1. Zac Fenigshtien zac.fenigshtien@888holdings.com

2.  Introduction: 3 Tier Architecture  SQL Injection ◦ Parameter Sandboxing ◦ Blacklisting, Whitelisting ◦ Minimizing the Surface Area ◦ Encryption: Hash, Symmetric, Asymmetric  Crawlers  2 nd Degree Injection / HTML Injection 2

3. 3 Application Graphical User Interface: Input / Output Client Side Input Validation: Valid Dates, Mandatory Fields, Check Digit Business Logic Layer: Application Logic Server Side Input Validation: Zip Code Match The Address Data Access Layer: Data Source Management: DB: Open Connections, Connection Pooling, Execute Statements, Handle SQL Errors… (EDMX, Linq) GUI (UI)BLL (BL)DAL

4. ‘ OR 1=1;-- 4 http://en.wikipedia.org/wiki/Magic_string

5. DEMO

6.  Never concatenate input parameters into your query.  Use the appropriate datatypes for input parameters.  Minimize the length of string input parameters. 6

7.  Try to use Whitelisting.  Blacklisting can’t be a full solution.  Remember that Blacklisting require constant maintenance. 7

8.  Disable unused features: ◦ CMD Shell. ◦ Trustworthy, Cross DB Ownership Chaining. ◦ SQLCLR, OLE DB.  Use unprivileged SQL users for the application.  Use unprivileged WINDOWS user for the SQL Service. 8

9. DEMO

10.  Classic, Error Based or Time Delay.  Bypass the need for application output.  Used by automated tools.  Prolong attacks. 10

11.  Hash: One-Way Encryption. ‘ABC’  ASCII('A')+ASCII('B')+ASCII('C')=198  Use it to secure passwords and to validate data.  Always use salt. 11

12.  Symmetric: Encrypt & Decrypt data using a key. ‘ABC’  ‘CDE’  Fast and relatively secure.  Use it to secure data.  Transferring and keeping the key is problematic. 12 Encryption algorithm: Forward X Letters Encryption Key: 2

13.  Asymmetric: Encrypt & Decrypt data using pair of keys (private & public).  Data that was encrypted with the public key can be decrypted only with the private key, and vice versa.  Relatively slow and very secure.  Used in secure communication (along side the other algorithms). 13

14. DEMO

15.  Any public data can be collected.  Try to filter queries according to the user that use the results.  This form of attack is very hard to detect. 15

16.  The attacker will place HTML/JavaScript code within a record. This code will be executed on the client side.  This kind of attack dose not jeopardize the DB.  If the application require that HTML/JavaScript code will be stored in the DB – Validate this code by Whitelisting. 16

17. Thank you