Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 

Intruding into Dummy Websites

By Phil Factor,

Today we have a guest editorial from Phil Factor.

Have you ever lost the keys to your house and had to break in?  One can quickly make the unpleasant discovery that it is extraordinarily easy to do so.  I expect that it is even more educational to test out your neighbors’ security systems by attempting to break into their houses, and maybe leaving a box of chocolates if you succeed, though I’ve never actually tried. It would, I imagine, be difficult to explain to the law-enforcement agencies if you get it wrong.

The same is true of SQL Server Databases, particularly if they are tied to a website written by bungling and demented amateurs.  Once one has lost the perennial argument as to whether you should expose base tables to the application layer (No no! a thousand times no!) then it is just too easy.

The problem is that the quickest way to understand the importance of website, and database, security is to try cracking open other people’s data-driven websites. . “You allow the programmers to access tables with dynamic SQL? This is what happens!”  It is remarkable how easy it is to end up displaying a vast list of all the customers of a site and their passwords. One can’t, however, escape the fact that there is a moral dimension to breaking into other people’s websites just for practice and for demonstrating to your management the failure of implementing DB best-practices.

In addition, some websites are run by hardened criminals engaged in dangerous scams, and may have very unpleasant surprises for anyone foolish enough to choose to try to hack their sites.

No. For many reasons,  I can’t bring myself to attack real websites for educational reasons any longer. I like to do my bayonet practice on straw men.

I’m keen on the idea of a practice dummy website that we, as SQL Professionals, put up on the internet, stocked with fake data.  We’d use it as a training assault course, so you can all practice breaking into it, just to convince yourself how easy it is to do if the website’s constructor trusts the application layer to do the decent thing and allow the application login rights to anything more than a defended phalanx of stored procedures.  Surely every DBA and database developer should do it: It is very educational, and I can assure you that nothing concentrates the mind faster than the sight of credit-card numbers scrolling on the screen instead of the list of branch offices. To cap it all, one could do it without a twinge of conscience. What do you think?

Total article views: 178 | Views in the last 30 days: 1
 
Related Articles
FORUM

Database backups best practice

Database backups best practice

BLOG

Anniversary at Database Trends & Applications Magazine

I was happy to hear that the magazine Database Trends and Applications had recently relaunched their...

FORUM
FORUM

High Traffic Website Design

High traffic Website DB Design

FORUM

Best Practices to Improve ASP.Net Web Application Performance.

Best Practices to Improve ASP.Net Web Application Performance.

Tags
editorial    
hackers    
security    
 
Contribute

Join the most active online SQL Server Community

SQL knowledge, delivered daily, free:

Email address:  

You make SSC a better place

As a member of SQLServerCentral, you get free access to loads of fresh content: thousands of articles and SQL scripts, a library of free eBooks, a weekly database news roundup, a great Q & A platform… And it’s our huge, buzzing community of SQL Server Professionals that makes it such a success.

Join us!

Steve Jones
Editor, SQLServerCentral.com

Already a member? Jump in:

Email address:   Password:   Remember me: Forgotten your password?
Steve Jones