Pete Finnigan's Oracle Security Weblog

One of my key issues with Oracle security is to reduce the possible direct access to the database from as many people as possible in any organisation that i work with. I generally call this the "access Issue" as its basically means that anyone who can find out the four pieces of information necessary (The hostname{or IP Address}, Port Number, SID, USERNAME/PASSWORD) can log into the database. As we know the IP address and port number can be found easily within an organisation using port scanners such as nmap or amap. We also know from orldy experience of conducting database security audits for many years that usernames/passwords can be found easilly (some are defaults, some because bad naming conventions occur), passwords in our experience are even easier as we often find most passwords very easily because sites still set them to the username, a default, a simple dictionary word or its too short. This issue is one of the key issues in Oracle security. If you reduce the chance that anyone who should not do so (remember those that should do so should be very small) should not be able to attempt a direct connection to the database. Whilst this does not fix Oracle security it certainly reduces the risk. If you cannot get a connection you cannot run anything or read anything. We of course need to also solve the problem of the legitimate access use as well!. I talked about this subject at the UKOUG conference in my back to basics talk and also in my Oracle security masterclass. The presentations are available on my Oracle Security white papers page.

So the only piece of information that is slightly harder to find is the SID/Service name. Alexandr Polyakov has written an excellent paper on how to find database SID's. I have had a couple of email conversations with him over the last week or so and promised to ppost a link here to his paper. There are SID guess and SID brute force tools out there but this is the first detailed discussion on how to find SID's. This is an excellent paper called "Different ways to guess Oracle database SID"