{"id":3387,"date":"2018-06-11T17:08:31","date_gmt":"2018-06-11T20:08:31","guid":{"rendered":"https:\/\/www.dbarj.com.br\/?p=3387"},"modified":"2018-11-09T17:33:49","modified_gmt":"2018-11-09T19:33:49","slug":"protecting-oracle-database-binaries-against-malicious-changes","status":"publish","type":"post","link":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/","title":{"rendered":"Protecting Oracle Database Binaries against malicious changes"},"content":{"rendered":"<h3>Introduction<\/h3>\n<p>In the live sessions where I talk about <strong><span style=\"color: #800000;\">Oracle Database<\/span><\/strong> security and vulnerabilities, I do always mention rootkits or malwares that can attack a database from either inside (via SQL injection, PL\/SQL poisoning, Java leaks, etc) or externally (by changing oracle user files, such as binaries \/ libs \/ crontab \/ etc).<\/p>\n<p>To explore these two forms of attacks, a hacker often uses what I call the <em><span style=\"color: #0000ff;\"><strong>ladder of joy<\/strong><\/span><\/em>:<\/p>\n<p id=\"DVyqPyC\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-3391 size-full\" style=\"border: 3px solid #eeeeee; padding: 3px; margin: 3px;\" src=\"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2.png\" alt=\"\" width=\"1002\" height=\"648\" srcset=\"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2.png 1002w, https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2-300x194.png 300w, https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2-768x497.png 768w\" sizes=\"auto, (max-width: 1002px) 100vw, 1002px\" \/><\/p>\n<p>Usually an attacker starts the privilege escalation attack from a low-level user, maybe with only the <strong>CREATE SESSION<\/strong> permission, and attempts many &#8220;ladder-climbing&#8221; techniques such as SQL Injection, Java Vulnerabilities, Buffer Overflow, etc. Once as <strong>SYSDBA<\/strong> or <strong>DBA<\/strong>, it is trivial to reach the <em>oracle<\/em> account in OS, responsible for the DB binaries.<\/p>\n<p><span style=\"color: #800000;\"><strong>The purpose of this article is to present how to protect the Oracle Home user files against improper changes and thus prevent the deployment of rootkits or malwares.<\/strong><\/span><\/p>\n<p><span style=\"color: #000000;\"><b style=\"color: #000000;\">P.S: Note that some steps of this article are not <\/b><span style=\"color: #000000;\"><b>documented<\/b><\/span><b style=\"color: #000000;\">\u00a0nor supported by oracle. Needless to say to try this at your own risk.<\/b><\/span><\/p>\n<h3>Getting Started<\/h3>\n<p>In Oracle 18c was introduced a new feature called Read-Only Oracle Home (or <strong>ROOH<\/strong>) and over this new feature that we will implement this security functionality. For pre-18c databases, there is also a section in this tutorial.<\/p>\n<p>Among the objectives of the ROOH, we have:<\/p>\n<p>\u2022 Remove mutable files from Oracle Home.<br \/>\n\u2022 Consolidate these files into a separate folder.<br \/>\n\u2022 Facilitate the migration \/ environments cloning.<br \/>\n\u2022 Facilitate use of Docker \/ Oracle Homes sharing via NFS \/ etc.<\/p>\n<p>However, ROOH only ensures that no process will create or change files in ORACLE_HOME, but it doesn&#8217;t make it impossible for the <em>oracle<\/em> user to do any kind of change in his own files. Once as owner, he is obviously able to change them. Therefore, these files are not yet protected against malicious changes.<\/p>\n<p>What we will do, <span style=\"text-decoration: underline;\">once activated ROOH<\/span> and ensured that the <em>oracle<\/em> user does not need to modify any file within Oracle Home root anymore (except in cases of patching), is to protect the binaries with the following steps:<\/p>\n<ol>\n<li>Save the current owners and privileges of all ORACLE_HOME files.<\/li>\n<li>Change the current owner of all ORACLE_HOME files to <em>root<\/em>.