Oracle Hack PR Drama: Deny, Deny, Deny — Despite Damning Data – Source: securityboulevard.com

Larry Ellison’s PR pukes desperately follow the  script.

A hacker claims to have breached Oracle Cloud Infrastructure (OCI), stealing 6,000,000 records. But Oracle Corp. says that’s not true.

However, many customers confirmed the leaked dataset is genuine. Several researchers point to a four-year-old critical vulnerability as the hacker’s entry point. But still Oracle keeps up the pretense.

“There has been no breach,” the PR flaks cry. In today’s SB  Blogwatch, we cry too.

Your humble blog­watcher curated these bloggy bits for your enter­tain­ment. Not to mention:  The Officerance.

OCI Dokey Then

What’s the craic? Eduard Kovacs reports: Evidence Seems to Confirm Oracle Cloud Hack

“No breach”
Oracle has categorically denied that its Cloud systems have been breached, but sample data made available by the hacker seems to prove otherwise. … A hacker named ‘rose87168’ … claims to have obtained six million lines of data, including SSO and LDAP passwords.
…
rose87168 provided sample data consisting of roughly 10,000 records to several security firms in an effort to demonstrate the hacking claims. … Some customers said … the leaked data is genuine and … exposed accounts have access to sensitive data. … The attack on Oracle Cloud systems may involve the exploitation of a vulnerability … CVE-2021-35587, which impacts Oracle Fusion Middleware.
…
“There has been no breach of Oracle Cloud,” an Oracle spokesperson [said]. “The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.”

Do we believe them? Lawrence Abrams doesn’t: Data stolen in alleged cloud breach is valid

“Oracle Fusion Middleware 11g”
rose87168 shared [with me a] URL … for a text file hosted on the “login.us2.oraclecloud.com” server that contained their email address. This file indicates that the threat actor could create files on Oracle’s server, indicating an actual breach. However, Oracle has denied that it suffered a breach of Oracle Cloud and has refused to respond to any further questions.
…
This denial, however, contradicts [my] findings. [I] received additional samples of the leaked data from the threat actor. … The associated comp­a­nies … who agreed to confirm the data under the promise of anonymity [all] confirmed the authenticity of the information.
…
The “login.us2.oraclecloud.com” server was running Oracle Fusion Middleware 11g [which] was impacted by a vulnerability tracked as CVE-2021-35587 that allowed unauthenticated attackers to compromise Oracle Access Manager. The threat actor claimed that this vulnerability was used in the alleged breach.

How big is the impact? As Aviv Sinai argues, The Impact is Bigger Than You Think:

“The real risk”
But the real story of the … OCI breach isn’t about the back-and-forth details or the vulnerability that attackers exploited. [There’s] a far more critical question: How many organizations even know they’re using OCI? … Security teams have a small window of opportunity to defuse a ticking time bomb by acting fast, including rotating credentials and enforcing MFA—if you know what tenants exist in the first place.
…
While its footprint is small compared to giants like AWS, Azure, and Google Cloud, OCI has carved out a niche by catering to enterprises that rely heavily on Oracle’s database products. … So, while OCI may not dominate in raw market share, its presence across major enterprises—and its strategic use cases—give it a bigger real-world impact than the numbers suggest.
…
Experts recommend an all-too familiar playbook: Rotate passwords, enable MFA, review access logs. All sensible. All important. But there’s an unspoken ass­um­p­tion: … That you already know where your Oracle tenants are and who’s using them. And that’s where the real risk lives.

For example? Secure Strategy exemplifies thuswise:

It’s the SaaS apps that are the danger. Most of those affected won’t be directly using Oracle Cloud. They’ll be using NetSuite, or another SaaS app (Zoom etc) that runs on Oracle Cloud. A quick look at the domains affected will show this – lots of SMEs.

How bad is it? Really bad. 2thumbsup undersells the severity:

The fact that Oracle was hosting their login gateway on a product with a known vulnerability from 2021 with a CVSS score of 9.8 is quite disturbing.

But what about Oracle’s unequivocal PR prose? Dru Nemeton is simply in awe:

What a perfect response.
The thing that happened—did not happen.
The thing that you are experiencing—you are not experiencing.
The thing that you can see with your own eyes—you cannot see with your own eyes.

But does this “deny everything” strategy actually work? Yes, argues dylan604:

This is the way. … Those that have already drunk the kool-aid will believe your denial. Those that are too lazy to look or only get their info from one source will not know any different than your denial. The rest are just wrong from being in opposition anyways. It works anywhere, as long as you are large enough.

What would Dick The Butcher do? Stu J calls it “popcorn time:”

Oh pleeeeeease can someone affected sue Oracle into the floor for criminal negligence? Providing an insecure service by running instances of your own software, which is riddled with public exploits, and not updating said instances to patch the exploitable bugs? Priceless multi-layered levels of negligence.

Meanwhile, at least mprindle is happy:

Great! I really need another year of worthless credit monitoring.

And Finally:

I knew Severance reminded me of something

Previously in And Finally

You have been reading SB Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weird­est web­sites—so you don’t have to. Hate mail may be directed to  @RiCHi, @richij, @[email protected], @richi.bsky.social or [email protected]. Ask your doctor before reading. Your mileage may vary. Past per­formance is no guar­antee of future results. Do not stare into laser with re­maining eye. E&OE. 30.

Image sauce: U.S. State Department