Tag: security

I got a new mobile device recently and despite the restore from backup, I still had to perform quite a few setup chores. Reconnecting various apps to services by logging in was time consuming, but simple. A password manager was useful here, since I have different passwords everywhere. I set that application up first and then proceeded from there.

The only trouble I really had was with Outlook and mail. I have an IMAP provider for one account and Outlook doesn’t make it easy to figure out where to change the settings for this. The second issue was with my corporate mail, which is secured with a 2FA connection through Duo.

This is a technology that doesn’t use text, but has an application on devices and pushes a notification to them. I get a push when I log onto corporate assets from my PC, and I have to approve a login from my mobile. This prevents sum of the sim hijacking that can occur, where someone might have access to my SMS messages. It also prevents a lazy guy with Google Messages from getting a code on the same device rather than walking to the other room to get my phone an ensure I have it.

I had to get help from our admins with the new device, despite having the old device connected and able to approve the connection. I had thought this would work, but there was some issue with Duo. On one hand, maybe this is good that it isn’t simple and I can’t quickly approve a new device, in that it prevents someone from stealing my identity on a cloned device. On the other, in an organization of any size, where mobiles might change constantly, this feels like a time sink.

This might not be an attack vector to be worried about, but I think it’s better to be safer here than we might need. I do think that good security is worth some hassle. I don’t really complain about having to periodically re-authenicate, the requirement for strong passwords, and I love having 2FA enabled on many services. I hope we continue to find more and stronger methods of protecting individual and corporate data, along with more respect for the rights of humans whose data is being captured and used by most organizations. I also hope that we continue to improve the security options in SQL Server, including adding 2FA.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.

Recently Twitter had a security breach, with a silly scam. At least, I’d think it was silly. I saw a tweet from Elon Musk noting that he’d return $2k in bitcoin for every $1k anyone sent to him. He was feeling generous.

While that might seem silly, a number of other high profile accounts were breached and seemed to lend some level of veracity to the offer. I saw a few news reports that the hackers made off with over US$100,000, so apparently at least a few people were fooled. Twitter locked down verified accounts for a bit while it investigated, removed some tweets, and tried to close the security hole.

What is disturbing here is that apparently the hack took place through Twitter syadmins, with privileged accounts. As of this writing, it isn’t clear if this was social engineering or a sysadmin worked with hackers, but there were internal tools allowing Twitter employees to post tweets on behalf of users.

I have no idea how this happened, but I’m assuming this is some sort of data change made to their system. If this were an RDBMS with a “tweets” table, this would be adding a row to the table with links to the verified accounts’ linkage. Not a hard change in the SQL Server world, and certainly the type of change that most admins could make.

The question might be should they be allowed? Many of us have made ad hoc data changes to systems to correct an issue, and some of us do this regularly.

This reminds me of some customers whose DBAs aren’t allowed to directly connect from SSMS (or other clients) to production and make changes. All changes, including ad hoc data changes, must be submitted to some sort of pipeline, where the change is logged, and perhaps approved by someone else. A different sort of two factor authentication.

Should this be a more common pattern of access to production systems? Limiting access by everyone, even admins? I know we need to trust administrators, but what happens when administrators get fooled by social engineering? A thorny attack vector that we ought to be considering in our architectures.

Steve Jones
Listen to the podcast at Libsyn, Stitcher or iTunes.

There are all sorts of viruses, worms, and malware out in the world, and some of us have had to deal with them at different points in our career. SQL Slammer was particularly memorable for me, but there were plenty of non data related virus issues I’ve had to work on at various employers.

To keep sensitive information safe, many high security environments have built air-gapped computers, where these systems aren’t connected to a network, or at least not a general network in an organisation, and certainly can’t access the Internet. At home, you could think of this as an older computer with no network card, or even a spare laptop with a broken network radio. To get information to/from this computer, you’d use some sort of removable media.

Apparently there are concerns about malware being able to jump this air gap, using the removable media. Nothing terribly new here, as infected USB sticks have been a concern for years, but this appears to be a twist and apparently the malware waits for a chance to send information off to a receiver.

If your system is truly air gapped, then there might not be a way for this information to be ever be copied, but what if that isn’t the goal. Imagine ransomware uses this technique and infects database backups. If you have an offline place for backups, could a copy of a new backup infect other backups? With separate tapes this isn’t an issue, but if you use some sort of part-time connection to move data, this could be an issue.

I’m always wary of online backups or even live copies of data. I know many large systems find tape unusable and impractical, but I know that having physical copies of tapes ensured some level of security for my backups.

The creativity of malicious actors and the threat vectors they devise are scary and incredibly hard to guard against. I don’t know what the best solution is for data and database backups, but I certainly hope that someone smarter than me is working on the problem.

Steve Jones

Listen to the podcast at Libsyn, Stitcher or iTunes.