Pete Finnigan

In forensics the evidence can be grouped into two blocks. The first is changes made to the database and the second is read activity. Usually an attackers goal is to steal data (read) but he may need to do changes....[Read More]

Posted by Pete On 06/10/26 At 02:16 PM

First, I am appending this text here before I post this blog live as I realised its almost exactly 22 years since I started this blog in September 2004; so happy birthday to my blog!! Now to the actual subject....[Read More]

Posted by Pete On 28/09/26 At 08:36 AM

Last week I posted a blog - Extreme PL/SQL - Running an Assembly Language Program in PL/SQL where I presented the fact that I have written a virtual machine on PL/SQL and also an assembler in PL/SQL and showed how....[Read More]

Posted by Pete On 23/09/26 At 07:52 AM

Back in 2022 I started work on an idea that I could build an interpreter for a simple language in PL/SQL and then building on that create a Virtual Machine in PL/SQL and an assembler in PL/SQL for the assembly....[Read More]

Posted by Pete On 16/09/26 At 08:54 AM

As you will have noticed in my blogs I have been using and playing with AI and Large Language Models (LLMs) for a while now but with a focus on Oracle Security still. I want to understand the capabilities of....[Read More]

Posted by Pete On 10/09/26 At 10:35 AM

We support doing security audits of all of the current Oracle databases from 19c to 21c and 26ai. We also support doing security audits on databases in your own data center or in the cloud. No matter where the database....[Read More]

Posted by Pete On 09/09/26 At 12:33 PM

I got asked a question via a DM on one of my social media channels a few days ago and thought it worth an investigation. They asked me; Can an Oracle synonym point to another synonym, ad infinitum. Let me....[Read More]

Posted by Pete On 07/09/26 At 08:08 AM

I was asked by someone recently why their context values had disappeared. They had two database users that created the same context. Yes, I know you cannot do that but there was a subtle reason that the code did not....[Read More]

Posted by Pete On 02/09/26 At 09:30 AM

A few weeks ago I did a sample blog post to use local LLM to create a PL/SQL package to encrypt and decrypt data in an Oracle database - AI Comparison for Oracle Security Code Generation . In that blog....[Read More]

Posted by Pete On 19/08/26 At 12:42 PM

There are many components that are part of Database Vault. At the lowest level are factors that encapsulate the individual pieces of data that you may use in the rest of the set up. Then there are DV rules that....[Read More]

Posted by Pete On 17/08/26 At 12:51 PM

I am using my local LLM using a mac book pro M5 64gb and running Ollama, open-webui via docker and the interface on my Windows laptop. I posted a blog recently Can local LLM AI generate the top 100 most....[Read More]

Posted by Pete On 05/08/26 At 09:35 AM

As part of a previous investigation when looking at timestamps and dates for changes recorded to the database meta data I noticed in addition to the normal columns the SYS.USER$.SPARE6 column as it was populated for some users. I also....[Read More]

Posted by Pete On 03/08/26 At 01:59 PM

One area I have not covered in previous blogs about Oracle Security and AI is sovereignty of that AI and of course in particular of the data. This means that the control of the hardware (compute and GPU) and the....[Read More]

Posted by Pete On 29/07/26 At 02:20 PM

My day to day focus is helping customers secure data in their Oracle databases. As you will have seen from a small number of blogs here recently I have been writing a little about AI and in particular local LLMs....[Read More]

Posted by Pete On 28/07/26 At 08:41 AM

I am working on a simple password audit tool for Oracle Apex and I have written a simple password cracker in PL/SQL to test if a password is found or not; i.e. is the password weak or not. To allow....[Read More]

Posted by Pete On 23/07/26 At 12:01 PM

Sometimes in forensic analysis of an Oracle database it is necessary to understand how data is stored on disk. Actually we must understand that if we were to create our own database we might start with a file that holds....[Read More]

Posted by Pete On 13/07/26 At 09:11 AM

If we have an Oracle database table with no timestamp can we still get a date/time stamp when something happened? For instance if a table has a date/time column then yes of course we can know when the records changed....[Read More]

Posted by Pete On 25/06/26 At 10:53 AM

I have been involved with Oracle Database Vault recently with a deployment and I was asked how can someone view the database vault dictionary views when DV is installed. So, if we start with no DV enabled in our database....[Read More]

Posted by Pete On 02/06/26 At 12:49 PM

Let us imagine that I have a 21c database that has Database Vault (DV) enabled and I have forgotten my Database Vault owner password. In my case C##DVO. This user as well as a backup (That I have also forgotten....[Read More]

Posted by Pete On 28/05/26 At 02:17 PM

I am slightly late with this one as the event itself was on the 7th May 2026. The World Password Day 2026 is a day to try and highlight that passwords are weak. An article I saw on line said....[Read More]

Posted by Pete On 11/05/26 At 12:37 PM