3

Given: A malicious user has gained (root) access to the server hosting an application's password database. Let's say the application is using a reliable password hashing mechanism like bcrypt and the password database is storing the relevant information - username, hash, salt, # iterations...

Is it possible to prevent the malicious user from creating their own admin user in the database and successfully logging into the application with full rights? Presumably they could INSERT a new admin user into the database with their own bcrypt'ed password. They would then be able to log into the application with full admin rights.

Is there any way to prevent this or mitigate such an attack on the application?

4

If only the database server is compromised: yes. If the application server is compromised: no.

Store a HMAC of the final password hash along with the hash itself: SIG = HMAC(hash, secret).

secret is a single value only known to the application server. It never changes. When verifying a login attempt, recalculate the HMAC and compare. This way the attacker who has compromised the database is unable to create or modify a password (since secret is only known to the application server).

In practice, things are always a bit different: if your DB server is compromised you most likely are in a lot more of trouble.

  • 1
    That's not going to help if they simply assign admin rights to an existing user they know, or created themselves via the app, or changed, or found the password of. – Anti-weakpasswords Feb 12 '16 at 6:17
-1

Firstly, I think you need to collect evidence about what happened, because it could've been the result from SQL Injection attack through your application or another application hosted in the same server, also it could've been the result from another kind of attack. Review your logs of your application, application server, database server, even operating system. Detect the bad users on your databases and delete them.

Now, I recommend you the following security measures:

  1. Create a user on your databases for your application.
  2. Set the correct priviliges to user of your application on your database based on what your application needs.
  3. Set access control mechanisms in your application; maybe an attacker could escalate privileges on some of functions of your application to insert an admin user.
  4. Implements input data validations in your application; if you implements input data validations you can avoid SQL injection attacks or another kind of injection attacks, how you mentioned above, it could've been the result from SQL injection attack.

I hope this information helps you.

Good luck.

  • It looks like this is asking about how to pre-emptively reduce the risk if this happens, not asking for info on how to react. – Someone Somewhere Mar 8 '16 at 23:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.