All About SQL Injection

SQL injection!
SQL injection is the most common and videly used exploit by hackers all over the
world...few days back i was just doing some SQL injection test on Indian govt sites,
I was shocked to see how many imp govt sites r open to it....this is a big thread
for us...a malicious hacker can do a lot of harm if he wish to.

Vocabulary:

* SQL: Server Query Language-used in web applications to interact with databases.
* SQL Injection: Method of exploiting a web application by supplying user input
designed to manipulate SQL database queries.
* "Injection": You enter the injections into an html form which is sent to the web
application. The application then puts you input directly into a SQL query.
In advertantly, this allows you to manipulate to query...

Prerequisite:

* A background of programming and a general idea of how most hacking methods are done.
see this pic --->




Application:

* Hacking a SQL database-driven server (usually only the ones that use unparsed user
 input in database queries). There is still a surprising number of data-driven web
applications on the net that are vulnerable to this type of exploit. Being as typical
as all method, the frequency of possible targets decreases over time as the method
becomes more known. This is one those exploits that aren't easily prevented by a
simple patch but by a competent programmer.

Use:
First, let's look at a typical SQL query:
SELECT fieldName1, fieldName2 FROM databaseName WHERE
restrictionsToFilterWhichEntriesToReturn

Now, to dissect...
The red areas is where criterion is inputed. The rest of the query structures the
query.

* SELECT fieldName1, fieldName2 - Specifies the of the names of fields that will
be returned from the database.
* FROM databaseName - Specifies the name of the database to search.
* WHERE restrictionsToFilterWhichEntriesToReturn - Specifies which entries to return.

Here is an example for somebody's login script:

SELECT userAcessFlags FROM userDatabase WHERE userName="(input here)"
AND userPass="(input here)"

The idea is guess what that application's query looks like and input things
designed to return data other than what was intended.

In the example, input like the following could give gain access to the
administrator account:

User: administrator
Pass: " OR ""="

Making the query like this:

SELECT userAcessFlags FROM userDatabase WHERE userName="administrator"
AND userPass="" OR ""=""

As you can see, ""="" (nothing does indeed match nothing)
Note: Injections are rarely as simple as this...

One can be creative and use error messages to your advantadge to access other
databases, fields, and entries. Learn a little SQL to use things like UNION to
merges query results with ones not intended.On the security side, parse user data
and get rid of any extra symbols now that you know how it's done.

The idea in this example is to break out of the quotation marks.
When stuff is inside quotation marks, the stuff isn't processed as code or anything
but as a phrase and what it is.

The password injection was: " OR ""="
What this does is close the string that was started by the quotation mark in the part
userPass=". Once you break out, THEN stuff is considered code. So, I put OR ""="
after I break out of the string. You will notice that it is comparing two quotation
marks with one, but the quotation mark already built in by the application finishes
it so we have this:
userPass="" OR ""=""
Notice how the first and last quotation marks are not colored and are not built in.

Additional notes:
This was just an extremely simplified version and you will probably need to learn a
little SQL to fully understand.

Here are a few SQL terms that do other things:
UNION: You use this to merge the results of one query with another. You may put
things like SELECT after UNION in order to search other databases and stuff.
Sometimes you may need to use ALL in conjuction to break out of certain clauses.
It does no harm so when in doubt you could do something like:
" UNION ALL SELECT 0,'','hash' FROM otherDatabase WHERE userName="admin
The key when using UNION is to make your new query return the same amount of columns
in the same datatype so that you may get the results you want.

:-- This works sometimes to terminate the query so that it ignores to the rest
 of the stuff that might be fed afterwards if you don't like it. For example:
SELECT * FROM userDatabase WHERE userName="admin";--" AND userPass="aH0qcQOVz7e0s"

NOT IN: If you have no idea which record you want you could record cycle
(you request vague info, and you put what you already got in the NOT IN clause so
that you can get the next entry)
Usage:
SELECT userName userPass FROM userDatabase WHERE userName NOT IN
('Dehstil','Twistedchaos')

EXEC: This command should never work, but if it does...you win; you could do anything.
For instance, you could inject something like this:
';EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:

All my examples so far have dealt with read processes. To manipulate a write process,
here is an example for those who know what their doing:
INSERT INTO userProfile VALUES(''+(SELECT userPass FROM userDatabase WHERE
userName='admin')+'' + 'Chicago' + 'male')
This example would theoretically put the admin's password in your profile. 

