Breakable

Breakable
Kevin Poulsen, SecurityFocus 2002-01-16

A U.K. security expert is preparing to unveil a trove of serious vulnerabilities in Oracle's database products. Can the company redefine 'unbreakable' in time?

Colapse all | Post comment

14 evaluations missed what 1 guy found... 2002-01-16
Anonymous (5 replies)

If I were Oracle, I'd be seriously questioning the 14 reviewers about how they managed to miss that many security issues. That's 2 useless evaluations per hole found by lichfield...

...

[ more ] [ reply ]

14 evaluations missed what 1 guy found... 2002-01-16
Anonymous (3 replies)

Just goes to show you, never send a boy to do a man's job....

[ more ] [ reply ]

14 evaluations missed what 1 guy found... 2002-01-17
Anonymous

Or better yet: Never send under qualified people on the company payroll to do a hackers job. :)...

[ more ] [ reply ]

14 evaluations missed what 1 guy found... 2002-01-17
Anonymous

Sure, but we're talking about buffer overflows, not about some kind of obscure, weird, and mystic holes.

Don't trust oracle nor the 14 auditors involved. It would be nice if those names are shown to the world.

...

[ more ] [ reply ]

14 evaluations missed what 1 guy found... 2002-01-17
Anonymous

Who did the evaluations? Aurthur Anderson?

'We'll just shred this evidence of security problems...and see, now they're gone!'...

[ more ] [ reply ]

14 evaluations missed what 1 guy found... 2002-01-17
Anonymous

No, thats 14 useless evaluations, for a total of 98 missed holes.

[b]...

[ more ] [ reply ]

14 evaluations missed what 1 guy found... 2002-01-17
Brad C. Johnson, Vice President, SystemExperts Corp.

I think it's right to question what these 14 evaluations did, and why they missed these problems. I think it's wrong to assume these evaluations were useless and the people who did them aren't providing value.

The reality is, Litchfield is an expert who had incentives to try and find problems: h...

[ more ] [ reply ]

Not just some guy 2002-01-17
BLKMGK

Ever hear Litchfield speak or speak to him? He's pretty bright and thinks\speaks about 90mph (lol). He's the guy who wrote\worked on CIS, Typhon, and some other tools. Some of the work he's done on Lotus Notes lately is very interesting too. He's a good guy and I'm surprised that he's going so easy ...

[ more ] [ reply ]

14 evaluations missed what 1 guy found... 2002-01-17
Paul Robinson

I wonder how many of those 14 evaluations were from people paid by Oracle to provide their opinion and how many of them were from people that could expect NOT to be hired for evaluations again if the evaluation was negative or unfavorable?

You have to wonder when a company sells a product that pr...

[ more ] [ reply ]

PGU 2002-01-16
Anonymous (1 replies)

Maybe instead of Unbreakable, their new slogan should be Pretty Good Unbreakable....

[ more ] [ reply ]

PGU 2002-01-17
Anonymous

Marketing people should work more aligned with other areas.

Probably those error will make Oracle take severe decisions with technical employees, but the main fault is on the Mktg Dept.

...

[ more ] [ reply ]

Breakable 2002-01-17
Anonymous (2 replies)

Ha! Take that zinger, oracle, the newest version of frickin' MySQL is more secure than you!

But I suppose posturing and unbelievable claims are what you can expect from a company whose CEO looks like The Rock....

[ more ] [ reply ]

Breakable 2002-01-17
KZ

MySQL more secure?

I wouldn't make such claims unless I have a real evaluation done by real hackers.

It is not because it's open source it's more secure

Never make assertions on security unless they are the result of serious scientifical tests....

[ more ] [ reply ]

Breakable 2002-01-17
Anonymous

Can MySQL support row level security or row level auditing? I don't think so. If MySQL wants to compete at the enterprise level maybe the first thing that should be done is to change the name to OurSQL....

[ more ] [ reply ]

Schneier is right 2002-01-17
Anonymous (1 replies)

Schneier is right, they are liars....

[ more ] [ reply ]

Schneier is right 2002-01-17
Brad C. Johnson, Vice President, SystemExperts Corp.

Yes indeed, Schneier is right. The work unbreakable does have a meaning in English and it's a word that people regularly use and know how to use correctly.

Unbreakable: impossible ro break.

They are indeed lying and marketing spin can't change that fact.

Unfortunately for them, they ap...

[ more ] [ reply ]

Breakable 2002-01-17
drama at slakin d0t n3t (1 replies)

any of the developers that have half a witt of security knowledge would know nothing is perfect, only in certain environments, and even then things can go wrong.

think before you speak, didnt your mother ever tell you that? ;x

...