<\/li>\n<\/ol>\n<p>The purpose of Step 1 is to have a way to return to the original owner and privileges in case you need to apply a patch or do any other type of ORACLE_HOME change.<\/p>\n<p>The goal of Step 2 is to effectively protect ORACLE_HOME from unwanted changes, since the <em><strong>oracle<\/strong><\/em> user will no longer own the files (similar to what happens today with GRID_HOME, whose owner is <em>root<\/em> and not the <em>grid<\/em>).<\/p>\n<h4>Before you begin<\/h4>\n<p>Make sure that:<\/p>\n<ul>\n<li>ROOH is active for your ORACLE_HOME (<a href=\"https:\/\/docs.oracle.com\/en\/database\/oracle\/oracle-database\/18\/ssdbi\/checking-if-read-only-oracle-home-exists.html\" target=\"_blank\" rel=\"noopener\">see this doc to know how<\/a>).<\/li>\n<li>No process is running as the ORACLE_HOME owner (usually <strong><em>oracle<\/em><\/strong>).<\/li>\n<\/ul>\n<h4>1. Saving permissions and current owners<\/h4>\n<p>The first step is to backup the privileges and permissions.<\/p>\n<p>This can be done running the command below as <em><strong>oracle<\/strong><\/em>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">$ ORACLE_HOME=\/u01\/app\/oracle\/product\/18.0.0\/dbhome_1\r\n$ cd $ORACLE_HOME\r\n$ find -depth -printf '%m:%u:%g:%p\\0' |\r\nawk -v RS='\\0' -F: '\r\nBEGIN {\r\n    print \"#!\/bin\/sh\";\r\n    print \"set -e\";\r\n    q = \"\\047\";\r\n}\r\n{\r\n    gsub(q, q q \"\\\\\" q);\r\n    f = $0;\r\n    sub(\/^[^:]*:[^:]*:[^:]*:\/, \"\", f);\r\n    print \"chown --\", q $2 \":\" $3 q, q f q;\r\n    print \"chmod\", $1, q f q;\r\n}' &gt; original-permissions.sh<\/pre>\n<p>The <em>find<\/em> and <em>awk<\/em> commands above will generate the <em><strong>original-permissions.sh<\/strong><\/em> file inside the ORACLE_HOME. This shellscript has the current <em>chown<\/em> and <em>chmod<\/em> commands for all existing files.<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">$ head original-permissions.sh\r\n#!\/bin\/sh\r\nset -e\r\nchown -- 'oracle:oinstall' '.\/bin\/lxegen'\r\nchmod 755 '.\/bin\/lxegen'\r\nchown -- 'oracle:oinstall' '.\/bin\/sqlldr'\r\nchmod 751 '.\/bin\/sqlldr'\r\nchown -- 'oracle:oinstall' '.\/bin\/lsnrctl'\r\nchmod 751 '.\/bin\/lsnrctl'\r\nchown -- 'oracle:oinstall' '.\/bin\/ore_srcexport.pl'\r\nchmod 644 '.\/bin\/ore_srcexport.pl'<\/pre>\n<h4>2. Change the current owner for all ORACLE_HOME files to root<\/h4>\n<p>Before changing the current owner of the files to <strong><em>root<\/em><\/strong>, you need to check a few things, since <em><strong>oracle<\/strong><\/em> read (r) and execute (x) privileges will now be granted through the file group (usually <em><strong>oinstall<\/strong><\/em>):<\/p>\n<ol style=\"list-style-type: lower-roman;\">\n<li>If the owner of the file had execution privilege (<span style=\"color: #800000;\"><strong>x<\/strong><\/span>), then the file group needs to be able to execute.<\/li>\n<li>If the owner of the file had reading privilege (<span style=\"color: #800000;\"><strong>r<\/strong><\/span>),\u00a0the file group needs to be able to be able to read.<\/li>\n<li>Group and others must not have write privileges (<span style=\"color: #800000;\"><strong>w<\/strong><\/span>).<\/li>\n<\/ol>\n<p>This can be done through the commands below. Run as <em><strong>root <\/strong><\/em>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\"># ORACLE_HOME=\/u01\/app\/oracle\/product\/18.0.0\/dbhome_1\r\n# cd $ORACLE_HOME\r\n# pwd\r\n\/u01\/app\/oracle\/product\/18.0.0\/dbhome_1\r\n# find .\/ -perm -u+x ! -perm -g+x -exec chmod g=u-w {} +\r\n# find .\/ -perm -u+r ! -perm -g+r -exec chmod g=u-w {} +\r\n# find .\/ -perm -g+w ! -type l -exec chmod g-w {} +\r\n# find .\/ -perm -o+w ! -type l -exec chmod o-w {} +\r\n# chown -R root .\/*<\/pre>\n<p>Nice! You can now start your instance with assurance that an attack will not be able to affect the DB binaries.