How to Hide Data in Image, Audio & Video Files: Steganography

Ever wondered to know how to hide secret messages in images, audio and video files? Well, in this post I will take you through a concept called steganography using which, it is possible to hide your secret information in image files, songs or any other file of your choice. At the end of this post, you can also download free stegnographic tools and start hiding your data.

What is Steganography?

Steganography is a means of obscuring data where secret messages are hidden inside computer files such as images, sound files, videos and even executable files so that, no one except the sender and the receiver will suspect the existence of stealth information in it. Steganography may also involve the usage of cryptography where the message is first encrypted before it is concealed in another file. Generally, the messages appear to be something else such as an image, sound or video so that the transfer of secret data remains unsuspected.

The main advantage of steganography over other methods such as cryptography is that, it will not arose suspicion even if the files fall in the hands of a third party. Unlike cryptographic messages, stegnographic messages will no way attract the attention of a third party by themselves. Thus stegnanography has an upper hand over cryptography as it involves both encryption and obscurity.

What are the Applications of Steganography?

Steganography is mainly used to obscure confidential information/data during storage or transmission. For example, one can hide a secret message in an audio file and send this to another party via email instead of sending the message in the textual format. The receiver on the other end will decrypt the hidden message using the private decryption key. In a worst case scenario, even if a third party does manage to gain access to the email, all he can find is the audio file and not the hidden data inside it. Other usage of steganography include digital watermarking of images for reasons such as copyright protection.

Eventhough steganography has many useful applications, some may use this technique for illegitimate purposes such as hiding a pornographic content in other large files. Roumors about terrorists using steganography for hiding and communicating their secret information and instructions are also reported. An article claiming that, al-Queda had used steganography to encode messages in images and transported them via e-mails, was reported by New York Times, in October 2001.

How do Steganography Tools Work?

Stegnography tools implement intelligent algorithms to carefully embed the encrypted text messages or data inside other larger files such as an image, audio, video or an executable file. Some tools will embed the encrypted data at the end of another file so that there will be enough room for storing larger data.

There are many steganography tools available online but only a few are able to work flawlessly. I did not find any tool that worked perfectly on both small and large data. However I have  managed to develop my own tool that can work perfectly on all types of files and all size of data. The tool is called “Stego Magic“. You can download it from google.

How to Use Stego Magic?

Suppose you want to hide a text message inside a JPG file:

1. Place the JPG and the text file (.txt) in the same folder as that of StegoMagic_TXT.exe

2. Run StegoMagic_TXT.exe and follow the screen instructions to embed the text message inside the JPG image.

3. Note down the secret decryption key.

Now you can send this image to your friend via email. To decrypt the hidden message, your friend should load this JPG file onto the Stego Magic tool and use the secret decryption key.

Malware Infection on Websites

                                                

Malware is a type of software that attempts to steal your personal information or use your computer to do things that you do not intend. Malware infections quite often lead to harsh consequences, causing victim’s computer become slow or unresponsive. Malware is usually spyware, deceptive adware, etc. Common malwares are free screen savers that secretly generate advertisements, malicious web browser toolbars that take your browser to different pages than the ones you expect or could be key logger programs that can transmit your personal data to others.

Detecting the Malware

Malwares affect client systems but use innocent webservers to reach a large number of clients. You may not have any evil intentions but someone might have secretly modified your web pages on your website, by injecting malicious code, insert iframes, adding links to a different website which actually hosts the malware in it or caused due to the third party ads that appear on your website. Quickly detecting malware on your website and removing it will avoid dangers to your visitors and reputation of your site.

