Oracle Rootkits 2.0.pdf

(2186 KB) Pobierz
Oracle Rootkits 2.0
Oracle Rootkits 2.0
Black Hat 2006 USA
Las Vegas
02-August-06
Alexander Kornbrust
Red Database Security GmbH
Agenda
Introduction
OS Rootkits
Database Rootkits 1.0
Execution Path
Modify Data Dictionary Objects
Advanced Database Rootkits 1.0
Database Rootkits 2.0
Modify Binaries
PL/SQL Native
Pinned PL/SQL Packages
Conclusion
Q/A
we are here:
1
6
2
7
3
8
4
5
9 10
03.08.2006
-2-
Introduction
Red-Database-Security GmbH
Founded Spring 2004
CEO Alexander Kornbrust
Specialized in Oracle Security
One of the leading company for Oracle Security
we are here:
1
6
2
7
3
8
4
5
9 10
03.08.2006
-3-
Introduction
Operating Systems and Databases are quite similar in
the architecture.
Both have
Users
Processes
Jobs
Executables
Symbolic Links
…
A database is a kind of operating system
we are here:
1
6
2
7
3
8
4
5
9 10
Definition Wikipedia:
Definition Wikipedia:
A rootkit is a set of tools used after
A rootkit is a set of tools used after
cracking a computer system that
cracking a computer system that
hides logins, processes
hides logins, processes
[…]
[…]
a set of recompiled UNIX tools
a set of recompiled UNIX tools
such as ps, netstat, passwd that
such as ps, netstat, passwd that
would carefully hide any trace that
would carefully hide any trace that
those commands normally display.
those commands normally display.
03.08.2006
-4-
Introduction
OS cmd
ps
Oracle
select * from
v$process
alter system
kill session
'12,55'
SQL Server
select * from
sysprocesses
SELECT @var1 = spid
FROM sysprocesses WHERE
nt_username='andrew'
AND spid<>@@spidEXEC
('kill '+@var1);
View, Stored Procedures
DB2
list application
Postgres
select * from
pg_stat_activity
kill 1234
force application
(1234)
Executables
View, Package,
Procedures and
Functions
select * from
view;
exec
procedure
View, Stored
Procedures
View, Stored
Procedures
execute
select * from view;
exec procedure
select * from
view;
select * from
view;
execute
procedure
cd
alter session
set
current_schema
=user01
we are here:
1
6
2
7
3
8
4
5
9 10
03.08.2006
-5-

Plik z chomika:

Inne pliki z tego folderu:

Inne foldery tego chomika:

Zgłoś jeśli naruszono regulamin