Re: SQL Server Authentication hacking

From: jimmers (jimmers@yandex.ru)
Date: 09/24/02 

From: "jimmers" <jimmers@yandex.ru>
Date: Tue, 24 Sep 2002 15:02:35 +0400

Maybe You mean "vulnerable"? If so, SQL Server Authentication
is vulnerable to sniffers that can decrypt password. Other information
(like User ID, Initial Catalog etc) is sent over wire unencrypted.

Cheers
jimmers

"dave" <david_whitehouse@embanet.com> wrote in message
news:73c101c263b8$01ba3cf0$3bef2ecf@TKMSFTNGXA10...
> I currently connect to SQL 7 and 2K servers using SQL
> server authentication. This means that in the connection
> string from the VB client application the username and
> password is passed across the network (connection string
> is shown below and uses ADO 2.7)
>
> I am trying to find out if this method is venerable to
> hackers who could potentially get this information and
> then log in themselves. Is this the case or is the
> information encrypted?
>
>
> db.Open "Provider=SQLOLEDB.1;Password=xyz;Persist Security
> Info=False;User ID=abc;Initial Catalog=DBname;Data
> Source=servername"
>

Relevant Pages

  • Re: Usergroup setup & Changing authentecation
    ... You can "test" SQL Server authentication by creating a user via ... I need to test sql> server authentacation and setup a test usergroup to test> in our new development environment. ...
    (microsoft.public.sqlserver.setup)
  • SQL Server Authentication hacking
    ... I currently connect to SQL 7 and 2K servers using SQL ... server authentication. ... This means that in the connection ... password is passed across the network (connection string ...
    (microsoft.public.sqlserver.security)
  • answered...
    ... Had to change connection string o use OLEDB provider ... instead of ODBC-type connection which only supports SQL ... Server Authentication. ...
    (microsoft.public.sqlserver.security)
  • anonymous logging on ISA SEVER
    ... SQL database(SQL server authentication) behind an ISA ... firewall without allowing anybody at all to log on to my ...
    (microsoft.public.isaserver)