Let us look at few ways to detect the presence of malware on your website:

• Check Google’s search results for your website, a warning message saying “This Site May Harm Your Computer” would be displayed near the title of the web page if any malware is found.
• Use Microsoft Webmaster tools to scan your website to find out all rogue pages on your site that are possibly infected with malware and identify external links on your site that point to pages hosting malware.
• Scan your website at McAfee Site Advisor to obtain a detailed report of possible malware issues and malicious links on your website.

Removing the Malware

Once it is confirmed that your website is infected with malware, you have to stop all advertising media on your website and make the whole site offline temporarily so further damage can be prevented until you are sure that your site is free of malware.

The first step when you find a malware on your site is to do a thorough check for more malwares. There could be other pages on your site that download and install rogue programs on the user’s computer without his/her consent. Check your server logs for any suspicious activity, like failed login attempts, remote command execution, unknown user accounts, etc.

You have to check mainly for attacks which would be the main reason for such behaviors. Your website will become more vulnerable to attacks when you are not using the latest security updates. When a hacker gains access to your website, he would modify webpages so that his malicious code gets executed and the spam links get displayed or redirect to a malicious website when people view your web pages.

If the malware in your website is injected due to hacking attacks, check the HTML source code of your web page for suspicious blocks of JavaScript code or hyperlinks that point to bad neighborhoods hosting malware. Look for any recently modified and uploaded files on your web server.

Most of the hackers would not place the malware on the infected website, instead they would inject a redirect code on the legitimate website so identify such recent activity on your website where user content can be added. Discard the pages which are suspected to have malware and redesign these pages.

Update your web server software and website software, install all latest patches available. Perform manual checks instead of depending on just antivirus software because generally, the antivirus software will only check for malwares installed or present on your system.

Key prevention measures to be taken in common suspected areas for malware behavior:

• Downloads available on your site: Scan your web server for malicious server files.
• Automatic redirects from your site: The redirect code is typically an I-frame that will silently attack the visitor’s browser with the browser specific exploits. Anti-virus scans on your web server or website will rarely detect this redirect code hence perform manual checks in the web page source code.
• Third party advertisements present on your site: Use only reputed, conscientious advertisement providers and regularly monitor them to be sure they stay clean.
• Malicious links posted in your site due to user activities: You can begin checking your site by making a list of all links to external sites. Then verify that you’ve intentionally put those links on your site. Next check your web pages for any obfuscated code.
• Hacking attacks on the site: Keep monitoring the web logs for hacking activities by any Web monitoring tools.

Removing the Flaw

Use encrypted protocols like SSH and SFTP for file transfer instead of clear text protocols like telnet or FTP. Telnet and FTP are both considered insecure, since they transmit user credentials in a way that anyone with access to the network can read, hence they are called clear text protocol. SSH and SFTP are based on an encrypted protocol which prevents network sniffing.

Use strong password policies in your website so that no one can break into user accounts and mess up.

Configure your website not to allow users to link directly to any form of executable files or to insert JavaScript into the user modifiable areas.

The malware may have been inserted into your application through some vulnerability in your code. Detecting this and fixing it may be the most important step to take. This will be discussed in more detail in more articles to come in the next few issues.

Monitoring the Website

Update any software you use on your web server, and make sure you are always running the most recent versions, with recent security patches. Perform regular scans on your site for security vulnerabilities using any vulnerability auditing scanners. Use security updated management tools to track down missing patches and apply those patches instantly. Actively monitor areas in your website, which is affected by user activities for suspicious links or executable files. Run webmaster tools frequently to review about any malware in your website.

Use Your Mobile Phone As WebCam For Your PC

Are you thinking of buying webcam for your PC? If  you have a mobile phone with a camera then no need to waste money for buying a webcam. A free software called SmartCam have solution for this. Nowadays most of we have a mobile phone with camera. So it is an useful software for us to use our mobile phone camera as webcam. It is an open source project software.

Click here to download this software

You have to install this software both on your mobile phone and computer. Connect your phone and computer via bluetooth and now use the webcam.

