'Hack your own Oracle database' tool unveiled next week

All in the name of security

Post a comment
Print

By Elinor Mills, 24 July 2009 14:23

NEWS

During their presentation at the Black Hat and Defcon hacker conferences next week in Las Vegas, security experts will release a tool that can be used to break into Oracle databases.

Chris Gates and Mario Ceballos will present Oracle pen-testing methodology and give out "all the tools to break the 'unbreakable' Oracle as Metasploit auxiliary modules", according to a summary of their presentation on the Defcon website.

The tools are designed to help companies determine whether their systems are vulnerable, Gates told silicon.com sister site CNET News.com. "There wasn't a good set of [free] tools for auditing Oracle databases," he said.

Gates said he did not contact Oracle about his presentation because none of the exploits or exploitation methods are new and information about ways to mitigate the attacks has been public for some time.

"If administrators haven't applied the patches, then the databases were/are vulnerable," he said when asked if the release of his tool will expose companies running Oracle databases to attack. "Plenty of other tools exist to do exactly what we are releasing. These tools just help streamline the penetration testing process."

Gates is a member of the Metasploit project, an open source platform used for developing, testing, and using exploit code and sharing information related to finding vulnerabilities.

"Over the years there have been tons of Oracle exploits, SQL injection vulnerabilities, and post exploitation tricks and tools that had no order, methodology, or standardisation, mainly just random .sql files. Additionally, none of the publicly available Pentest Frameworks have the ability to leverage built-in package SQL Injection vulnerabilities for privilege escalation, data extraction, or getting operating system access," the presentation summary says.

"We've created your version and SID enumeration modules, account brute-forcing modules, ported all the public (and not so public) Oracle SQL Injection vulnerabilities into SQLI modules (with IDS evasion examples for 10g/11g), modules for OS interaction, and modules for automating some of our post exploitation tasks," the summary says.

An Oracle spokesperson said the company had no comment.

Post a comment
Print

Post your comment

In order to post a comment you need to be registered and logged in.

Latest Security stories

Featured white papers

Vulnerability Management Buyer's Checklist

Qualys

Key Questions to Ask Before You Select a VM Solution Choosing a solution for Vulnerability Management (VM) is a critical step toward protecting your organisation's network and data. Without proven, automated technology for precise detection and remediation, no network can withstand the daily onslaught of new vulnerabilities that threaten security. To help finalise your decision on which solution to buy, Qualys provides this 12-point short list of considerations that will help you determine what will work best for your organisation.

Download now »
Creating a Dynamic Infrastructure through Virtualization

IBM

In almost every case,the transformation to a dynamic infrastructure will involve virtualization.Many IT professionals think of virtualization specifically in terms of servers.IBM,however,has a broader perspective,in which virtualization is seen as a generalapproach to decouple logical resources from physical elements,so that thoseresources can be allocated faster,more cost-effectively and more dynamically,wherever the business requires them in real time to ideally meet changingdemand levels or business requirements.

Download now »
How IP geolocation can improve your website experience and marketing activity

Quova

With geolocation technology, you can know a web user's real world whereabouts. This report examines the benefits from the fictional retailer's point of view. Things-4-You- a thriving online business, which had a poor record in converting online visitors into buying customers. Things-4-You demonstrates the potential of IP geolocation online. retailers.

Download now »