4

Website keep getting hacked every day and every now and then we hear website owners react and tell "affected users that their password might had been compromised". Most sites that disclose such leaks know exactly which information was compromised and it often only affects a small portion of the user.

In all my setups, I save everything in one single database. If a hacker was to gain access to the database, how can I verify what has been compromised.

My question is: how can I monitor my database for database leaks? There would be a few attack vectors: a user could find a bug in my code and gain access to my admin interface. In that case a log would help. But what if the attack manages to connect to my database and send any SQL query he wants? What if the whole server gets compromised? He could just delete the logs, or even hide his actions. This way, I wouldn't even know I was hacked until users start complaining.

In my setups I use Postgres but I was hoping for mitigate/detection solutions that are not bound to one stack.

  • 1
    if you want a more specific answer perhaps the adding the type of database might help since different databases have different monitoring tools. I have a SQL Server background and I can think of a few ways to do this – Anthony Jun 26 '15 at 12:39
  • 1
    @Anthony I mentioned that in the very last line – Matt3o12 Jun 26 '15 at 12:41
5

This is usually a combination of luck, technology and hand waving.

You may see that your database server was hacked (via unusual activity for instance, gigabytes being transferred to Internet, a fact detected by, say, your network provider). You may then have logs which trace activity on the database (ranging from "someone accessed the DB" to actual queries). You can then, hopefully, roughly imagine what has leaked.

Another example is the usage of Data Loss Prevention. This is a technology which had its glorious days a few years ago but failed to actually detect anything useful (generally speaking, it was looking for patterns in what is transferred). Taken into account the constraints you have to put in place so that it works, it is not surprising that you can hardly catch anything. But this is one technological possibility.

Another case is that you realize (or someone tells you) that your data is on pastebin.

You can see that there are plenty of possible scenarios.

Beside having your environment up-to-date, your main defense is to log everything, and do that in a place outside the immediate vicinity of your database (so that it stays there after the hack). You can use a home made solution (a centralized syslog server in a firewalled zone) or commercial ones (Papertrail, Splunk Cloud, ...). You then monitor these logs looking for unusual patterns.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.