Also we have another software called mobiola. With mobiola client you can use your webcam via data cable, bluetooth or wifi. You have to install mobiola client both on your pc and mobile

Top 10 Tips to love about windows 8

Now that the Windows 8 Developer Preview has been available for a while, it is easier to take a step back and evaluate it without the powerful emotions that strike most people the first time they deal with it. Looking at it from a long-distance perspective, there’s a lot to like about Windows 8, especially if you are ready to cut the cord from an installed desktop application base and transition to Web applications and Windows 8 native applications. Here are 10 things I think are great about Windows 8.

1: It’s designed for tablets and touch

Microsoft is working hard to make Windows 8 work well with tablets and the touch UI paradigm, to the point of alienating traditional desktop users. It remains to be seen how Microsoft will respond to criticism over the Metro UI. But I can tell you that after using a phone with the Metro UI for well over half a year now, I think it is extremely effective for touch, and I would love to have a tablet running Windows 8.

2: Apps “share” data

One of the big changes in the application development model is that native Windows 8 apps (those using the new Metro UI and WinRT API) really do not directly communicate with each other, even through the file system, except via carefully defined interfaces. While this handcuffs developers a bit, it means that when applications do share data, Windows is aware of how they do it and makes it easy. For example, you could have an application that handles images and use it to share the pictures with, say, an application to upload them to Facebook. That unleashes a lot more power for developers because it means that applications from different vendors will work together seamlessly, and the developers do not even have to write anything specific for the application theirs works with.

3: The apps can be integrated into the OS

Just as the applications can “share” with each other, they can do the same thing with Windows itself. Again, this allows some really neat integrations to be done without much work by application makers. You can see things like a new social networking application come out and within weeks, Windows will be able to use your friends who are on it in its contact list, or the pictures can go into your picture gallery. The possibilities are endless.

4: It offers ARM support

While the ARM CPUs may not be for everyone or every purpose, lots of mobile vendors have a deep commitment to that platform and understand it well. The ARM devices will not be able to run legacy Windows applications, but they will run the Windows 8 native apps without a hitch. That’s great news for hardware makers, software developers, and users.

5: It beefs up security

The new programming model for Windows 8 native applications is extraordinarily secure. While I am sure that exploits will be found, it will be difficult for the native applications to break free of their chains. Microsoft has really flipped it around. Instead of allowing everything and slowly adding restrictions over the years (and breaking applications in the process, like XP SP2 and Vista did), it’s starting from an “allow nothing” stance.

6: App markets will benefit developers and users

Application markets are nothing new. Even Vista had one (although no one seems to remember it). With Windows 8 native applications, Microsoft is making the application market the primary way of getting apps onto the computer, much like Windows Phone 7. That’s great news for developers who need to get some more visibility for their applications and who do not want to deal with payments processing and such, especially for low-priced apps. And the application market is great for users, too. As we’ve seen, app markets encourage lower prices, and Microsoft will surely apply the same strict quality control that it has to the Windows Phone 7 app market.

7: System restore is easier

Microsoft has built new utilities into Windows 8 that makes it much easier than ever to send the system back to “out of the box,” while preserving your data. Providing a more appliance-like experience is critical for the typical user, and the help desk will appreciate it too.

8: Cloud sync is everywhere

While not everyone is in love with the cloud as an idea, Windows 8 has great facilities for allowing applications and users to automatically sync data between devices using the cloud. That’s great for users who can seamlessly transition between their tablet and desktop PC (and perhaps their phone), as well as for tech support, who can just replace a broken device instead of worrying about data loss.

9: It offers simplified administration and configuration

The Control Panel has been stripped down to the bare essentials, and you can’t even think about tasks like registry editing, defragging, etc., from the Metro UI. (You can do these tasks through the legacy desktop, if needed, but that won’t work for ARM devices.) Throughout Windows 8, a primary theme has been giving the user a more appliance-like “It just works” experience. Power users might howl about it, but the truth is, the Windows experience is still far more complex than the average user wants to deal with. Windows 8 is a great move in the right direction for those users.

10: System stability is improved

Windows 7 has really set the standard for system reliability. Short of hardware or driver problems, the old blue screen of death is almost never seen anymore. Windows 8 takes this to the next level. The same changes to the application development model also improve system stability. Applications can’t run over each other’s data easily, and the new WinRT API just does not allow the kinds of shenanigans that have caused unstable systems over the years. If you stick with native Windows 8 applications, reboots (other than for patching) and crashes should be extraordinarily rare.

