I have an AWS instance running a rails app that I don't actively maintain. Since I didn't keep track of what was going on with this app, I didn't update it promptly when all the rails vulnerabilities were being discovered, so I think there's a good chance that it's been compromised. I want to save some of the data on it by ftp'ing a copy of the database (SQLite, if it matters) before I wipe it. Is it safe to do that, and to put the database back once everything's been wiped? Is there a way I can check the database to see if it's safe?
Your database cannot be trusted. At the very least, reset all administrative passwords stored in the database -- if you have a small set of users reset all passwords. You should also not trust that fake accounts weren't arbitrarily created or email addresses of admin accounts changed. I'd also make sure that the account running your webserver does not have a password set and cannot login. (Assuming a linux setup where apache/nginx typically runs as user
The recent rails vulnerability gave skilled attackers ability to run arbitrary remote commands on your server through embedding a YAML-encoded object in an XML HTTP request. It would be difficult to rule out that you were attacked; normally your best guess would be to consult your webserver logs -- however a skilled attacker could alter these logs (as your webserver user has permission to update these logs) -- and as these attacks could have been exploited any time in the past 6 years (even before it became public knowledge) your logs likely do not go back far enough.
There are a couple of ways to check the validity of your data. Not finding signs of tampering doesn't mean your data was not compromised because the logs could be compromised as well. Logs should be kept in a different security container.
- Check for changes against a backup. Even if the backup is old you could still identify changes to old data.
- Check HTTP server logs for requests that would have touched the data.
- Check DB server logs for queries that change data in a different way than the web application does. You can eliminate valid queries and identify malicious ones by sorting the queries by type and count.
You might also want to look at SQLite's built in integrity check, which will give you some confidence that the underlying structure of the DB hasn't been corrupted.
This won't tell you if any data has been modified though; see Cristian's answer for that.