In June this year, AC fun barrage video network (commonly known as station a) announced that the website was attacked by hackers, and nearly 10 million user data were leaked, including user ID, user nickname, encrypted stored password and other information. According to the announcement on user data leakage caused by hacker attack on AC fun published on the official website of station a, station a upgraded the user account system on July 7, 2017. However, if the user has not logged in to the website after this time, or the password encryption strength is not enough, the account will still be at risk of disclosure.

In recent years, data leakage incidents have emerged one after another. From the disclosure of Yahoo's 3 billion users' information in 2017, the theft of Uber's 57 million user accounts, to the disclosure of employee information of the U.S. Department of homeland security at the beginning of the new year in 2018, it can be described as wave after wave. This time, even the second world can not be spared. Looking at these data leakage events, most of them point to a highly confrontational field in Information Security: Web application security and database security behind it.

In May this year, Verizon just released the 2018 data leakage investigation report, which is also the 11th data leakage investigation report continuously released by Verizon. In this year's report, the Verizon team analyzed a total of 53000 incidents and 2216 confirmed data leakage incidents, and analyzed in detail the common attack methods in data leakage incidents. The report points out that in these leaks, most attacks point to web applications: for example, in the information industry, 45 of the 49 leaks were achieved through attacks on Web applications, accounting for more than 90%. It can be seen that web application security has been the forefront of data leakage events. A large number of penetration injection, detection, database collision and information theft occur between web servers and databases. The Internet of mutual funds, social networking, games and entertainment travel has been involved in every corner of our daily life. For these enterprises, the registered user data, as the core information asset of the website owner, involves the substantive business of the website and related information systems. Once leaked, it will not only cause losses in economic interests, There will also be a huge crisis of condemnation and trust.

First of all, the application of database is very complex and difficult to master. Many database administrators are busy managing complex systems and neglect the inspection of security risks and improper configuration, such as the control of database access rights, shared accounts, access with privileged accounts SA and system, and command execution. This is because the traditional security system largely ignores the topic of database security, and database administrators usually do not take security as their primary task.

Secondly, the increasing importance of data has also led to attacks on the database by some illegal personnel. Attackers usually attack them through SQL injection, apt and other attack methods. These vulnerabilities often do not exist at the database level. On the middleware, traditional WAF and data cleaning have their own limitations in dealing with such flexible attack methods, Can't be 100% safe.