Virtual Keyboard and the Fight Against Keyloggers

Welcome to Safe Bank’s net banking. Please enter your net banking userid and password.

Userid: 15236523 
Password: ************* 
Action = submit.jsp

and you have logged into net-banking application. Wow!!! You can now view your account balance, do third party funds transfer and much more.

Location: 
C:\WINDOWS\system32\config.dll

File contents: 
08-Aug-08: 08:00: Window title: Welcome to Safe Bank net banking
Userid: 15236523 [tab] Password: Welcome123!

Behind the Scenes: 
When you browsed to your net banking page and typed in your username and password to login into the online bank, there was a malicious program you were unaware of, named keylogger running in the background logging all the keystrokes into a config.dll file located in C:\WINDOWS\system32 folder. This file contains all the keystrokes typed in. It contains the window title and all those things typed into that window along with few other details. This file will then be uploaded to the attacker’s website which he can use to his benefit.

These keyloggers are easily and freely available on internet and also integrated with other programs like rookits making its detection very difficult. So your chance of being infected by such a malicious code even if you have an updated antivirus/anti-Spyware program is about 70%. See the brighter side, you still are 30% safe. Sounds scary..huh!!! So lets keep our focus to internet banking websites and see how we (BANK + USERS) can try to avoid compromising login credentials.

Round 1: Fight!

This is when password stealers were simple keyloggers. Whatever keys were typed in, they were captured by the malicious code and logged into some file in simple or encrypted form. This file was later uploaded to attacker’s site or simply the logs were mailed. This attack can be mitigated by virtual keyboards.

Figure 1.shows the basic virtual keyboard screenshot. It works simply by clicking the keyboard layout by a mouse. So the basic keyloggers cannot capture the mouse clicks and hence the passwords cannot be logged.

Fig 1. Virtual Keyboard (HDFC Net banking VKB)

You can achieve the same by Windows built-in virtual keyboard. Go to Start -> All Programs -> Accessories -> Accessibility -> on-screen keyboard.

Fig 2. Virtual Keyboard (Windows in-built)

Round 2: Fight!

Now the malware coders were challenged as to how to defeat the virtual keyboards.

Mouse clicks cannot be logged. However their x-y positions can be logged which can then be used to get the keys clicked using their x-y position on the web page.

This technique is much simpler to mitigate by simply randomizing the keyboard layout. However total randomizing can make end users unhappy. So a good tip can be randomizing only selected 2 or 3 rows of alphabets instead of all of them.

Round 3: Fight!

Now what? We have the x-y positions but how do we know that what keys were present in that x-y co-ordinate for that period as they have been randomized. Simple!!! Why not take a snap of the keys pressed. Screen snap-shot of say 1 by 1 cm can be taken when a mouse click occurs. The letter present in snapshot is the password of the victim. This code along with basic keylogger can get log username typed from keyboard and snapshots of keys pressed by mouse-clicks from the other code.

Fig 3: Screen shots of password typed as captured by the malicious code.

One well known worm using this technique was W32/Dumaru. How can this be mitigated? How about changing the characters on the keys pressed to something other, on a mouse click? Or simply put change all keys (instead of a single key) to a # sign or a * sign. So if I click on letter “p” then it changes to “#” and then to original letter.

Fig 4: p changes to # on a mouse click

So the key captured on the screen shot will be  instead of correct characters.

Round 4: Fight!

Again our frustrated malicious minded person, let us call them “Malman” (We can’t call them either a hacker or a script kiddie so in short Malman :) ) thinks of a way to fight their way to capture passwords. What if they capture screen shot of the keys clicked just a second after (or rather say few milliseconds after) the mouse is clicked. So when I click on “P” it becomes “#” on mouse click and back to “P” when click is released. Boom! Take a screen-shot of the key now. This works fine.

