Implementation of a security control method for DB query tools based on SQL injection and API hooking

초록

As DB query took can export query response results into endpoint devices, attackers are inclined to change their target from the data in DB server to the response results in the endpoint devices. This trend requires the DB security area expanded to the endpoint device level. This paper proposes a novel method for preventing DB query tools from exporting query response results into the endpoint devices. In order to implement the suggested method, we applied two well-known hacking methods, SQL injection and API hooking. We adopted SQL injection method to acquire the system privilege. We applied API hooking method to prevent the commands of DB query took from being executed. Although SQL injection and API hooking are known as attacking methods, we show that these two methods can be applied for the purpose of IT security control. The main contribution of thk research k that DB security can overcome a security hole named the vulnerability of endpoint device and expand its security area to endpoint area. ©2013 International Information Institute.

키워드