Brian Kelly on his blog mentiones a whitepaper by Cesar Cerrudo: Data0: Next generation malware for stealing databases. This whitepaper describes how malware could be crafted to steal information out of databases.
What is SQL Injection? From wikipedia: SQL injection is a technique that exploits a security vulnerability occurring in the database layer of an application. The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and thereby unexpectedly executed
Here is a nice SQL injection cheat sheet. Currently only for MySQL and Microsoft SQL Server, some ORACLE and some PostgreSQL
http://ferruh.mavituna.com/makale/sql-injection-cheatsheet/
Table Of Contents
About SQL Injection Cheat Sheet
Syntax Reference, Sample Attacks and Dirty SQL Injection Tricks
Line Comments
SQL Injection Attack Samples
Inline Comments
Classical Inline Comment SQL Injection Attack Samples
MySQL Version Detection Sample Attacks
Stacking Queries
Language / Database Stacked Query Support Table
About MySQL and PHP
Stacked SQL Injection Attack Samples
If Statements
MySQL If Statement
SQL Server If Statement
If Statement SQL Injection Attack Samples
Using Integers
String Operations
String Concatenation
Strings without Quotes
Hex based SQL Injection Samples
String Modification & Related
Union Injections
UNION – Fixing Language Issues
Bypassing Login Screens
Enabling xp_cmdshell in SQL Server 2005
Other parts are not so well formatted but check out by yourself, drafts, notes and stuff, scroll down and see.
Dotnetrocks has posted their latest podcast. From the site:
Carl and Richard talk to David Hayden about the new features of the Microsoft Enterprise Library 3
David Hayden is an independent consultant in Sarasota, Florida offering consulting, mentoring, and development services on architecture and best practices in .NET. David is a Microsoft MVP in C#, speaker, MSDN Forum Moderator, Enterprise Library Community Leader, and advisor to Microsoft Patterns & Practices. He spends much of his time helping companies and development teams leverage the proven practices and productivity benefits of Enterprise Library and Software Factories. In addition to his personal blogs at DavidHayden.com and CodeBetter.com, David also runs PnPGuidance.net, which offers numerous articles, screencasts, sample downloads and other resources covering best practices in .NET.
Download it here: http://www.dotnetrocks.com/default.aspx?showNum=262
SQL Down Under has made available their latest podcast. From the site:
Announcing show 23 with SQL Server MVP James Luetkehoelter. In this show, James discusses disaster recovery planning and technology for SQL Server, clustering, log shipping, mirroring and snapshots.Dowmload it here: http://www.sqldownunder.com/
What if I told you to take your latest production backup, restore it on a different machine and try using the database? Are you comfortable with that task? Do you think it will work? When was the last time you tested your backups?
Do you even have a backup?
Why am I asking all these things? Because your data is as good as your last good backup. Is your data backed up regularly? You will say “Of course it is we use [Insert expensive backup solution here] for all our enterprise backups”. Prove it, go to work on Monday and ask them to give you the latest backup. I bet out of a 100 people who ask this question to their backup team there will be several people without a backup file.
Here is another problem: three years ago the backups were taking about 1 hour. The backup started at 12 it would be done at 1, at 1:30 a job from another machine would ftp the file down. Two years later the backup takes 2 hours to complete, you didn’t realize this. Can you guess what will happen if you try to restore once of those backup that were moved by FTP? I will tell you it won’t work. What if there is no backup and you do a FTP? Oh yes the 0kb file will be created.
Where do you keep your backups?
Are you backups in the same building? If you would say yes then you have a big problem. Let me tell you a little story. I worked for a company in New York City between 2001 and 2005. This company had their office in WTC tower one. To be safe they kept their backups in WTC tower two. Well I don’t have to tell you what happened with the backup. If you do store your backup offsite (and why wouldn’t you?) make sure it is at least 100 miles away. If you don’t want to go that far from your current location then pick a location which is safe from floods, fires and not worthy to attack.
Where is your Source Code?
Do you backup your source code? Most people will say they keep it in Subversion or Visual Source Safe. But does that get backed up? What happens if your building goes up in flames? What we do is we have a full source code backup every day. In addition to that we also have differential backups every n revisions. We have jobs that create these backups and then FTP them to 3 different locations. If you have 20 developers and you lose 6 hours of work then you have lost 120 * $$ (you do the math). This is the best case scenarios. If the backup was in the building together with all the workstations then you got a lot bigger problem to deal with.
SQL developers are notorious for not using source control. They will tell you that the database backup is their source control. A source control system does not have to be expensive; we use Subversion (which is free and better than VSS). You can either use Tortoise or the plugin for Visual Studio to do your check ins.
| 
