3

So I was analysing a new application that is being written. I noticed that on the app server level there are sql calls that are being made from C# code. These calls can be seen in wireshark by following the TCP stream from my machine.

Is there any way to prevent a MITM from seeing this? The calls look something like this after wireshark reconstructs it:

S.E.L.E.C.T. .V.A.R. .F.R.O.M. .T.A.B.L.E...

Im not sure the protocols being used but clearly being able to see the plain text sql calls with variable names and table names is a problem.

4

This is a configuration issue with the database. Most modern databases offer transport encryption, though many are not enabled by default.

Here are some links for setting up SSL on popular SQL databases:

6.3.6 Using SSL for Secure Connections

How to enable SSL encryption for an instance of SQL Server by using Microsoft Management Console

1

Communications between the application and its database are unprotected. If both the database and the application are on the same machine, then this is not a problem: people who can snoop on local TCP connections also have extended administrative privileges on that machine, and thus have already won.

If, on the other hand, the machine that runs the application and the machine that hosts the database are distinct, then you need to add some protection layer. Typically, you would set up SSL, as @DavidHoude indicates in his answer. Alternative methods:

  • Install some VPN between the application server and the database host. A VPN will protect all communications between these two machines, at the OS level. Since neither the application nor the database need be aware of that protection, this may be simpler to install in your situation. IPsec should be supported natively by your OS; or you could use a dedicated product like OpenVPN.

  • Use physical protection: link the application server and the database server with a direct ethernet wire (no switch, no hub, just a direct link) and make sure that no evil people can physically approach that wire.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.