Forensic analysis of Oracle log files

Transcription

1

2 Jure Kajzer Abakus PLUS d.o.o. Forensic analysis of Oracle log files

3 Abakus plus d.o.o. History from 1992, ~ employees Applications: special (DB Newspaper Distribution, FIS Flight Information System) ARBITER the ultimate tool in audit trailing APPM - Abakus Plus Performance and Monitoring Tool Services: D, OS administration, programming (MediaWiki, Oracle) networks (services, VPN, QoS, security) open source, monitoring (Nagios, OCS, Wiki) Hardware: servers, backup server, SAN storage, firewalls Infrastructure: from 1995 GNU/Linux (19 years of experience!) Oracle on GNU/Linux: since RDBMS & Forms 3.0 (before Oracle!) > years of experience with High-Availability!

4

5 What are you on about you muppet?

6 Existing options and why not use them LogMiner ALTER SYSTEM DUMP LOGFILE Why not? requires a working (compatible) database susceptible to log corruption needs all logs since last dictionary (LogMiner)

7 Main structures Block static size (defined in block 0) defaults to disk block size endianess C0 FF 1B 58 7D 7D 7C 7B 7A A0 81 Record vector (size followed by data) chained Change static header size vector of data part sizes data parts

8 Block Structure block header 65 0F 80 A0 6D block number (R minor) file number (R major) first record offset (R micro) checksum (XOR) Redo Byte Address (R) 0x0f65..

9 Block 0x (Log header) DA 4A 40 3A A6 7D CF AE DF F A3 57 4A 1E C 3A F7 96 0D 08 7A F B 0B 8D AE C6 6F 86 B3 0B A3 AD BC A 0B DA 3D 0F D C6 CF 3B F D3 C9 4A D 7E F7 0C A3 4D A F 8E C C 2E 4A Log header B 63 DB version: DB ID: DB name: JURE Activation ID: Description: Thread, Seq# 3941, SCN 0x3cba0c-0x3cba4a Reset SCN: Thread: 1 Low SCN: Low epoch: //24 15:58: Next SCN: Next epoch: //24 15:59:...

10 Record Structure Record size (4B) Record header (B or 64B) VLD byte SCN epoch (if VLD 4th bit set) Changes

11 Record Chain go to next block header R at log header read record size (4b => int) Block header => first record R Record size 0 => last record in block >0 Record header is never split read record data (size - 4) block remainder >0x is last block finish

12 Chained record 0C E8 FE 0D F5 90 0A A 4D 90 AB FE C4 0B 0A D F AB 0C CF FF FF 0C F5 09 F5 B4 44 E6 65 0A 80 AB 81 4B 0F F6 FE FF C0 90 FF 11 7A 70 0D 05 5D 0D 8C F5 DC 0A D 38 C4 0A 2E 80 AB A2 C0 FA F C0 Log header RECORD CHAIN!= ROW CHAIN Record with size 0xB4 spans across two blocks Block header only contains first block address Record size == 0 signals no more records in block

13 Change Structure Fixed sized header (24B) operation code OBJECT_ID / DATA_OBJECT_ID Data part sizes vector of short values aligned sizes (mind the gap) Data parts types and order mostly depend on operation code

14 Change meta D F7 F7 5C 2B D2 FF FF 34 C C1 AC 0D F 7F 6B 2E A F 54 4B 4C 4D 3E 48 7A 40 4F 41 5A C E8 D2 9E 36 0C FA 6A 78 6F C 29 C1 24 FA 39 1C DB 72 FC C C FF FF D4 12 E1 81 0D C0 E B 2E FF FF 18 B D0 71 0C 0B FA 0B 0B F7 0F C C F 4A 5D C0 14 5D C E 31 4C 4B E C 5A 4C 9E 18 0A F7 05 FC C C D 64 4C 1D B D 0D B 5D 4F Log header AC 11 3E 33 F E 5B. UNDO change ( - DRP - delete) REDO change ( IRP - insert) Object ID 0x11 Object DATA ID 0x11 data parts ((5C / 2) - 1)

15 Change data 5C 2B D2 FF FF 34 C C1 C1 29 5A 29 5A 29 4D F 7F 6B 2E D 4F 3D F 54 4B 4C 4D A 40 4F 41 5A D 2D 36 0C FA 6A 78 6F C1 C B 12 DB 72 FC C C 1B 54 2D 35 2D D C0 E B 2E 5F D B 29 4B 29 5D 4D 0B F7 0F C C1 80 C A 29 5A A 5D 27 4F 3D 4F 3D 5F E 31 4C 4B D C 5A 4C 5F 55 2D 2D 44 4B 0D F FC 4C C1 46 1D B C D D 36 5B 5A... 0D B 5D 4F Log header 3E 33 F B 2E 41 4B 29 4B :31: 1?? (probably RAW) k1z3ahq7a1ph ?? (probably RAW) NULL :17:13 FIXED TABLE FULL SYS X$KZSPR ("INST_ID"=USERENV('INSTANCE') AND (("KZSPRPRV")=(-258) OR (-"KZSPRPRV")=(-259) OR (-"KZSPRPRV")=(-260) OR (-"KZSPRPRV")=(-261))) "INST_ID"[NUMBER,], "KZSPRPRV"[NUMBER, ] TABLE (FIXED) NULL NULL NULL

16 What to look for? Data operations: INSERT DELETE UPDATE MULTI-INSERT MULTI-DELETE OVERWRITE - UNDO DIRECT LOADER Transaction operations: HEADER COMMIT/ROLLCK ROLLCK TO SAVEPOINT 9 - SESSION BEGIN 5. - SESSION SWITCH

17 What about the details? some light eading David Litchfield - Dissecting the Redo Logs Redo Internals - Julian Dyke Zizzy

18 Time for tooling... The Good A good HEX editor The bad Spreadsheet app (Calc, Excel) The ugly Pen & paper (and some Xanax) DO NOT GO THERE!

19 or better yet: MAKE YOUR OWN TOOLS!!!

20 Security observations Data CAN be read from redo logs you have to guess data types if you don t know the table columns Data CAN be modified in redo logs you are limited to current data lengths or you have to shift records you must update CRC DDL is in clear text long story short just keep the log files safe -rw-r oracle dba 1851 jan : 1_236_78923.arch

21 Optimisation observations Try to avoid row chaining multiplies data change count by mod(cols,255) OR MORE if you use tables with >255 columns TRY HARDER Try to avoid ROLLCK TO SAVEPOINT do not use it for flow control logic

22 Optimisation observations in pictures Op. + Lock + Rollback Op. + Lock OP do the math Op. + Lock + Chain All together now Op. + Lock + Chain + Migrate

23 Questions?!?

24 Jure Kajzer Abakus PLUS d.o.o.