[Previous entry: "Alex has added an Oracle exploits page to his site"] [Next entry: "Red Database Security issues two new Oracle security advisories"]
A free script to find hidden users in your database
May 1st, 2005 by Pete
Post to del.icio.us
Post to Furl
Alex has just added a new page to his site - Oracle Security Scripts - that looks like it will contain a few scripts in the future but for now just contains the one script. The first thing the page does is remind the reader of what a safe SQL script is. In simple terms this is one that uses base tables and absolute paths to objects. The reason to do this is to avoid being tricked by Oracle root kits installed or even just a few views altered by hackers to avoid detection. Alex wrote about Oracle root kits recently. Alex's SQL script is fairly simple and looks for alterations to the views DBA_USERS and the view ALL_USERS. These views may have been altered to hide hackers users.
I have been testing root kits in my database and when I run Alex's script as follows:
SQL> @a
SQL Script: Check for hidden database user
Version: 0.01
Autor: Alexander Kornbrust of Red-Database-Security GmbH
These SELECT statements should never return anything
Keep in mind that an empty result does not guarantee that your
data dictionary is not modified. You can check the integrity of your data dictionary with Repscan
http://www.red-database-security.com/repscan.html
Invisible User in DBA_USERS
------------------------------
HACKER
no rows selected
SQL>
I find that my DBA_USERS view has been altered to hide the user HACKER. I saved the script to a local file called a.sql that I ran above.
