Oracle Data Redaction is Broken

Presented at DEF CON 22 (2014), Aug. 8, 2014, 10 a.m. (60 minutes).

The Oracle data redaction service is a new feature introduced with Oracle 12c. It allows sensitive data, such as PII, to be redacted or masked to prevent it being exposed to attackers. On paper this sounds like a great idea but in practice, Oracle's implementation is vulnerable to multiple attacks that allow an attacker to trivially bypass the masking and launch privilege escalation attacks.

Presenters:

• David Litchfield - Security specialist, Datacom TSS
  David Litchfield is a computer security researcher with a special interest in buffer overflow exploitation and database systems. He has written and contributed to several books including the Shellcoder's Handbook, The Database Hacker's Handbook and the Oracle Hacker's Handbook. He spends his spare time diving with great white sharks. Twitter: @dlitchfield

Links:

• https://defcon.org/html/defcon-22/dc-22-speakers.html#Litchfield
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation David Litchfield - Oracle Data Redaction is Broken - Slides.mp4
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 video and slides/DEF CON 22 - David Litchfield - Oracle Data Redaction is Broken - Video and Slides.mp4 (Video and Slides)
• https://infocon.org/cons/DEF CON/DEF CON 22/DEF CON 22 slides/DEF CON 22 - Hacking Conference Presentation David Litchfield - Oracle Data Redaction is Broken - Slides.srt (subtitles)
• https://www.youtube.com/watch?v=L6Fc9S0xUtY

Similar Presentations:

• Black Hat USA 2014 / Oracle Data Redaction is Broken
• DEF CON 14 (2006) / Oracle Rootkits 2.0
• Black Hat USA 2010 / Hacking Oracle From Web Apps