I have a lot of means of searching for malicious code within the file system, monitoring traffic, scanning log files, checking for suspicious/masked processes etc.
However, scanning a relational database such as MySQL is no easy task. Some exploits such as the Magento Shoplift from 2015 aim to inject malicious code within the database being aware of its structure and how it cooperates with the server-side application(s). Dumping the database and then running a signature-based search would be utterly inefficient as some of data is stored in BLOB and other types of data. Also, it is not necessarily looking suspicious and is far from what a PHP webshell might look like, for instance.
My question is: what is the most practical and efficient way to detect anomalies and spot malicious code in a MySQL database?
Could the following be considered a decent approach?
- Dump the database;
- Check it line by line compared to the same database from a backup archive;
- say using a functionality similar to that of diffchecker.com;
- Analyze the newly inserted/updated data;
- this might involve skipping large amounts of data which is clearly not that of any malicious behavior;