Pete Finnigan's Oracle Security Weblog

I saw a post on the Amis blog yesterday by Marco Gralike titled "Old undocumented stuff - Recompiling with timestamp". Of course the word undocumented grabbed my attention!

The post is quite a good one displaying the ALTER PROCEDURE {procedure name} COMPILE TIMESTAMP {time to use} in action. The TIMESTAMP clause is the key one here. Marco works through a simple example that shows the use of this statement to compile his sample procedure with a timestamp in the past. Someone posted in a comment that this functionality is needed for export and import to work. Marco has tested this on 10.1.0.4 and says he has used it back in Oracle 7.0 / 7.1 days.

This is an interesting statement that you should be aware of if you monitor the database for changes made to the dictionary in particular changes to objects. If you use a method based on checking timestamps then you should be aware that these times cannot always be trusted. The same would apply if a hacker made direct changes to the timestamps in the base object SYS.OBJ$. The only method that is acceptable to monitor for changes to dictionary objects is to checksum them and to store the checksums outside of the database and use a baseline for subsequent checks to be made against.