Feeds

'Big one' coming for Oracle database users?

Hoodies hit Microsoft, big lads do Larry

Top 5 reasons to deploy VMware with Tegile

Oracle users could be headed for a Microsoft-scale hack or a major database breach as master criminals begin to target valuable business systems.

That's the verdict of a UK database security consultant who's warned those running legacy versions of Oracle in particular are at risk from attack.

David Litchifield, managing director of Next Generation Security Software, said Oracle must shake up its system of patching databases to ensure users remain protected.

"There is a potential for a big one," Litchfield told The Register. "In terms of the little vandal - they will go for Microsoft. The professional hacker is going to break into a database server, (he) wants to steal 100,000 credit cards - he will go after the money."

Of particular concern is the number of unprotected versions of Oracle in use - especially version 8.1.7.4. Litchfield's Database Exposure Survey last year found 140,000 installations of Oracle are unprotected and could become hosts for a worm. Such databases have unfixed vulnerabilities like an arbitrary library loading issue with external procedures that could be exploited by an attack vector.

Litchfield was speaking as his company released its latest report on vulnerabilities in Oracle - dangling cursor snarfing. That followed recent publication of a report by fellow security consultant ESG Lab that claimed investments by Microsoft in SQL Server mean it's "years ahead" of Oracle in the security field.

Litchfield has criticized Oracle in the past for not moving quickly enough to fix such security holes, while being attacked by the database giant for allegedly putting customers at risk by releasing details of holes.

According to Litchfield, Microsoft still remains a target of hackers and disgruntled employees, but the difference is Microsoft has shifted its focus on SQL Server from purely new features to place greater emphasis on security. He approves of Microsoft's reliable delivery of patches.

"People who say no-one is looking at Microsoft anymore - that's nonsense, everyone wants to hack Microsoft. The fact they aren't finding bugs says Microsoft has done a good job," Litchfield said.

While Oracle has made improvements in security, such as releasing patches every three months, there's room for improvement. "They do need to shake things up in certain respects. They know they have bugs, and they are fixing them. Where they fail is in the advisories and the quality of the patches," Litchfield said.

He voiced optimism that procedures in place at PeopleSoft, known for good security and acquired by Oracle last year, could rub off on Oracle.®

Security for virtualized datacentres

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Home Depot ignored staff warnings of security fail laundry list
'Just use cash', former security staffer warns friends
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.