[comingback2022@cock.li].eking和[tsai.shen@mailfence.com].faust扩展名勒索病毒数据库可以完美恢复

最近接到两个由于操作系统文件被加密,其中的Oracle数据库文件被勒索病毒加密恢复的请求,通过底层分析,确认这两种勒索病毒加密的数据库能够非常好的恢复(可以通过修复,直接open库,然后导出数据,业务直接使用)
[comingback2022@cock.li].eking扩展名加密病毒

H:\BaiduNetdisk>dir *.[comingback2022@cock.li].eking
 驱动器 H 中的卷是 SSD-2T
 卷的序列号是 BC99-FC29

 H:\BaiduNetdisk 的目录

2024-08-05  21:30     1,395,400,994 O1_MF_SYSAUX_MB6WRFF4_.DBF.id[1A1BEE14-2939].[comingback2022@cock.li].eking
2024-08-05  21:30       860,627,234 O1_MF_SYSTEM_MB6WSTMC_.DBF.id[1A1BEE14-2939].[comingback2022@cock.li].eking

[tsai.shen@mailfence.com].faust扩展名加密病毒

H:\BaiduNetdisk>dir *.[tsai.shen@mailfence.com].faust
 驱动器 H 中的卷是 SSD-2T
 卷的序列号是 BC99-FC29

 H:\BaiduNetdisk 的目录

2024-08-04  22:37     5,589,704,978 SYSTEM01.DBF.id[3A33C1D4-2815].[tsai.shen@mailfence.com].faust
2024-08-04  22:37    21,475,631,378 SYSTEM02.DBF.id[3A33C1D4-2815].[tsai.shen@mailfence.com].faust

这两种病毒加密的破坏都是头部32个block,中间32个block,尾部128个block,可以通过自研的Oracle勒索病毒恢复工具进行恢复直接open库
tsai.shen


mkp勒索病毒预防建议:
1. 教育和培训:提高用户的网络安全意识非常重要。通过定期的网络安全培训和教育,向用户传达有关勒索病毒及其传播方式的知识,让他们能够警惕潜在的威胁,并学会如何正确应对可疑的电子邮件、链接和附件。
2. 更新和维护:及时更新操作系统、应用程序和安全软件,以修补已知的漏洞,并确保系统能够及时获取最新的安全补丁。此外,定期进行系统维护和检查,确保系统的安全配置和设置。
3. 备份数据:定期备份重要的数据和文件,并将备份存储在安全的离线或云存储中。确保备份是完整的、可靠的,并且能够及时恢复,以便在发生勒索病毒感染或其他数据丢失事件时能够快速恢复数据。
4. 网络安全工具:使用可信赖的网络安全工具,包括防病毒软件、防火墙、入侵检测系统等,以提高系统的安全性和防护能力。定期对系统进行全面的安全扫描和检测,及时发现并清除潜在的威胁。
5. 访问控制:实施严格的访问控制措施,限制用户对系统和文件的访问权限,避免使用管理员权限进行日常操作,以减少恶意软件感染的风险。此外,定期审查和更新访问控制策略,确保系统安全性得到有效维护。
6. 应急响应计划:制定和实施应急响应计划,明确团队成员的责任和任务,建立应对勒索病毒和其他安全事件的应急响应流程,以最大程度地减少损失并快速恢复业务正常运营。

如果此类的数据库(oracle,mysql,sql server)等被加密,需要专业恢复技术支持,请联系我们:
电话/微信:17813235971    Q Q:107644445QQ咨询惜分飞    E-Mail:dba@xifenfei.com

发表在 勒索恢复 | 标签为 , , , | 评论关闭

opatch auto 出现unable to get oracle owner for 错误

在11.2.0.4环境中使用opatch auto 打psu补丁之时遇到unable to get oracle owner for 错误

[root@rac1 35058300]# opatch auto .
Executing /u01/app/11.2.0/grid/perl/bin/perl /u01/app/11.2.0/grid/OPatch/crs/patch11203.pl -patchdir . -patchn . 
   -paramfile /u01/app/11.2.0/grid/crs/install/crsconfig_params

This is the main log file: /u01/app/11.2.0/grid/cfgtoollogs/opatchauto2024-08-06_22-25-22.log

This file will show your detected configuration and all the steps that opatchauto attempted to do on your system:
/u01/app/11.2.0/grid/cfgtoollogs/opatchauto2024-08-06_22-25-22.report.log

2024-08-06 22:25:22: Starting Clusterware Patch Setup
Using configuration parameter file: /u01/app/11.2.0/grid/crs/install/crsconfig_params
unable to get oracle owner for 

根据mos:OPATCH AUTO Fails with “unable to get oracle owner for” in Multi-Byte Language Environment (Doc ID 1325256.1)的描述是由于多字节语言环境导致,检测当前系统环境,确实是中文语言

[root@rac1 35058300]# env|grep LANG
LANG=zh_CN.UTF-8

export设置LANG=C,然后打patch成功

[root@rac1 35058300]# export LANG=C
[root@rac1 35058300]# opatch auto .
Executing /u01/app/11.2.0/grid/perl/bin/perl /u01/app/11.2.0/grid/OPatch/crs/patch11203.pl -patchdir . -patchn .
  -paramfile /u01/app/11.2.0/grid/crs/install/crsconfig_params

