Oracle Data Redaction is Broken by David Litchfield
Industry experts analyze emerging threats surrounding Oracle Data Redaction is Broken by David Litchfield.
Summary
Overview: The Oracle data redaction service is a new feature introduced with Oracle 12c. It allows sensitive data, such as PII, to be redacted or masked to prevent it being exposed to attackers. On paper this sounds like a great idea but in practice, Oracle's implementation is vulnerable to multiple attacks that allow an attacker to trivially bypass the masking and launch privilege escalation attacks.
Related talks
AUSCERT·42 min
David Litchfield
2016 Day 3 David Litchfield, Google Hackproofing Oracle eBusiness Suite.
Black Hat·50 min
Security researchers examine technical aspects of Hackproofing Oracle Ebusiness Suite.
Black Hat·47 min
David Litchfield
Engineers explore architecture and security mechanisms for DC 2010 - Hacking Oracle 11g.