Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Oracle’s stealth password cracking vulnerability

netspi.com | blog | #authentication | #vulnerability | #password-cracking | #database | #oracle

Summary

Oracle Database 11g's authentication protocol allows stealth password cracking—brute forcing leaves no failed-login evidence—and the fix requires upgrading to the new authentication protocol.
Published
Collected

original ↗

Related coverage

blog · netspi.com
API Security Testing: The Overlooked Frontline in Application Penetration Testing
APIs expose backend logic and sensitive data directly; targeted API security testing uncovers broken authentication, excessive data exposure, and access control flaws that traditional pentests miss.
blog · netspi.com
Why TOTP Won’t Cut It (And What to Consider Instead)
NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.
blog · netspi.com
Anti-Scraping Part 1: Core Principles to Deter Scraping
The first post in an anti-scraping series lays out five core principles: require authentication, enforce rate limits, lock down account creation, cap data volume, and return generic error messages.
blog · netspi.com
Multi-Factor Authentication: The Bare Minimum of IAM
Sectigo CTO Jason Soroko joins the Agent of Influence podcast to explain why MFA is the bare minimum of IAM, covering symmetric vs. asymmetric secrets and digital certificate best practices.
blog · netspi.com
Q&A: Asset Management, Vulnerability Management, and Authentication are Changing the Game for this CISO
AF Group CISO Seth Edgar shares which security activities are making the greatest difference in his security program via the Agent of Influence cybersecurity podcast.
blog · netspi.com
Exploiting SQL Server Global Temporary Table Race Conditions
Global temporary tables in SQL Server are readable and writable by any user; NetSPI shows how least-privileged users can exploit race conditions to access data, including a TSQL Agent job escalation.
back