Message-Id: <10585.114279@fatcity.com> From: Nikolay Kumanov Date: Thu, 10 Aug 2000 20:15:22 +0300 Subject: RE: eweek Oracle base breached using mdsys This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible. ------_=_NextPart_001_01C002EE.913426C0 Content-Type: text/plain; charset="iso-8859-1" I have only WinNT installation guide handy, but in chapter 6, "Reviewing Your Installed Starter Database Contents" it is said "This section describes the user names and passwords included in the starter database. Change the password for user names immediately after installation". And MDSYS user is there. OK, this user isn't granted any roles, but it has all the privileges granted directly. The manual doesn't mention this, so there is a mistake, but still, homework must be done sometimes. /flameproof_suit_on Probably that shows that we must go for databases that have only a single 'SA' account, so that securing them will be easier :}}}}} /flameproof_suit_off Dr. Nikolay Kumanov MIS Manager, Zeitungsgruppe Bulgarien GmbH 47, Tsarigradsko chaussee, Sofia 1504, Bulgaria phone: +(359-2)4339-643, fax: +(359-2)946-1286 mailto:nkumanov@zgb.bg "Show me a completely smooth operation and I'll show you someone who's covering mistakes. Real boats rock." - Frank Herbert, "Chapterhouse: Dune" -----Original Message----- From: Bowes, Chris [mailto:Chris.Bowes@kosa.com] Sent: Thursday, August 10, 2000 7:19 PM To: Multiple recipients of list ORACLE-L Subject: eweek Oracle base breached using mdsys Don't know if this was posted here or not. It was a hacker test setup. They "worked so hard" to secure the site and left a default password unchanged... http://www.zdnet.com/eweek/stories/general/0,11011,2604981,00.html and a follow up http://www.zdnet.com/eweek/stories/general/0,11011,2606344,00.html --Chris Chris.Bowes@Kosa.com ------_=_NextPart_001_01C002EE.913426C0 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable eweek Oracle base breached using mdsys
I = have only WinNT=20 installation guide handy, but in chapter 6, "Reviewing Your Installed = Starter=20 Database Contents" it is said "This section=20 describes the user names and passwords included in the starter = database. Change=20 the password for user names immediately after=20 installation". And MDSYS user is there. OK, this user isn't granted any = roles,=20 but it has all the privileges granted directly. The manual doesn't = mention this,=20 so there is a mistake, but still, homework must be done = sometimes.
 
/flameproof_suit_on
Probably that shows=20 that we must go for databases that have only a single 'SA' account, so = that=20 securing them will be easier :}}}}}
/flameproof_suit_off

Dr. Nikolay Kumanov

MIS Manager, Zeitungsgruppe Bulgarien = GmbH=20
47, Tsarigradsko chaussee, Sofia 1504,=20 Bulgaria
phone: = +(359-2)4339-643, fax:=20 +(359-2)946-1286
mailto:nkumanov@zgb.bg =

"Show me a completely smooth operation = and I'll show=20 you someone who's
covering = mistakes. Real=20 boats rock." - Frank Herbert, "Chapterhouse: Dune"

-----Original Message-----
From: Bowes, Chris=20 [mailto:Chris.Bowes@kosa.com]
Sent: Thursday, August 10, = 2000 7:19=20 PM
To: Multiple recipients of list = ORACLE-L
Subject: eweek=20 Oracle base breached using mdsys

Don't know if this was posted here or = not.  It=20 was a hacker test setup.  They "worked so hard" to secure the = site and=20 left a default password unchanged...

http://www.zdnet.com/eweek/stories/general/0,11011,2604981,00.html=20

and a follow up

http://www.zdnet.com/eweek/stories/general/0,11011,2606344,00.html=20


--Chris