4

First off, I don't know how hackers get at an entire password table and steal them. I don't know if the owners of the website are to blame or what, but I am wondering if it involves logging into the DB or not.

Assuming that hackers steal passwords by logging into the DB with application or admin users, what about putting passwords into it's own schema with air-tight privs?

PASS.Passwords having the hashed password and UserId primary/foreign key to the User table.

The only permissions any DB user has to PASS schema would be execute procedure. Not even the DB admins would have read privs.

Authenticate by executing IsAuthenticated(@UserId, @HashedPassword) returns bit.

Create password by executing Create(@UserId, @HashedPassword) returns bit.

Update password by executing Update(@UserId, @OldHashedPassword, @NewHashedPassword) returns bit.

And that is all you get. No user having permissions to actually read even the hashed password, would hackers still be able to steal the table even if they compromised the environment?

Improve this question

1 Answer 1

Reset to default
4

The majority of the big password dumps are done with sql injection. Isolating your authentication database from the rest of the program is a defense in depth strategy because you are planning on the fact that one developer may introduce a SQL Injection vulnerability. The vast majority of SQL databases do not allow query stacking, and should be difficult to obtain arbitrary remote code execution using SQL Injection. Dumping the administrative password or other authentication credentials using SQL Injection (sqlmap rocks) is a very common attack pattern in the wild.

OAuth is an even better approach. Google and Facebook are popular OAuth providers; they not only have more users but more resources to devote to security. A system is most secure when security threats are avoided entirely.

Improve this answer
3
  • Thanks Rook. I was wondering if a programmer were to expose a sql injection vulnerability to dbo schema, and the application had admin privileges to dbo, but only execute procedure on PASS schema. (And actually nobody not even the admins have more than execute procedure on PASS schema) Worst case scenario of hacker ownage and all their malicious techniques, could they get at the hashed passwords? If all they can do is sql inject, I think the schema permissions should prevent them from reading or dumping right?
    – Andrew Hoffman
    Dec 18, 2013 at 20:36
  • @Andrew Hoffman that is a great example of violating the principle of least privilege access.
    – rook
    Dec 18, 2013 at 21:20
  • how? I didn't know what that was until I wiki'd it, but are you referring to the application getting admin privs to DBO? In that case I agree but I'm not an admin and sometimes applications get too many privileges.
    – Andrew Hoffman
    Dec 18, 2013 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .