eWeek: Openhack database gets cracked

“The jewel of eWEEK Labs’ Openhack e-commerce site — the
database — has been cracked, and the hack has revealed a
previously unreported hole in an operating system running some of
the biggest Web sites in the world: Sun Microsystems Inc.’s Solaris
8.”

“The crack was performed by none other than Spanish security
consultant Lluis Mora, the same person who felled eWEEK Labs’
previous security test site. On July 15, at about 3:30 am GMT,
Mora, who goes by the handle JFS, retrieved protected information
from the database server of the Labs’ and security firm Guardent
Inc.’s online Openhack security test….”

“The stated goal of the database crack was to access a table
called “secret,” which contained the message “75% of all users
choose bad passwords.” We turned out to be part of this majority,
because a bad password was one of the Openhack site’s
vulnerabilities.”

“After breaking through a number of other defenses, Mora found
an Oracle account — the MDSYS user, created by the Oracle
installer to manage Oracle’s Spatial Data Option package — that
had administrator privileges and thus is able to read any data on
the system. When we installed Oracle 8i 2.0 on a Sun Enterprise
E4500 server running Solaris 8, we accidentally missed changing the
default password for this account. (We set the passwords for
all the common Oracle administrator accounts to 10-character random
strings.) Using the MDSYS account, Mora was able to access and read
the secret — and ironic — contents of the secret table.”

Complete Story