<\/p>\n<p><em>PS: Keep in mind that there is no use for this type of protection if <strong>oracle<\/strong> user is able to execute <span style=\"text-decoration: underline;\"><strong>su or sudo<\/strong><\/span> as <strong>root<\/strong>.<\/em><\/p>\n<h3>Rollback<\/h3>\n<p>Always before applying a patch or if you want to undo the owner and permissions changes, execute the <em><strong>original-permissions.sh<\/strong><\/em> file (generated in step 1) as <strong><em>root<\/em><\/strong>:<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\"># ORACLE_HOME=\/u01\/app\/oracle\/product\/18.0.0\/dbhome_1\r\n# cd $ORACLE_HOME\r\n# sh original-permissions.sh<\/pre>\n<p>NOTE: Remember to re-run Step 1 after running changes to Oracle Home to ensure that permissions and owners for new files are included in a new shellscript.<\/p>\n<h3>Is my Oracle Home really protected now?<\/h3>\n<p>As <strong><em>oracle<\/em><\/strong> user, I can now check if oracle database home folder is really secured. How?<\/p>\n<p>Let me try to remove all the files from ORACLE_HOME recursively as <strong><em>oracle<\/em><\/strong>.<\/p>\n<p><span style=\"text-decoration: underline;\"><span style=\"color: #800000;\"><strong>DON&#8217;T EVER TRY THIS IN YOUR SERVER.<\/strong><\/span><\/span><\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"shell\">$ cd $ORACLE_HOME\r\n$ pwd\r\n\/u01\/app\/oracle\/product\/18.0.0\/dbhome_1\r\n$ find .\/ | wc -l\r\n42098\r\n$ rm -rf .\/* .\/.* 2&gt;&amp;-\r\n$ find .\/ | wc -l\r\n42098<\/pre>\n<p>As you can see from the output above, <strong><em>oracle<\/em><\/strong> user is not able to remove anything.<\/p>\n<h3>Pre-18c Databases<\/h3>\n<p>In environments running DB 12c or earlier, this type of protection approach would also work with some limitations. However, to avoid problems it is necessary to map <strong>ALL<\/strong> the files that are changeable within ORACLE_HOME (something non-existent in 18c with ROOH) and keep them with the original <strong><em>oracle<\/em><\/strong> user permissions.<\/p>\n<p>As it&#8217;s impossible to control the directories where a pre-18c DB version generates files, to avoid any impacts I recommend an <strong>&#8220;inclusive approach&#8221;<\/strong>, protecting only the files in the following folders:<\/p>\n<ul>\n<li>.\/bin\/<\/li>\n<li>.\/ctx\/lib\/<\/li>\n<li>.\/hs\/lib\/<\/li>\n<li>.\/javavm\/admin\/<\/li>\n<li>.\/ldap\/lib\/<\/li>\n<li>.\/lib\/<\/li>\n<li>.\/network\/lib\/<\/li>\n<li>.\/odbc\/lib\/<\/li>\n<li>.\/owb\/wf\/lib\/<\/li>\n<li>.\/plsql\/lib\/<\/li>\n<li>.\/precomp\/lib\/<\/li>\n<li>.\/racg\/lib\/<\/li>\n<li>.\/rdbms\/admin\/<\/li>\n<li>.\/rdbms\/lib\/<\/li>\n<li>.\/sqlplus\/lib\/<\/li>\n<li>.\/srvm\/lib\/<\/li>\n<li>.\/sysman\/lib\/<\/li>\n<li>.\/xdk\/lib\/<\/li>\n<\/ul>\n<p>This can be done through the commands below as <em><strong>root<\/strong><\/em> (remember to save the current owner and permissions before, as described in step 1):<\/p>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\"># ORACLE_HOME=\/u01\/app\/oracle\/product\/12.1.0\/dbhome_1\r\n# cd $ORACLE_HOME\r\n# pwd\r\n\/u01\/app\/oracle\/product\/12.1.0\/dbhome_1\r\n# cat protected_folders.txt\r\n.\/bin\/\r\n.\/ctx\/lib\/\r\n.\/hs\/lib\/\r\n.\/javavm\/admin\/\r\n.\/ldap\/lib\/\r\n.\/lib\/\r\n.\/network\/lib\/\r\n.\/odbc\/lib\/\r\n.\/owb\/wf\/lib\/\r\n.\/plsql\/lib\/\r\n.\/precomp\/lib\/\r\n.\/racg\/lib\/\r\n.\/rdbms\/admin\/\r\n.\/rdbms\/lib\/\r\n.\/sqlplus\/lib\/\r\n.\/srvm\/lib\/\r\n.\/sysman\/lib\/\r\n.\/xdk\/lib\/\r\n# find $(cat protected_folders.txt) -perm -u+x ! -perm -g+x -exec chmod g=u-w {} +\r\n# find $(cat protected_folders.txt) -perm -u+r ! -perm -g+r -exec chmod g=u-w {} +\r\n# find $(cat protected_folders.txt) -perm -g+w ! -type l -exec chmod g-w {} +\r\n# find $(cat protected_folders.txt) -perm -o+w ! -type l -exec chmod o-w {} +\r\n# chown -R root $(cat protected_folders.txt)<\/pre>\n<p>NOTE: You may also include or exclude folders from this list at your own risk, to shrink or extend protection.