Recent searches
Search options
Somebody is claiming to have exfiltrated 6 million lines of data with Oracle Cloud’s SSO and LDAP that includes JKS files, encrypted SSO passwords, key files and enterprise manager JPS keys from servers on login.*.oraclecloud.com
The poster has no prior reputation, it is unclear if they're LARPing. Some of the sample data does align with prior infostealer logs, I'm told. https://breachforums.st/Thread-SELLING-Oracle-cloud-traditional-hacked-login-X-oraclecloud-com
If anybody is interested, the servers they claim they targeted all run Oracle WebLogic and are managed by Oracle as a SaaS service.
Has anybody else got Oracle to comment on this? No reply to my queries.
Oracle are denying a breach to @BleepingComputer, but the threat actor has provided an archived URL which suggests they somehow uploaded a file to the Oracle Access Manager (SaaS solution) frontend.
https://web.archive.org/web/20250301161517/http:/login.us2.oraclecloud.com/oamfed/x.txt?x
@GossiTheDog probably coincidence, but just in case: https://infosec.exchange/@avuko/114167264483218333
@GossiTheDog WebLogic? You mean the framework that used to have a new RCE every 3 months like clockwork? That WebLogic?
@GossiTheDog haha, weblogic.. what is this? The German government?
@GossiTheDog Oracle doesn't talk. They sue.
@joacim @GossiTheDog basically this. If you’re not a customer with a support contract they sue you for running their software unlicensed, and if you are a customer with a support contract they sue you for breaching the contract that says you’re not allowed to do any kind of vulnerability testing.
Remember the Oracle CISO’s rant a few years ago?
Oracle is too busy with Stargate grand future to worry about pesky security matters.
@GossiTheDog wrong permissions?
@GossiTheDog
As far as I know, no official comment from Oracle, but big customers are already being contacted and credentials/mfa are being reset as we speak.
@GossiTheDog And we were told that they were running a vulnerable version with a public CVE that does not have a public PoC exploit.
I could not verify that though.
For the jks, it's probably useless default java certificate. Anyway, try 'changeit' as password, nobody changed it since sun era.
@GossiTheDog Thanks. I will bring it up with our account team on Monday.
@GossiTheDog Have you seen anything convincing come out of this? The more I look at it, the more it seems to be hot air.
Wish I had more insight on the apparent Oracle Access Manager upload.