Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Security

Network Hacking 175

Posted by timothy from the prepare-for-cranky-anecdotes dept.
Wrighter the Pessimist writes: "In this article on Yahoo, they report that computer hacking has become easier, partially because of devices that have built-in computers, like printers and playstations. However, it also lists a number of 'ordinary' (obsolete?) methods of 'hacking' - such as gaining physical access to a corporate computer, and social engineering. It would be interesting to see a study done on this, to see how many attacks are actually carried out from such devices." The article touches on the Dreamcast Attack mentioned the other day, but also some slightly less bulky approaches. Be on the lookout for dark-clad intruders slipping CD-Rs into machines at your workplace ...
This discussion has been archived. No new comments can be posted.

Network Hacking More

Network Hacking

Comments Filter:

  • Obsolete? (Score:5, Informative)

    by BurritoWarrior ( 90481 ) on Sunday August 04, 2002 @02:40PM (#4008657)
    They day social engineering is obsolete is the day there are no more humans and computers rule the world.

    As long as there are people, social engineering will work wonderfully.

    • Re:Obsolete? (Score:2, Insightful)

      by Cyno01 ( 573917 )
      you cant social engineer a voice mail system, to truly social engineer you have to get a live person, which is becoming harder and harder to do over the fone these days
    • That's not completly true, people know a lot more about computers now then they did in the early 90s. Social enginnering isn't as easy as it use to be, and may in some instances be impossible.

    • They day social engineering is obsolete is the day there are no more humans and computers rule the world.
      This is true. A lot of the most successful modern worms and virii are based largely on a social engineering concept -- trying to get people to do something that will compromise their machine. Love Bug, Klez, Sircam all rely on trying to trick people into clicking on an attachment to launch their payload. They masquerade as legitimate e-mail from people you know and hope you're dumb enough to fall for their tricks. That sounds like a form of social engineering to me.

  • Comment removed (Score:4, Insightful)

    by account_deleted ( 4530225 ) on Sunday August 04, 2002 @02:43PM (#4008672)
    Comment removed based on user account deletion
    • Why even bother with physical access? The number of people here at work who screw their machines up due to email viruses received through checking their Hotmail, Yahoo and AOL webmail accounts at work is frightening.

      Those viruses and trojans slip neatly by all the elaborate MS Exchance server based virus scanners we have.

      And since this is a non-technology sector corporation, they try to cut costs where ever they can, which means McAffee virus scan on the local computers, which has caused so many conflicts between the latest virus definitions and programs like Microsoft Word that most end users tend to turn automatic virus checking off without permission.

      In the end, social engineering will never be "obsolete".

      • Yet another reason why people should be given real computers with proper e-mail software and web browsers. I highly doubt anyone is going to cause any such problems on the Sun Blade workstation on my desk at work with KMail and Konqueror. And before someone complains about it not being "standard" or not being "easy to use" by normal office people: Star Office and KDE.
      • "Why even bother with physical access? "

        How true. It need not even be hotmail or some such. Just send in something that looks like a resumé that does the job.
      • Block webmail sites at your firewall. This can be tedious to do manually, as there are many (and more each day), so try a product like Websense [websense.com] which allows you to block them and get updated "signatures" from the vendor to keep them blocked.

        No, I don't work for them. Yes, we are a customer.
        • Oh, we have tried blocking Hotmail, Yahoo and AOL webmail.

          It only took about two hours after the block for Human Resources to give us a frantic call to unblock those sites.

          As I mentioned, my company is a non-tech sector based company, so the IT department is seen as an unwanted, but necessary evil. And of course, all but two of the higher level executives complained on end about not being able to check their AOL accounts at work.

          And that's another area of attack. The number of executives who put a copy of AOL on their corporate laptops to access personal AOL accounts from home and on the road is insane. And then there's the small remote properties which have access to our network through Citrix, who invariably have a copy of AOL running, often with more spywared software than I care to think about.

          It all comes back to the simple fact that human nature and social engineering are the weakest links.



        • While this will stop the 99% of people harmlessly using webmail, it will not touch the 1% who're technically clued and determined to get around it, be it to just read their mail, or to do malicious damage.

          I have admin'ed several websense boxes (as well as multiple other proxies.) I am a network/security consultant, and the first point I make to any of my customers who want to use an internet control mechanism (i.e. filtering proxy) is that anyone sufficiently determined will get around it--don't try to solve non-technical problems with technology.

          In short, websense makes managers feel good, but it does not work. It doesn't work for SSH port forwarders, it'll work even less once distributed proxy avoidance toys like Triangle Boy gain widespread use, and it'll completely break down once .NET and friends get spinning (read the part where proxy avoidance is explicitly mentioned in .NET docs.)

