch update (CPU) every quarter. The most recent Oracle CPU was just released last Tuesday that provided patches to 13 database specific vulnerabilities. Team SHATTER was credited in the release for identifying 3 vulnerabilities. Once a vulnerability is publicly disclosed, whether a vendor has released a patch or not, Team SHATTER updates its vulnerability knowledgebase with workaround details to ensure databases are as secure as possible.

Now for the bad news. Once these patches are released they should be patched – at least the most critical vulnerabilities. If left unpatched, hackers can reverse engineer the patch, or can often find information online on how-to exploit the unpatched vulnerabilities, leaving a DBMS even more vulnerable that before the patch was released.

In our last post we discussed the SQL Slammer worm – this is a great example of what can happen when organizations don’t patch database vulnerabilities. 

Many organizations don’t implement patches right away – some even wait a year or more. The most common excuses are the downtime involved with implementing patches and the time involved with testing these patches to make sure they don’t affect the production software. Whatever the excuse may be, organizations should use database activity monitoring to manage the gap between patches on its databases containing critical information PII data.

The Team SHATTER Vulnerability of the Day series on Twitter provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Team SHATTER Database Vulnerability 6 of 10 – Buffer Overflows

Application Security, Inc.’s Team SHATTER (Security Heuristics of Application Testing Technology for Enterprise Research) has researched the Top 10 Database Vulnerabilities in order to provide you with the most up-to-date vulnerabilities, risk and remediation information.

The first five installments of this series have been mostly about configurations and best practices, finally, we are making it to the good stuff.

Buffer Overflows. Now what exactly are they?

A buffer overflow is when the input to a function contains more data than the input buffer can hold. If the size of the input is not checked during the copy to that buffer, adjacent memory that is used for other purposes might get overwritten. In most cases, this will be more or less random and can lead to unpredictable behavior, like crashing the server. However, if an attacker is able to also change the code execution pointer to the location of the overwritten memory, it is possible to execute any kind of malicious code using the context of the DBMS process. This could lead to a potential total compromise of the system, resulting in loss of sensitive information and overall security.

To protect against these types of attacks, it is important to always keep your DBMS updated with the latest security patches available from the vendor, as well as monitoring for known attack signatures.

The Team SHATTER Vulnerability of the Day series on Twitter provides you with what to check for and how to mitigate these common risks. Stay informed. Follow @TeamSHATTER on Twitter.

Is it possible we have hit the crisis point?

Our annual study with Enterprise Strategy Group usually generates a lot of buzz around what firms aren't doing to protect their most critical applications that house sensitive information - you guessed it, the database.

But what we've seen in our survey that we launched today isn't just a bunch of statistics – it’s a grim reminder that we are facing perhaps the worst of threats to our confidential data, and there are things we are either overlooking, don't understand...or, simply doing nothing about.

We polled 175 IT Security execs at large organizations, and based on some of the staggering numbers, it’s possible we may have a crisis on our hands...

The study reveals that 60% of organizations don’t feel their existing database controls adequately protect their organization’s confidential data. Coming from security executives, this doesn't inspire a lot of confidence.

In addition, the data reports that nearly 70% of organizations do not feel that their existing database controls are well-defined. Again, considering the source, if controls aren't spelled out and communicated appropriately, how can IT Security even do its job?

The survey reveals that despite the fact that over two-thirds of organizations are spending moderate to significant amounts of time writing custom scripts, remediating compliance issues, and engaging in associated tasks - which means costly manual processes are the norm. 

38% of organizations still failed database security audits, which tells us that while companies may be better this year in identifying database audits as important, they aren't taking a continuous approach to compliance. Therefore they may be passing one audit, but what happens in the next one a month or even a week later? 

The study further reveals the troubling statistic that less than 4% of IT budgets are spent protecting the data where it lives – in the database. Why is it troubling? Well, if companies looked at their overall IT Security spend and re-prioritized their misplaced spending, they'd be able to ground both their compliance initiatives and protections in the database.

 

Authorized Database Roles - Where do they go when someone leaves?

By now you know the drill - another data breach, more identity theft, more records potentially compromised. MassMutual experienced a database breach of employee information over the weekend through a contracted vendor database.

There's some information that's come to the surface already, and it appears they've been able to curb the damages and take the proactive steps to protect employees.

What this breach underscores is the fact that organizations are still not taking the right steps to protect sensitive, confidential information in a comprehensive way. What also persists to be a major issue is the lack of segregation of duties in the database.

As the unemployment rate hovers around 10% and organizations are still slashing headcount, roles and privileges to data still exist, possibly even if that employee has been let go, has moved on or has been reassigned. When those access controls still exist, organizations are at risk.

