Timing Attacks for Recovering Private Entries From Database Engines

Abstract. Dynamic content for Web applications is typically managed through database engines, including registration information, credit cards medical records and other private information. The web applications typically interface with web users and allow them to make only certain queries from the database while they safeguard the privacy where expected, for example, they may allow to add data in a column of the database but not to view the complete contents of this column. We will describe a new technique that allows executing a timing attack which recovers entries from a private column in a database and only requires the ability to insert data in this private column. During the presentation, we will show the experiments that led us to developing exploit code for the MySQL engine that demonstrates this technique, give details for the audience to understand the underlying algorithm, analyze the results and discuss future work. We will also discuss how to protect from or detect this exploit. Vulnerability Description Database management systems are prone to a design vulnerability in their indexing and insertion/update algorithms. An attacker which is allowed to insert new entries in a database table and time their response can exploit this vulnerability and recover all the entries from the table under attack. The problem derives from an information leak caused by the data structure used for indexing table columns and the underlying data manipulation and storing functions. This vulnerability is present in the MySQL v5 when used with the InnoDB storage engine. Earlier versions have not been checked. This vulnerability could also affect every database configuration where a table column is indexed by a data structure and algorithms set which leak information, including but not limited to, those that implement the B-tree data structure. This has not been checked. Vulnerable systems MySQL is vulnerable when used with InnoDB storage system. MySQL is the most popular free and open source database engine, with a great success in web applications, it is the database engine in the LAMP/WAMP platforms (Linux/Windows-Apache-MySQL-PHP), and used in the popular Youtube, flickr