29 Mai 2007 von Alexander Kornbrust.

The following link contains a podcast where David talks about database forensics.

Geschrieben in Podcast, David Litchfield, Oracle Security | Keine Kommentare »

29 Mai 2007 von Alexander Kornbrust.

On the AusCERT2007 conference David Litchfield said that he start the research on a new project called FEDS (Forensic Examiners’ Database Scalpel).

More information here

Geschrieben in Forensics, David Litchfield, Oracle Security | Keine Kommentare »

29 Mai 2007 von Alexander Kornbrust.

Mary Ann Davidson gave one of their famous talks on the AusCERT 2007. (”Every Marine fights… which means they know how to defend themselves”).

According to Mary Ann Davidson (Oracle CSO), applications will have to defend themselves from attack in the future.

How can a software defend from attacks? Every Marine has a weapon (M16) so probably attacking attackers is the best approach. This means we need also weapons for the database… After 3 invalid login attempts Oracle could ban the IP or start a denial of service (d.o.s.) attack against the bad ip address/address range. This could be a nice talk for one of the next security conferences.
I think this is the wrong approach. I agree with Mary Ann that developers (even Oracle developers) should develop good and secure code.

Geschrieben in Mary Ann, Oracle Security | Keine Kommentare »

28 Mai 2007 von Alexander Kornbrust.

During Oracle security audits we find from time to time the following (unsecure) code. Do you see the vulnerability and do you know how to exploit it?

Solution coming soon…
———-Code without exception handling—

FUNCTION CHGPWD (
P_USER VARCHAR2,
P_PWD VARCHAR2)
RETURN BOOLEAN IS

L_STMT VARCHAR2(255);

BEGIN

L_STMT:= ‘ALTER USER “‘ || P_USER || ‘” IDENTIFIED BY “‘ || P_PWD||’”‘;

EXECUTE IMMEDIATE L_STMT;

RETURN TRUE;

END;

Geschrieben in source code audit, Oracle Security | 1 Kommentar »

24 Mai 2007 von Alexander Kornbrust.

The interview “Security guru blasts Oracle’s patching policies” with Aaron Newman from Application Security Inc. descibes the problems with patching Oracle databases (long time to patch, backports, …).

Geschrieben in Allgemein | Keine Kommentare »

23 Mai 2007 von Alexander Kornbrust.

I just updated the website with a new section called “Oracle Videos“. This section contains small video files related to Oracle Security (e.g. tutorials, hacking examples, portscans, …).

Geschrieben in Oracle Security | Keine Kommentare »

23 Mai 2007 von Alexander Kornbrust.

Welcome to our new Oracle Security Blog!

We will post information about Oracle Security.

Geschrieben in Allgemein | Keine Kommentare »