0

I have a small network of several Windows 10 machines (all protected by BitDefender 2020 Total Security), one of which acts as server with Firebird database.

For some time the database is deteriorating - in some random records some fields have altered values. I completly changed the server machine for a brand new with fresh Windows 10 installation and antivirus, on which the database was recreated from GBK archive. The primary machine was carefully check for RAM errors (with MemTest86) and SSD errors (CrystalDiskInfo and ADATA SSD ToolBox) - everything was in 100% fine.

I don't have no suspicions other than that the server was hacked, but it looks like an alleged malware / virus must move inside database (even packed GBK archive), because only GBK file was moved to new machine (on verified pendrive).

Is it even possible that the virus is stored inside the database (e.g. in the form of stored procedures, etc.) and it transfers with GBK archive? If so, how to detect and remove it from database?

(Firebird database is stored in the form of single FDB file, which was scanned by BitDefender without any results)

3

In general the answer to “is it possible” will almost always be yes.

In the case you describe: is it practical that something malicious would be stored in the database? It seems unlikely, and wouldn’t be the first explanation I’d choose for the circumstances.

If you are particularly concerned then lookup historic vulnerabilities in the software, a typical search might be “firebird CVE”.

Some further ideas:

  • Assessing whether there are any suspicious saved functions should be trivial. Use a database manager and inspect any stored procedures.
  • Dump the entire database to a “safe” format and check the data matches the expected format. For example, backup to ASCII SQL statements and restore to a fresh database.
  • Leave the database running for some defined period without making any changes (for example prevent your application from updating or inserting rows). Does the corruption still occur?
  • Turn on query logging, if possible. Do any statements affect rows which then become corrupted?
  • Check your application code carefully! A logic bug is a far more obvious cause of this kind of problem.

These ideas assume you are using the latest version of the database software.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.