Encrypting MariaDB about siakmas HOT 3 OPEN

hey I still don't know about it, but do MariaDB can be used on a native-browser-app or php docker or something like that that make this web app standalone?

[https://mariadb.com/kb/en/library/installing-and-using-mariadb-via-docker/]

from siakmas.

hey I still don't know about it, but do MariaDB can be used on a native-browser-app or php docker or something like that that make this web app standalone?

from siakmas.

Testing with done MariaDB 10.1.38

Results

• ALL DB HAS BEEN ENCRYPTED WHEN ISN'T USED OR LOGGED IN
• 5 ROTATING KEYS AVAILABLE FOR MAKING ENCRYPTION ALGORITHM MORE HARDER TO BE ANALYSED
• Hiding decryption priv key (this one needs extra attention since i cant using Amazon Web Service API for key management or other online service ) why? because private key needs to be separated from the host/server so attacker cant guessing/searching (via directory travesal, exploitable php function or even LFI but i already taking prevention for those vulns, maybe) key in localhost
• Changing file permission for priv key and conf file

Things to do:

1. Making auto script to change the rotation of keys each specific time
2. Changing CBC to CTR (will try if CTR is supported) ❌

VULN FOR NOW

1. Since CBC is used, the table column name is still in plain text

DONT ASK THIS (IF YOURE ASKING THIS, THEN YOU'RE AN IDIOT)

Can you encrypt the db name too?

Ref:

• 1. https://stackoverflow.com/questions/3115559/exploitable-php-functions/3697776
• 2. https://security.stackexchange.com/questions/35492/is-it-possible-for-a-hacker-to-download-a-php-file-without-executing-it-first
• 3. https://mariadb.com/kb/en/library/encryption-plugin-api
• 4. https://mariadb.com/kb/en/library/file-key-management-encryption-plugin/

from siakmas.