Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Oracle Zero-Day Flaw Project Cancelled

ScuttleMonkey posted more than 7 years ago | from the patches-not-so-welcome dept.

Oracle 61

Benny Folds writes "Cesar Cerrudo of Argeniss has suddenly cancelled plans to release daily zero-day flaws in Oracle databases during the first week in December. Just days before the project was due to start, Cerrudo announced that 'due to many problems,' the WoODB (Week of Oracle Database Bugs) is being scrapped. He did not elaborate on the reasons for the cancellation."

cancel ×

61 comments

Sorry! There are no comments related to the filter you selected.

oracle (4, Funny)

crushkill (750473) | more than 7 years ago | (#17037502)

he probably wanted to focus more on family issues, since its christmas season

Re:oracle (3, Funny)

icebike (68054) | more than 7 years ago | (#17040612)

Or equally likely, the mysterious packet slipped under his door at
midnight with pictures of his loved ones photographed through
that sniper scope sort of changed his priorities.

Why is that same white van parked across the street again...

They didn't cancel the project! (2, Funny)

Anonymous Coward | more than 7 years ago | (#17037508)

The fully patched oracle backend to their web server crashed and it just appears the project is off.

LOL (4, Funny)

1001011010110101 (305349) | more than 7 years ago | (#17037520)

1. Start a security consulting firm
2. Request 0 day vulnerabilities from everyone for an event
3. Cancel Event
4. Profit!

Re:LOL (3, Insightful)

Josh Lindenmuth (1029922) | more than 7 years ago | (#17037592)

Seems like this was his plan from the beginning. I can't imagine he would risk his clients' security by releasing all these bugs ... he already got tons of publicity from /. and elsewhere.

Re:LOL (2, Insightful)

Anonymous Coward | more than 7 years ago | (#17037812)

I can't imagine he would risk his clients' security by releasing all these bugs ...

It may surprise you to learn that some of us pay security consultancies to find bugs in software we use [siebel.com] . I don't really care if they then spray them all over milw0rm [milw0rm.org] or keep them quiet for use in their next pen-test; I can make an informed decision on whether to use it, and if so, what sort of controls to include to cover the risk.

Re:LOL (2, Insightful)

rs232 (849320) | more than 7 years ago | (#17037974)

1. Start a security consulting firm
2. Request 0 day vulnerabilities from everyone for an event
3. Get threatened with litigation
4. Cancel Event

"[We] do not credit security researchers who disclose the existence of vulnerabilities before a fix is available. We consider such practices, including disclosing "zero day" exploits, to be irresponsible as they can result in needlessly exposing customers to risk of attack ", Eric Maurice

"Oracle might have caught a break with Cerrudo but the upcoming release of a hacking handbook by database security guru David Litchfield .. titled The Oracle Hacker's Handbook .. promises an in depth examination of all the techniques and tools that hackers use to break into Oracle database servers"

payoff (1)

TheDoctorWho (858166) | more than 7 years ago | (#17037530)

cheaper for oracle to pay the guy off for now instead of fixing the holes

2 words (1)

LCookie (685814) | more than 7 years ago | (#17037544)

Cease & Desist

Re:2 words (1)

suggsjc (726146) | more than 7 years ago | (#17041526)

Isn't that three? When did and or '&' stop becoming a word?

If only (3, Funny)

vga_init (589198) | more than 7 years ago | (#17037546)

If only they would cancel the production of flaws too. :-/

Re:If only (1)

Barryke (772876) | more than 7 years ago | (#17041286)

But .. that's what the article already said:

"Cesar Cerrudo of Argeniss has suddenly CANCELLED PLANS TO RELEASE DAILY ZERO-DAY FLAWS in Oracle databases during the first week in December."

I'm thrilled. Still sticking with mySQL though.

Mission Accomplished (2, Interesting)

Salvance (1014001) | more than 7 years ago | (#17037558)

Sounds like he got what he wanted: publicity and a response from Oracle (hopefully with some better responsiveness to bugs on their part in the future). Why anger his clients if he has already received the desired response?

With good reason (4, Funny)

SuperKendall (25149) | more than 7 years ago | (#17037612)

One reason may have been the scary looking bearded dude holding a samurai sword staring at him through the window every day...

after what happened to the head of Siebel... (2, Funny)

SuperBanana (662181) | more than 7 years ago | (#17038230)

One reason may have been the scary looking bearded dude holding a samurai sword staring at him through the window every day...

Seems a reasonable concern, given we all know what happened to the head of Siebel [slashdot.org] .

