RE: eweek Oracle base breached using mdsys

From: Nikolay Kumanov <nkumanov_at_zgb.bg>
Date: Thu, 10 Aug 2000 20:15:22 +0300
Message-Id: <10585.114279@fatcity.com>

This message is in MIME format. Since your mail reader does not understand this format, some or all of this message may not be legible.

------_=_NextPart_001_01C002EE.913426C0
Content-Type: text/plain;

charset="iso-8859-1"

I have only WinNT installation guide handy, but in chapter 6, "Reviewing Your Installed Starter Database Contents" it is said "This section describes the user names and passwords included in the starter database. Change the password for user names immediately after installation". And MDSYS user is there. OK, this user isn't granted any roles, but it has all the privileges granted directly. The manual doesn't mention this, so there is a mistake, but still, homework must be done sometimes.

/flameproof_suit_on
Probably that shows that we must go for databases that have only a single 'SA' account, so that securing them will be easier :}}}}} /flameproof_suit_off

Dr. Nikolay Kumanov

MIS Manager, Zeitungsgruppe Bulgarien GmbH 47, Tsarigradsko chaussee, Sofia 1504, Bulgaria phone: +(359-2)4339-643, fax: +(359-2)946-1286 mailto:nkumanov_at_zgb.bg <mailto:nkumanov_at_zgb.bg>

"Show me a completely smooth operation and I'll show you someone who's covering mistakes. Real boats rock." - Frank Herbert, "Chapterhouse: Dune"

-----Original Message-----
From: Bowes, Chris [mailto:Chris.Bowes_at_kosa.com] Sent: Thursday, August 10, 2000 7:19 PM
To: Multiple recipients of list ORACLE-L Subject: eweek Oracle base breached using mdsys

Don't know if this was posted here or not. It was a hacker test setup. They "worked so hard" to secure the site and left a default password unchanged...

http://www.zdnet.com/eweek/stories/general/0,11011,2604981,00.html
<http://www.zdnet.com/eweek/stories/general/0,11011,2604981,00.html>

and a follow up

http://www.zdnet.com/eweek/stories/general/0,11011,2606344,00.html
<http://www.zdnet.com/eweek/stories/general/0,11011,2606344,00.html>

--Chris
Chris.Bowes_at_Kosa.com

------_=_NextPart_001_01C002EE.913426C0
Content-Type: text/html;

charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<TITLE>eweek Oracle base breached using mdsys</TITLE>

<META content=3D"MSHTML 5.50.4134.600" name=3DGENERATOR></HEAD>
<BODY>
<DIV>I =
have only WinNT=20
installation guide handy, but in chapter 6, "Reviewing Your Installed = Starter=20
Database Contents" it is said "This section=20
describes the user names and passwords included in the starter = database. Change=20
the password for user names immediately after=20 installation". And MDSYS user is there. OK, this user isn't granted any = roles,=20
but it has all the privileges granted directly. The manual doesn't = mention this,=20
so there is a mistake, but still, h<FONT=20
face=3DArial size=3D2>omework must be done = sometimes.</DIV>
<DIV> </DIV>
<DIV>/flameproof_suit_on</DIV>
<DIV>Probably that shows=20
that we must go for databases that have only a single 'SA' account, so = that=20
securing them will be easier :}}}}}</DIV>
<DIV>/flameproof_suit_off</DIV>
Dr. Nikolay Kumanov 
MIS Manager, Zeitungsgruppe Bulgarien =
GmbH=20
 47, Tsarigradsko chaussee, Sofia 1504,=20
Bulgaria phone: = +(359-2)4339-643, fax:=20
+(359-2)946-1286 <A=20
href=3D"mailto:nkumanov_at_zgb.bg">mailto:nkumanov_at_zgb.bg</A> =

"Show me a completely smooth operation =
and I'll show=20
you someone who's covering = mistakes. Real=20
boats rock." - Frank Herbert, "Chapterhouse: Dune" 
<BLOCKQUOTE dir=3Dltr style=3D"MARGIN-RIGHT: 0px">
 <DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft>-----Original Message----- From: Bowes, Chris=20 [mailto:Chris.Bowes_at_kosa.com] Sent: Thursday, August 10, = 2000 7:19=20
 PM To: Multiple recipients of list = ORACLE-L Subject: eweek=20
 Oracle base breached using mdsys </DIV> Don't know if this was posted here or = not.  It=20
 was a hacker test setup.  They "worked so hard" to secure the = site and=20
 left a default password unchanged... <A target=3D_blank=20 =
href=3D"http://www.zdnet.com/eweek/stories/general/0,11011,2604981,00.ht= ml">http://www.zdnet.com/eweek/stories/general/0,11011,2604981,00.html</=

A></FONT>=20
  </P>
  <P><FONT face=3DArial size=3D2>and a follow up</FONT> </P>
  <P><FONT face=3DArial size=3D2><A target=3D_blank=20

=
href=3D"http://www.zdnet.com/eweek/stories/general/0,11011,2606344,00.ht= ml">http://www.zdnet.com/eweek/stories/general/0,11011,2606344,00.html</=

A></FONT>=20
  </P><BR>
  <P><FONT face=3DArial size=3D2>--Chris</FONT> <BR><FONT face=3DArial=20

Received on Thu Aug 10 2000 - 12:15:22 CDT