I just got an email from Tom Kyte to let me know about a link he had found on a blog listed on http://blogs.ittoolbox.com - (broken link) blogs.ittoolbox.com. The entry is titled http://blogs.ittoolbox.com/security/investigator/archives/004111.asp - (broken link) And You Thought Your Company Photos Were Bad? and it says that a regular securitymonkey blog reader had sent this in.
The main item is a photo published in a magazine sent out by a UK train company. A close up of the photo reveals some great information goofs by showing usernames and passwords on a white board. This is a great example of how critical information can be leaked not just by newsgroup postings or on mailing lists. The key lesson to learn here is "why were the usernames and passwords on white board in the first place". This is not something new though. I have been in companies where similar info was listed on the walls on white boards.
Great blog post though.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Richard talks about diagnostics support pack and applications collection tool (ACT)"] [Next entry: "Useful PL/SQL function that returns an MD5 sum for a string"]
May 2005
- A free script to find hidden users in your database - 05/01/2005 by 05/01/2005
- Alex has updated his Oracle exploits page to add 5 more exploit codes - 05/02/2005 by 05/02/2005
- alpha copies of two chapters of Tom's new book are available - 05/04/2005 by 05/04/2005
- Another nice flashback paper - 05/05/2005 by 05/05/2005
- Tom writes about anonymous postings - 05/07/2005 by 05/07/2005
- Richard talks about diagnostics support pack and applications collection tool (ACT) - 05/09/2005 by 05/09/2005
- A great example of information leakage! - 05/10/2005 by 05/10/2005
- A nice paper on latch internals - 05/11/2005 by 05/11/2005
- Nice list of Oracle's default ports - 05/12/2005 by 05/12/2005
- A select only user causing locks? - 05/13/2005 by 05/13/2005
- Marcel-Jan has an interesting tool on his site called SQL-Gotcha - 05/15/2005 by 05/15/2005
- nice paper by Doug Burns on Oracle parallel execution tuning - 05/16/2005 by 05/16/2005
- SQLGotcha is on freshmeat - 05/17/2005 by 05/17/2005
- A good paper on Oracle's random number generator - 05/18/2005 by 05/18/2005
- A good description of some of the Oracle default accounts - 05/20/2005 by 05/20/2005
- orablogs is back - 05/21/2005 by 05/21/2005
- A good list of Oracle discussion resources - 05/22/2005 by 05/22/2005
- IDG were scheduled to interview Oracle's CSO - 05/24/2005 by 05/24/2005
- Scarlet Pruitt's interview with Mary Ann Davidson is out - 05/25/2005 by 05/25/2005
- Alex is to talk at ITUnderground Warsaw and DOAG Freiburg - 05/26/2005 by 05/26/2005
- A new short paper on Alex's site - How to change XMLDB Ports - 05/28/2005 by 05/28/2005
- Chris was also talking about Alex's 42 bugs found in Metalink - 05/30/2005 by 05/30/2005
- Alex has released his paper on metalink hacking - 05/31/2005 by 05/31/2005
Archives
Syndication
Powered by gm-rss 2.0.0
