This small article is a reaction for those convincing me that authentication+authorization policy inside database provides you ultimate data protection 🙂 You don´t want to pay for Oracle Advanced Security, you´re not compressing data and you feel that your data are safe (according strict access policy in database). Well, you must be joking apparently! 🙂
Let´s have a sample table with 20 records consisting of visa credit card numbers:
I´m system power user and still curious if I can dig some „gold“ from data persisting in data files. Let´s try something! First step = find where data are stored.
[oracle@ol65 orcl]$ ll
total 2738040
-rw-r—– 1 oracle oinstall 9748480 Jan 27 15:53 control01.ctl
-rw-r—– 1 oracle oinstall 104865792 Jan 27 09:07 example01.dbf
-rw-r—– 1 oracle oinstall 52429312 Jan 27 15:53 redo01.log
-rw-r—– 1 oracle oinstall 52429312 Jan 27 09:07 redo02.log
-rw-r—– 1 oracle oinstall 52429312 Jan 27 09:07 redo03.log
-rw-r—– 1 oracle oinstall 545267712 Jan 27 15:53 sysaux01.dbf
-rw-r—– 1 oracle oinstall 828383232 Jan 27 15:53 system01.dbf
-rw-r—– 1 oracle oinstall 112205824 Jan 22 13:09 temp01.dbf
-rw-r—– 1 oracle oinstall 723525632 Jan 27 15:53 undotbs01.dbf
-rw-r—– 1 oracle oinstall 322445312 Jan 27 15:42 users01.dbf
[oracle@ol65 orcl]$ pwd
/u01/app/oracle/oradata/orcl
Well, nothing interesting, just few dbf file. But consider, maybe all is stored there. It begins to be interesting if you´re familiar with strings command and basic knowledge of regular expressions (time is just informing about speed on my laptop):
[oracle@ol65 orcl]$ time strings -a users01.dbf | grep "[0-9]\{4\}\-[0-9]\{4\}\-[0-9]\{4\}\-[0-9]\{4\}"
4255-8613-9716-5076,
4531-2930-4967-2232,
4548-7929-1826-4899,
4691-3746-9407-0405,
4649-1103-3295-2551,
4997-5257-8004-9774,
4692-4078-2653-8573,
4044-8832-9347-1412,
4688-8299-4664-4385,
4339-4136-0219-4499,
4016-7845-2950-8098,
4961-6591-9364-9979,
4787-0768-3223-3820,
4582-2114-8843-1397,
4549-3001-8407-0658,
4464-3676-8558-3399,
4804-1261-5366-8044,
4284-1059-8455-5702,
4127-1856-7120-0292,
4633-7926-0863-2443
real 0m4.653s
user 0m2.857s
sys 0m1.678s
As you can see, few seconds on laptop´s disk is perfect result, can imagine much more faster on servers storages. And of course I chose credit card numbers – because valid cc number is still valuable in a black market 🙂
Pay for Oracle Enterprise and consider if your data are automatically in bulletproof vault 😉
-a-