Cybersecurity Experts Slam Oracle’s Handling of Big Breach

Cybersecurity experts slammed Oracle’s handling of a customer data breach that appears to stem from infrastructure the technology giant failed to update and keep secure.

See Also: OnDemand | Activate Continuous Security Testing to Improve Cyber Response

After denying a customer data breach for the past two weeks, Austin, Texas-based Oracle appears to have done an about-face.

Citing anonymous sources, Bloomberg News reported Wednesday that publicly traded Oracle has informed an unknown number of its cloud infrastructure customers that hackers stole their “usernames, passkeys and encrypted passwords” and that it’s hired CrowdStrike to investigate the breach, which the FBI is also probing.

Oracle didn’t immediately respond to a request for comment on that report.

This would be the second breach reportedly confirmed by Oracle in recent weeks, after hackers claimed to have stolen electronic health records being stored by healthcare technology vendor Cerner, which Oracle acquired in 2022. Oracle reportedly told its healthcare clients that an attacker on Jan. 22 used compromised customer credentials to access data on Cerner servers that it had yet to migrate to Oracle Cloud (see: Oracle Health Responding to Hack of Legacy Cerner EHR Data).

The technology giant’s apparent shift to acknowledging the second breach arrived after days of denials by Oracle, following a cybercrime forum user with the handle “rose87168” on March 20 posting for sale what they said were 6 million Oracle Cloud users’ usernames, passwords, passkeys and security certificates, as first reported by Bleeping Computer.

Oracle responded to the publication with this statement on March 21: “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data.”

In response, the threat actor apparently used stolen credentials to create a text file containing only their own email address on cloud infrastructure managed exclusively by Oracle, and later posted chat messages with Oracle’s support team, apparently made using a customer’s compromised account.

The threat actor has been attempting to extort affected customers, demanding they pay a ransom to remove their information from the data set before it gets sold to others or leaked.

Multiple cybersecurity experts who have reviewed public and non-public samples of the stolen data said it appears to be genuine.

Karl Sigler, senior security research managers at Trustwave SpiderLabs Threat Intelligence, told Bloomberg News his firm has studied the “rich dataset” being sold and confirmed it’s legitimate, warning that the personally identifiable information could fuel highly targeted phishing attacks and allow attackers to directly log into customers’ accounts.

“The dataset includes PII, such as first and last names, full display names, email addresses, job titles, department numbers, telephone numbers, mobile numbers and even home contact details,” Trustwave SpiderLabs said in a recent blog post. “This level of exposure can immediately lead to identity theft, spear phishing attacks and social engineering campaigns, where attackers impersonate employees or executives to gain access to additional internal systems or defraud partners.”

Cybersecurity firm CloudSEK said that the information, pertaining to 140,000 Oracle Cloud tenants, appears to have been obtained by targeting a critical vulnerability in the OpenSSO Agent component of Oracle Fusion Middleware, tracked as CVE-2021-35587. The U.S. National Vulnerability Database in 2021 warned that the “easily exploitable vulnerability allows unauthenticated attackers with network access via HTTP to compromise Oracle Access Manager.”

“Our engagement with the threat actor suggests a possible undisclosed vulnerability on login.(region-name).oraclecloud.com, leading to unauthorized access,” said CloudSEK.

Using the FOFA search engine that maps software and hardware assets, the firm found that the allegedly targeted server was last updated around Sept. 27, 2014, meaning it would have been susceptible to CVE-2021-35587. The U.S. Cybersecurity and Infrastructure Security Agency added the vulnerability to its catalog of known-exploited vulnerabilities in November 2022.

“They left servers online and unpatched,” said British cybersecurity expert Kevin Beaumont in a post to LinkedIn. “The big question becomes that if Oracle can’t admit the incident in writing and is issuing misleading statements, what else happened, what did the threat actor touch etc. Oracle have a responsibility to just be transparent, even if it clashes with their corporate culture.”

Beaumont earlier this week accused Oracle of “attempting to wordsmith statements around Oracle Cloud and use very specific words to avoid responsibility,” by claiming there was no breach of “Oracle Cloud.” He said the breach appeared to center on the cloud service formerly called Oracle Cloud, which Oracle rebranded as Oracle Classic.

Oracle has reportedly been contacting customers to verbally confirm the breach of Oracle Classic, aka generation 1 of Oracle Cloud Infrastructure.

“Multiple Oracle cloud customers have reached out to me to say Oracle have now confirmed a breach of their services,” Beaumont said, adding that these breach notifications are only happening verbally, and not in writing. “This is similar behavior to the breach of medical PII in the ongoing breach at Oracle Health, where they will only provide details verbally and not in writing.”

“I have to say Oracle’s handling of this issue has been one of the worst I have ever seen in my career,” said cybersecurity expert Brian Honan in a post to LinkedIn. “Their focus dealing with customers appeared to be more about protecting Oracle’s brand rather than their customers.”

At least one lawsuit seeking class-action status has been filed over the data breach. The lawsuit accuses Oracle of negligence, contract breach, unjust enrichment and breach of fiduciary duty, and among other outcomes requests that Oracle be required to submit to third-party auditing of its information security posture for the next decade.

Publicly traded Oracle hasn’t reported either breach to investors, and whether it might do so isn’t clear. The U.S. Securities and Exchange Commission requires covered entities to disclose any cybersecurity incident they determine is material, meaning there is “a substantial likelihood that a reasonable investor would attach importance,” within four business days of making that determination.

Regardless of Oracle’s communications, all potentially affected customers should immediately “rotate all SSO, LDAP and associated credentials, ensuring strong password policies and enforcing multi-factor authentication,” said CloudSEK. The firm also recommends all affected customers launch an incident response investigation, including reviewing LDAP logs “for suspicious authentication attempts” as well as signs of unauthorized access to any interconnected systems.