Blended Web and Database Attacks on Real-time, In-Memory Platforms
summary
Shows a new SQL injection vector that abuses TIME TRAVEL queries to retrieve previously deleted rows from versioned tables, live-demoed against SAP HANA; demonstrates web app code stored and executed from the DB with server-side JavaScript leading to SQL-driven code injection and on-the-fly app modification via the XS IDE; shows R integration exploited to call and remotely stop the external R service and run commands (R server shutdown), plus reused exploit scripts and mitigation steps: prepared statements, least privilege, SSL, firewall.
AI-written summary · about
chapters (17)
- 0:00Intro
- 2:39In Memory Computing/IMDB
- 4:06Reasons
- 5:29Market Leaders
- 8:06Main Vendors
- 9:36What is SAP?
- 15:37A blended architecture (contd)
- 16:29Impact of vulnerabilities
- 20:22SAP HANA Concepts
- 24:03SQL Injection on HANA
- 26:48Time travel tables and SQL injection
- 33:47Countermeasures
- 34:27Cross Site Scripting
- 36:24Use Security Features
- 37:39Attacks to the R-Integration
- 44:50Calling C++ functions
- 46:15Conclusions
related talks
56mBlended Web and Database Attacks on Real-Time, In-Memory Platforms
43mLive hacking: Breaking into your Java web app
22mLive Hacking Session Part 2
53mHow hacking works - Web edition
42mModern web application bugs
01h 02mLive Hacking: Breaking into your Web App
35mInside a hacker’s mind
58mModern web application bugs