A table of a bank's customers, for example, may well have a column for storing each customer's unique bank account number – a possible candidate for a primary key. The primary key's value distinguishes each row of customer data.
To speed up the retrieval of customer data, the bank account number or the Social Security number of each customer, for example, can be indexed. The arrangement allows bank staff to quickly search the database using that particular piece of information. These indexes, however, are the focus of a new timing attack technique demonstrated by researchers from Core Security Technologies. The attack uses a series of insert operations to find weaknesses in the database's indexing algorithm. Attackers can then extract data from indexed fields. The insertion commands do not exploit any application logic or code flaws; the functions are typically available to all database users.
The initial defensive recommendation is to not use indexes on confidential data. Without indexes, however, data retrieval is complex. To find the particular row matching a given bank account or Social Security number, the database server would have to perform a full table scan to search every row in the customers' table. Complex queries across multiple tables also depend heavily on indexes. These delays would have a significant impact on performance and cripple most large commercial databases.
While there are no reports of this attack being used in the wild, it is a plausible threat. Database administrators should monitor log files more closely to look for abnormal repetitive insert activity. Application firewalls will also need to be tuned to detect unusual patterns of activity. For new databases, architects must make some modifications to the data model and application code. For each column in a table that must be indexed, there must now be a corresponding column to store the hash value of the confidential data. This hash value can then be used for indexing. The attacker will not be able to calculate the value of confidential data from it, effectively negating the attack. Applications can still search for the confidential data efficiently by performing the search on the indexed hash value column and passing the hashed value of the data as the search criteria.
Dig Deeper on Enterprise Data Governance
Related Q&A from Michael Cobb
Google is beginning to encrypt data by default on its Android devices. Expert Michael Cobb explains how this change will affect enterprise BYOD ...continue reading
Securing enterprise communications has become a top concern lately. However, finding the application that best suits your enterprise security needs ...continue reading
Expert Michael Cobb provides background on the RC4 encryption algorithm and determines whether a recent RC4 attack signals trouble for SSL/TLS users.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.