Researchers: Oracle Database Passwords Can Be Cracked
The security experts said that the password algorithm Oracle uses is weak and provides attackers several ways to break into databases.
Passwords that limit access to Oracle databases can be cracked with off-the-shelf hardware, a pair of security researchers claimed in a recently published paper.
The researchers, Joshua Wright of the SANS Institute and Carlos Cid, of the University of London, said that the password algorithm Oracle uses is weak -- Oracle doesn't preserve the case of the password, for example -- and provides attackers several ways to break into databases.
"An adversary with limited resources can mount an attack that would reveal the plaintext password from the password hash for a known user," wrote Wright and Cid.
Although an attacker would have to have one of more usernames and the associated password hashes to proceed, that's not an impossible chore, even if the assault is only a brute force attack.
The pair used an off-the-shelf workstation powered by a Pentium 4 2.8GHz processor to test Oracle password hash cracking, then concluded that all the possible passwords of an account could be cranked out in under 40 days, giving 20 days as the average time it would take to break into an account.
"This is especially problematic for organizations with a password expiration duration that is shorter than 20 days, since it is likely an attacker will be able to produce the plaintext password before the account password is changed," wrote the researchers.
Among their recommendations, Wright and Cid advised Oracle-equipped enterprises to enforce longer passwords (12 characters minimum) and require that passwords be changed frequently.
"The SANS Institute contacted the Oracle product security team about these findings on 7/12/2005," said Johannes Ullrich, the chief research officer at the SANS Internet Storm Center, in an alert posted Thursday. "Subsequent requests for clarification on what Oracle plans to do to address these vulnerabilities have gone unanswered."
Oracle did not immediately respond to TechWeb's call for comment.
How Enterprises Are Attacking the IT Security EnterpriseTo learn more about what organizations are doing to tackle attacks and threats we surveyed a group of 300 IT and infosec professionals to find out what their biggest IT security challenges are and what they're doing to defend against today's threats. Download the report to see what they're saying.
Infographic: The State of DevOps in 2017Is DevOps helping organizations reduce costs and time-to-market for software releases? What's getting in the way of DevOps adoption? Find out in this InformationWeek and Interop ITX infographic on the state of DevOps in 2017.
Digital Transformation Myths & TruthsTransformation is on every IT organization's to-do list, but effectively transforming IT means a major shift in technology as well as business models and culture. In this IT Trend Report, we examine some of the misconceptions of digital transformation and look at steps you can take to succeed technically and culturally.