Justified (1)

SuperKendall (25149) | more than 7 years ago | (#17038936)

Now in that case I'd say Larry was perfectly justified, having had to work with Siebel in the past...

Re:With good reason (5, Funny)

bill_mcgonigle (4333) | more than 7 years ago | (#17038312)

This isn't too hard to figure out. Look at the announcement retraction page. See that field of seemingly unimportant binary numbers in the background? Run it through OCR and take the digits as sets of 16-bit big-endian numbers, and you come up with the following numbers: 17,21,39,76,203,230,238,245,279. Now, look at the letters at each of those positions in the announcement and you get:

The Week of OracLe DAtabase Bugs

We aRe sad to announce that due to many pRoblems the Week of Oracle Database Bugs gets suspended.

We would like to ask for apologizes to people who supported this and were reallY excited with the idea, alSo we woUld likE to thank the people who contributeD with Oracle vulnerabilities.


Coincidence? Yeah, sure.

Re:With good reason (0)

Anonymous Coward | more than 7 years ago | (#17038500)

Where is the "announcement retraction page" you are refering too?

Re:With good reason (2, Informative)

thue (121682) | more than 7 years ago | (#17038662)

http://www.argeniss.com/woodb.html [argeniss.com] I am guessing - I am still trying to figure out how he got the numbers out of it.

Re:With good reason (2, Interesting)

Anonymous Coward | more than 7 years ago | (#17039042)

Has to have been a joke. The first five digits -do- make 17, but then you have to skip a digit (a 1) and the next series will also make 21 (note that both 17 and 21 are palindromes in binary). After that, though, you have to do some hunting to find a series of digits that will make 39. I stopped looking at that point.

Re:With good reason (1)

genooma (856335) | more than 7 years ago | (#17038840)

Here it is [argeniss.com] .

Re:With good reason (1)

jackspenn (682188) | more than 7 years ago | (#17043940)

You are a regular Dan Brown.

Fear Him! (0, Flamebait)

ill_conditioned (529750) | more than 7 years ago | (#17037642)

Goes to show that while Microsoft, the RIAA, the MPAA, and the other big boys will just throw cease and desist letters and lawyers at you, Larry Ellison will skip that and just fuck you up. Have you SEEN that guy? He eats nails for breakfest.

Re:Fear Him! (4, Funny)

udderly (890305) | more than 7 years ago | (#17037758)

Have a look [zpub.com] --it's obvious that this guy's a homicidal manic.

From the main page:

It's an old joke in Silicon Valley. Q: What's the difference between God and Larry Ellison? A: God doesn't think he's Larry Ellison.

Re:Fear Him! (2, Informative)

Capt James McCarthy (860294) | more than 7 years ago | (#17037852)

"Goes to show that while Microsoft, the RIAA, the MPAA, and the other big boys will just throw cease and desist letters and lawyers at you, Larry Ellison will skip that and just fuck you up. Have you SEEN that guy? He eats nails for breakfest." You don't become a [B,M]illionaire by being nice. All of those organizations/people will knock you off if you threaten their profits. It's cheaper the court and easier today.

Re:Fear Him! (1)

funfail (970288) | more than 7 years ago | (#17047080)

He eats nails for breakfest.

Fingernails or toenails?

Re:Fear Him! (0)

Anonymous Coward | more than 7 years ago | (#17039264)

He looks like an Angry Uncle Rico (Napoleon Dynamite).

Re:Fear Him! (0)

Anonymous Coward | more than 7 years ago | (#17039652)

Goes to show that while Microsoft, the RIAA, the MPAA, and the other big boys will just throw cease and desist letters and lawyers at you, Larry Ellison will skip that and just fuck you up. Have you SEEN that guy? He eats nails for breakfest.

Now, Larry..! We talked about this talking about yourself in the third person in our last session, remember? And I thought we'd agreed that you'd keep the physical threats out of my office? If there's something you'd like to bring to the group, I'm sure we'd all like to hear it -- when it's your turn.

That's OK, Larry, that's my job.

Please, carry on, Taco.

Larry Ellison (3, Interesting)

Cally (10873) | more than 7 years ago | (#17037700)

...probably made him an offer he couldn't refuse.

Re:Larry Ellison (1)

djdavetrouble (442175) | more than 7 years ago | (#17037982)

+11 insightful.
He is after all, made of money...

Re:Larry Ellison (0)

Anonymous Coward | more than 7 years ago | (#17041216)

A million dollar to spend a night with his wife?

The two thugs who visited his family (3, Funny)

stox (131684) | more than 7 years ago | (#17037706)

had nothing to do with it. They were just trying to let him know about a new life insurance plan.

