The Oracle® Hacker's Handbook: Hacking and Defending Oracle

12.2. Encrypting Data Prior to Exfiltrating

Some database intrusion detection products examine data leaving the server to determine whether it matches a given pattern — for example, Personally Identifiable Information (PII) such as credit card numbers or social security numbers. To avoid setting off alarms, attackers may obfuscate or even encrypt the data before stealing it. Anyone sniffing the network wire will just see an innocent-looking nonsense or random strings. Needless to say, to some this may be considered evidence of a compromise, so the attacker is left with striking a balance. Using credit cards as an example, devices looking for such data leaving the database server can often be trivially tricked by simple concatenation of two or more card numbers. Each character of the numbers could be summed with a constant — for example, 0×20 — making a numeric string an alpha string using the characters P to Y. Packages such as the DBMS_OBUSCATION_TOOLKIT, DBMS_CRYPTO, or UTL_ENCODE can also be used. For example,

select utl_encode.base64_encode((select password from dba_users where
username = 'SYS')) from dual;

results in the base64 encoded string of "30367274702B3268744B6F3D".

Another alternative is to use the LZ_COMPRESS function of UTL_COMPRESS, which uses the Lempel-Ziv compression algorithm.

select utl_compress.lz_compress((select password from dba_users where
username = 'SYS'),6) from dual;

This produces the string "1F8B080000000000000BBBBCEAEDF2B70BB7 AC020094E6B32C08000000". ...