Re: [despammed] RE: SQL Slammer doing the rounds again?

From: whiplash (whiplash_at_despammed.com)
Date: 11/14/03

  • Next message: Francesca C Smith: "Re: Strange Port 0 Traffic" 
    Date: Fri, 14 Nov 2003 00:51:04 +0100
To: incidents@securityfocus.com

    Jim Harrison (ISA) wrote:

    > Unfortunately, there are many folks who have queried the ISA newsgroups
    > and other ISA lists about how (not why) to allow inbound SQL connections
    > because many web designers haven't quite caught up to the idea that the
    > Internet isn't the friendly little sandbox that they seem to believe it
    > is.

    And what did you answer, actually?
    The only answer I could give 'em could be "You must not".

    And if they really do need to have a "distributed web app"
    I'd answered "do use IPSEC in communications between
    web servers and application servers".

    > Consequently, they deploy distributed web apps that expect to have
    > direct access to a SQL server across whatever network they're installed
    > in. This often leaves the network admins with one choice; open external
    > access to the SQL server.

    I'm a net admin: my answer to such a ridicolous request could be "go
    and do learn how to work, mr. clueless-web-developer: I'll never leave
    a sql server wide open on the internet".

    > While it's true that you can IP-restrict that traffic,

    Wow: impressive, isn't it?

    > there's also IP spoofing to contend with.

    Come on: let's try to be serious.

    (I've never seen a worm trying blind spoofing attacks
    in modern times: have you?)

    The problem is the total leak of a real security culture between
    certain web application developers.

    The problem is that certain net admins say "Yup: sure" to
    what these developers ask them.

    The problem is the existence of very poor security-oriented
    architectures.

    You simply cannot consider ipothetic blind-spoofig attack
    (have you ever tried a blind-spoofing against modern TCP/IP
    stacks, btw? <g>) as a real threat, in such a scenario.

    ---------------------------------------------------------------------------
    Network with over 10,000 of the brightest minds in information security
    at the largest, most highly-anticipated industry event of the year.
    Don't miss RSA Conference 2004! Choose from over 200 class sessions and
    see demos from more than 250 industry vendors. If your job touches
    security, you need to be here. Learn more or register at
    http://www.securityfocus.com/sponsor/RSA_incidents_031023
    and use priority code SF4.
    ----------------------------------------------------------------------------

  • Next message: Francesca C Smith: "Re: Strange Port 0 Traffic"

    Relevant Pages

    • Re: Microsoft Informational Alert
      ... > PSS Security Response Team Alert - SQL Security Recommendations ... > PRODUCTS AFFECTED: SQL Server ... Secure your SA login account with a non-NULL password. ...
      (microsoft.public.security)
    • Maximum Number of Database Users and Roles
      ... of security accounts for sql server is 16379 ... I have a web site that I had/have to change the security model for which was ... originally setup using a Windows Domain Group and users to access our sql ...
      (microsoft.public.inetserver.asp.db)
    • Maximum Number of Database Users and Roles
      ... of security accounts for sql server is 16379 ... I have a web site that I had/have to change the security model for which was ... originally setup using a Windows Domain Group and users to access our sql ...
      (microsoft.public.sqlserver.server)
    • Re: SQL logins logged where
      ... you can't trace directly to a table but can use the> fn_trace_gettable function to load the trace file into a> table. ... If you are using SQL Server 7, use> xp_trace_setqueuedestination to set the destination to a> table. ... Security Tab does not give too many ...
      (microsoft.public.sqlserver.security)
    • Re: Access 2007->SQL Server2005 "connection was forcibly closed",G
      ... I moved every table I was able to move to the SQL ... closed connections - but all of these errors are in the version which used ... the SQL Server 2000 and everything worked ... communication between ODBC (OLEDB and Native Client, ...
      (microsoft.public.sqlserver.connect)