<\/p>\n<h3>Conclusion<\/h3>\n<p>Privileges Escalation (<em>DBA<\/em> user on DB -&gt; <em>oracle<\/em> user on OS), although not presented here because it is outside the scope of this article, is something really trivial and the main end goal of the invaders. Therefore, making it harder to deploy any kind of malicious code in binaries is a real concern that must be raised in all types of environments, especially in Production.<\/p>\n<b>Have you enjoyed? Please leave a comment or give a \ud83d\udc4d!<\/b>\n<div class='watch-action'><div class='watch-position align-left'><div class='action-like'><a class='lbg-style2 like-3387 jlk' href='javascript:void(0)' data-task='like' data-post_id='3387' data-nonce='de4404f630' rel='nofollow'><img class='wti-pixel' src='https:\/\/www.dbarj.com.br\/wp-content\/plugins\/wti-like-post\/images\/pixel.gif' title='Like' \/><span class='lc-3387 lc'>+5<\/span><\/a><\/div><\/div> <div class='status-3387 status align-left'><\/div><\/div><div class='wti-clear'><\/div>","protected":false},"excerpt":{"rendered":"<p>Introduction In the live sessions where I talk about Oracle Database security and vulnerabilities, I do always mention rootkits or malwares that can attack a database from either inside (via SQL injection, PL\/SQL poisoning, Java leaks, etc) or externally (by changing oracle user files, such as binaries \/ libs \/ crontab \/ etc). To explore &hellip; <\/p>\n<p><a class=\"more-link btn\" href=\"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/\">Continue reading<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":["post-3387","post","type-post","status-publish","format-standard","hentry","category-security-en","item-wrap"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Protecting Oracle Database Binaries against malicious changes - DBA - Rodrigo Jorge - Oracle Tips and Guides<\/title>\n<meta name=\"description\" content=\"This article presents how to protect the Oracle Home user files against improper changes and thus prevent the deployment of rootkits or malwares.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"DBA RJ\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/\"},\"author\":{\"name\":\"DBA RJ\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"headline\":\"Protecting Oracle Database Binaries against malicious changes\",\"datePublished\":\"2018-06-11T20:08:31+00:00\",\"dateModified\":\"2018-11-09T19:33:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/\"},\"wordCount\":1038,\"commentCount\":2,\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2018\\\/06\\\/img_5b16f1dec5dc2.png\",\"articleSection\":[\"Database Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/\",\"name\":\"Protecting Oracle Database Binaries against malicious changes - DBA - Rodrigo Jorge - Oracle Tips and Guides\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2018\\\/06\\\/img_5b16f1dec5dc2.png\",\"datePublished\":\"2018-06-11T20:08:31+00:00\",\"dateModified\":\"2018-11-09T19:33:49+00:00\",\"description\":\"This article presents how to protect the Oracle Home user files against improper changes and thus prevent the deployment of rootkits or malwares.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2018\\\/06\\\/img_5b16f1dec5dc2.png\",\"contentUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2018\\\/06\\\/img_5b16f1dec5dc2.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/2018\\\/06\\\/protecting-oracle-database-binaries-against-malicious-changes\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Protecting Oracle Database Binaries against malicious changes\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/\",\"name\":\"DBA - Rodrigo Jorge - Oracle Tips and Guides\",\"description\":\"Blog about Databases, Security and High Availability\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/en\\\/#\\\/schema\\\/person\\\/28a44ca3a6633fe4156ad1ea209d40a9\",\"name\":\"DBA RJ\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"url\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"contentUrl\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\",\"width\":712,\"height\":712,\"caption\":\"DBA RJ\"},\"logo\":{\"@id\":\"https:\\\/\\\/www.dbarj.com.br\\\/wp-content\\\/uploads\\\/2019\\\/09\\\/RodrigoJorgePOUG19.png\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protecting Oracle Database Binaries against malicious changes - DBA - Rodrigo Jorge - Oracle Tips and Guides","description":"This article presents how to protect the Oracle Home user files against improper changes and thus prevent the deployment of rootkits or malwares.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/","twitter_misc":{"Written by":"DBA RJ","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#article","isPartOf":{"@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/"},"author":{"name":"DBA RJ","@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"headline":"Protecting Oracle Database Binaries against malicious changes","datePublished":"2018-06-11T20:08:31+00:00","dateModified":"2018-11-09T19:33:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/"},"wordCount":1038,"commentCount":2,"publisher":{"@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"image":{"@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2.png","articleSection":["Database Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/","url":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/","name":"Protecting Oracle Database Binaries against malicious changes - DBA - Rodrigo Jorge - Oracle Tips and Guides","isPartOf":{"@id":"https:\/\/www.dbarj.com.br\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#primaryimage"},"image":{"@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2.png","datePublished":"2018-06-11T20:08:31+00:00","dateModified":"2018-11-09T19:33:49+00:00","description":"This article presents how to protect the Oracle Home user files against improper changes and thus prevent the deployment of rootkits or malwares.","breadcrumb":{"@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#primaryimage","url":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2.png","contentUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2018\/06\/img_5b16f1dec5dc2.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbarj.com.br\/en\/2018\/06\/protecting-oracle-database-binaries-against-malicious-changes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.dbarj.com.br\/en\/"},{"@type":"ListItem","position":2,"name":"Protecting Oracle Database Binaries against malicious changes"}]},{"@type":"WebSite","@id":"https:\/\/www.dbarj.com.br\/en\/#website","url":"https:\/\/www.dbarj.com.br\/en\/","name":"DBA - Rodrigo Jorge - Oracle Tips and Guides","description":"Blog about Databases, Security and High Availability","publisher":{"@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbarj.com.br\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":["Person","Organization"],"@id":"https:\/\/www.dbarj.com.br\/en\/#\/schema\/person\/28a44ca3a6633fe4156ad1ea209d40a9","name":"DBA RJ","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","url":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","contentUrl":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png","width":712,"height":712,"caption":"DBA RJ"},"logo":{"@id":"https:\/\/www.dbarj.com.br\/wp-content\/uploads\/2019\/09\/RodrigoJorgePOUG19.png"}}]}},"_links":{"self":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/posts\/3387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/comments?post=3387"}],"version-history":[{"count":0,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/posts\/3387\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/media?parent=3387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/categories?post=3387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbarj.com.br\/en\/wp-json\/wp\/v2\/tags?post=3387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}