Digital Forensics in Small Devices: RFID Tag Investigation

4.2.3.4.7 Server Hardening Information
The identification of security weakness or hardening of compromised backend
server could also give support to forensic investigator for determining the scope
and areas of interest in investigation.
According to Fowler (2009, p. 261), “one of the most well-known SQL
Server misconfigurations is the use of blank passwords and logins with blank
passwords (example: SA login) are an attractive target for an attacker trying to
gain access to a SQL Server instance”.
Thus, all the backend server logins were also collected by using
automated WFT from Helix_RFID_IR toolkit. The result of the collected logins
could be seen in the following Figure (4.44).
Figure 4.44: Collected SQL Server logins
Furthermore, an investigation on security configurations of the SQL Server was
also significant in order to find out whether the malicious hacker or
unauthorized user had gained access to the backend database by using the weak
point of the security configuration. However, the database attack could be
minimized by server administrators by using a SQL Server 2005 Surface Area
Configuration (SAC) tool. The Surface Area Configuration (SAC) tool was
basically introduced in 2005 and later versions of SQL Servers in order to
simply disable the vulnerable features of SQL Servers for hardening the
security. By using SAC tool, the administrators could disable unnecessary
database features or functionalities such as xp_cmdshell, SQL Server browser,
remote connection and the like. Similar to the configuration settings of the SQL
Server, SAC could give the forensic examiner the information about which
113