Blog

Cyber defenders are tasked with protecting their data and systems.  This has become a notoriously difficult task largely due to the complexity of IT systems.  On the other hand, attackers often only need to find one exposed vulnerability or configuration oversight to gain enough information to gain initial access, and enable subsequent stages of a cyber attack such as deploying ransomware, stealing data, or even taking more destructive action such as destroying data or launching denial of service (DoS) attacks. 

Oracle attacks are one such class of cyber attack where a small oversight on the part of defenders can be turned into enough information to enable a successful breach. In this article we will define what oracle attacks are, and give several examples of how attackers can exploit some information leakage in systems to gather sensitive information that enables them to continue their exploit campaign against a target. 

What Are Oracle Attacks?

In standard English, an oracle is a person or mythological entity with the ability to give wise and insightful advice or predict the future. More broadly, an oracle can be any authoritative or reliable source of knowledge or wisdom if they consistently provide valuable insights or information.

Oracle attacks are a class of cyber attacks in which the behavior of a system is exploited to extract information that enables larger cyber attacks. The "oracle" in this context is the system that, when attacked, provides some feedback - other than direct cleartext data such as usernames and passwords - that the attacker can use to deduce sensitive information. Oracle attacks showcase the power of leveraging seemingly insignificant data to launch more substantial, impactful cyberattacks. When hardware devices are used as the source of feedback, the attack is known as a "side-channel attack".

By exploiting minimal feedback from systems—whether through error messages, timing discrepancies, or behavioral clues—attackers can piece together valuable information that allows them to escalate their access and control.

Types of Oracle Attacks

In this section, we will break down some fundamental oracle attacks so defenders can better understand the breadth and scope of security testing and security controls that they need to effectively protect their digital assets.

Here are the main types of oracle attacks:

• Error-Based Oracle Attacks: In an error-based oracle attack, the attacker sends crafted inputs to a system and observes the errors or exceptions that are returned. These errors can reveal details about the underlying system or allow the attacker to infer specific data. SQL injection is a common vector for error-based oracle attacks. By injecting malicious SQL queries, an attacker might cause the database to return error messages that provide clues about table names, column types, or even specific data stored in the database.

• Padding Oracle Attacks: Padding oracle attacks target encryption systems that use block ciphers in modes like CBC (Cipher Block Chaining). The attacker manipulates the encrypted data (ciphertext) and observes the system's response to determine whether the padding is valid or not. This feedback can be used to decrypt the ciphertext or even craft valid encrypted messages without knowing the encryption key. A padding oracle attack was famously used to break SSL/TLS encryption in the BEAST (Browser Exploit Against SSL/TLS) attack.

• Timing Oracle Attacks: Timing oracle attacks exploit the time taken by a system to respond to certain inputs. By carefully measuring the time it takes for the system to process different inputs, an attacker can infer sensitive information. If the server takes slightly longer to reject a password that matches part of the correct password, the attacker can use this timing information to guess the password character by character. Timing attacks have been used against various cryptographic algorithms and authentication systems, to reveal secret keys or passwords based on differing response times. Time-based SQL Injection attacks are not considered oracle attacks since they use time delays (such as SLEEP functions) to infer information rather than measuring a system's raw response times.

• Blind Oracle Attacks: In a blind oracle attack, the attacker doesn't directly receive error messages or timing information but still gains insight through the presence or absence of certain responses. This could involve observing changes in behavior, output, or other indirect indicators. In a blind SQL injection attack, the attacker might not see error messages directly. Instead, they might infer information based on changes in the application's behavior (e.g., if a query returns a different number of results or a different page layout). An attacker might use a blind SQL injection to infer the structure of a database by sending queries that result in different behaviors (e.g., a boolean-based SQL injection that returns different pages depending on the truth value of a query).

Conclusion

Oracle attacks exploit the feedback provided by a system, whether through errors, timing differences, or other performance changes, to extract sensitive information that attackers can use to further their attacks such as extracting account credentials or guessing passwords or cryptographic keys.

The fundamental types of oracle attacks include error-based oracle attacks, padding oracle attacks, timing oracle attacks, and blind oracle attacks. Each type relies on different methods of extracting information from the system to which they are applied. By understanding the range of exploitation techniques used by attackers, defenders can improve their measures to effectively protect against them.