Auditing Matters

Question

Auditing Matters

Steve Jones - SSC Editor

SSC Guru

Points: 736478
More actions
February 22, 2014 at 11:29 am

#286001

Comments posted to this topic are about the item Auditing Matters

Viewing 10 posts - 1 through 9 (of 9 total)

You must be logged in to reply to this topic. Login to reply

Gary Varga SSC Guru Points: 82166 More actions · Answer 1

I found that reading a couple of books on hacking in general (i.e. hacking networks, systems, databases, applications, etc.) really helped open my eyes to a new way of thinking. It also highlighted things like rootkits to me (yes, it was a LONG time ago). Sometimes general technology reading can be worthwhile.

Gaz

-- Stop your grinnin' and drop your linen...they're everywhere!!!

thisisfutile Hall of Fame Points: 3668 More actions · Answer 2

From Steve's editorial:

look for potential hacking issues, like updating all of your lookup values to the same string, or embedding script tags in your data.

Can anyone elaborate on either of Steve's two suggestions? I don't understand what either of these ideas mean. I'm hoping that it's obvious after someone explains them but at this point I'm clueless. Any links perhaps?

Gary Varga SSC Guru Points: 82166 More actions · Answer 3

thisisfutile (2/24/2014)
From Steve's editorial:
look for potential hacking issues, like updating all of your lookup values to the same string, or embedding script tags in your data.
Can anyone elaborate on either of Steve's two suggestions? I don't understand what either of these ideas mean. I'm hoping that it's obvious after someone explains them but at this point I'm clueless. Any links perhaps?

I believe that the embedded script tags is referring to the scripting equivalent of SQL Injection. It was a common hacking practice to add valid (but malicious) HTML into a comment on a forum, for example, and anyone who loaded up the page (along with all the comments) downloaded and, therefore, executed whatever HTML (and often JavaScript) that was embedded in the original, malicious comment. This method does not target the servers (like SQL Injection attacks) but peer clients.

I hope that I made it clear (and was right).

Gaz

-- Stop your grinnin' and drop your linen...they're everywhere!!!

call.copse SSCoach Points: 18064 More actions · Answer 4

thisisfutile (2/24/2014)
From Steve's editorial:
look for potential hacking issues, like updating all of your lookup values to the same string, or embedding script tags in your data.
Can anyone elaborate on either of Steve's two suggestions? I don't understand what either of these ideas mean. I'm hoping that it's obvious after someone explains them but at this point I'm clueless. Any links perhaps?

I don't think it means anything beyond what it says - I have observed both these attacks (not at my workplace).

If you have a SQL Injection vulnerability then a way this may be exploited (in a minor, annoying way) is that the hackers change all strings in a lookup table (e.g. list of countries) to ''Leet haxors wuz here". They may also choose to update a string value to include script tags e.g. edit all product names to include something like <script>alert('Leet haxors wuz here');</script> - in that way when anyone visits the site (if it puts the product name on the page etc) the aforementioned alert appears.

thisisfutile Hall of Fame Points: 3668 More actions · Answer 5

Thank you both, Gary Varga and call.copse for the explanations. I now understand. I think my confusion started because I thought Steve was suggesting some methods for finding exploits but instead it was basic exploits that he was pointing out.

I read it like this... "look for potential hacking issues, BY updating all of your lookup values to the same string, or embedding script tags in your data.

I knew it was something simple that I was making more complicated...I have a tendency to do that. 😛 Where's my coffee cup?

Steve Jones - SSC Editor SSC Guru Points: 736478 More actions · Answer 6

I meant write code that looks for

count(lookup value) = count(*)

for a table. Also, look for items in your text fields like "<script language=js>"

We've seen both of these hacks here on the site over the years. There are some other patterns you can search for that can let you know you've had an attack.

stephen.sarre SSC Enthusiast Points: 160 More actions · Answer 7

Hi Steve

Sorry I still don't understand what you mean by

" write code that looks for count(lookup value) = count(*)"

Thanks

Steve

Steve Jones - SSC Editor SSC Guru Points: 736478 More actions · Answer 8

If I have

LookupID LookupValue

====== =========

1 Red

2 Blue

3 Orange

and I run a count of values, grouped by the value, I'd get this.

count(lookupvalue) count(*)

============ ======

1 (for Red) 3 (total)

1 (for Blue) 3 (total)

1 (for Orange) 3 (total)

The count(*) is the row count. I'd have to do grouping to get the count by specific values, and include those values. I didn't write all the code here.

If I've been hacked, my table could be:

LookupID LookupValue

====== =========

1 Red

2 Red

3 Red

or

LookupID LookupValue

====== =========

1 Red <script=js>http.redirect 'malicioussite.com</script>

2 Red <script=js>http.redirect 'malicioussite.com</script>

3 Red <script=js>http.redirect 'malicioussite.com</script>

and my counts would be

count(lookupvalue) count(*)

============ ======

3 (for Red) 3 (total)

SQLRNNR SSC Guru Points: 281334 More actions · Answer 9

Gary Varga (2/24/2014)
I found that reading a couple of books on hacking in general (i.e. hacking networks, systems, databases, applications, etc.) really helped open my eyes to a new way of thinking. It also highlighted things like rootkits to me (yes, it was a LONG time ago). Sometimes general technology reading can be worthwhile.

+10

Jason...AKA CirqueDeSQLeil
_______________________________________________
I have given a name to my pain...MCM SQL Server, MVP
SQL RNNR
Posting Performance Based Questions - Gail Shaw[/url]
Learn Extended Events