I've read about a piece of malware that primarily targets corporate users in order to modify and delete records...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
on corporate SQL databases. Does this malware pose any risks beyond the cost incurred from having to restore systems? Are there specific defenses that can be used to protect databases?
Ask the Expert
Have questions about enterprise information security threats for expert Nick Lewis? Send them via email today! (All questions are anonymous.)
The W32.Narilam malware has functionality that allows it to update or delete MS-SQL databases. Narilam spreads copies of itself to the local system and mapped drives to enable it to auto-execute when someone logs into the system. For it to start infecting a network, it needs to either be included in other malware or someone must manually infect a system. The risk from this malware is low, and the damage is primarily in the time spent cleaning up an infected system. It doesn't contain functionality to capture data from the local system or from potential databases. It also only targets three very specific database names (alim, maliran and shahd), and the odds of having a database with the targeted name is fairly low. If an organization has a database this malware attacks, any data could be lost from the last backup depending on how the database and logs are architected. This could potentially be hours to days of data, if not more.
Along with standard enterprises security best practices including database backups, databases can be protected from Narilam by not allowing delete privileges and limiting updates for non-privileged users. To aid in recovery, organizations should have a business continuity or backup plan that covers a database outage. This could minimize the effect from this malware if a database is corrupted and needs to be restored from backups and transaction logs. Also, applications could be architected to limit the database permissions, only allowing minimal updates or data insertion as necessary.
Dig Deeper on Malware, Viruses, Trojans and Spyware
Related Q&A from Nick Lewis
Attackers can use the SandJacking attack to access sandboxed data on iOS devices. Expert Nick Lewis explains how to protect your enterprise from this...continue reading
Malicious Windows BITS tasks set up by attackers can reinfect systems even after the malware has been removed. Expert Nick Lewis explains how to ...continue reading
ZCryptor ransomware can self-replicate through autorun files placed on removable storage devices. Expert Nick Lewis explains how your enterprise can ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.