[ISN] Oracle CEO Touts Security Plans
isn at c4i.org
Tue Sep 27 02:10:42 EDT 2005
Forwarded from: security curmudgeon <jericho at attrition.org>
: By David Needle
: September 21, 2005
: He tweaked Microsoft's Bill Gates for once saying his company was going
: to devote special focus to security for the month of February. "Our
: first client was the CIA, and our second client was the National
: Security Agency. That was 25 years ago. We've been working on security
: since day one," said Ellison. He further claimed the last time an Oracle
: database was broken into was 15 years ago, versus the 45 minutes he said
: it took for someone to break into Microsoft's first version of its
: Passport online ordering system.
Well isn't this a doozy of a quote. This screams a) pure ignorance or b)
very crafty wording designed to evade any criticism.
"last time an Oracle database was broken into was 15 years ago, vs the
45 minutes he said it took for someone to break into Microsoft's first
version of its Passport online ordering system."
How do *you* read this quote?
1. Oracle database, as in their software, meaning installed anywhere
2. Oracle database, as in a database run by Oracle Corporation
3. Oracle database, as in a consumer service like MS Passport is (?!)
Depending on how you read this, the reply will obviously change.
1. Hacker logs onto FWP hunter database, but no information stolen
"Luckily, Aasheim said, the agency's databases use Oracle software, which
compresses inforamtion into a code that is not visible to hackers as
(Yes yes, horrible quote as far as the 'readable text' part, but still
proves the point..)
Further, not that DNS is necessarily proof, we all know that many places
name machines based on the application it runs:
2. A database run by Oracle, not hacked in last 15 years (so it was hacked
15 years ago)? But this doesn't jibe given the wording above:
"He further claimed the last time an Oracle database was broken into was
15 years ago, versus the 45 minutes he said it took for someone to break
into Microsoft's first version of its Passport online ordering system.
This wording implies Ellison is directly comparing an Oracle product to a
Microsoft service? If so, he is comparing a database running on the Oracle
network, protected by multiple layers of security (presumably), to a
public facing, publicly accessable Microsoft service. Apples and oranges
3. Comparing Oracle a product, to Microsoft Passport service? Apples and
So, would anyone at Oracle like to back peddle and try to explain this
More information about the ISN