Prevent manipulation of password database

Question

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the password database is storing the relevant information - username, hash, salt, # iterations...

Is it possible to prevent the malicious user from creating their own admin user in the database and successfully logging into the application with full rights? Presumably they could INSERT a new admin user into the database with their own bcrypt'ed password. They would then be able to log into the application with full admin rights.

Is there any way to prevent this or mitigate such an attack on the application?

Answer 1

If only the database server is compromised: yes. If the application server is compromised: no.

Store a HMAC of the final password hash along with the hash itself: SIG = HMAC(hash, secret).

secret is a single value only known to the application server. It never changes. When verifying a login attempt, recalculate the HMAC and compare. This way the attacker who has compromised the database is unable to create or modify a password (since secret is only known to the application server).

In practice, things are always a bit different: if your DB server is compromised you most likely are in a lot more of trouble.

Answer 2

Firstly, I think you need to collect evidence about what happened, because it could've been the result from SQL Injection attack through your application or another application hosted in the same server, also it could've been the result from another kind of attack. Review your logs of your application, application server, database server, even operating system. Detect the bad users on your databases and delete them.

Now, I recommend you the following security measures:

1. Create a user on your databases for your application.
2. Set the correct priviliges to user of your application on your database based on what your application needs.
3. Set access control mechanisms in your application; maybe an attacker could escalate privileges on some of functions of your application to insert an admin user.
4. Implements input data validations in your application; if you implements input data validations you can avoid SQL injection attacks or another kind of injection attacks, how you mentioned above, it could've been the result from SQL injection attack.

I hope this information helps you.

Good luck.