Minimizing Databases Attack Surface Against SQL Injection Attacks

Lately, end-users and database administrators face continuously personal data exposures. Among different type of vulnerabilities an adversary might exploit, to gain access to this data, SQL injections are considered one of the most serious vulnerabilities, which remain at the top twenty most known vulnerabilities more than a decade. Though various defenses have been proposed against SQL injections for database protection, most of them require “modifications” on the underlying infrastructure, such as proxy interposition, middleware drivers, etc., while they cannot be employed transparently. In this paper, we propose a practical framework that enables the transparent enforcement of randomization to any given database for enhancing protection against SQL injection attacks, while being agnostic to the underlying database and completely transparent to end-user. We demonstrate a methodology for identifying automatically SQL statements on a given database application, and we introduce a runtime environment for enforcing the randomization and de-randomization mechanism in a completely transparent way, without requiring access to its source code. We evaluate in terms of overhead our approach using the well-known MySQL database under different configurations. Results indicate the employment feasibility of the proposed framework.