This is the main log file: /u01/app/11.2.0/grid/cfgtoollogs/opatchauto2024-08-06_22-27-31.log

This file will show your detected configuration and all the steps that opatchauto attempted to do on your system:
/u01/app/11.2.0/grid/cfgtoollogs/opatchauto2024-08-06_22-27-31.report.log

2024-08-06 22:27:31: Starting Clusterware Patch Setup
Using configuration parameter file: /u01/app/11.2.0/grid/crs/install/crsconfig_params

Stopping RAC /u01/app/oracle/product/11.2.0/db_1 ...
Stopped RAC /u01/app/oracle/product/11.2.0/db_1 successfully

patch ././32758914/custom/server/32758914  apply successful for home  /u01/app/oracle/product/11.2.0/db_1 
patch ././34998337  apply successful for home  /u01/app/oracle/product/11.2.0/db_1 

Stopping CRS...
Stopped CRS successfully

patch ././32758914  apply successful for home  /u01/app/11.2.0/grid 
patch ././34998337  apply successful for home  /u01/app/11.2.0/grid 
patch ././33112794  apply successful for home  /u01/app/11.2.0/grid 

Starting CRS...
Installing Trace File Analyzer
CRS-4123: Oracle High Availability Services has been started.

Starting RAC /u01/app/oracle/product/11.2.0/db_1 ...
Started RAC /u01/app/oracle/product/11.2.0/db_1 successfully

opatch auto succeeded.
发表在 Oracle安装升级 | 评论关闭

Oracle 23ai 表和视图的列最多支持到4096个

根据经验,oracle在以前常用版本中(包含oracle 19c),表和视图支持最大的列数量为1000,在oracle 23ai中允许支持最大列数量为4096,具体参见:23ai New Feature – Increased RDBMS Table/View Column Limit to 4096 (Doc ID 2947033.1),这里做了简单的试验,确认如果要支持4096列,需要设置max_columns=’EXTENDED’
准备测试表1000列、4096列和4097列

create table t_xff_col_1000(
col1 number,
col2 number,
col3 number,
col4 number,
……
col1000 number
);


create table t_xff_col_4096(
col1 number,
col2 number,
col3 number,
col4 number,
……
col4096 number
);

create table t_xff_col_4097(
col1 number,
col2 number,
col3 number,
col4 number,
……
col4097 number
);

[oracle@xifenfei ~]$ cat tab_col_4096.sql |grep col|grep -v xff|wc -l
4096
[oracle@xifenfei ~]$ cat tab_col_1000.sql |grep col|grep -v xff|wc -l
1000
[oracle@xifenfei ~]$ cat tab_col_4097.sql |grep col|grep -v xff|wc -l
4097

在max_columns为默认值的情况下(STANDARD)23ai版本中最多也只能支持1000列

[oracle@xifenfei ~]$ sqlplus / as sysdba

SQL*Plus: Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems on Mon Aug 5 22:01:57 2024
Version 23.5.0.24.07

Copyright (c) 1982, 2024, Oracle.  All rights reserved.


Connected to:
Oracle Database 23ai Enterprise Edition Release 23.0.0.0.0 - for Oracle Cloud and Engineered Systems
Version 23.5.0.24.07

SQL> show parameter max_co;

NAME                                 TYPE
------------------------------------ ----------------------
VALUE
------------------------------
max_columns                          string
STANDARD

SQL> @tab_col_1000.sql

Table created.

SQL> @tab_col_4096.sql
        col1001 number,
        *
ERROR at line 1002:
ORA-01792: maximum number of columns in a table or view is 1000

在max_columns为EXTENDED的情况下能够支持列4096

SQL> alter system set max_columns='EXTENDED';
alter system set max_columns='EXTENDED'
                                      *
ERROR at line 1:
ORA-02096: specified initialization parameter is not modifiable with this
option


SQL>  alter system set max_columns='EXTENDED' scope=spfile;

System altered.

SQL> shutdown immediate;
Database closed.
Database dismounted.

ORACLE instance shut down.
SQL> SQL> startup 
ORACLE instance started.

Total System Global Area 2413360688 bytes
Fixed Size                  5363248 bytes
Variable Size             570425344 bytes
Database Buffers         1828716544 bytes
Redo Buffers                8855552 bytes
Database mounted.
Database opened.
SQL> show parameter max_co;

NAME                                 TYPE
------------------------------------ ----------------------
VALUE
------------------------------
max_columns                          string
EXTENDED
SQL> @tab_col_4096.sql

Table created.

SQL> select table_name,count(1) from dba_tab_cols where table_name like 'T_XFF%' GROUP BY TABLE_NAME;

TABLE_NAME
--------------------------------------------------------------------------------
  COUNT(1)
----------
T_XFF_COL_4096
      4096

T_XFF_COL_1000
      1000

SQL> @tab_col_4097.sql
create table t_xff_col_4096(
*
ERROR at line 1:
ORA-01792: maximum number of columns in a table or view is 4096
发表在 Oracle 23ai | 标签为 | 评论关闭