eWeek: Openhack database gets crackedJul 18, 2000, 19:55 (7 Talkback[s])
(Other stories by Timothy Dyck)
"The jewel of eWEEK Labs' Openhack e-commerce site -- the database -- has been cracked, and the hack has revealed a previously unreported hole in an operating system running some of the biggest Web sites in the world: Sun Microsystems Inc.'s Solaris 8."
"The crack was performed by none other than Spanish security consultant Lluis Mora, the same person who felled eWEEK Labs' previous security test site. On July 15, at about 3:30 am GMT, Mora, who goes by the handle JFS, retrieved protected information from the database server of the Labs' and security firm Guardent Inc.'s online Openhack security test...."
"The stated goal of the database crack was to access a table called "secret," which contained the message "75% of all users choose bad passwords." We turned out to be part of this majority, because a bad password was one of the Openhack site's vulnerabilities."
"After breaking through a number of other defenses, Mora found an Oracle account -- the MDSYS user, created by the Oracle installer to manage Oracle's Spatial Data Option package -- that had administrator privileges and thus is able to read any data on the system. When we installed Oracle 8i 2.0 on a Sun Enterprise E4500 server running Solaris 8, we accidentally missed changing the default password for this account. (We set the passwords for all the common Oracle administrator accounts to 10-character random strings.) Using the MDSYS account, Mora was able to access and read the secret -- and ironic -- contents of the secret table."