Скачать или смотреть Reading unencrypted Oracle Data Blocks Without a Database: Extracting Data with dd and hexdump!

Think your data is safe just because it's in a database? Think again!
In this quick demo, I show how I was able to extract actual rows directly from a data block without any access to the database engine.

Watch to understand the risks and why data-at-rest encryption is no longer optional.

// Daniel's SOCIAL //
LinkedIn:   / djborges  
YouTube:    / @sysdb  

Disclaimer: This video is for educational purposes only.

// MENU //
00:00 Introduction
00:46 Identifying tables and tablespaces
00:56 Checking a table DEPT encrypted or not
01:21 Identifying a block ID using dbms_rowid
01:55 Copying the unencrypted datafile to another server
02:15 Extracting data from a data block using DD command
02:40 Reading contents with hexdump and strings
03:52 How to prevent data leak?
04:16 Encrypting a tablespace
04:54 Copying the encrypted datafile to another server
05:09 Repeating the same DD and hexdump command process
05:37 Conclusion

// COMMANDS I USED IN THIS VIDEO //

SELECT owner, table_name, tablespace_name FROM dba_tables WHERE owner = 'SCOTT';
SELECT tablespace_name, encrypted FROM dba_tablespaces WHERE tablespace_name = 'SCOTT_TBS';
SELECT dname, loc, dbms_rowid.rowid_relative_fno(rowid) AS file_id, dbms_rowid.rowid_block_number(rowid) AS block_number FROM scott.dept;
SELECT file_id, file_name, tablespace_name FROM dba_data_files WHERE file_id = 17;
scp /data/CDBWEB/343D6C90608811D6E0650A00275B5722/datafile/scott_tbs01.dbf [email protected]:/home/oracle/forensics/unencrypted
dd if=/home/oracle/forensics/unencrypted/scott_tbs01.dbf bs=8192 skip=134 count=1 of=block_134.raw
hexdump -C block_134.raw
strings block_134.raw
ALTER TABLESPACE scott_tbs ENCRYPTION ONLINE USING 'AES256' ENCRYPT;
scp /data/CDBWEB/343D6C90608811D6E0650A00275B5722/datafile/o1_mf_scott_tb_n1yw0dsp_.dbf [email protected]:/home/oracle/forensics/encrypted
dd if=/home/oracle/forensics/encrypted/o1_mf_scott_tb_n1yw0dsp_.dbf bs=8192 skip=131 count=1 of=block_131_encrypted.raw
hexdump -C block_134.raw
strings block_134.raw

// SPONSORS //
Interested in sponsoring my videos? Reach out to my team here: [email protected]

#oracle #linux #database