So has he (2, Interesting)

Timesprout (579035) | more than 7 years ago | (#17037748)

provided details of these supposed exploits to Oracle yet?

Two words.... (2, Insightful)

8127972 (73495) | more than 7 years ago | (#17037834)

..... Lawsuit threat

Re:Two words.... (2, Interesting)

LurkerXXX (667952) | more than 7 years ago | (#17039964)

Yup. Most likely.

It'd be a shame if he put his list of flaws in an Oracle Database running on the net... and someone hacked it and published them anonymously...

It wouldn't be his fault at all, so he'd be immune from their lawsuits at that point, and still get them out there.

Paid (1)

waTR (885837) | more than 7 years ago | (#17037858)

It is obvious that he got something from Oracle (especially with the recent news about its lack of security). This is simply a case of damage control by Oracle. Cannot really blame them for it, it is war afterall.

PS3? (1)

TheRealBurKaZoiD (920500) | more than 7 years ago | (#17037860)

He must've been one of the few people fortunate to snag a PS3 during the Black Friday rush...

Beware of Larry (0)

Anonymous Coward | more than 7 years ago | (#17037882)

Nobody f@%#s Larry, Larry f@%#s you... fakesteve.blogspot.com/2006/10/die-red-hat-die.htm l

I think the phone call went like this (4, Funny)

User 956 (568564) | more than 7 years ago | (#17037886)

Cesar Cerrudo of Argeniss has suddenly cancelled plans to release daily zero-day flaws in Oracle databases during the first week in December.

I think the phone call with Oracle went like this: "Hi, Is this Cesar? Yeah, this is Oracle. We found a suitcase full of money, we think it belongs to you."

Re:I think the phone call went like this (3, Funny)

jonnythan (79727) | more than 7 years ago | (#17037960)

More like "We found a suitcase full these funny red sticks with clocks attached. Where did your wife park her car today?"

Re:I think the phone call went like this (1, Funny)

Anonymous Coward | more than 7 years ago | (#17038174)

Will the security researcher be driving his usual car home tonight?

Re:I think the phone call went like this (0)

Anonymous Coward | more than 7 years ago | (#17043240)

More like "We found a suitcase full these funny red sticks with clocks attached. Where did your wife park her car today?"

On Main street in front of McDonalds. Please hurry!

Re:I think the phone call went like this (2, Funny)

Tim C (15259) | more than 7 years ago | (#17038952)

Probably more like "We have a room full of lawyers, we think they'd like to talk to you".

Cancelled due to lack of poverty (3, Funny)

192939495969798999 (58312) | more than 7 years ago | (#17037976)

"Due to this new lack of poverty, er I mean bugs, the oracle bug project has been cancelled."

Oracle (4, Insightful)

RAMMS+EIN (578166) | more than 7 years ago | (#17038080)

Consider the hostile position Oracle takes when it comes to publishing benchmark results, I would not at all be surprised if they had an even more hostile position regarding publishing vulnerabilities.

The Truth.. 6 bugs just won't cut it.. (4, Funny)

madsheep (984404) | more than 7 years ago | (#17038358)

Well it's obvious why it had to be cancelled guys. When you have a week that's 7 days long and you can only come up with 6 bugs, you've got to cancel the things. Imagine the embarassment of starting on Sunday.. getting to Saturday and being one short.

O.R.A.C.L.E. (-1, Offtopic)

Anonymous Coward | more than 7 years ago | (#17038390)

One Rich A$$hole Called Larry Ellison

Simple (4, Funny)

Billosaur (927319) | more than 7 years ago | (#17038442)

Larry Ellison assured him there were no flaws in Oracle.

the database (2, Funny)

BSAlert (972201) | more than 7 years ago | (#17038598)

I heard his gold level support expired and his database system crashed and he couldn't recover the list of bugs.

Unbreakable when in court (2, Insightful)

Anonymous Coward | more than 7 years ago | (#17038708)

This is obviously due to legal threats from Oracle towards Cerrudo.

It's not as if database hacking isn't still the easiest way to compromise a server.
The DBA's are angry about 0-day exploits being released as they don't want to do what they are payed for: Keep the server current.
Oracle is angry because it makes them look worse as their competition, which is maybe even true. Hey... the database is vastly known for its complexity and we techies all know how much security and complexity like one another.
Finding 7 non exposed oracle security bugs is not even a challenge!

