Oracle Data Redaction is Broken
summary
Oracle 12c’s Data Redaction promises masked output but is trivial to bypass: XMLQuery and XMLTable return redacted columns, RETURNING INTO on updates leaks values, and UTL_HTTP or a brute‑force PL/SQL routine recovers characters. The demo builds a table with a credit‑card column, applies a redaction policy, then extracts full numbers and uses those vectors for privilege escalation (even a public→SYS path exists). The product is patched (July 2014) but the attack surface—between 15–18k JSP files and many unreviewed interfaces—makes flaws likely.
AI-written summary · about
chapters (25)
- 0:00Introduction
- 0:22Who am I
- 3:34History
- 6:48Launching External Procedures
- 8:45Oracles Fix
- 13:12Backend Bypass
- 17:41Patches
- 20:46Oracle vs Microsoft
- 22:45Oracle Data Redaction
- 23:54Why Redaction
- 25:11How it works
- 26:24XML query vulnerability
- 27:52Updating a column
- 29:10Brute force
- 31:00Common Criteria
- 32:59Protection Profile
- 34:30Data is not changed
- 37:00Is it useful
- 38:12PCI compliance
- 38:45Data encryption
- 39:48How do I protect against this
- 40:29Oracles internal processes
- 40:55Its not rocket science
- 42:22No documentation
- 44:02Oracle Fusion Media Pack
related talks
51mMaking the most of Security Tests
50mHackproofing Oracle Ebusiness Suite
34mHacking the Oracle Application Framework
15mBest Practices for Securing Oracle Database
32mAnonymization and Dynamic Masking with PostgreSQL
24mDefending the Oracle Database: responding to the threat of ransomware
34mWhy your encrypted Database isn't secure: practical attacks against encrypted OSS databases
30mProtecting Data While Maintaining Analyzability & Its Business Value: Is It FACT or FICTION