How insiders hack SQL databases with free tools and a little luck

It was just a simple database. It hadn't been used in over a year. It was behind the firewall and it didn't really contain anything that anyone would care about. That is, until someone on the inside with malicious intent got hold of it.

I see this scenario quite often. It's almost always a case of the focus being on the "important" database systems – while the seemingly "little" database systems that no one really uses are

    Requires Free Membership to View

More on SQL Server database security:

 ignored. Ending up on the Privacy Rights Clearinghouse  list of data breaches is as simple as a trusted insider using a few free tools to exploit database weaknesses that almost certainly exist on the network. Sure, we can talk about database  patching and  passwords until we're purple in the face, but those two things are still the essence of most database security problems I see. Let me walk you through a real-world scenario.

Step 1: A bored employee (or contractor, or consultant, or auditor – you name it) decides one day that he wants to see what he can get into on the network. He knows that most of the good stuff is stored in company databases. The employee then combs the Internet for a couple of minutes and stumbles across the free (and very handy)  SQLPing tool. This tool, like most network and security tools, is intended for legitimate and legal use, but the employee knows that good things can be used in bad ways. So, he simply plugs his local network address range into the tool and finds all of the SQL Server systems he can "play" with as shown in Figure 1.

Figure 1 – Using the SQLPing scanner to find live SQL Server systems. (Click on image for enlarged view.)

Step 2: The employee then starts to poke around on the database systems during his adventure to hack SQL Server databases. He's not sure how to actually connect to the database, so he does a little more research on the Internet. He learns that Microsoft has a couple of tools he can use to connect to SQL Server databases. He hopes he won't need a password. Ha! He's in luck. It just so happens that the database he's interested in does not have a password on the sa account. Good for him – bad for business. Figure 2 shows how the employee simply connects to the database using Microsoft Web Data Administrator.

Figure 2 – Using Web Data Administrator to export a database. (Click on image for enlarged view.)

The ability to export databases, create backdoor users, delete databases is all in his control.

Step 3: The employee then stumbles across another interesting database system – and a new tool. With Microsoft's SQL Server Management Studio Express, he can connect and execute queries to databases as he sees fit. Sure, SELECT statements, table names and the like aren't for the faint of heart. But everything he needs is at his beck and call on the Internet. Having gone out on a limb and gained access to the database by using "password" as the password, he gets right in. He's able to execute a basic query that shows how many other accounts on the system have no password at all, as shown in Figure 3.

Figure 3 – Using SQL Server Management Studio Express to execute queries. (Click on image for enlarged view.)

The system is thick with sloppy misconfigurations. The database is his.

Step 4: The employee has read recently that  unstructured data scattered about the network is becoming a big problem for businesses. He does a little research and decides to poke around for Microsoft Access files on unsecured shares where they shouldn't be. He knows data contained in them may be stale, but they may still have some juicy content. After all, they were the company's mission-critical, relied-upon databases not that long ago. Any files he comes across are his. It's just a matter of loading them into Access. If they're password protected as a means of SQL Server database security, he can simply crack the passwords using  a good commercial password cracking tool. It's a lot of valuable information for such a small investment.

Step 5: The employee goes on to abuse the database content for ill-gotten gains and the network administrator is none the wiser.

Think about these vulnerabilities. Then look at the  descriptions of known breaches happening every week. It's all so free and easy, and it's reality -- no fancy commercial hacking tools are required.

Network flaws need your attention right now. It's okay to focus on the most urgent vulnerabilities on your enterprise's most critical systems, but don't overlook the "little guys." Your greatest SQL Server database security issues may very well be on some harmless database deep inside the network that no one ever uses. Leave no stone unturned and never, ever assume that network insiders cannot or will not do bad things, that is hack your SQL Server databases.

Kevin Beaver, is an information security consultant, keynote speaker and expert witness with Atlanta-based Principle Logic LLC. Kevin specializes in performing independent security assessments. Kevin has authored/co-authored seven books on information security, including Hacking For Dummiesand Hacking Wireless Networks For Dummies(Wiley). He's also the creator of the Security on Wheels information security audio books and blogproviding security learning for IT professionals on the go. Kevin can be reached at  kbeaver@principlelogic.com.

This was first published in June 2008

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.