Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

my application ( C#+SQL server) is running on the shared hosting. However, someone is able to access the database without permit. The connection string in the Web.config file, it had also been encrupted. Based on the above the senario, I have the following questions:

  1. Is the shared hosting not secure?
  2. Is the coding not really secure?

If the problem on the coding, what should I fixed? Many thanks!

------In Web.config, before encrypt------

<connectionStrings>
  <add name="MyLocalSQLServer" connectionString="Initial Catalog=aspnetdb;
Data Source =192.07.32.45; Initial Catalog =myDataBase; User Id =Username; Password =Password;" providerName="System.Data.SqlClient"/>
</connectionStrings>

------In Web.config, After encrypt------*

<connectionStrings configProtectionProvider="MyUserDataProtectionConfigurationProvider">
    <EncryptedData>
      <CipherData>
        <CipherValue>AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAWuizHyLxzk+U4/8NnMRAjQAAAAACAAAAAAADZgAAqAAAABAAAADLFqu00qT0BeGh6wmHHGySAAAAAASAAACgAAAAEAAAAM56z6ezglmufZGcta83RKGgAQAAtvDpExhD6h95lfWBt0FqZYzxupI2IepH/XlhLB5rsuuQDCJUL7XGIIsaVW2oNQxgNCPXxRSuCxHQ7vqgbh4G7xHk0wdyws5Ax4T/RYJbfYEF5KAPzShdmdoZdkY/FOWrVEgAr7LzKFBoDcPJBvgX+lfsJdBNeWRB5BqRX552dUFjtDlp8u3K/dA9twWDU2w/cRLMXJtVZ/y/ICI1fzXjX3u7sY9K1IC+5Hbi7nouCK6Ze5RLBnL0Zfdq0PyGlj2To4ftAYAT0SzkBaxlXRQSzMhX+7c+rgKpMqtG9XjAW26x3IJAp2/uAr2zOZqH+tskamHYSruhTicHJDTtP+r6Rs21y2QkRT9Hb9oPd9B5mDIzGtDkifWBbmwLv4XFuYcna1Zgny7McSxMI62jxayVlZKcS5dXV0shwLoUjbTDcXQmFKsRvo2sCW86wcN8ad02jhKCQMf9SWnZpd849mlqgMFiQQSFlZ6Q+vJLrXqVb8zmVZemQPQcY/DktgjOvjn0iOZ3zhl20fRENOa3ZIWvvK8p9pblz3sEfS19MAW0JtYUAAAAayvNPot3An7LaCTdFYrEip+fTU4=</CipherValue>
      </CipherData>
    </EncryptedData>
  </connectionStrings>
share|improve this question

migrated from stackoverflow.com Sep 21 '11 at 16:26

This question came from our site for professional and enthusiast programmers.

    
share your code that do the connection stuff –  Rami.Shareef Sep 21 '11 at 12:51
    
And you need to provide more details of how the person is able to access the database. Using your application? Using SQL Server Management Studio? Something else? –  JohnL Sep 21 '11 at 12:56
    
Point 1 is a question that should be asked to your hosting company. –  Ira Rainey Sep 21 '11 at 13:00
    
They decrypted the connectionstring and find the database location, username and password there. –  Acubi Sep 21 '11 at 13:04
    
How do you know somebody has access to your database? If you have data that you really need to protect, shared hosting isn't what you should be using, because you cannot limit who can access the content. –  Ramhound Sep 21 '11 at 13:08
show 2 more comments

2 Answers 2

Make sure that

It also makes sense to use a password generator create the user credentials, or a use long phrase (such as "correct horse battery staple") as the password.

share|improve this answer
    
+1 for "correct horse battery staple" –  Paperjam Sep 21 '11 at 18:57
add comment

If you're seeing unauthorized access to your database despite your web.config data being encrypted, then it's entirely possible that your database itself was compromised.

Most shared SQL providers allow remote connections, so someone could have brute-force attacked or otherwise compromised your database.

There are a number of best practices for securing a database, including:

  • Disable the SA account and create another user account to manage the database, or
  • Rename the SA account.
  • Use strong passwords or, as Jeremy McGee mentioned, long-phrase passwords.
  • Use separate users with limited, specific access according to role.
    • For example, you could create a user for your web site and grant it access to only the pertinent tables used by the web site.
    • One benefit of using multiple users is you can more easily trace the source of the compromise in the event it happens.
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.