Alex commented on my post about " oradebug " about the select statement on x$ksmfsv which holds a list of all fixed variables amongst other things and joined it to x$ksmmem to get the absolute address in the SGA to....[Read More]

Posted by Pete On 21/09/11 At 07:26 PM

Laszlo has published his slides from Hacktivity in Budapest last weekend where he shows how the Oracle undocumented oradebug command can be used to exploit the database; covering turning off authentication, turning off audit and more. His slides are here....[Read More]

Posted by Pete On 21/09/11 At 12:54 PM

I spoke at the UKOUG special security day event last week at Bletchley Park just outside of Milton Keynes. We had a great agenda for the day which was focused on Data Security. We had Ian Glover of CREST and....[Read More]

Posted by Pete On 19/09/11 At 04:07 PM

Ron Reidy will be teaching my 2 day class " how to perform a security audit of an Oracle database " in Denver, CO, USA on November 10th and November 11th 2011. The class is a public course so if....[Read More]

Posted by Pete On 06/09/11 At 09:49 AM

I noticed a few days ago that David Litchfield had posted two new short papers on Oracle security; one is related to global cursors declared in PL/SQL packages, the other about cursor variable type SYS_REFCURSOR being passed out of functions/procedures....[Read More]

Posted by Pete On 06/07/11 At 01:20 PM