Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

There seems to be an explosion of new databases, especially in the non-relational and "NotOnly SQL" offerings. How does this database fad affect data integrity and security? What are some ways that programmers can hang themselves by not accounting for strange database behavior? This question is more about flaws like Time of Check to Time of use (TOCTU) than the usual SQL Injection and Insecure Direct Object Reference.

Does anyone know of interesting attack scenarios or real world vulnerabilities (CVE numbers, papers, exploit code!) that fall under this category of attacks?

share|improve this question
add comment

1 Answer

Interesting question. I don't have any specific knowledge of any new DBMS systems that have caused a vulnerability when using a traditional RDBMS would have not led to the same outcome. As far as integrity goes, I think you make that compromise when you add in "eventually consistent" as a platform goal for a lot of the highly distributed NOSQL offerings.

I don't think it's going on a limb to say that the ecosystem isn't nearly as developed as RDBMS solutions. That said a lot of the logic that can be found in a RDBMS has moved to the application and is dependent on the developer, which is likely a potential weakness.

Given the reason for implementation is largely scaling related (for Enterprise), would attacks against this platform more likely be attacks against it's distributed nature at least initially. As an example the Citigroup e-payment flaw, though they probably are using traditional RDBMS.

share|improve this answer
    
+1 Perfect, this question is about developers accidentally introducing flaws due to unexpected database behavior. –  Rook Jan 11 '13 at 23:24
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.