I saw a post on Eddie Awad's blog last week and made a not to have a look. The post is titled "Pre DBMS_RANDOM". This is an interesting post that shows how random numbers were generated pre DBMS_RANDOM. Eddie shows some code from an Oracle Applications package that uses a seed and a date as the randomizing factor. There are known issues with DBMS_RANDOM in that if the seed is not long enough the number generated is not random enough. It is better to use the DESGETKEY function in DBMS_OBFUSCATION_TOOLKIT as this uses the FIPS-140 random number generator.
Nice blog entry though, useful to see how it was done. Its not too difficult to see how any encryption that uses a key generated by Eddies package might be broken with knowledge of the time frame it was encrypted and the seed value.
Blog
Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
[Previous entry: "Security firm considers changing its policy on public disclosure of security vulnerabilities"] [Next entry: "Wifred notes that Patch 9.0.4.2.0 has a bug in Oracle forms"]
September 2005
- 0rm's Oracle password cracker orabf has been updated - 09/01/2005 by 09/01/2005
- CPU July 2005 patch set for Application Server Windows 9.0.2.3 has a problem - 09/03/2005 by 09/03/2005
- Security firm considers changing its policy on public disclosure of security vulnerabilities - 09/04/2005 by 09/04/2005
- Wifred notes that Patch 9.0.4.2.0 has a bug in Oracle forms - 09/05/2005 by 09/05/2005
- archivelog mode - or not? - 09/06/2005 by 09/06/2005
- jDUL / DUDE (Database Unloading by Data Extraction) - an alternative to DUL - 09/07/2005 by 09/07/2005
- Nice paper by KK Mookhey and Nilesh Burghate - Detection of SQL Injection and Cross-site Scripting Attacks - 09/09/2005 by 09/09/2005
- Amis talks about the need to remove USER from PL/SQL and SQL code - 09/12/2005 by 09/12/2005
- A small correction to a post about DBMS_SYSTEM.KSDDDT - 09/13/2005 by 09/13/2005
- Alex has released details about a common SQL Injection vulnerability in Oracle reports - 09/14/2005 by 09/14/2005
- Oracle Locks Up 'Federated' App Server - 09/15/2005 by 09/15/2005
- On Security, Is Oracle the Next Microsoft? - 09/17/2005 by 09/17/2005
- Some testing of orabf (Oracle password cracker) speed by Marcel-Jan - 09/19/2005 by 09/19/2005
- Oracle Proxy Users - 09/21/2005 by 09/21/2005
- Meet the experts (Oracle Security) at Oracle Open World - an open standard for securing Oracle - 09/24/2005 by 09/24/2005
- A new paper on a security hole in Application Server Control - 09/25/2005 by 09/25/2005
- Another Larry news article on security from OOW - 09/26/2005 by 09/26/2005
- Quite a nice post about debugging with DBMS_DEBUG - 09/27/2005 by 09/27/2005
- More details on default failed_login_attempts - 09/29/2005 by 09/29/2005
- more failed_login_attempts! - 09/30/2005 by 09/30/2005
Archives
Syndication
Powered by gm-rss 2.0.0
