Database Security 3.0

Litchfield DBMS_JVM_EXP_PERMS 0-day on Oracle

At last week’s BlackHat D.C., David Litchfield revealed 0-day vulnerabilities in Aurora, the Java implementation built into Oracle.

Vulnerabilities in the following packages:

• DBMS_JAVA
• DBMS_JAVA_TEST
• DBMS_JVM_EXP_PERMS
  

allow an attacker to escalate their privileges to sysdba and take complete control of the database. It was successfully demonstrated how a low privileged user can grant themselves sysdba privileges, access on every file on the Oracle host server and execute those files, including a shell. It was also shown how to load binary code into the Oracle process and execute it. Finally a way to bypass Oracle Label Security was demonstrated.

There is currently no fix available from Oracle, however Oracle’s access control features allow for a workaround. By default EXECUTE is granted to PUBLIC for the above mentioned packages.

In order to protect against these current threats, database administrators should revoke execution privileges on these packages from PUBLIC and any other user that does not require them. The AppDetective and DbProtect ‘Object privilege granted to PUBLIC’ Oracle Vulnerability Assessment checks can be used to help find and remediate these privileges.

Application Security has also made available for download a custom policy and check to specifically find these privileges and learn if your Oracle databases are vulnerable. With Application Security, Inc.’s User Rights Review (URR) platform, customers will also be able to determine which users can exploit the vulnerability as well as an explanation of how to fix the vulnerability.

Team SHATTER also suggests adhering to the following general security considerations to minimize the risk of new attacks like this:

• Always stay up-to-date on the latest security patches
• Minimize the attack surface by only installing and enabling functionality that is required for the business task
• Remove all unused default components, accounts and databases
• Assign only minimal privileges required
• Assign privileges through roles, not directly to users

Related links:
SHATTER Security Bulletin

$25.95 is all it takes…

Let's get this straight – insurgents in Iraq made a monumental hack last week into our military’s communications system that powers the Predator drones. These drones are perhaps one of the more effective weapons used in modern warfare to monitor areas and movements of the enemy.

But now with SkyGrabber, a Russian-developed, offline satellite internet downloader, which can be purchased for the low, low price of $25.95, you can put yourself on the path toward intercepting messages and information that have traditionally given the U.S. the leading edge in intelligence and surveillance.

That’s right, the Russian-developed program is all it takes. But this is just the tip of the iceberg. It’s been reported this year that U.S. military systems are fending off close to 3 million probes on its systems every day.

This speaks to the fact that even sophisticated criminals, have demonstrated an unyielding thirst for information, whether they’re attacking corporate networks, storefront systems or military systems.

To quote Brian Krebs, who writes the Security Fix blog for the Washington Post, “I’ve said it before, and I’ll say it again: cyber gets no respect until people start dying because of vulnerabilities.” Maybe a hack like this will put things in perspective to wrap up a year that saw over 220 million records stolen because of vulnerable systems – someone out there is making a lot of money.

IBM's Guardium acquisition

By acquiring Guardium at such a significant multiple, IBM has validated the database security, risk and compliance marketplace. However, this acquisition adds yet another point solution to their already disparate database tools portfolio, and such an "rfp check box" architecture approach will not satisfy the integrated platform requirements of serious customers seeking enterprise wide data governance.      

- John Ottman, President & CEO, Application Security, Inc.

Are Financial Services Organizations Protecting Themselves Better?

Interesting article by Linda McGlasson of Bank Information Security tracking the biggest breaches of 2009. The Identity Theft Center is reporting 356 total data breaches in 2009, 46 or which occurred at financial services organizations.

Of the 46 financial services breaches, IDTC categorized them:

Insider theft: 12 breaches;

Skimming: 8;

Missing paper documents: 10 of the breaches

Exposure of data on the Internet: 4;

Accidental breaches: 2;

Stolen or missing hard drives/laptops: 5;

Outside network intrusions: 2;

Unknown cause: 3.

So between IDTC reporting that fraud cost consumers $1.8 billion and the classification of breach method, doesn't it beg the fact that the thieves are scoring this data from somewhere?

Wait, can you hear that? It sounds like a database being cracked open to steal that information that lead to all that theft. And isn't it more important to protect data where it resides as opposed to focusing on the conduits?

And the Survey Says......

By Josh Shaul

This week we released the results of our “Database Security Controls” research study, which was run for us by the analyst firm Enterprise Strategy Group (ESG). We sent ESG off to interview global IT decision makers located in North America. They met with 179 companies and asked a set of questions around data and database security. The responses were collected and aggregated for the report. The results are simply astonishing.

A whopping 84% of respondents believed that they have adequate protection in place for sensitive data.

With so many data breaches reported this year, we were surprised to hear that so many folks felt comfortable with the controls they have in place….but if 84% of companies really have adequate data security, we’re all in pretty good shape….Right?

The survey then drilled down into more specific questions. Have you failed an internal audit? Have you failed a compliance audit? Have you experienced a data breach recently? The answers to the specific questions painted a very different picture. More than 50% of the organizations surveyed experienced a data breach in 2008. I repeat, more than 50% experienced a breach this year, while at the same time, 84% claim to have adequate security. Adequate means enough to get the job done…..Right?

And it’s not just data breaches.

48% failed internal audits. 42% failed payment card industry audits. 38% of federal agencies surveyed failed FISMA audits. The number of failures present a huge problem on their own, but couple that with the false sense of security that the IT community has built around its data, and we really have something to worry about. The amount of data at risk is staggering. For those of you who have experienced a data breach this year, or who regularly fail key components of your audits, stop feeling secure. If you haven’t done something drastic to correct the situation, you’re likely a soft target just waiting to be spotted.

There are signs of hope.

There were some real signs of hope within the survey results. 76% of the organizations we spoke with said that they plan to place purchasing priority on database security solutions in 2009. Wait, didn’t 84% say they already had adequate security?? Maybe folks aren’t burying their heads in the sand after all.

Grab a copy of the survey results from our webpage.