31 Mrz 2010 von Alexander Kornbrust.

Paul released a new article about Oracle Java Forensics. He describes how to find traces of Java attacks (e.g. via dbms_jvm_exp_perms) in the Oracle database.

I’ve got some nice ideas from Paul’s article.

Well done.

Geschrieben in 11g, Forensics, Oracle Security | Drucken | Keine Kommentare »

27 Nov 2008 von Alexander Kornbrust.

David Litchfield has posted a new whitepaper “Using the Oracle System Change Number in Forensic Investigations“. He published also 2 tools called oratime and orablock. Oratime is converting a SCN to a timestamp. 

C:\oratools>oratime 671406483

21/11/2008 21:48:03

 The second tool from the whitepaper “orablock” can extract data from a data block.

C:\cadfile>orablock

Orablock v1.0

(c) David Litchfield

(david@davidlitchfield.com)

-h (show help)

-f data_file (required)

-c column_template

-z block_size (default 8192)

-o object_id

-b block_number

-s seperator (default newline)

-a action

Actions are:

A DUMPALL

D SHOWDELETED

O DUMPNOTVIAOFFSETS

S SHOWDELETEDNOTVIAOFFSETS

C DUMPSCNS

Geschrieben in Forensics, David Litchfield | Drucken | Keine Kommentare »

12 Aug 2007 von Alexander Kornbrust.

David Litchfield just released the 5th part of his Oracle Forensics whitepaper “Finding Evidence of Data Theft in the Absence of Auditing“. He describes how to find traces if the attacker used only SELECT statements.

Geschrieben in Forensics, David Litchfield, Oracle Security | Drucken | Keine Kommentare »

13 Jul 2007 von Alexander Kornbrust.

Searchsecurity.com has some articles about Oracle security incidents. You can find them here and here.

DBAs are talking about a few incidents. Most of the incidents are never reported or never discovered.
After 2.3 million stolen from a DBA it’s time for companies and organizations to start thinking about Oracle security. A good starting point is a Oracle Security Training. We are offering training worldwide.

Geschrieben in Forensics, Oracle Security | Drucken | Keine Kommentare »

29 Mai 2007 von Alexander Kornbrust.

On the AusCERT2007 conference David Litchfield said that he start the research on a new project called FEDS (Forensic Examiners’ Database Scalpel).

More information here

Geschrieben in Forensics, David Litchfield, Oracle Security | Drucken | Keine Kommentare »