Attacks/Breaches
12/16/2010
03:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

You've Been Breached: Now What?

Logs are a key component of an incident response plan if your database gets attacked.

InformationWeek Green - Dec. 20, 2010 InformationWeek Green
Download the entire Dec. 20, 2010, issue of InformationWeek, distributed in an all-digital format as part of our Green Initiative
(Registration required.)
We will plant a tree
for each of the first 5,000 downloads.

No one likes to think about database breaches, but the fact is, they happen. Rather than cross your fingers and hope for the best, create an incident response plan ahead of time. Without a plan, you may destroy critical evidence that could be used to prosecute the offender. You might also overlook just how the incident occurred, leaving you exposed to future breaches.

Log analysis is an essential component of an incident response plan. You'll want to review logs from the compromised machine or machines and from other sources, including network devices and access control systems.

A number of log types--transaction, server access, application server, and OS--can all provide valuable information to retrace what occurred. If your database administrator has enabled transaction logs--and it's a big if--start there because they're a rich source of information.

Your first goal is to understand what data has been extracted, which will help you gauge the current risk to the company. Then examine what else the attacker may have tried to do. As you review logs, look for queries that would match the data known to be exported. If you don't have any evidence to match against, gather up the database administrator, application developer, and anyone else who knows normal application and database activity. Get a conference room, display the logs on a projector, and have them help you look for anomalies such as unusual queries that applications or administrators wouldn't normally make.

Search logs for evidence of SELECT statements and examine the results for those that appear to be out of the norm. This is where having a DBA or application developer on hand will help. They know the applications that access this database server and can pick out suspect queries, such as those that return more records than normal, are formatted differently, or are preceded by erroneous requests. For example, improper SQL statement formats are common when an attacker doesn't know the database structure and is attempting to blindly guess database, table, and row names. In addition to SELECT statements, look for INSERTS, DELETES, DROPS, or command execution queries.

The attacker may also have attempted to insert a database account, edit logs, or execute system commands from within the database, among other tactics.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2004-2771
Published: 2014-12-24
The expand function in fio.c in Heirloom mailx 12.5 and earlier and BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in an email address.

CVE-2014-3569
Published: 2014-12-24
The ssl23_get_client_hello function in s23_srvr.c in OpenSSL 1.0.1j does not properly handle attempts to use unsupported protocols, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an unexpected handshake, as demonstrated by an SSLv3 handshak...

CVE-2014-4322
Published: 2014-12-24
drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not validate certain offset, length, and base values within an ioctl call, which allows attackers to gain privileges or c...

CVE-2014-6132
Published: 2014-12-24
Cross-site scripting (XSS) vulnerability in the Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3 through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 allows remote authenticated users to inject arbitrary web script or HTML vi...

CVE-2014-6153
Published: 2014-12-24
The Web UI in IBM WebSphere Service Registry and Repository (WSRR) 6.3.x through 6.3.0.5, 7.0.x through 7.0.0.5, 7.5.x through 7.5.0.4, 8.0.x before 8.0.0.3, and 8.5.x before 8.5.0.1 does not set the secure flag for a cookie in an https session, which makes it easier for remote attackers to capture ...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.