SQL Server Forensic Analysis

10. SQL Server Rootkits

The threat of rootkits is not new and has been discussed in-depth at security conferences, in the media and in several books. This coverage has primarily focused on traditional operating system rootkits and the ways in which they can affect a computer system. As the focus of cybercrime has shifted from loud service-disrupting attacks to covert financially motivated threats, databases, which typically store financial data, have become popular targets for attackers. Keeping pace with the shift in cybercrime, rootkits have silently evolved as well. Rather than masking operating system access, rootkits have now moved to the database and conceal instances of unauthorized database access and information disclosure. ...