When discussing the public exposure of
Oracle vulnerabilities, opinions about those who publicize hacking
techniques. Some suggest that the hacking expert is doing a
public service while others believe that exposing an Oracle
vulnerability enables an unethical DBA to hack into a database.
Sadly, not all database professionals have scruples, as we
see in these
real-world examples of Oracle hacker horror stories.
While publically exposing
vulnerabilities may be illegal in parts of the United States (the
crime of
aiding and abetting), there are some
European Oracle "researchers" who offer "black hat" and
"secret" Oracle hacking tutorials.
The question is none of ethics and whether there is any
legitimate use for the disclosure of Oracle vulnerabilities? Oracle
Corporation responds with a resounding NO!
According to this
eWeek article, Oracle Corporation condemned a hacker as being
selfish and irresponsible for putting Oracle customers at "severe
risk":"A few hours after [the hacker] went public
with a technical description of the flaw, including a blow-by-blow
demonstration of ease in which an attack could occur,
Oracle lashed
back, accusing the British researcher of putting its customers at
severe risk for selfish, irresponsible reasons."
Most Oracle DBA's agree that it is best to quietly work with Oracle
on a patch before publishing details on any bug, but there are
vulnerabilities that are not within the purview of Oracle,
vulnerabilities in 3rd party products.
In these cases, most
professionals would find that exposing a non-Oracle vulnerability to
be encouraged, provided that they no not expect that the publication
could be used by criminals.
Is publishing Oracle hacks aiding and abetting a
criminal?
Ethics aside, we must ask
if publishing an Oracle hack constitutes a crime, anywhere in the
world where the article might be read. In the USA, the FindLaw
definition for
aiding and abetting a criminal, publically exposing an
Oracle hack appears to fit the definition for "secret" and black
hat" Oracle hacking:
"A criminal charge of
aiding and abetting or accessory can usually be brought against
anyone who helps in the commission of a crime, though legal
distinctions vary by state.
A person charged with
aiding and abetting or accessory is usually not present when the
crime itself is committed, but he or she has knowledge of the
crime before or after the fact, and may assist in its commission
through advice.
While not all of the Oracle hackers have ill intent, many are aiding
and abetting criminals by publically exposing vulnerabilities within
the Oracle software.
Despite claims of some self-proclaimed
European Oracle experts, a properly installed and configured Oracle
cannot be hacked, even with the most sophisticated methods.
Recent Internet law has indicated that web authors are
responsible for what they publish that causes harm, anywhere in the
world.
If your shop gets hacked because of information
published by an Oracle hacking expert, you may want to seek the
advice of your local attorney Generals office to see if the advice
of the hacker warrants arrest and prosecution.
|
|
 |
|
Guarantee your Success!
Oracle is the
world's most complex, robust and flexible database, considered
impossible to master without a mentor.
That's why all BC
Oracle trainers are working professionals, experts in Oracle who
share their tips and secrets. |
|
| |
|
Burleson is the American Team
Note:
This Oracle
documentation was created as a support and Oracle training reference for use by our
DBA performance tuning consulting professionals.
Feel free to ask questions on our
Oracle forum.
Verify
experience!
Anyone
considering using the services of an Oracle support expert should
independently investigate their credentials and experience, and not rely on
advertisements and self-proclaimed expertise. All legitimate Oracle experts
publish
their Oracle
qualifications.
Errata?
Oracle technology is changing and we
strive to update our BC Oracle support information. If you find an error
or have a suggestion for improving our content, we would appreciate your
feedback. Just
e-mail:
 and include the URL for the page.
Copyright © 1996 - 2012
All rights reserved.
Oracle ©
is the registered trademark of Oracle Corporation.
|
|
