Author: Robert Agar

MySQL is one of the most popular database platforms in the world. It is widely used to power eCommerce sites and web applications that are essential components of many companies’ business strategies. MySQL databases are often the repository for sensitive customer data gathered while conducting business as well as information regarding internal processes and personnel.

An organization’s databases are responsible for storing and manipulating the information required to keep it operating and competing effectively in their market. They are critically important to a company’s success and need to be guarded and kept secure. The database team comprises an enterprise’s first line of defense and is responsible for implementing security policies and standards that minimize the chances for the systems to be accessed by unauthorized users or exposed to malicious malware.

One of the …

Protecting the data stored in your database may have been at the top of your priorities recently, especially with the changes that were introduced earlier this year with GDPR.

There are a number of ways to protect this data, which until not so long ago would have meant either using an encrypted filesystem (e.g. LUKS), or encrypting the data before it is stored in the database (e.g. AES_ENCRYPT or other abstraction within the application). A few years ago, the options started to change, as Alexander Rubin discussed in …

In the last few days, there has been information released about yet another alleged data leak, placing in jeopardy “…[the] personal information on hundreds of millions of American adults, as well as millions of businesses.” In this case, the “victim” was Exactis, for whom data collection and data security are core business functions.

Some takeaways from Exactis

Please excuse the pun! In security, we have few chances to chuckle. In fact, as a Security Architect, I sigh deeply when I read about this kind of issue. Firstly, it’s preventable. Secondly, I worry that if an organization like Exactis is not getting it right, what chance the rest of the world?

As the Wired article notes the tool https://shodan.io/ can be revealing and well worth a look. For example, you …

In this blog post, we’ll look at ProxySQL firewalling (how to use ProxySQL as a firewall).

Not long ago we had an internal discussion about security, and how to enforce a stricter set of rules to prevent malicious acts and block other undesired queries. ProxySQL came up as a possible tool that could help us in achieving what we were looking for. Last year I wrote about how to use ProxySQL to stop a single query.

That approach may be good for few queries and as a temporary solution. But what can we do when we really want to use ProxySQL as an SQL-based firewall? And more importantly, how to do it right?

First of all, let us define what “right” can be in this context. …

This blog post focuses on MySQL 5.7's newly improved features of security validation and password expiration.

The post Security Validation and Password Expiration in MySQL 5.7 appeared first on Datavail.

Ah database security… the black sheep of topics and something you would really rather not have to deal with right?

I mean surely all the fanfare and paranoia is reserved for the neck beards with tinfoil hats whom live in their own D.I.Y Faraday cage … that must be it … it just has to be?

No, the hard reality is the world is not rose tinted and “they” are out to get you be it for fun or for profit; from defacements to theft compromising your applications, and more importantly your data is big business. For some these acts are nothing short of sheer entertainment for an otherwise boring evening. (I’ll be speaking about this topic next week in much more detail at the Percona Live MySQL Conference and Expo in Santa Clara, California. My session, “Security and why you need to review …

In the past few years, hackers, hacktivists and criminals have targeted millions of databases. Any information you own is at risk.

Join GreenSQL’s live webinar and learn the actions required in order to protect your invaluable information and that of your customers.

Security expert David Maman, Founder and CTO of GreenSQL, the Unified Database Security Company, will cover the following topics:

-         Advanced database hacking methods

-         Common database security threats

-         How to protect databases from SQL injection attacks

-         Separation of …

The GreenSQL Unified Database Security solution is proceeding at a rapid pace. We are pleased to announce that our latest release, GreenSQL 2.1.4, is available for immediate download.

The GreenSQL Unified Solution features Security, Auditing, Masking and Performance for databases  in one suite, ensuring that databases are protected from internal and external threats in real-time, while improving performance and facilitating database security policy compliance.

Download any GreenSQL package and get GreenSQL’s Enterprise Edition functionality for an evaluation period of 14 days. 

Read more:  …

Last Wednesday evening, I gave a talk at the WizeNight gathering in Tel Aviv, Israel. Wize is a new nonprofit organization that organizes WizeNights, free lectures for people who want to learn interesting and important things, over a beer. This time, the event took place at the Bialik Bar.

My talk covered topics such as the hype about recent computer security attacks, the lack of social networking security for our virtual presence, database information security, credit card readers and zero-day attacks.

Here are 5 facts I shared with the crowd that most didn’t know:

1. Identity theft is a bigger crime than drugs in the U.S.
2. Social networking is highly unsecured.
3. Many of the largest companies worldwide have been exposed to SQL injection attacks.
4. Internet commerce is more secure than the average mall store.
5. …

Summary

As part of GreenSQL’s Database security research,  we’ve been validating and extending coverage of known and unknown vulnerabilities in order to increase GreenSQL product security, at this post we will reveal a full working Prove of Concept for the CVE-2007-4517 vulnerability which executes arbitrary code.

The Exploit: PL/SQL/2007-4517 exploit is a PL/SQL procedure that exploits the CVE-2007-4517 vulnerability, also known as Oracle Database XDB.XDB_PITRIG_PKG.PITRIG_DROPMETADATA Procedure Multiple Argument Remote Overflow.

The vulnerability is caused due to a boundary error in the XDB.XDB_PITRIG_PKG.PITRIG_DROPMETADATA procedure when processing the OWNER and NAME arguments to create an SQL query.

This can be exploited to cause a buffer overflow by passing overly long OWNER and NAME arguments to the affected procedure.

Symptoms

System Changes: …