Biz & IT —

Oracle security chief to customers: Stop checking our code for vulnerabilities [Updated]

"Stop reverse engineering our code, already.”

The now-deleted post by Mary Ann Davidson, Oracle's CSO.
The now-deleted post by Mary Ann Davidson, Oracle's CSO.

Oracle's chief security officer is tired of customers performing their own security tests on Oracle software, and she's not going to take it anymore. That was the message of a post she made to her corporate blog on August 10—a post that has since been taken down.

Perhaps thinking that all the security researchers in the world were busy recovering from Black Hat and DEF CON and would be somehow more pliant to her earnest message, Mary Ann Davidson wrote a stern message to customers entitled "No, You Really Can't" (here in Google's Web cache; it's also been reproduced on SecLists.org in the event that Oracle gets Google to remove the cached copy). Her message: stop scanning Oracle's code for vulnerabilities or we will come after you. "I’ve been writing a lot of letters to customers that start with 'hi, howzit, aloha'," Davidson wrote, "but end with 'please comply with your license agreement and stop reverse engineering our code, already.'"

Davidson scolded customers who performed their own security analyses of code, calling it reverse engineering and a violation of Oracle's software licensing. She said, "Even if you want to have reasonable certainty that suppliers take reasonable care in how they build their products—and there is so much more to assurance than running a scanning tool—there are a lot of things a customer can do like, gosh, actually talking to suppliers about their assurance programs or checking certifications for products for which there are Good Housekeeping seals for (or “good code” seals) like Common Criteria certifications or FIPS-140 certifications."

Davidson continued:

Most vendors—at least, most of the large-ish ones I know—have fairly robust assurance programs now (we know this because we all compare notes at conferences). That’s all well and good, is appropriate customer due diligence and stops well short of 'hey, I think I will do the vendor’s job for him/her/it and look for problems in source code myself', even though: A customer can’t analyze the code to see whether there is a control that prevents the attack the scanning tool is screaming about (which is most likely a false positive); A customer can’t produce a patch for the problem—only the vendor can do that; A customer is almost certainly violating the license agreement by using a tool that does static analysis (which operates against source code).

Davidson said that maybe some customers weren't aware that what they were doing was reverse engineering, something explicitly verboten by Oracle's world-famous software licensing terms, "because the actual work is being done by a consultant, who runs a tool that reverse engineers the code, gets a big fat printout, drops it on the customer, who then sends it to us."

She dismissed such reports, saying that "we don’t just accept scan reports as 'proof that there is a there, there,' in part because whether you are talking static or dynamic analysis, a scan report is not proof of an actual vulnerability. Often, they are not much more than a pile of steaming … FUD. (That is what I planned on saying all along: FUD.) This is why we require customers to log a service request for each alleged issue (not just hand us a report) and provide a proof of concept (which some tools can generate)."

If her team at Oracle decides that the report from a customer "could only have come from reverse engineering (in at least one case because the report said, cleverly enough, “static analysis of Oracle XXXXXX”)," Oracle would "send a letter to the sinning customer, and a different letter to the sinning consultant-acting-on-customer’s behalf—reminding them of the terms of the Oracle license agreement that preclude reverse engineering, So Please Stop It Already... Oh, and we require customers/consultants to destroy the results of such reverse engineering and confirm they have done so."

The post was up for less than a day before it was unceremoniously deleted. But there are still other missives about meddling customers and those pesky security researchers from Davidson on Oracle's blog, including "Those Who Can't Do, Audit" and "Is Your Shellshocked Poodle Freaked Over Heartbleed?", in which she refers to security professionals as "security weenies" and describes the security research process thusly:

Here’s how it works. A researcher first finds vulnerability in a widely-used library: the more widely-used, the better, since nobody cares about a vulnerability in Digital Buggy Whip version 1.0 that is, like, so two decades ago and hardly anybody uses. OpenSSL has been a popular target, because it is very widely used so you get researcher bragging rights and lots of free PR for finding another problem in it. Next, the researcher comes up with a catchy name. You get extra points for it being an acronym for the nature of the vulnerability, such as SUCKS—Security Undermining of Critical Key Systems. Then, you put up a website (more points for cute animated creature dancing around and singing the SUCKS song). Add links so visitors can Order the T-shirt, Download the App, and Get a Free Bumper Sticker! Get a hash tag. Develop a Facebook page and ask your friends to Like your vulnerability. (I might be exaggerating, but not by much.) Now, sit back and wait for the uninformed public to regurgitate the headlines about “New Vulnerability SUCKS!” If you are a security researcher who dreamed up all the above, start planning your speaking engagements on how the world as we know it will end, because (wait for it), “Everything SUCKS.”

Ars attempted to reach out to Oracle for an explanation of why the post was withdrawn, but a spokesperson was not immediately available for comment. If we receive a response, we'll update this article.

Update: Oracle Executive Vice President and Chief Corporate Architect Edward Screven made a statement distributed by e-mail to the press on the post:

The security of our products and services has always been critically important to Oracle. Oracle has a robust program of product security assurance and works with third party researchers and customers to jointly ensure that applications built with Oracle technology are secure. We removed the post as it does not reflect our beliefs or our relationship with our customers.

Just how Oracle's chief security officer fell out of alignment with Oracle's core beliefs and managed to spread her heretic thoughts on customers was not addressed.

Listing image by Paul Downey

Channel Ars Technica