Shaven, Not Stirred - Hacking SQL Server
How easy is it to hack a SQL Server? In this session we’ll see examples on how to exploit SQL Server, modify data and take control, while at the same time not leaving a trace. We’ll start by gaining access to a SQL Server (using some “creative” ways of making man-in-the-middle attacks), escalating privileges and tampering with data at the TDS protocol level (e.g. changing your income level and reverting without a trace after payment), and more. Most importantly, we’ll also cover recommendations on how to avoid these attacks, and take a look at the pros and cons of new security features in SQL Server 2016. This is a demo-driven session, suited for DBAs, developers and security consultants. NB No actual state secrets will be revealed. Please do not send agents to my house again.