Databases contain sensitive information are large, enterprise organizations. 99% of enterprise data exists in some form inside a database. Yet with breach numbers up to 340,102,273 you'd think there would be a massive call to action for organizations who have are facing a radically scaled-up threat environment.

Beanbags and Database Security. A discussion at CSI 08.

By Josh Shaul.

The week before Thanksgiving I led a session at the CSI 08 conference in Washington, DC. It was setup as a group discussion in a small room with bean bags instead of chairs. It was a relaxed atmosphere designed to foster a philosophical discussion. In reality, there was one row of chairs at the back of the room. Everyone except one or two folks sat on chairs. The bean bags were a little intimidating. Once you sit in one of those things, there is no telling if you’re ever getting up. 

Decision Making - The Stakeholders

Our discussion was an exploration of who the stakeholders and responsible parties are in a typical corporation’s database security program. We started by reviewing a few recent data breaches, discussing how they happened and could have been prevented. With an understanding of the mechanics of a data breach, we began on discussion on responsibilities. 

It quickly became clear that not everyone in the audience knew of a database security program at their office. Some even came clean, admitting that they have no such program or effort. Those who did have a plan in place discussed radically different approaches and experiences.  

Group Authority?

A security manager at a large retailer described how his team was responsible for ensuring that databases and other applications are configured securely; in accordance with the requirements of internally developed standards. That was the good news. The bad news was that his group was not responsible for making sure databases had security patches applied. That was someone else’s responsibility. His group was also not responsible for auditing access to databases or monitoring for attacks. Those activities would also fall into other groups….if they were in place at all…he wasn’t sure.

Split up Responsibilities

Another member of the audience described that they have a policy that mandates some basic database security requirements such as strong passwords and access controls. The policy is fairly solid, but there is no one responsible for ensuring that the policy is implemented. Some systems are likely in compliance, others are not. The only people who have a chance of knowing are the system owners, and the scope of their knowledge is very narrow, they only know about the systems they personally own and manage. 

Clear ownership, No ownership

We also heard from a utilities company where there is clear ownership of policy development, and database assessment and auditing, but nobody responsible for remediation or risk reduction. This group made an investment in technology and processes to measure their security posture, but gain very little return from that investment because they rarely fix the problems they find. 

Does anyone own database security? 

According to the group I met with, no one person ultimately does. It boils down to a shared responsibility between operations teams (database admins), IT security teams, and often audit / compliance teams. The group agreed that picking a vocal leader for each of the major functions of a database security program (policy development, assessment, auditing, monitoring, and remediation) is a critical step.

Ensuring that the leaders communicate and cooperate, and are held accountable when their functions don’t deliver is the ultimate key to a successful program, but is often the biggest hurdle to overcome.

Seatbelts, Seatbacks, and Traytables Folks - Virtualization Changes Everything

If you're not reading Chris Hoff's blog, you probably should be.  There are a ton of reasons, but among them is that he's mining the intersection of security and virtualization like no one else I know of.  There are a few mind-blowing posts, including today's which details the latest network element stack architecture ideas emerging from VMworld. 

The current collision of virtualization, networking, and security reminds me of the sea change the industry went through as everyone opened themselves to the Internet in the 90s.  The benefits were enormous and undeniable and as a result so was the reality that it was going to happen.  But so was risk as the opportunity for loss skyrocketed along with complexity. 

Ditto today with virtualization.  The agility virtualization offers is so incredibly compelling there's simply no stopping it.  But not only will our policies get an order of magnitude more complex (even more "users" doing more intimate things with our data <ahem> at a greater rate of change), so will our infrastructure. 

Between that and the ever-helpful bad guys, though, I guess job security increases too. 

Black Hat 2008

Last week I took part in  the yearly security pilgrimage called Black Hat in Las Vegas. This years briefings were at Cesars Palace, with 8 parallel tracks ranging from App Sec and 0-Day to Reverse Engineering and Over The Air.

Day 1

I started the day out with a great refresher on everything Application Security by Jared DeMott. Anybody interested in a great general purpose intro on all the different App Sec jargon, and techniques should take a look at this once it shows up in the Black Hat archives.

Next I wanted to see Dan Kaminsky’s ‘DNS is broken’ presentation. Unfortunately clouds of people were already outside the doors and I could not get in the room. But then this got covered by the press and on various blogs in enough detail by now. So in the end, it won the ‘coveted’ most overhyped talk award at the end of day one.

After lunch I sat in the talk by Petko Petkov aka PDP. He had a great presentation mostly talking about x-site/application authentication issues. The core of his message was that we can’t take systems out of context for security testing. An application that is quite secure standalone or in a particular environment, can be used quite maliciously when integrated with another app, or ported to a new platform. For example Apple’s Quicktime™ which runs quite secure in the Mac™ environment has had a flew of issues in the recent past on Windows™.

