Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 

Hacked

By Steve Jones,

I've been hacked before. My personal web site has been hacked with a variety of injection and XSS attacks over the years. None too serious, and I've had backups that allowed me to fix things fairly easily, especially once I had a copy of Data Compare, which saved me a lot of time. At SQLServerCentral, we've been hacked as well, though not in a long time. I think we've closed most of the security holes, and I haven't had any issues to deal with in quite some time.

However as I was reading a note from Richard Douglas about being hacked, it brought back memories of working at JD Edwards. Richard was hacked at work, on his personal system. At JD Edwards, we were required to lock our workstations at all times when we were not physically in front of them. We also had two accounts: a normal user and a domain admin "privileged" user. As you might expect, there were numerous lapses of people walking to the kitchen or bathroom and forgetting to lock their workstations. It was considered fair game to change settings, send email to our group, even place semi-SFW pictures on someone's desktop. It was quite embarrassing to be caught, and was much more a an effective security reminder than a reprimand from our boss.

However there is a serious security problem here. Many of us would use our privileged account all too often, since it was a hassle to log out and back in. The "run as" option didn't work well for some applications, and we were less secure than we probably should have been. If someone walking by, whether an employee, guest, consultant, or someone else noticed SSMS running, how long would it take them to type:

  sp_addlogin 'joeuser', 'joeuser'
  sp_addrole 'joeuser', sysadmin

I type quickly and that took me less than 30 seconds. I'm sure even a slow typist could get that entered, and erased, inside of a minute. That might result in a serious security breech, if the system to which you were connected contained HIPAA, PCI, or any identity information. Perhaps even worse these days is the chance someone might attach a USB key logger to your keyboard.

You might be safe in your environment, but you can never be sure. A little care in ensuring you are not unnecessarily exposing security holes, and making sure that outsiders are always escorted can prevent embarrassing incidents from occurring.

Steve Jones


The Voice of the DBA Podcasts

We publish three versions of the podcast each day for you to enjoy.

Everyday Jones

The podcast feeds are available at sqlservercentral.mevio.com. Comments are definitely appreciated and wanted, and you can get feeds from there. Overall RSS Feed: or now on iTunes!

Today's podcast features music by Everyday Jones. No relation, but I stumbled on to them and really like the music. Support this great duo at www.everydayjones.com.

You can also follow Steve Jones on Twitter:

Total article views: 257 | Views in the last 30 days: 2
 
Related Articles
BLOG

Podcasting

A new video setup is on the way!!!! Actually I'll do a couple podcasts on podcasting over the hol...

BLOG

Podcasting

I'm working on getting a small studio set up for some podcasting of the editorials. That means I put...

ARTICLE

Podcast Announcements

Podcast Feeds

BLOG

We’re Live on the PowerScripting Podcast! (Thursday night, 02-28)

Your MidnightDBAs Unusually, Sean and I will be guests on someone else’s podcast this week! Tune i...

ARTICLE

Legal Security

As database professionals, we know that we are responsible for the security and integrity of the dat...

Tags
editorial    
 
Contribute

Join the most active online SQL Server Community

SQL knowledge, delivered daily, free:

Email address:  

You make SSC a better place

As a member of SQLServerCentral, you get free access to loads of fresh content: thousands of articles and SQL scripts, a library of free eBooks, a weekly database news roundup, a great Q & A platform… And it’s our huge, buzzing community of SQL Server Professionals that makes it such a success.

Join us!

Steve Jones
Editor, SQLServerCentral.com

Already a member? Jump in:

Email address:   Password:   Remember me: Forgotten your password?
Steve Jones