This can be defeated by changing the keys after the mouse click. So if I press “p”, it changes to “#” and then to “r”. Character “r” is captured in the screen shot.

Fig 5: p changes to # on a mouse click and then to r

This can however make the end-user uncomfortable because each time the keys location will change and he will have to search for his password which will greatly help shoulder surfing. Hovering is a technique in which the keys will automatically be selected and entered into the password field when a mouse cursor is held over it for a few milliseconds. Again the time delay has to be such that it should cause neither user in-convenience nor aid shoulder surfing.

The fight continues

The fight will go on and on. New attack vectors target Win32 API calls made to access HTML document where virtual keyboard fails to protect your passwords. However this can be mitigated in combination with products from different vendors like Trusteer’s Rapport, Juniper’s “Secure Virtual Workspace” or by secured remote terminal sessions using citrix. But then this again adds to increased cost and security overheads. Not many banks will happily implement such solutions.

So should we as end users let the “Malman” get all our passwords. No. We can fight back by taking few precautions from our side in combination with few other trusted tools which can help us protect our passwords.

• Regularly update your Operating System for any patches released.
• Use latest anti-virus and anti-spywares engines. Regularly update with detection signatures and periodically scan your system
• Also do scan for any rootkit present on your system with tools like Rootkit Revealer
• Always use updated version of internet browsers with latest patches. Do not forget to regularly update the patches
• Simple freeware tools like KeyScrambler Personal firefox add-on can add to the increased security
• Keep yourself educated with different techniques used by Malman to steal passwords

At last

This is what-in-short you can do to secure your Bank accounts. I mainly focused on Virtual Keyboards and how their fight against keyloggers evolved. But there are many attack vectors like Phishing etc. on internet used to compromise Bank accounts. Both Bank and the end customers should fight side by side to defeat the Malman. Individually it is impossible to fight them back

Mobile Application Testing

Technology is evolving faster by the day. Today, we see mobiles are no longer mobiles, they are small computers. The smartphones run powerful applications, providing everything to users at their fingertips. Users can use their mobiles for:

• Logging in to banks in order to transfer funds
• Purchasing or selling shares via trading portals
• Booking travel or movie tickets
• Tweeting or social networking
• Donating to charity

As money transactions move to mobiles, hackers also move their attention to it. Hence, as a precautionary measure, securing mobile applications becomes important. This article introduces you to the three key aspects of securing mobile applications.

Mobile applications may be a -

• web application accessed via a WAP browser.
• thick client application sending out an HTTP requests or SMSes.

Security testers should broadly focus on the following categories while analyzing their test cases -

• Local Storage of Data
• Hard-coded Sensitive Data in the Source Code
• Data in Transition

Let us further discuss these categories in detail from a security tester’s perspective.

Local Storage of Data

The local storage of data can also be referred to as a “Handset Memory Analysis” for mobiles.

Mobile applications store data in the local memory of a handset. This data is stored by developers in files locally and is used by the application.

• The Android OS stores data in files at runtime, but due to its native sand-boxing mechanism, obtaining access to this data is difficult. It also stores some data in the SQLite database.
• The Apple iOS stores sensitive information like keystrokes, snapshots and other cached information in the iPhone local memory in the form of client-side SQLite databases or .plist files.
• The Java application in Nokia phones stores it in the form of RMS files. These RMS (Record Management System) files get stored permanently and are easily accessible. Sometimes, they are easily readable when connected to a PC via a data cable. These files have a history of containing sensitive information like bank account numbers, beneficiary details or registered biller(s) auto-pay details.

A security tester needs to conduct a Handset Memory Analysis to detect sensitive information stored in the device.

A mobile application should not store sensitive data in user handsets. If at all it is necessary to store some data, it should be stored in a secure manner using strong encryption algorithms. It can further be stored at non-reachable locations with strict permissions.

Hard-coded Sensitive Data in the Source Code

Applications are also known to comprise hard-coded data in the source code. We may come across various types of sensitive data like –

• payment gateways hard-coding the credentials
• applications hard-coding the server and application-specific details
• developer names & comments explaining the code pieces

Reverse-engineer the source code to obtain readable code files. This would ultimately help discover hard-coded data. It would also help reveal the application logic.

