0

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)?

If an IDS is monitoring the server, logging everything that is write once then read only... Wouldn't it mean every step that's taken will be logged? SQL inject might trigger the IDS, so let's say a hacker social engineered to get a pass into the db, but still any steps logged... But you can't erase it as its write once only. Then how does a hacker leave without leaving any traces? Otherwise the last IP contact point can be revealed...

  • Are you referring to some particular case, ask for a hacking tutorial, or ponder the possibility ("if" not "how")? – techraf Mar 31 '16 at 6:32
  • I am just pondering the possibility as i am doing some research work, and i saw the case a few weeks ago on bangladesh bank hack, and the forensic team saw the traces left by the hacker. So i am wondering, because i am a dev, if someone came into our db, there is a possibility that hacker left without any traces and not trigger the IDS... so i was just wondering if possible how would have they done that – clark Mar 31 '16 at 7:04
1

The write-once property of logging systems are poorly written most of the time.

Even you believe that your IDS is bulletproof: Don't forget that the attacker has full control over the attacked host. So, he can even control whether the host send packets to the IDS or not. Even if the packets are sent to the IDS, the network itself is mostly susceptible to attacks.

  • ahhh, i never thought about it from that angle.....if the attacker stops the db talking to the IDS, then the IDS won't be getting any log. – clark Mar 31 '16 at 7:23
  • Sure, the perfect-logging is defined first by Bellare or Shneier, if I'm not mistaken. But it has flaws. It has many unrealistic assumptions. (1) Timely and reliable communication channels. (2) Write-once and non-volatile storage. (3) Atomic relations in between events and log records. These are hard to obtain in the real world. – MTSan Mar 31 '16 at 7:28
  • True, and an attacker can always disable the logging from the db before he does anything to it. Doing small things to make sure/test it doesnt log first, and when ready and action then...but very interesting... i will read more on it. If the IDS/SIEM logs everything down to any contact point to the hosting, then would be hard...assuming pictorially the IDS is in the inside covering the outside(host/server db...)but you gotta switch it off reaching past the outside.. – John Mar 31 '16 at 9:37
0

In my opinion, it would be possible if that certain attacker gained access to the device which has been whitelisted on the IDS, or whatever security system on that network.

  • So further steps needs to be taken to have admin access for the IDS, i assume? sorry, i am not following. Because even if its whitelisted, whatever steps it takes, will still be in the log tho. Just like any other users login or read/write to the db, the server log will show. The only way i can think of is, the hacker will have to also have the admin control for the IDS, and when all steps are done when leaving, go into the IDS and erase the steps from the log? – clark Mar 31 '16 at 7:09
  • I'm not sure why just an access to whitelisted device would log on IDS, but if you have SIEM system or log management system that is logging everything, sure it would leave log, I think.But, just an NIDS, HIDS will not be enough, since attack will come from inside. – mau5 Mar 31 '16 at 7:16
  • Hi, sorry yes i am thinking about SIEM, so even a login from an admin into the server would be logged.. i was just doing research work, and saw a few cases some db was compromised... but there was no trace on the SIEM, so i wondered – clark Mar 31 '16 at 7:20
0

By definition this would be impossible with a perfect IDS. OTOH if we could write perfect systems we wouldn't need IDS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.