标签云
asm mount asm恢复 asm 恢复 bbed bootstrap$ dul eking In Memory kcbzib_kcrsds_1 kccpb_sanity_check_2 kfed MySQL恢复 ORA-00312 ORA-00607 ORA-00704 ORA-01110 ORA-01555 ORA-01578 ORA-08103 ORA-600 2662 ORA-600 3020 ORA-600 4000 ORA-600 4137 ORA-600 4193 ORA-600 4194 ORA-600 16703 ORA-15042 ORA-15196 ORACLE 12C oracle dul ORACLE PATCH Oracle Recovery Tools oracle加密恢复 oracle勒索 oracle异常恢复 Oracle 恢复 ORACLE恢复 ORACLE数据库恢复 oracle 比特币 OSD-04016 sql加密恢复 YOUR FILES ARE ENCRYPTED 勒索恢复 比特币 oracle 比特币加密文章分类
- Others (2)
- 中间件 (2)
- WebLogic (2)
- 操作系统 (91)
- 数据库 (1,431)
- DB2 (22)
- MySQL (58)
- Oracle (1,314)
- Data Guard (41)
- EXADATA (7)
- GoldenGate (20)
- ORA-xxxxx (150)
- ORACLE 12C (72)
- ORACLE 18C (6)
- ORACLE 19C (12)
- ORACLE 21C (3)
- Oracle ASM (60)
- Oracle Bug (7)
- Oracle RAC (42)
- Oracle 安全 (6)
- Oracle 开发 (26)
- Oracle 监听 (26)
- Oracle备份恢复 (445)
- Oracle安装升级 (71)
- Oracle性能优化 (62)
- 专题索引 (5)
- 勒索恢复 (63)
- PostgreSQL (13)
- PostgreSQL恢复 (3)
- SQL Server (26)
- SQL Server恢复 (7)
- TimesTen (7)
- 达梦数据库 (2)
- 生活娱乐 (2)
- 至理名言 (11)
- 虚拟化 (2)
- VMware (2)
- 软件开发 (26)
- Asp.Net (9)
- JavaScript (12)
- PHP (2)
- 小工具 (9)
-
最近发表
- ORA-600 2032故障处理
- Oracle Recovery Tools实战批量坏块修复
- ORA-15063: ASM discovered an insufficient number of disks for diskgroup 恢复
- 修改oracle scn小工具(patch scn)
- ORA-01110 ORA-17070 OSD-04006 故障恢复
- fdisk分区导致asm disk破坏数据库恢复
- ORA-600 kcvent_internal_02故障处理
- PostgreSQL恢复系列:pg_filedump基本使用
- Oracle断电故障处理
- PostgreSQL恢复系列:pg_control异常恢复
- PostgreSQL恢复系列:wal日志丢失恢复
- pvcreate asm disk导致asm磁盘组异常恢复
- O/S-Error: (OS 23) 数据错误(循环冗余检查) 数据库恢复
- 数据库open报ORA-00959: tablespace ‘UNDOTBS1′ does not exist分析
- ASM删除表空间恢复
- ORA-12518 ORA-27302: 错误发生在: ssthrddcr
- plsql 插入blob
- 分享运气超级好的一次drop tablespace 数据恢复
- segment header异常对象删除处理
- Oracle 数据库(RDBMS)的版本支持状态摘要 (Doc ID 1674382.1)
友情链接
标签归档:.$ILICONE
比特币加密勒索间隔加密
最近我们在一个客户的oracle恢复case中发现比特币文件系统勒索加密比较特殊,和大家做一个分享
文件加密后缀名为:.$ILICONE
文件加密特点分析
DUL> dump datafile 5 block 1 Block Header: block type=0x0b (file header) block format=0xa2 (oracle 10) block rdba=0x01400001 (file#=5, block#=1) scn=0x0000.00000000, seq=1, tail=0x00000b01 block checksum value=0x6e7d=28285, flag=4 File Header: Db Id=0xe1891cca=3783859402, Db Name=XIFENFEI, Root Dba=0x0 Software vsn=0x0, Compatibility Vsn=0xa200300, File Size=0x3ffffe=4194302 Blocks File Type=0x3 (data file), File Number=5, Block Size=8192 Tablespace #7 - OA rel_fn:5 DUL> dump datafile 5 block 2 Block Header: block type=0x63 (unknown) block format=0x57 (unknown) block rdba=0xc6538298 (file#=793, block#=1278616) scn=0xe0ab.fdc4d8d0, seq=225, tail=0xa7b5cab5 block checksum value=0xfaa1=64161, flag=165 corrupted block. DUL> dump datafile 5 block 3 Block Header: block type=0x1e (LMT space map block) block format=0xa2 (oracle 10) block rdba=0x01400003 (file#=5, block#=3) scn=0x0000.00246fbe, seq=1, tail=0x6fbe1e01 block checksum value=0xe495=58517, flag=4 DUL> dump datafile 5 block 4 Block Header: block type=0x83 (unknown) block format=0xa3 (unknown) block rdba=0x17e4c9e4 (file#=95, block#=2410980) scn=0xe3b2.fc505eea, seq=101, tail=0x6e2f1004 block checksum value=0x7f2e=32558, flag=196 corrupted block. DUL> dump datafile 5 block 5 Block Header: block type=0x1e (LMT space map block) block format=0xa2 (oracle 10) block rdba=0x01400005 (file#=5, block#=5) scn=0x0000.00264875, seq=1, tail=0x48751e01 block checksum value=0xb25e=45662, flag=4 DUL> dump datafile 5 block 6 Block Header: block type=0x68 (unknown) block format=0x35 (unknown) block rdba=0x7011e0e3 (file#=448, block#=1171683) scn=0x47bf.9f2df54a, seq=207, tail=0x69ae0a91 block checksum value=0x49f8=18936, flag=174 corrupted block.
通过这里初步分析,确认加密是间隔方式加密,在数据库中表现明显的是每相隔8k进行加密,而且这里是偶数block被加密
确认加密文件结束位置
DUL> dump datafile 5 block 962818 header Block Header: block type=0x4d (unknown) block format=0xde (unknown) block rdba=0x0bab780d (file#=46, block#=2848781) scn=0x056b.2c695f6b, seq=223, tail=0x2399e0cb block checksum value=0x9706=38662, flag=212 corrupted block. DUL> dump datafile 5 block 962820 header Block Header: block type=0x00 (blank block) block format=0xa2 (oracle 10) block rdba=0x014eb104 (file#=5, block#=962820) scn=0x0000.00000000, seq=1, tail=0x00000001 block checksum value=0x174a=5962, flag=5
通过这里可以发现,对于一个32G的文件,一直被加密到block 962818,也就是7.34G(962818*8k),这里间隔加密,而且加密深度特别深,在以往的比特币文件系统加密中比较少见.
再次提醒
1. 不要把数据库暴露在外网
2. 相对linux而言,win更容易受到黑客的攻击
3. 数据库一定要做好备份,条件允许的情况下,配置数据实时同步到其他机器还是有必要的