Why your encrypted Database isn't secure: practical attacks against encrypted OSS databases
summary
Shows concrete failures: transparent data encryption protects nothing — SQL injection reads plaintext from an encrypted RDS because the DB decrypts on boot. Demonstrates attacking pgcrypto by running avml memory grab on the host to recover keys and cached psql queries. Exploits deterministic/Rails encrypted_record by matching IVs in WAL/backups and links prescriptions. Re-identifies randomized-encrypted check‑ins by geohashing trajectories, noting four points re-identify 95%, and suggests randomized AES-GCM, homomorphic/order‑revealing approaches and threat modeling.
AI-written summary · about
chapters (7)
- 0:00Intro
- 0:23Practical Attacks on Encrypted Databases
- 3:27Transparent Data Encryption
- 9:16Direct memory access
- 13:37Deterministic Encryption
- 15:56Chosen Plaintext Attack
- 21:53Reidentification Attack
related talks
45mSecurity Attacks on PostgreSQL
47mData at Rest Encryption Going Beyond the Basics to Address Modern Attacks
48mColumn encryption solutions and ideas
32mPostgreSQL Security: Defending Against External Attacks
41mKeeping Secrets: Emerging Practice in Database Encryption
35mSecuring PostgreSQL From External Attack
47mEsoteric Web Application Vulnerabilities
50mSecuring PostgreSQL From External Attack