Summary ========== Oracle native authentication protocols are typical challenge-response protocols. After some negotiation the client sends the username. If the user exists the server sends an encrypted key. The client uses the key to encrypt the user's password and sends it to the server. One of the protocols is documented quite well in [1.]. On reading that description it is quite obvious that the protocol is vulnerable against the off-line brute force attack. Oracle changed the algorithm in 9i and changed it again in 10g. If we use the OCI driver, our programs will use these newer protocols, but thin drivers use the older version, thus implementing an off-line brute forcer is not absolutely pointless (if you can sniff the connection you can conduct several other attacks of course). The servers and the clients support the older version of the protocol, thus it is worth a research whether downgrade attack is possible. This article describes four versions of the Oracle native authentication. These information are based on [3.]. This description is shorter than [3.] and just emphasizes those differences that could be important in a downgrade attack againts the (SEEMS TO BE stronger) newer authentication protocols. We do not disclose the details of the downgrading. In the Downgrading chapter you can find screenshots about a successful attack to prove that downgrading is possible. Detailes ========== The full anouncment can be found at http://www.pwc.com/extweb/service.nsf/docid/3AC99308583CCE398025727400391E31/$file/oraauthdg_pub.pdf Solution ========= There are two solutions to these kind of problems: - Use strong passwords so a brute force attack is not feasible - Use encryption in the communication channel Credits ========= Article is written by László Tóth. Special thanks goes to Balázs Boda, Lajos Antal and Pete Finnigan _________________________________________________________________ The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited. If you received this in error, please contact the sender and delete the material from any computer.
