Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Alex has added an Oracle exploits page to his site"] [Next entry: "Red Database Security issues two new Oracle security advisories"]
Alex has just added a new page to his site - Oracle Security Scripts - that looks like it will contain a few scripts in the future but for now just contains the one script. The first thing the page does is remind the reader of what a safe SQL script is. In simple terms this is one that uses base tables and absolute paths to objects. The reason to do this is to avoid being tricked by Oracle root kits installed or even just a few views altered by hackers to avoid detection. Alex wrote about Oracle root kits recently. Alex's SQL script is fairly simple and looks for alterations to the views DBA_USERS and the view ALL_USERS. These views may have been altered to hide hackers users.
I have been testing root kits in my database and when I run Alex's script as follows:
SQL Script: Check for hidden database user
Autor: Alexander Kornbrust of Red Database-Security GmbH
These SELECT statements should never return anything
Keep in mind that an empty result does not guarantee that your
data dictionary is not modified. You can check the integrity of your data dictionary with Repscan
Invisible User in DBA_USERS
no rows selected
I find that my DBA_USERS view has been altered to hide the user HACKER. I saved the script to a local file called a.sql that I ran above.