Bruce Potter of SchmooCon fame, had probably the funniest of all presentation and should really consider a second career path as a comedian. While he did quite extensively promote his newest venture, he had some really good thoughts on presenting vast amounts of audit data. Presentation of data can make or break a security product and I’m really exited about our continued reporting enhancements in DbProtect.

Day 2

I started the day out with Arian Evans presentation about double/triple-encoding as well as transcoding attacks. This February’s highly successful SQL Worm and its more recent derivatives are using this class of attacks. Basically an attacker can circumvent all web app firewalls by properly encoding SQL code, and hide its malicious payload until the database interprets the mumbo jumbo passed through from the web sites POST command. Our security team jumped on this earlier this year, and we were able to create DbProtect activity monitoring filters and rules for these attacks.

I see this as proof, that a comprehensive security posture requires more then just perimeter protection, but that the bad guys will always find their way around these protections, and make their way to where the data is, which is where DAM really comes to shine.

Incidentally, my next stop were some short ‘turbo talks’ of which one was by Justin Clarke, who looked at the same class of attacks from a slightly different angle, and who had a really nice working attack demo.

Later this day Microsoft™ introduced 3 new security initiatives. As a security vendor I was really exited about MAPP, the Microsoft Active Protections Program. In a nutshell, Microsoft will give pre-release announcements to select 3rd party vendors for upcoming security patches, including some pretty detailed vulnerability information. This will give active protection vendors like AppSec a leg up on the hackers, allowing for release of application protection content at the same time new patches are released. Allowing IT departments to thoroughly test these new patches, while still being protected from new attacks exploiting the new vulnerabilities.

I really hope for this to be successful, and for IBM™, Oracle™, etc. to come up with similar initiatives.

Finally I was all set to go to David Litchfields talk. I had never had the chance to see him before and was really looking forward to it. Turns out he lost his passport, and by the time he got a replacement, the airfare would have been not worth it for him, to go for one day.

I can’t help it, but to be disappointed. While I don’t know how much his airfare would have been, I wish he would have thought about his audience, too.

espresso track to your database ;-)

Around the office here, we talk a fair amount about the difficulty of securing all of the conduits to the data (wired, wireless, general-purpose hosts, packaged apps, etc.).  Firms don't have the luxury of giving up this legacy approach overnight, but clearly they are moving toward securing data more directly, a broad trend to be sure of which we play just a part.  I realized today, however, that we left a conduit out - the Internet-connected espresso machine. 

I'm sure these beauties are showing up everywhere ;-) and once that happens the customer database may be just a hop or two away.  After all, where better to store all your dosage, volume, and other crucial settings :-) 

Virtualization Changes Everything

Posted by Ted Julian

Yesterday I recapped some ideas from the first day of Gartner’s IT Security Summit here in Washington, DC.  Today, I’ll cherry-pick from Day 2 because the last session finished the day with a bang – it was the best presentation from the whole event. 

Neil MacDonald gets the “big idea” award for his presentation entitled, “Radically Transforming Security in a Virtualized World.” It was one of the most thought-provoking presentations I’ve seen in my 10+ years in the security business.  Yup, that’s not something you’ll hear me say too often.

Perhaps you’re like me and you thought the security challenge / opportunity had to do with securing virtual environments.  Like any new technology – wireless, Web applications, etc. – virtualization introduces new security problems that need to be addressed.  That may be true – but it’s not the big idea.  The big idea is that virtualization offers a new way to secure IT infrastructure with major benefits over today’s approaches. It will spawn new classes of security products that will change the world and next-generation versions of today’s security solutions that will either kill today’s security vendors or save them.

Here are a few examples Neil walked through ranging from the basic to the profound. 

• Virtual security appliances.  Now that most security appliances run on off-the-shelf hardware, why bother shipping them, powering them, cooling them and otherwise managing them.  Instead, use virtual appliances – software containers you can easily drop into your virtualized infrastructure.  Way easier to try, buy, and manage. 
• VM-spanning versions of existing security solutions.  The hypervisor / virtual machine management layer underneath all your VMs presents a ripe opportunity to do things better in several ways.  If the security function can be abstracted at the hypervisor level, a single security product VM could provide its services to all of the other VMs.  No need to build, buy, or manage distinct security agents for each VM.  One anti-virus VM, for example, could provide a-v services to all of the other VMs whether they are Windows, Linux, etc. This approach is not only easier to build, buy, and manage, it’s arguably faster and more secure.  As these security services run below the host OS of each of your VMs, they are not rootable in the same way and should run faster with more direct access to hardware.
• New, VM-spanning security solutions.  Tapping into the hypervisor / virtual machine management layer should provide a perspective on system activity that spans all the VMs.  Analyzing activity at this level yields perspective that will enable an entirely new class of security and management solutions.