[ more ] [ reply ]

Breakable 2002-01-17
Anonymous

In the UK there are laws against adverts that are untrue. MAybe the Advertising Standards Authority should look at Oracle's...

[ more ] [ reply ]

What Oracle means by UnBreakable 2002-01-17
Anonymous (3 replies)

I think some people here have misunbderstood. This is what Oracle means by unbreakable:

"With Oracle9i Database, your business is unbreakable. Oracle9i Database is designed to eliminate the need for planned downtime and to withstand any failure: system failure, storage failure, site failure, or h...

[ more ] [ reply ]

What Oracle means by UnBreakable 2002-01-17
whatever

Thank you oracle fanboy (a fanboy is what video gamers call another person who does nothing but put up posts on message boards supporting their product of choice)

What else are we supposed to think when the man says "Oracle9i Unbreakable Can't break IT.. Can't break IN. (IT as in it not IT as in...

[ more ] [ reply ]

UnBreakable <- Can't break in? 2002-01-18
Anonymous

It also Says "Can't Break it, Can't break IN." That means that it's resistant to attempts to break in. That is the issue at hand. I think it's great that oracle is taking a security initiative, but they shouldn't make false statements.

If you make any kind of interface with a database, (which i...

[ more ] [ reply ]

What Oracle means by UnBreakable 2002-01-18
Anonymous

A security incident, requiring the reinstall of the OS and applications from read-only media, is one of the worst types of "breakage"......

[ more ] [ reply ]

enron 2002-01-17
kkr

maybe they should do the enron thing and have their security auditors destroy any evidence of not finding any holes 8]...

[ more ] [ reply ]

Breakable 2002-01-17
Grizzly

Remmeber The Titanic Larry...

[ more ] [ reply ]

Breakable 2002-01-17
Anonymous

Anyone claiming to have developed an "Unbreakable" piece of software is a fool. You just do not know what is around the corner. And suddenly you look like an idiot. =/...

[ more ] [ reply ]

Breakable 2002-01-17
Anonymous (1 replies)

What's it matter? Oracle has already made their money because they've sold the product to hundres of companies. Everyone knows that clueless lying idiots in marketing prepare slogans to present to clueless idiot CEO's (help call Apple support I can't find the My Computer icon on my desktop) which b...

[ more ] [ reply ]

Breakable 2002-01-18
Anonymous

Not to take your English grammar to task, but "superior" is a comparative term, whereas "unbreakable" is absolute. Windows can indeed be a superior OS, so long as the other OS's are a complete pile of rubbish, or if Windows was an incredible piece of software.

However, Oracle ceases to be unbreak...

[ more ] [ reply ]

Oracle9i = 0 Evaluations 2002-01-17
Ross

Oracle likes to tout all those evaluations, but nearly all of them are on Oracle 7! If you look at current products from the vendors that Oracle likes to compare with, it's Oracle 0, IBM 0, Microsoft 1!

Why isn't the press calling Oracle on this every time they make the 14 evaluations claim?

...

[ more ] [ reply ]

Breakable 2002-01-18
An ex-Oracle security guy (1 replies)

[Moderator -- please replace the previous Anonymous posting with the following content, with this one, thanx]

Let's be real folks. All us security types know that security is a rich topic for 'truth or dare.' And everyone beats up Oracle's marketing department for their hype. So what? Mary An...

[ more ] [ reply ]

Breakable 2002-01-18
Anonymous

They asked for it using such terminology as "unbreakable". Why couldn't they of rolled out the "Most Secure Database" campaign? Because some marketing people need to be kicked in the bridge of the nose with a steel toed boot. You really think any "security guru" at any company would claim a highl...

[ more ] [ reply ]

Breakable 2002-01-18
Anonymous

Part of this is just a business tactic, too. Oracle's Blood Enemy seems to scoff at security issues, and as others have posted, treat them as a mere PR problem. So Oracle is trying to wedge into that and make it a Real Problem for Microsoft, not just a PR gimmick.

...

[ more ] [ reply ]

Breakable 2002-01-18
An Interested Party

here, here!...

[ more ] [ reply ]

Playing with words 2002-01-20
Tired guy

Even if you unplug the NIS, there are still ways to break it. So its more like a comparison to me. If I was a customer and I will have to choose, I will go for an Oracle9i knowing that it can be broken from a security expert. But in the other hand I definately won't go for a DB that can be threatene...

[ more ] [ reply ]