Detecting Overwrite of BackEnd data file.

G

GregR5

I am concerned about a malicious user Over-Writting the current
BackEnd datafile with an old BackEnd datafile! I'm looking for
suggestions for detecting this condition with code.

ThankYou
Greg
 
E

Ed Metcalfe

GregR5 said:
I am concerned about a malicious user Over-Writting the current
BackEnd datafile with an old BackEnd datafile! I'm looking for
suggestions for detecting this condition with code.

ThankYou
Greg
Click to expand...

Greg,

Prevention is better than cure - put the backend of the database somwhere
that the users are not aware of. You could even leave the current backend
where it is and not tell anyone you have relocated the real backend.

A simple way of detecting an old backend would be to put a new table in the
current backend. As part of the startup routine of your frontend have it
check for the existance of the table. If it's not there, the file has been
overwritten with an older version.

Ed Metcalfe.
 
J

Jeff Boyce

Greg

Not sure you and I have the same definition of "BackEnd datafile"...

Do you mean you have a user who has a backup copy of an earlier back-end
..mdb file?

In addition to Ed's suggestion, you could consider adding a record in a
[tblVersion] in your front-end file that keeps track of version date/time.
When your front-end applications start up, they could check the
corresponding table in the back-end and respond accordingly.

--
Regards

Jeff Boyce
Microsoft Office/Access MVP


Microsoft IT Academy Program Mentor
http://microsoftitacademy.com/

Microsoft Registered Partner
https://partner.microsoft.com/
 
G

GregR5

Not sure you and I have the same definition of "BackEnd datafile"...
Do you mean you have a user who has a backup copy of an earlier back-end
.mdb file?
Click to expand...

FE/BE. I am referring to the Backend of a split project. Not a
backup ;). I am concerned that a user can copy the Backend at any
time, and then a few weeks latter copy it over the current BE.
Causing the system to return to its old state. No one the wiser in
some cases.
Prevention is better than cure - put the backend of the database somwhere
that the users are not aware of. You could even leave the current backend
where it is and not tell anyone you have relocated the real backend.
Click to expand...

DateTime & ldb are dead giveaways!
In addition to Ed's suggestion, you could consider adding a record in a
[tblVersion] in your front-end file that keeps track of version date/time.
When your front-end applications start up, they could check the
corresponding table in the back-end and respond accordingly.
Click to expand...

It seems multiple users would time/date stamp at different durations.
I could have one FE designated as the "Master" and have it check a
single record in the BackEnd against the Master's FE. However, this
would prohibit other FE's from detecting the Overwrite, and would
restrict this check to the "Master" user. There must be some clever
scheme to handle this? Otherwise, I would probably have to create a
BE table and maintain records of ALL the FrontEnd Users. And, save a
TimeStamp to each during every startup? What a hastle!

Greg
 
J

John W. Vinson

I am concerned about a malicious user Over-Writting the current
BackEnd datafile with an old BackEnd datafile! I'm looking for
suggestions for detecting this condition with code.
Click to expand...

Explaining to users that termination and an expensive lawsuit for damage to
property would result from doing so might be a useful approach.

A sufficiently knowledgable and malicious user could certainly get around
almost any scheme you could propose! Perhaps if security is this much of an
issue, you should consider migrating the data to SQL/Server and using ODBC
connections to link your Access frontends to the data.

John W. Vinson [MVP]
 
E

Ed Metcalfe

DateTime & ldb are dead giveaways!
Click to expand...
<snip

Not if you set your frontend to update something in the backend every once
in a while.

You have hit upon one of the problems in a file server database. The users
need permissions to write to the directory that the backend sits in -
nothing you can do about that really. A knowledgable and malicious attacker
can and will find a way around anything you put in place. If you are really
that concerned about somebody doing this deliberately and with the intention
of doing damage then MS Access is probably not the correct solution for you.

Ed Metcalfe.
 
E

Ed Metcalfe

[See previous message]

Only just read John Vinson's reply who seems to have advised the same as me.
It wasn't plagiarism, honest! :)

Ed Metcalfe.
 
G

GregR5

Thankyou all for the good responses.

YES, I am totally aware of the security shortcomings involving this
issue. This is why I was specifically asking about suggestions for
detecting this condition with code. I am sure others have implemented
some method of detecting an over-written Backend. Unless, somebody has
a better method of detecting an over-written backend. I will probably
to create a BE table and maintain records of ALL the FrontEnd Users.
And, save a TimeStamp to each during every startup? "What a hastle! "

Thanks Greg
 
J

John W. Vinson

Thankyou all for the good responses.

YES, I am totally aware of the security shortcomings involving this
issue. This is why I was specifically asking about suggestions for
detecting this condition with code. I am sure others have implemented
some method of detecting an over-written Backend. Unless, somebody has
a better method of detecting an over-written backend. I will probably
to create a BE table and maintain records of ALL the FrontEnd Users.
And, save a TimeStamp to each during every startup? "What a hastle! "

Thanks Greg
Click to expand...

SQL Express is... free.

Just from curiosity, and if it wouldn't violate privacy concerns, why are your
users likely to DO this? what's their benefit?

John W. Vinson [MVP]
 
Top