Oracle security issues that are easy to ignore as security risks are eliminated

oracle| Safety | Safety Problems | Problem database security problem has been one of the focus of attention, we know that a business or organization of the database if the hacker attacks, and these databases and the preservation of very important data, such as banks, communications and other databases, the consequences will be disastrous. Oracle databases use a variety of tools to ensure database security, such as passwords, roles, permissions, and so on.

As Oracle database administrators know, after the typical database system installation, the general SYS and system and internal three users with the default password, after the successful database installation, the system administrator's first task is to modify the password of these users to ensure the security of the database. However, many administrators tend to overlook one of these security issues, and we'll discuss this in detail below.
Oracle database systems After a typical installation, in addition to creating a few of the users described earlier, a user named Dbsnmp is automatically created who is responsible for running the intelligent agent for the Oracle System (Intelligent Agent), and the user's default password is also " Dbsnmp ". If you forget to modify the user's password, anyone can access the database system through that user. Now let's take a look at what permissions and roles the user has and then analyze the user's potential loss to the database system.
Start the Sql/plus program and use the user login to enter:
SQL>select * from session_privs;
CREATE SESSION
ALTER SESSION
UNLIMITED TABLESPACE
CREATE TABLE
CREATE CLUSTER
CREATE SYNONYM
CREATE PUBLIC SYNONYM
CREATE VIEW
CREATE SEQUENCE
CREATE DATABASE LINK
CREATE PROCEDURE
CREATE TRIGGER
ANALYZE ANY
CREATE TYPE
CREATE OPERATOR
CREATE INDEXTYPE

You can see that the user is not a SYS or system administrative user, however, it has two system-level permissions: Unlimited tablespace and create public synonym.
See these two permissions you should immediately think that these are security risks, especially unlimited tablespace, it is one of the attack points to destroy the database system. If at this time you still think that even if someone uses this not modified password to log into the database will not cause any loss, I have to remind you: the user has unlimited tablespace system privileges, it can write a small script, and then malicious system to fill with garbage data, The database system will not be able to run, and would directly lead to eventual paralysis. At present, many database systems require 7x24 work, if there is a system with garbage data filled with the situation, then, such as database system recovery, I am afraid that irreparable damage has been caused.
In order to ensure the absolute security of the Oracle database system, it is strongly recommended that the database administrator modify the user's default password and not leave the "door" for malicious people.