Possible corrupt or injected data

Question

Hello,
I have a question for the SQL Server security experts.
My scenario is as follows:  I am currently migrating data off a legacy system, and into another.  This system is notoriously hard to work with, and has been severely abused over the years.  Many logical associations were broken, and band aided
back together.  It is a sunset system, however demographic data still needs to be retrieved.
Upon loading the data into a slowly changing dimension in another system, I am running into an issue where the same values will not equal themselves.  I have tried converting the data types, stripping all non-ascii characters from the string data. 
I have checked the data lengths, all equal similarly length and stored string data.  I am detecting no hidden characters within the string as well.  There is no reason why this data won't equal itself.  My only conclusion at this point is that
it is either corrupted or injected.
Are there any suggestions on how to detect possible corruption or injection?  I have read many articles around sql injection, and I suspect that I am dealing with binary data injected onto the end of the string data.  However, when I check the
byte size it looks normal.

Answer 1

Physical corruption you would detect with DBCC CHECKDB
Corrupted foreign keys you could detect with DBCC CHECKCONSTRAINTS
If someone has maliciously manipulated the data in order to conduct any kind of second order attack via SQL Injection or otherwise, it really depends on the skillfulness of the attack how easily one could detect & comprehend that.
Hidden character may also have gotten into the system by badly written applications and imho are not necessarily an indication of an attack.
Maybe you could show us a sample.
If you truly suspect an attack going on though, you should follow your hopefully existing escalation procedures and get the system ready for a forensic investigation by making sure nothing can get changed any more. Unless you want to keep
that system running to try to catch the attacker “live”. But I do not recommend using a production system as a honeypot if you don’t know exactly what you are doing (and probably not even then).
Andreas Wolter (Blog |
Twitter)
MCSM: Microsoft Certified Solutions Master Data Platform, MCM, MVP
www.SarpedonQualityLab.com |
www.SQL-Server-Master-Class.com