Fake Data (Honey Data)
create table app.userdata (username varchar2(30), password varchar2(30));
-- Fill Honey table with data
insert into app.userdata values ('WEBUSER','WEBUSER01');
insert into app.userdata values ('WEBADM','ADMADM01');
insert into app.userdata values ('WEBREAD','READUSER01');
-- create predicate function
create or replace function perfcheck (pv_schema in varchar2, pv_object in varchar2)
return varchar2 as
begin
dbms_output.put_line(‘Send email to the security team or lock the database user...');
-- return always true. Attacker will see all results
return '1=1';
end;
/
-- now we activate VPD for this table
exec dbms_rls.add_policy(object_schema => ‘APP', object_name => ‘USERDATA',
policy_name => 'PERFCHECK', policy_function => 'PERFCHECK');
By using honey data , it could help to identify attacks that are not triggered by error messages.
Honey data is data (e.g. Passwords, Credit card numbers,…) in tables which is never used by the application (Fake Ones). If someone from anywhere is accessing this kind of data , alert will be raised.
Creation a table or tables containing unused data with juicy names (e.g. PASSWORD, CREDITCARD, SALARY).
Such interesting data is often the target of attackers.
During the attack, attackers are often accessing the view ALL_TAB_COLUMNS (Oracle) or INFORMATION_SCHEMA.COLUMNS (MySQL) to get the column names of interesting data.
Attackers are normally downloading the data of interesting tables found via the column name in further attacks.
You could monitor such an access and could react (send email, lock user, …).
Oracle can implement this monitoring via Virtual Private Database (VPD).
-- The script
-- Create Honeytablecreate table app.userdata (username varchar2(30), password varchar2(30));
-- Fill Honey table with data
insert into app.userdata values ('WEBUSER','WEBUSER01');
insert into app.userdata values ('WEBADM','ADMADM01');
insert into app.userdata values ('WEBREAD','READUSER01');
-- create predicate function
create or replace function perfcheck (pv_schema in varchar2, pv_object in varchar2)
return varchar2 as
begin
dbms_output.put_line(‘Send email to the security team or lock the database user...');
-- return always true. Attacker will see all results
return '1=1';
end;
/
-- now we activate VPD for this table
exec dbms_rls.add_policy(object_schema => ‘APP', object_name => ‘USERDATA',
policy_name => 'PERFCHECK', policy_function => 'PERFCHECK');
if Oracle solves it using VPD ,
how could it be implemented on MySQL ? A question needs to be answered.
It can be done using MySQL by :
ReplyDelete1- make a fake table like users_tb ,or permissions_tb with field (username , password , ....).
2- when these tables are accessed , a trigger raised to put some data in another fake table (temp_tb).
3- a small service reads from the temp_tb , if any data appears , it will alert the administrator, this means that there is an attempt to attack.