Database Systems Security Course Module Paul J Wagner

Database Systems Security Course Module Paul J. Wagner University of Wisconsin – Eau Claire

Background n Need l Security curriculum is relatively light in database systems area F F n Focus currently on protecting information through network configuration, systems administration, application security Need to specifically consider database system security issues Goals l l Understand security issues in a specific Oracle environment and in a general database system environment Use module to emphasize general security principles and ideas Develop a teaching module for computer security course or a database systems course Develop an accompanying lab project to give students practical experience in this area

Main Message to Students n Database system security is more than securing the database l l l Secure database Secure DBMS Secure applications Secure operating system in relation to database system Secure web server in relation to database system Secure network environment in relation to database system

Secure databases n Traditional database security topics and issues l Users, Passwords F l Default users/passwords • sys, system accounts – privileged, with default passwords • scott account – well-known account and password, part of public group – e. g. public can access all_users table • general password policies (length, domain, changing, protection) Privileges, Roles, Grant/Revoke F F F Privileges • System - actions • Objects – data Roles • Collections of system privileges Grant / Revoke • Giving (removing )privileges or roles to (from) users

Secure DBMS n Possible Holes in DBMS l l http: //technet. oracle. com/deploy/security/alerts. htm (50+ listed) Buffer overflow problems in DBMS code Miscellaneous attacks (Denial of Service, source code disclosure of JSPs, others) UTL_FILE package in PL/SQL F F n allows read/write access to files in directory specified in utl_file_dir parameter in init. ora possible access through symbolic links Need for continual patching of DBMS l l Encourage awareness of issues, continuous vigilance Cost of not patching F SQL Slammer Worm

Secure Application Development n n Access to Oracle Database or Environment Through Applications Example: SQL Injection Attack through Web Application l l l l Application tracks own usernames and passwords in database Client accepts username and password, passes as parameters Application Java code contains SQL statement: F String query = "SELECT * FROM users_table " + " WHERE username = " + " ‘ " + username + " ‘ " + " AND password = " + " ‘ " + password + " ‘ " ; Expecting one row to be returned if success, no rows if failure Attacker enters any username, password of: Aa ‘ OR ‘ ‘ = ‘ Query becomes: SELECT * FROM users_table WHERE username = ‘anyname‘ AND password = ‘Aa‘ OR ‘ ‘ = ‘ ‘; // F or T => T All user rows returned to application If application checking for 0 vs. more than 0 rows, attacker is in

Secure Application Development n Application Security in the Enterprise Environment l l n n J 2 EE. NET Use of Proxies Security Patterns

Secure Operating System n Interaction of Oracle and OS l Windows F F l Secure administrative accounts Control registry access Need good account policies Others… Linux/Unix F F F Choose different account names than standard suggestions Restrict use of the account that owns Oracle software Secure temporary directory Some Oracle files are SUID (root) Command line SQL*Plus with user/pass parameters appears under ps output Others…

Secure Web Server n n n Interaction of Oracle and Web Server Apache now provided within Oracle as its application server, started by default Apache issues l Standard configuration has some potential problems F l l l n See Oracle Security Handbook for more discussion Ensure secure communication from web clients to web server Use Max. Clients to limit possible connections Others… Internet Information Server (IIS) issues l Many…

Secure Network n Interaction of Oracle and Network l Oracle Advanced Security (OAS) product F l Oracle server generally behind firewall F F l Features for: • Authentication • Integrity • Encryption – use of SSL Good to separate DB and web servers Connections normally initiated on port 1521, but then dynamically selected Other Network Issues To Consider F F Possibility of hijacking a sys/sysmgr connection Various sniffing and spoofing issues

Miscellaneous Issues n Newer Oracle Security Features l l n Virtual Private Databases (VPDs) Oracle Label Security Auditing l Good policy: develop a comprehensive audit system for database activity tracking F Can write to OS as well as into database for additional security, accountability for all working with databases

Lab Exercise n Overall Security Examination of Oracle in Networked Environment l 1) Database: Set up Oracle client, test known database for: F F l 2) DBMS: Check for known vulnerabilities F F l Check overall system level Test for several specific problems from Oracle list 3) Application: F l Privileged access through sys or system accounts Public access through scott, other known/discovered usernames Demonstrate SQL Injection Have students modify example code to prevent such attack OS, Web Server, Network components – yet to be developed Task: develop summary report, including specifics for all areas

Pedagogical Issues n Potential Uses Within Curriculum l l l n Computer Security Database Systems Software Engineering? Module/Lab Exercise l l l Will use late in Computer Security special topics course, Spring 2003 Available to colleague to use in Database Systems course, Spring 2003 Final module and exercise will be available through web site

References n n n “Oracle Security Handbook” by Theriault and Newman; Osborne/Oracle Press, 2001. “Oracle Database Administration: The Essential Reference”, Kreines and Laskey; O’Reilly, 1999. “Investigation of Default Oracle Accounts”, http: //www. pentest-limited. com/user-tables. pdf

Contact Information n Central Repository for this presentation, entire panel l http: //www. cs. uwec. edu/~wagnerpj/sigcse/cybersec 2003 l l Email: wagnerpj@uwec. edu Phone Number: 715 -836 -5901