Pete Finnigan's Oracle Security Weblog

Alex has just added a new page to his site - Oracle Security Scripts - that looks like it will contain a few scripts in the future but for now just contains the one script. The first thing the page does is remind the reader of what a safe SQL script is. In simple terms this is one that uses base tables and absolute paths to objects. The reason to do this is to avoid being tricked by Oracle root kits installed or even just a few views altered by hackers to avoid detection. Alex wrote about Oracle root kits recently. Alex's SQL script is fairly simple and looks for alterations to the views DBA_USERS and the view ALL_USERS. These views may have been altered to hide hackers users.

I have been testing root kits in my database and when I run Alex's script as follows:

SQL> @a
SQL Script: Check for hidden database user

Version: 0.01
Autor: Alexander Kornbrust of Red Database-Security GmbH

These SELECT statements should never return anything
Keep in mind that an empty result does not guarantee that your
data dictionary is not modified. You can check the integrity of your data dictionary with Repscan



Invisible User in DBA_USERS
------------------------------
HACKER


no rows selected

SQL>

I find that my DBA_USERS view has been altered to hide the user HACKER. I saved the script to a local file called a.sql that I ran above.