--
Wil

I thought that Oracle has zero-days already... (1)

mikelang (674146) | more than 7 years ago | (#17038928)

I thought that Oracle has a number of unpatched zero-days already.

just because? (1)

edis (266347) | more than 7 years ago | (#17039008)

yep, because aim of project itself was pretty shitty - why not to write nicely designed letter to Oracle before THIS THING anniversary?

Peace,

His bug database crashed (2, Funny)

Bright Apollo (988736) | more than 7 years ago | (#17040268)

Maybe we should create a communal top-ten?

1) His Oracle XE database of bugs crashed
2) He looked on Metalink and found them all listed under "fixed in 11g"

et al...

I want to learn from the pros! (2, Interesting)

TheSpatulaOfLove (966301) | more than 7 years ago | (#17040380)

I am simply amazed by the Oracle sales force. These guys must tell an amazing story when they make the final presentation to big wigs, because they land multi-million dollar contracts and promise the world...always to fall very short of the intended outcome.


Every single company I've worked for or interacted with that chose to go with Oracle has been driven into the ground during the roll-out and for months, sometime years after the fact with system failures. I've actually seen a few go completely out of business and many employees who were let go cite Oracle implementation as the beginning of the end.


I've lovingly adopted a new name for Oracle. I call it "Fish-eye". It focuses on one thing and everything else is blurry - That one thing? Ruining successful companies.

Re:I want to learn from the pros! (2, Informative)

Angvaw (992553) | more than 7 years ago | (#17041448)

Yeah, the Oracle Database totally destroyed eBay, Amazon, The Sims Online, World of Warcraft...

Re:I want to learn from the pros! (1)

TobiasS (967473) | more than 7 years ago | (#17042646)

This type of stuff typically happens when you buy into overzealous DBA's that want to transform your DB into an app server instead of just treating it as a place to store your data properly.

I am sure back in the day a fair amount of overselling was going on as well which can break your wallet with Oracle.

you have no idea... (0)

Anonymous Coward | more than 7 years ago | (#17043200)

I was married to an Oracle sales weasel for eight years - that job is the next best thing to hitting the lottery! they get paid multi-six (some seven) figures to sell software most of them don't know the 1st thing about. if they make their quota they get a free trip (w/spouse) to Hawaii (usually though Banf & Whistler have been in the mix lately) - we were on Maui (courtesy of Oracle) on 9/11. I could tell some serious stories from those trips... I occasionally heard them talk about "technical" issues and just have to bite my tongue to keep from laughing.

good work if you can get it...

Finally (1)

professorfalcon (713985) | more than 7 years ago | (#17041688)

Can we call bullshit now?

List of exploits was stored in... (2, Funny)

belphegore (66832) | more than 7 years ago | (#17041732)

Obviously, his list of exploits to be published was stored in an Oracle DB, which got hacked.

How Lame. (1)

kiwioddBall (646813) | more than 7 years ago | (#17042492)

Slag off Oracle and its security record, and then back down without giving a reason. It is OK to slag off Oracle but when you back down it is OK not to give reasons?

Weak.

That said, perhaps he took the sensible line and told Oracle about any flaws he may have had, they will fix them and the consumer wins.

Receptionst: Cesar, Mr Ellison is on line 1 (4, Funny)

sp3298622 (800612) | more than 7 years ago | (#17044302)

L: Cesar, Listen, there are no vulnerabilities in Oracle - Cancel your show
C: No bugs!? You're kidding, I have had so many submissions, I might have to extend it to a month!
Receptionist: Cesar, you're wife is in line two, something about the power at home being off, do you want to take it now?
C: Just a sec, I am giving our old buddy here the low-down
L: As I was saying, there are NO vulnerabilities
C: what are you talking about, I just said...
Receptionist: Cesar, it's Bobby on line three, he's asking if it's ok if he goes and plays with this new friend he met?
C: What new friend? he's home sick today! I'll take it in a minute.
L: So about those vulnerabilities, you sure about that?
C: Larry, you must be living in LA LA Land, what don't you understand?
Receptionist: Cesar, it's your mom on Line four, she's saying thanks for arranging the nice social worker and he's going to take her for a quiet relaxing walk.
C: social worker? I don't remember anything about that, ask her to ...
L: Cesar, I don't think you understand.
C: I don't understand?! you are the who doesn't understand, I am going to disclose every single...
Receptionist: Cesar, Your dad just called to ask where exactly is that restaurant he's suppose to meet you for lunch at 12?
C: Lunch? I am going to see him tomorrow for dinner..
L: Optimistic fella you are ol' Cesar.
C: hmm, well actually now that you mention it, there weren't really that many submissions.
L: Well, are we still on for Golf then?
Check for New Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>