Well the Polish Oracle Users Group conference was quite a success. This year they held it in Sopot right on the Baltic Sea. Here are a few of the stand out things about this conference and POUG in general.

1. The Baltic Sea is cold. It’s just my nature, if there is water, I’m going to get in. When I saw that POUG was holding the conference in Sopot, the first item to make it into my carry on was my swimsuit. I decided to take an early morning swim Wednesday, running across sand that was like talcum powder I dove right in, swam out about 20 meters and decided this water is just effen cold. So, out of the water and into a hot shower to bring my body temperature back to normal. 🙂
2. When I arrived to the speakers dinner, it looked like a who’s who of people in the Oracle community. These are some of the sharpest minds in the world. Heli was there to speak about machine learning. Bryn was there to talk about wrapping your data in a secure shell. Roger Macnical was there to talk about full table scans and so many more. The educational opportunity was only limited due to having to pick between sessions that were running in parallel.
3. The food, I had lost about 40 kilos, and after a week in Sopot, I found 5 of those kilos that I had lost. Who knew they went to Poland. 🙂 Really, the food in Poland is fantastic.
4. The sessions, Timur Akhmadeev did a great presentation of “Defaults, bloody defaults.” That exposed some gaps in my knowledge. It’s always good to learn something new.
5. The networking, I had been chewing on a problem that I’ve been having with analytics on blockchain, and ran into Christian Berg who is the analytics guru in Switzerland. We don’t get to chat as much as I like; however at the after party, we dove into the problems with running analytics on blockchain data and think we may have come up with a solution. Once we run some test in the lab, and confirm you’ll read more. At POUG, you have the opportunity to chat with experts from all over the world and resolve your issues.
6. The panel session at the end of the conference. Why do I keep volunteering to sit on panels? This is an opportunity to get opinions on may subjects. This time, the discussion revolved around why learn the internals. Of course you should understand how Oracle works. Now some people take it farther than I do. So when I need to understand something a bit deeper I know there are people I can go to and ask difficult questions; like Kamal Stawiarski. If he does not know the answer; you know he will find the answer and help you out.
7. The overall organization and execution of the conference. Luiza Nowak rocked it yet again. Luiza is the face, brain, and muscle behind making sure POUG goes smoothly. I’m constantly amazed by her ability to organize a complex conference and keep calm.
8. The best speakers gift, having a beer named after me.

Thanks guys, I’m looking forward to coming back next year.

Apache Struts 2

The Apache Struts 2 vulnerability may impact you. Proof of concept code has been released on gethub and is actively being discussed in underground forums. No plugins are needed for this exploit. All the attacker needs is put together a url that will give access to the Apache Struts installation.

CVE-2018-11776

Discovered by https://www.recordedfuture.com/

Here is a list of potential Oracle products that could be vulnerable. (this list is not exhaustive and I have not had time to validate every entry on this list)

This vulnerability was discovered August 22, 2018, and I have not been able to find a patch for it. Please do your research, if you are using Apache Struts 2, then keep a close eye for the patch, and once the patch is released, install it.

The patch is in the July 2018 CPU patch.

What can happen: An attacker can gain control over the Weblogic server without knowing the password.

Affected versions.  10.3.6.0, 12.1.3.0, 12.2.1.2, and 12.2.1.3

Reference URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2893

Known Attacks. There are two proof of concept attacks published on gethub.com. (I’m not posting the links for good reason.) and there are two known active attacks going on in the wild. ISC SANS and Netlab 360 is tracking attacks.

To Do: 1) Block port 7001 internally until patched.

2) Patch Weblogic with the July 2018 CPU patch set.
Patch URL:http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html

I’m more than a little disappointed at people not being serious about information security. One of my customers asked me to help load data from a school system into an apex application I designed for some years back. The excel spreadsheet received from the school system has teacher names and social security numbers. The excel file was not encrypted in any way shape or form. I’ll be contacting the school system on Monday to resolve this issue. If it’s not resolved in a short period of time, I’ll be sending the data to their local news paper. This has got to stop.

Chatting with a friend this morning, we were talking about todo list and being overwhelmed by everything that needs to get done. After sharing with her mindfulness meditation, that helps me keep the “chattering monkeys” at bay and has improved my focus. I mentioned that I’ve gotten away from todo list and now write out the outcome I want from today. Coming up with an outcome for the day can be quite difficult; but once you get the hang of it; the outcome for today will be self evident.

Back on 3/1 I needed to bring this practice back into focus and wrote this note to myself.

In my outcome for the day, I also establish a performance goal for the day. This performance goal can be related to my physical performance while exercising and/or my performance around people. An example of this would be even though my chair is very comfortable, I will do twenty minutes on the rowing machine and lift weight for thirty minutes. It will also include what distance will I do in those twenty minutes, and what weights / sets will I do in my exercise.

My professional outcomes for the day, may be; Catch the problem in production, before the customer catches it. This way, the customer is not surprised when there is an issue. They get an FYI instead of, them sending my team an email saying there is a problem.

The beauty of this is, when you defined the outcome; what you need to do to get that outcome should become self-evident.