You could've applied all 1,449 Oracle patches and still been hit by this attack
Attackers now ready to exploit how things work, rather than just break them, says Oracle support expert
In late July, Oracle released 1,449 security patches in what may have been an unprecedented bad day for database administrators. However, these patches would not have prevented a credential theft attack on an Oracle database server, according to Huntress, a security platform. Craig Savage, cybersecurity lead at Spinnaker Support, an Oracle third-party support vendor, stated that even if the system had been fully patched and functioning correctly, the attack would have still occurred.
The attack involved a SQL injection that exploited a public-facing web application. After gaining initial access, the threat actor uploaded a post-exploitation toolkit called khunt into the Oracle database using a Java source within the database, which is a novel aspect of this attack. Huntress noted that this kind of technique had rarely been documented in the wild.
Oracle's database has an embedded Java Virtual Machine (JVM), and users can store Java source code as a database object. During this incident, attackers uploaded Java source code via the Tomcat implementation to the database, which was then compiled as a stored schema object. Savage warned that Oracle has its own JDK, and users can build and run Oracle Java programs within the database, which should be limited to only the DBA user.
He argued that this functionality should be disabled in a production environment, as it was poorly configured and secured in this case. Savage stated that cybercriminals are increasingly exploiting this kind of functionality, rather than just seeking vulnerabilities. He emphasized that organizations need to focus on basic security measures, not just patching.
Written by urgent.news from The Register's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
