Attacks/Breaches
12/16/2010
03:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

You've Been Breached: Now What?

Logs are a key component of an incident response plan if your database gets attacked.

InformationWeek Green - Dec. 20, 2010 InformationWeek Green
Download the entire Dec. 20, 2010, issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree
for each of the first 5,000 downloads.

No one likes to think about database breaches, but the fact is, they happen. Rather than cross your fingers and hope for the best, create an incident response plan ahead of time. Without a plan, you may destroy critical evidence that could be used to prosecute the offender. You might also overlook just how the incident occurred, leaving you exposed to future breaches.

Log analysis is an essential component of an incident response plan. You'll want to review logs from the compromised machine or machines and from other sources, including network devices and access control systems.

A number of log types--transaction, server access, application server, and OS--can all provide valuable information to retrace what occurred. If your database administrator has enabled transaction logs--and it's a big if--start there because they're a rich source of information.

Your first goal is to understand what data has been extracted, which will help you gauge the current risk to the company. Then examine what else the attacker may have tried to do. As you review logs, look for queries that would match the data known to be exported. If you don't have any evidence to match against, gather up the database administrator, application developer, and anyone else who knows normal application and database activity. Get a conference room, display the logs on a projector, and have them help you look for anomalies such as unusual queries that applications or administrators wouldn't normally make.

Search logs for evidence of SELECT statements and examine the results for those that appear to be out of the norm. This is where having a DBA or application developer on hand will help. They know the applications that access this database server and can pick out suspect queries, such as those that return more records than normal, are formatted differently, or are preceded by erroneous requests. For example, improper SQL statement formats are common when an attacker doesn't know the database structure and is attempting to blindly guess database, table, and row names. In addition to SELECT statements, look for INSERTS, DELETES, DROPS, or command execution queries.

The attacker may also have attempted to insert a database account, edit logs, or execute system commands from within the database, among other tactics.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4725
Published: 2014-07-27
The MailPoet Newsletters (wysija-newsletters) plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/.

CVE-2014-4726
Published: 2014-07-27
Unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before 2.6.8 for WordPress has unspecified impact and attack vectors.

CVE-2014-2363
Published: 2014-07-26
Morpho Itemiser 3 8.17 has hardcoded administrative credentials, which makes it easier for remote attackers to obtain access via a login request.

CVE-2014-2625
Published: 2014-07-26
Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to read arbitrary files via crafted input, aka ZDI-CAN-2023.

CVE-2014-2626
Published: 2014-07-26
Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files, and consequently execute arbitrary code, via crafted input, aka ZDI-CAN-2024.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.