# Database Security

- OS security is quite data oriented
    - Usually isn’t concerned with file contents
- Database security is concerned with information
    - Can look at content
    - Can often be inferred even when stringent access policies are in place

#### SQL Security

- Three entities
    1. Users
    2. Actions
    3. Objects
- Users invoke actions on objects
- Newly created objects are owned by the creator
- Privileges can be granted
    - Granter, grantee, object, action, grant-able

#### View-Based Security

- Views are derived relations

```SQL
CREATE VIEW pharm_order AS
SELECT DrugDB.Name, SUM(Total)
	FROM Patients, DrugDB
	GROUP BY (DrugDB.Name)
WITH CHECK OPTION
```

This view abstracts the drugs away from the patients, so that the admin can order the correct amount of drugs without violating doctor-patient privilege

##### Why use Views

- Views are a flexible way of creating policies closer to application requirements
- Views can implement **controlled invocation**
- Data can easily be reclassified
    - Deleting views instead of changing permissions is much easier
    - Never have a situation where an application has access to raw data

##### Why Not?

- `INSERT` / `UPDATE` actions depend on the `CHECK` options, else might be **blind inserts**
    - This is where someone can’t access the data, but can update it
- Completeness and consistency are not achieved automatically
- Can quickly become very inefficient
    - Views can be cached, if not can become very slow

#### Statistical Databases

- Where access to data is restricted, access to aggregates is permitted
    - This means averages, sums can be looked at
    - However, individual records cannot be viewed

##### Inference

- Since individual items are sensitive, we cannot permit access
- Statistical queries are useful, but by definition refer to data
- Some queries can reveal information on the underlying data - *Covert Channel*

###### Example: Salaries

- S = The sum of all salaries in the department
- T = The sum of all salaries for the department except those who have “Department Head” as “Position”
- Boss’ salary = S - T

Solution: Do not allow sets of just one

- S = Sum of all salaries
- T = Sum of all salaries of women, and anyone whose first name is Albert
- U = The sum of all men’s department salaries
- Albert’s salary = T + U - S

Solution: Do not allow conditions that refer to just one

- S = Sum of all salaries
    - Number of department heads named Albert not allowed
- T = sum of all salaries for those named Albert
- U = The sum of all salaries for department heads
- V = The sum of all salaries for those who are not department heads, or named Albert

Salary = V + T + U - S

##### Further Defences

- Data swapping - swap records but keep stats the same
- Noise addition - alter aggregate output (a little bit)
- Table Splitting - Separate data completely
- User Tracking - Log queries

### SQL Injections

- It’s common for user input to be read and then used within an SQL query
- Unexpected user input can completely rewrite the query
- Bears striking similarities to an XSS attack
- An application or website is vulnerable to an injection if it doesn’t filter SQL control characters:
    - `‘` Represents the beginning or end of a string
    - `;` represents end of a command
    - `/*...*/` - comments
    - `–` - comment a line
- Login pages will request hashes from the database

#### Blind SQL Injection

- Most servers won’t directly output SQL errors to the screen
- A *blind* SQL injection performs database analysis without any actual output

#### Fingerprinting the DB

- Some commands are specific to an individual DBMS

`http://shop.com/items.php?id=2; waitfor delay '0:0:10'--`

This will work on `MS SQL` but not `MySQL`

- Once you know the DB, access the system tables

##### Union

- `UNION` appends (not joins) two tables together
    - They must have the same number of columns

#### Second Order SQL Injection

- Entry points may be checked for special characters, but internal functions?
- Store the exploit in one pass, then have it executed later