Oracle Data Redaction is Broken
David Litchfield details oracle Data Redaction is Broken David Litchfield SECURITY SPECIALIST, DATACOM TSS The Oracle data redaction service is a new feature introduced with Oracle 12c.
Summary
Architecture and Background
Oracle Data Redaction is Broken David Litchfield SECURITY SPECIALIST, DATACOM TSS The Oracle data redaction service is a new feature introduced with Oracle 12c.
Vulnerability Analysis
It allows sensitive data, such as PII, to be redacted or masked to prevent it being exposed to attackers.
Exploitation and Demonstrations
On paper this sounds like a great idea but in practice, Oracle's implementation is vulnerable to multiple attacks that allow an attacker to trivially bypass the masking and launch privilege escalation attacks.
Remediation and Defensive Strategies
David Litchfield is a computer security researcher with a special interest in buffer overflow exploitation and database systems. He has written and contributed to several books including the Shellcoder's Handbook, The Database Hacker's Handbook and the Oracle Hacker's Handbook. He spends his spare time diving with great white sharks. Twitter: @dlitchfield
Related talks
Main Stage·43 min
Hadrien Barral
Hadrien Barral demonstrates crafting fully functional executable shellcode consisting entirely of valid multi-byte UTF-8 emoji characters.
Main Stage·57 min
Atlas
Atlas details atlas: Remedial Heap Overflows: dlmalloc style Sometimes even the top dudes need a refresher course.
Main Stage·35 min
Anders Ingeborn
Anders Ingeborn explores designing small payloads at DEF CON 9, examining payload-crafting and practical defenses.