Re: Adding some random characters to Oracle password

>It can't get discovered because it is hard-coded and compiled into the app.
>Source code is secured.

Hi,

Hard coding passwords into applications is a bad idea. If its not possible to simply get the password with strings because its obfuscated in some way then it is possible for some people with a debugger. You do not need the source to get the password. If you have this in your application copy the binary to a Unix box and run "strings" against the binary and see what you find.

kind regards

Pete

-- 
Pete Finnigan (email:pete_at_petefinnigan.com)
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.