• Android packages the application in .apk files, which have to be reverse-engineered to .dex files and then to readable class files.
• Other .jar files can be simply renamed to .rar and extracted by WinRAR software. This results in decompiled class files that can be read using text editors.

A security tester has to decompile the application code in order to detect sensitive data or hard-coded information.

A mobile application should not hard-code sensitive data in the client-side code.

Data in Transition

Another aspect of mobile usage is the communication channel. Data in transit may be vulnerable to sniffing or manipulation. The data in transit can be tampered or stolen to –

• obtain access to other user accounts.
• transfer funds from other accounts.
• sell shares of other users in order to create a nuisance.
• conduct social engineering.

During a security test, the tester should analyze the data in transition. The HTTP traffic in mobile networks can be intercepted via a proxy editor tool. Here, the security tester can execute targeted manipulation attacks in order to test the application’s resilience against such attacks.

Mobile applications should thus implement server-side validation to prevent data manipulation in transit. Strong SSL encryption should also be implemented to protect data in transit.

Conclusion

There may be various dimensions to mobile application attacks. This article attempts to focus on three key aspects of the mobile security testing domain. Most of the tests revolve around these three aspects. OWASP and other known security forums periodically release guidelines for securing mobile applications. All these guidelines should be diligently followed by developers and included in the detection armory by a security tester.

Database Links Security

Database links (DBLinks in Oracle) are a technique for one database to connect to a remote database and execute queries. The originating database uses an account in the remote destination database to connect. This connection thus uses a username and password of an account in the destination database. The connection has the privileges of the account that’s used in the destination database.

Insecurities with Database Links

Database links introduce several insecurities for the destination database:

• If the originating database is insecure and compromised, the database link could be used by an unauthorized user
• If the originating database is compromised, the user name and password of the database link connection could be compromised
• An adversary who gains access to a database link can execute queries with the privileges of the DBLink account

Best Practices for Database Links

Database links can be made secure through a combination of technical and process controls:

Technical Controls

1. Use Private Database links, instead of Public links. This restricts access to the DBLink to the owner of the DBLink.
2. Use accounts with minimal privileges to access the database link.
3. If the DBLink requires read access to some tables, and update access to some other tables, split this into two DBLinks with different accounts – one with Read, and the other with Update privileges
4. Ensure that the DBLink password is stored encrypted in the originating database
5. Ensure that the DBLink connection is encrypted in transit, by using, say SSL.
6. Restrict the IP addresses from which the DB Link connection may originate.

Process Controls

1. Evaluate the need for database links and authorize them only when they are essential
2. Verify the level of privileges required for the database link - give the minimal set of privileges required to function
3. Assign different accounts for database links from different sources - this allows better auditing and tracking
4. Insist that the originating database server adhere to security best practices - remember security is only as strong as the weakest link, and the originating database should be secure
5. Perform periodic audits of the originating database to ensure that it complies with the best practices for database security, and that the database links adhere to the technical controls specified above

Recommended Reading

1. Database Links: A Definition in Plain English, Lewis Cunningham,http://it.toolbox.com/blogs/oracle-guide/database-links-a-definition-in-plain-english-7023
2. Database Links, Pete Finnigan’s Oracle Security Forum,http://www.petefinnigan.com/forum/yabb/YaBB.cgi?board=ora_sec;action=display;num=1181549741
3. A Simple Oracle Host Based Scanner, Pete Finnigan,http://www.securityfocus.com/infocus/1522
4. Public DBLinks or Not?, AskTom, http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:5991749853476
5. Guidelines for Securing the Network, Keeping your Database Securehttp://download.oracle.com/docs/cd/B28359_01/network.111/b28531/guidelines.htm#i1009371
6. Oracle Database Listener Security Guide,http://www.integrigy.com/security-resources/whitepapers/Integrigy_Oracle_Listener_TNS_Security.pdf
7. Database Links, Ask Tom, http://asktom.oracle.com/pls/asktom/f?p=100:11:0::::P11_QUESTION_ID:456820211101