2

I recently came across a scenario in an assessment regarding IT security. I am new to this area and my knowledge is limited so I'm not sure if my answer to the scenario is suitable or not. Will really appreciate if someone could help out. So the scenario is:

A small company decided to move their infrastructure to the cloud. During the migration activity, they identified one of the database servers had 4 unknown local Windows users on it. This triggered a technical review and internal investigation.

The issues found were:

  • There were 4 local unknown users created on the server.
  • There were a total of 30 database-level users on MS SQL database.
  • The database server is storing data for 20 web applications.
  • Basic findings were that 5 web applications were compromised, where
  • 1 site was having command injection issues
  • 1 site was having SQL injection issues
  • 1 site was having XSS and CSRF issues
  • 2 sites were not doing any input validation
  • None of the sites was using HTTPS
  • Two of the databases were found to have credit card information

The questions are:

Based on this scenario, is this a database, application or system security issue and why?

What are the logs that the company can review during the investigation?

My answer:

I think this is an application security issue.

Application security defined as "the general practice of adding features or functionality to software to prevent a range of different threats. These include denial of service attacks and other cyberattacks, and data breaches or data theft situations". In relation to the scenario:

  • web applications are stored within database server which means this makes it easier for an attacker to access the data because they only need to crack the administrator account for one server to have access to everything.

  • users are created via web applications and stored in the database server, we have yet to identify the privileges of the 4 unknown users. Any one or all of these unknown users could have malicious intentions. They could be identified as individuals with unauthorised access to the company’s network, which means the company may have already been a victim of data breaches or data theft.

  • issues such as SQL injection, XSS and CSRF are a common type of application security vulnerabilities where attackers can exploit and facilitate cybercrime. As a result attackers could target availability, confidentiality, and or integrity of the company’s data.

  • credit card information is found within two databases and 5 web applications were found to have no https. This is signs of data breaches and theft.

I suggest the company to look into database and web application logs for signs of an actual exploit, I will also look into security audit logs for any failed authentication attempts and heck the firewall for unusual traffic based off the location.

  • 4
    I wouldn't call this a DB, nor application nor system security issue. I would call it a dumpster fire and would take the apps and servers offline immediately. – André Borie Oct 25 '17 at 11:57
  • 2
    The lack of HTTPS implies a breach of PCI, making it a legal issue too – jrtapsell Jan 23 '18 at 13:29
  • 1
    Why are you trying to "label" the scenario? It's like trying to determine if someone dying of a flesh-eating bacteria is a victim of an environmental, a bacteriological, or an organ failure issue. It's all 3, and debating how to label it is not going to save the patient. – schroeder Jan 23 '18 at 13:50
  • Let me guess, is this a homework question? – schroeder Jan 23 '18 at 13:53
1

Based on your description, certainly there are multiple serious application security issues.

Based on this scenario, is this a database, application or system security issue and why?

However, that does not rule out other issues. For example, the new users have not been detected until migration started, so there is a "security monitoring" (a subset of System Security) issue. Similarly, new DB users have not also been detected, and that could (depending on your processes) be within the scope of Database Security.

What are the logs that the company can review during the investigation?

Depends on what logs are enabled for the systems as well as for the application. It seems you are using Windows servers, so there is a high likelihood that you will have copious event logs from windows systems both for user activity as well as database activity. Similarly, webserver access logs would also be available (irrespective of the OS).

I always recommend application logging (though not all app-level logging is done with security in mind) - and if done correctly they are extremely valuable when the compromise is done via application vulnerabilities.

Your investigation will have management objectives. What logs you review will need to be aligned to them. e.g., if the objectives do not include discovery of initial attack vector, you may be able to ignore application logs. If the objectives do not include preserving evidence to pursue with law-enforcement, you may want to limit the time you spend investigating disk artifacts (especially if you can restore the clean application from version control).

  • > ... they only need to crack the administrator account for one server to have access to everything. It sounds like the applications are using Administrator level access instead of accounts with reduced access, that's another major problem. – RustProof Labs Oct 25 '17 at 13:32
1

Based on this scenario, is this a database, application or system security issue and why?

All of them.

  • The additional users on the MSSQL Database imply that an attacker either gained admin access to the database directly or that the database users used by the application with the SQL injection had far more permissions than it needed.
  • Command injection, SQL injections, XSS, CSRF and missing input validation are application-level security issues. I would also put not having HTTPS enabled on your webserver in that category, but some people might instead consider this a system security issue.
  • New users on the operating system imply that an attacker gained admin access on the operating system level. Maybe they didn't actually manage to log into the operating system directly but just abused the command injection vulnerability in the one application. But in that case the application ran as a user with unnecessary privileges, which is also a system security issue.

What are the logs that the company can review during the investigation?

  • The Windows Event Log might tell you when the Windows users were created. MSSQL also logs various events to the Windows event log, so it might tell you when and how those database users were created.
  • When the vulnerable web applications have any own logging functionality, those could be helpful (If this were a real-world case I would not expect much from them because the developers were obviously not the most competent ones, but it should be mentioned nevertheless).
  • The MSSQL error log might show you some of the experiments the attacker did when they were testing out SQL injections.
  • The logs from the webserver (IIS?) might tell you which IP addresses accessed the web applications when the new users were created.

But keep in mind that in case of a system compromise, any logs found on the compromised system aren't 100% reliable. A very thorough attacker might falsify them.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.