In Esteban Martinez Fayo's "Hacking and Protecting Oracle Database Vault" session at Black Hat USA in Las Vegas a couple weeks ago, he used several exploit methods that could be used to disable Oracle Data Vault. Each exploit provided an avenue by which he could hack the database. With each exploit he performed the same hack: rename the dynamically linked library that implemented all Oracle Database Vaults functions.

Adrian Lane, Contributor

August 9, 2010

1 Min Read

In Esteban Martinez Fayo's "Hacking and Protecting Oracle Database Vault" session at Black Hat USA in Las Vegas a couple weeks ago, he used several exploit methods that could be used to disable Oracle Data Vault. Each exploit provided an avenue by which he could hack the database. With each exploit he performed the same hack: rename the dynamically linked library that implemented all Oracle Database Vaults functions.These are known exploits, and in the case of the buffer overflow attack, a patched problem. The demonstration was not some tricky new exploit, but common attack vectors. The real point of the presentation is not about a particular exploit, but the fact that Database Vault functions could be removed entirely should any of these exploits -- or valid permissions -- be available. Once the DLL is renamed, the next database restart will occur normally, but the database will resume operation without Database Vault functions.

Some of the people I spoke with after the show did not understand how this could be the case, but unless you are looking at the log files to detect this type of system event, it will go entirely unnoticed. User access, DBA roles, and multifactor authentication requirements simply vanish.

My interest in pointing this out is not the novelty of the attack, but rather to point out that you probably have tools in your house to detect or even prevent this type of exploit. The presentation lacked some of the detection and prevention tactics, so I will mention a few here:

About the Author(s)

Adrian Lane

Contributor

Adrian Lane is a Security Strategist and brings over 25 years of industry experience to the Securosis team, much of it at the executive level. Adrian specializes in database security, data security, and secure software development. With experience at Ingres, Oracle, and Unisys, he has extensive experience in the vendor community, but brings a pragmatic perspective to selecting and deploying technologies having worked on "the other side" as CIO in the finance vertical. Prior to joining Securosis, Adrian served as the CTO/VP at companies such as IPLocks, Touchpoint, CPMi and Transactor/Brodia. He has been invited to present at dozens of security conferences, contributed articles to many major publications, and is easily recognizable by his "network hair" and propensity to wear loud colors.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights