I found this news item today posted on Network World Fusion and written by Paul Roberts. It was published a few days ago but is still relevant. The state of California has announced that a massive theft of personal data has taken place from a database at the University of California, Berkeley.
The database contained up to 1.4 million records of a personal nature such as social security numbers, birth dates, names and addresses etc. According to a spokesman:
"investigators know a malicious hacker exploited a vulnerability in "commercially available database software" and compromised the computer, but they don't know if the attack was targeted, speculating that malicious hackers possibly discovered the system by scanning for machines running vulnerable versions of the database software."
We do not know if this database is an Oracle database or an MS SQL database or another database. It more than likely wasn't but it doesn't really matter to the rest of us. This item should be a warning to all those who run Oracle databases, even if this issue was not involving Oracle. Any database that is exposed to the Internet or even a wide area network and if that database has not been patched then it is vulnerable to this sort of attack.
Hackers are out there writing scripts to find vulnerable databases with known vulnerabilities. Do not let them get yours.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "interesting thread on how to secure a third party application"] [Next entry: "Brian Duff talks about connecting to Oracle servers with ssh"]
October 2004
- find_all_privs.sql : A script to find all privileges allocated to a user or role - 10/02/2004 by 10/02/2004
- PeteFinnigan.com Tools page updated - 10/03/2004 by 10/03/2004
- who_has_role.sql : A script to find which users and roles have been granted a role - 10/05/2004 by 10/05/2004
- Howard Rogers writes about Virtual Private databases - 10/06/2004 by 10/06/2004
- Tools page has been updated again - 10/07/2004 by 10/07/2004
- who_has_priv.sql : script to find user who have been granted a system privilege - 10/09/2004 by 10/09/2004
- Oracle remids all customers to apply Patches for alert #68 - 10/10/2004 by 10/10/2004
- preventing password leakage with SQL*Loader - 10/11/2004 by 10/11/2004
- which special characters can be used in Oracle database passwords - 10/12/2004 by 10/12/2004
- expired passwords, ORA-01045 and password changes - 10/13/2004 by 10/13/2004
- SQL Injection papers - 10/14/2004 by 10/14/2004
- where is the next monthly patch? - 10/15/2004 by 10/15/2004
- computerworld have also picked up the patch quickly story - 10/16/2004 by 10/16/2004
- Listener security guide - 10/17/2004 by 10/17/2004
- A tuning book and security? - 10/18/2004 by 10/18/2004
- An interesting SQL Injection paper - 10/19/2004 by 10/19/2004
- Internetnews article : "Customers Gripe About Oracle's Patch Plan" - 10/20/2004 by 10/20/2004
- Auditing DBA's? - 10/21/2004 by 10/21/2004
- You can search inside the SANS Oracle security step-by-step guide - 10/22/2004 by 10/22/2004
- Is setting trace a security risk? - part 1 - 10/23/2004 by 10/23/2004
- technewsworld.com says "Oracle's Security Luck Runs Out" - 10/24/2004 by 10/24/2004
- Another issue with alert 68 on AIX 32 bit - 10/25/2004 by 10/25/2004
- Writing to the alert log - 10/26/2004 by 10/26/2004
- more info on DBMS_SYSTEM.KSDWRT - 10/27/2004 by 10/27/2004
- massive data theft from a database in California - 10/28/2004 by 10/28/2004
- Can I connect to the database as the user PUBLIC? - 10/29/2004 by 10/29/2004
- Interesting question about Sarbanes-Oxley on Oracle 7.3.3 - 10/30/2004 by 10/30/2004
- Howard Rogers new paper on secure application roles - 10/31/2004 by 10/31/2004
Archives
Syndication
Powered by gm-rss 2.0.0
