WIXLIB

International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016ISSN 2229-5518313Database Security: Attacks and TechniquesPreeti SharmaDepartment of Computer Science & Applications, Kurukshetra University, Kurukshetra-136119Email: preetisharma4795@gmail.comMonikaDepartment of Computer Science & Applications, Kurukshetra University, Kurukshetra-136119Email:ABSTRACTIn today’s world, the data become an essential asset as it is used in daily life from a single person to every bigorganization. To make the use of data efficient and maintained it is stored in database. Hence the databasesecurity is an important factor to provide integrity, confidentiality and availability of data. This papergenerally provide a review of need of database security, attacks possible on databases and their preventiontechniques.IJSERKeywords- Access Control, Active Attack, Attacker, Database, SQLIA.1. INTRODUCTIONThe data plays an crucial role in today’s world forthe success or failure of an organization becausemostly of the organizations make the use ofdatabase for storage of major or important data ofthe organization and the data is not mandatory to bean user’s details but it also contains all credential orsensitive information of an organization. Many of theorganizations spent lot of money for securing theirdatabases and this importance of data will make thedatabase security important in every sector either it isprivate sector or government sector. Hence the datamust be protected.Basically there are five layers of security – databaseadmin, system admin, security officer, developer andemployee. Thus, security can be affected at any of thelevel by an attacker. In database security attackers aredivided into three segments that are 1.1 AdministratorAn admin is an authorized person who haspermission to control the system but misuseshis/her privileges against the security policies toget the important information.1.2 InsiderAn insider is also a member of trusted committeein an organization but did misuse of his/herauthority and want to get some sensitive or anyother important information.1.3 IntruderAn intruder is not a part of an organization.Actually he/she is unauthorized people whoaccess the personal data of an organization andwant to get the sensitive information.The security of data basically requires threethings-Confidentiality, Integrity and Availability.Where Confidentiality means the data must beused by an authorized person, Integrity meansthe data must be controlled by an authorizedperson in an authorized manner and Availabilitymeans the data must be available to anauthorized user at appropriate time. These threeare shown in Fig.1 below:ConfidentialityIntegrityDatabase SecurityFig.1 Three main factors of database securityIJSER 2016http://www.ijser.orgAvailability

International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016ISSN 2229-5518314User32. ATTACKS ON DATABASEThe attacks performed on database are basicallyclassified into two segments:User3 observe thecontents sent fromuser1 to user22.1 Passive AttacksPassive attacks focus on the observation. Here theattacker observes the data present in the database.The passive attack is very dangerous attack but lessproblematic than active attacks. Generally, passiveattacks are performed without any data modification.In passive attacks no data in the database is to bemodified but the attacker just observes thecommunication between two users over the network.The passive attacks can be performed in three forms:2.1.1 Static LeakageusUser1N/WUser2Fig.2 Passive attack2.1.3 Dynamic LeakageIn this type of passive attack, the plain text value canbe generated by observing the continuous changesperformed in database for a particular time. Thenafter observing the changes the data is analyzed thathelp the attacker to get the related data about theplain text value.IJSERIn this type of passive attack, the snapshot ofdatabase is observed in the sense to obtain the plaintext values at a particular specified time. Staticleakage only deals with the observation of the data indatabase only at a specified time period but after atime the attacker stop the observation on dataBasically, it is not much harmful because dataremains same and appropriate data is received by theright person but the attack performs because theattacker just observe the data in database. It is calledstatic leakage because it is performed only for aspecified time period.2.1.2 Linkage LeakageIn this type of passive attack, the linking between thedatabase value and the position of that specifiedvalue in index is established to obtain the plain textvalue. In linkage leakage, some steps are taken toactually perform the linkage attack. First step inlinkage leakage is to check the index of the databaseand search for the particular data on which the attackis to be performed. And in second step, when therequired data value is found in an index of thedatabase, the data get linked with the database value.Linkage leakage creates problems but it is not asdangerous as compared to other attacksThe main steps in dynamic leakage are –In first step,the attacker observe the data transmitted betweenusers for a time and in second step, the observed datais analyzed that results in the related information ofthe plain text value.2.2 Active AttacksThe active attack is much more problematic ascompared to the passive attack because passive attackis based on the observations and no modification indata can be done in passive attack. But in activeattack, the modification of data is done For example;the user captures the wrong information as result ofquery. The active attack can be performed bydifferent ways as:2.2.1 SpoofingIn this active attack, a value is generated and then thecipher text is replaced by that value. This value isgenerated by using some algorithms and techniques.IJSER 2016http://www.ijser.org

International Journal of Scientific & Engineering Research, Volume 7, Issue 12, December-2016ISSN 2229-55183152.2.2 Splicing2.3.1 Tautology Based AttacksIn this active attack, two cipher text values are thereand one cipher text value is then replaced by anothercipher text value.Tautology attack is generally occurred in databasebecause these are very simple to perform. Here ,attacker uses one or more than one conditionalstatements by injecting SQL tokens so that it isalways evaluated true i.e. 1n these attacks, attackernormally traverse the authentication pages and accessthese pages that helps for execution purpose. Forexample,ClientServer“SELECT name FROM bank WHERE name ’or1 1--‘AND pin ’ ’Active intruderFig. 2.2 Active attack2.2.3 Replay’In this example the code is injected at WHEREclause and the data is easily retrieved because thewhere clause always return true. The database treatseverything after WHERE token as conditionalstatement but inclusion of “OR 1 1” clause turn itinto tautology (The character “--“begins the commentthat everything after this is ignored.)IJSERIn this active attack, the cipher text value is replacedby old version that is previously updated or may bedeleted. That’s why this attack is called replaybecause deleted old version value is underconsideration.2.3 SQL Injection AttackSQL injection attack is the most serious attack in thedatabase security. In today’s world almost allapplications use the database as backend and themost critical attack placed on the web applications isSQL injection attack that is abbreviated as SQLIA orSIA. Basically SQLIA can be termed as thedangerous attack in database security because SQLattack is performed on server and then server run themalicious queries that results in the manipulation ofthe database. SQL injection is just a technique inwhich malicious users can add the SQL commandsinto the SQL statements, through web page input.2.3.2 Union Queries Based AttackIn tautology attack the data retrieval is not possible.But in the union query based attack, attackers makethe use of unsecure parameter to make injected dataand then join this injected query to the original queryusing UNION. Hence this can retrieve the data fromthe database.For example, “SELECT name FROM bank WHEREname ’’UNION SELECT name from employeeWHERE employee id ’123’ -- AND pin Suppose that there is no name equal to “” (emptystring), the original query returns null string, theinjected query returns name of employee withemployee id ‘123’. Thus, the final result is union oftwo queries and finally returned by application.2.3.3 Piggybacked QueriesHere, an executor normally adds the unauthorizeddatabase statements into an unsecure SQL datachannel. The SQL injection attack is basicallyperformed to allow the unauthorized access to thedatabase.SQL injection attack is divided into some attacks thatare given as:It is the one of the most harmful attack because inthis attack no effect is visible on original query butsimilar to union query attack an injected query isadded to the original query.For example, “SELECT name FROM bank WHEREname ’Preeti’ AND pswrd ’abcde’ ANDpin ’132001’; drop table bankIJSER 2016http://www.ijser.org