Pete Finnigan's Oracle Security Weblog
This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.
vonjeek from The hackers Choice has updated his Oracle password cracker to include the 11g password hashes and to use the 11g SHA1 password algorithm. The cracker also takes advantage of the fact that 11g keeps the old DES based/derived hash in the same place as the new SHA-1 hash. The THC 11g Password cracker is shown below in action for a sample password:
The password cracker exploits the fact that the old DES hash is stored. Therefore the upper case version of a password can be cracked first. If the password guessed generates a hash that matches that stored in the SYS.USER$.PASSWORD column then a further attack can be made on the SHA-1 hash to determine the case sensitive version of the password. This reduces the number of guesses necessary. As you can see the tool is graphically based and does a test based on user=pwd, dictionary attack then a brute force attack using the old DES based hash first. The readme is shown below:
explains how the cracker works. Nice tool!!
Simply connect PFCLScan to your Oracle database and it will automatically discover the security issues that could make your Oracle database vulnerable to attack and to the potential loss of your data.
PFCLObfuscate is the only tool available that can automatically add license controls to your PL/SQL code. PFCLObfuscate protects your Intellectual Property invested in your PL/SQL database code.
PFCLTraining is a set of expert training classes for you, aimed at teaching how to audit your own Oracle database, design audit trails, secure code in PL/SQL and secure and lock down your Oracle database.
Choose PFCLServices to add PeteFinnigan.com Ltd to your team for your Oracle Security needs. We are experts in performing detailed security audits, data security design work and policy creation