SQL Injection Attacks and Defense - 2009

370 Chapter 8 • Code-Level Defenses
Table 8.8 Password in Different Languages
Word for Password
password, pwd, passw
passwort, kennwort
Motdepasse, mdp
wachtwoord
senha
haslo
Language
English
German
French
Dutch
Portuguese
Polish
To make the attack more difficult, it could be a good idea to use an unobvious table
and column name for saving password information. Although this technique will not stop
an attacker from finding and accessing the data, it will ensure that the attacker will not be
able to identify this information immediately.
Setting Up Database Honeypots
To become alerted if someone tries to read the passwords from the database, you could
set up an additional honeypot table with a password column that contains fake data. If this
fake data were selected, the administrator of the application would receive an e-mail. In
Oracle, you could implement such a solution by using a virtual private database (VPD),
as in the following example:
-- create the honeypot table
Create table app_user.tblusers (id number, name varchar2(30), password
varchar2(30));
-- create the policy function sending an e-mail to the administrator
-- this function must be created in a different schema, e.g., secuser
create or replace secuser.function get_cust_id
(
p_schema in varchar2,
p_table in varchar2
)
return varchar2
as
v_connection UTL_SMTP.CONNECTION;
begin
v_connection := UTL_SMTP.OPEN_CONNECTION('mailhost.victim.com',25);