          At this point, I should probably mention that almost all filtering software works very similarly, that is, it draws from combinations of blacklists meticulously compiled by cat-eyed librarian types trolling for smut, keyword lists, file extensions and content signatures (breaks down with encrypted files, unless you just want to block everything you don't recognize) and sometimes some sort of gymcrackery involving content pattern matching (such as the company claiming to be able to detect porn pictures from the amount of flesh.) The latter rarely work correctly.

          That said, you're just as well off using something free, like DansGuardian [dansguardian.org] or SquidGuard [squidguard.org] with one of the myriad of free filter lists they link to--assuming you can give your management the same feelgood effect from something free or cheap that they'd normally get from forking out $30k upwards to a company like WebSense.

          By the way, did I mention that there is no IDS product which can consistently and reliably detect HTTPS-tunneled SSH traffic based on packet (or even stream) signatures?

          In short, your idea for blocking webmail sites works, as long as your only goal is to prevent the casual user from getting at viruses and other Bad Things (tm) by means other than the corporate sanctioned means, like your local Exchange server. Good Luck! :-)

    • You've never used System Policies, or an 'Approved Applications' listing then? Sure, neither is a panacea, but they would prevent stuff like that happening quite so easily.

      Breaking a Network's security Restrictions can be made difficult, it's just not easy to put the proper restrictions in place on an M$ Product like 2K or XP.
      • 'Approved Applications' listing then?

        Which under Windows is an immensly fun system that checks to make sure the file name is the same.

        Heh.

        Amazing how many programs still work after being renamed to calc.exe :) (some do break though, ugh)
        • Comment removed based on user account deletion

          • When some compilers compile, they store the "original" name somewhere in the binary - MS compilers do this for sure.


            Of course there is always the most extreme case scenario of a person making a custom tool to break into your system, allowing them to compile it with whatever name they want to.

            CRCs or such would help, but even those can be worked around, though with an immense amount of difficulty.

            I remember an article on slashdot quite a while back about a mathematical proof showing that once physical access was gained to the machine, nothing could stop security from being broken down eventually. Though in the most extreme of cases it may take many years and many millions of dollars worth of equipment. ^_^
    • Puting a autorun cd into a drive that installs and puts itself into the startup folder would be very easy and very hard to stop

      It's hard to stop someone putting that disc in, but it's very easy to disable autorun for data discs. (Music can still start automatically, if you want that) It can probably be done by the admin via a policy file, so no user needs to be trusted. No problem there.
      • I'm not sure autorun's going to kick in if the person's not logged on.... and if they are still logged on then the attacker can just run it himself or enable autorun (if he really is that lazy he could keep a script to to it for him when a machine doesn't autorun....)
    • You know, the last place I worked, they never ordered CDRoms for any of the machines. Strikes me as smart in a way now even if it was a royal pita then. Combine this with losing the floppy drive and you'd be doing very well I'd think. Less amount of viruses brought in from the outside as well.
    • Years ago, I did desktop support for a large government installation. I would get assigned a handfull of cases per location at a time. Inevitably, one of those cases would be for someone who was away from their desk with their desktop locked via screensaver. It was good that they were following policy and used either a timed or manual lock - it was bad that normally I'd have to leave a "sorry we missed you" card and their case would go back in to the cue (and further delayed).

      Then I burned an autorun CD that would kill their screensaver when popped in to their CDROM drive. I very rarely ran in to a workstation with autorun disabled. What I usually got was quick desktop access and often a customer comment card thanking me for the quick turn-around.
    • If you have unmonitored physical access to a machine, you can tell it what drive to boot from, which means you can root the machine by simply booting off a disk of your choice. The point is, don't expect a machine to be secure if untrusted parties have physical access to it.
      • If you have unmonitored physical access to a machine, you can tell it what drive to boot from, which means you can root the machine by simply booting off a disk of your choice. The point is, don't expect a machine to be secure if untrusted parties have physical access to it.

        The autorun CD would be much easier than rebooting the machine and definitely tipping off the user that their machine has been used to do something. You'd also face the possibility of passwords on the CMOS setup screen and the system bootup. Then you face even more frustration when you finally do get it to boot up and it comes up in OpenBSD or Linux instead of Win98 and LILO has a password on it so you can't just go use a different init to bypass it without entering a password. Ho hum. Not to mention you can't pull the drive out physically and swap it because the damn user has padlocked the case cover shut. These crazy users!
    • I had a friend in college who put together a CD that would automagically install Linux on a lab computer (they were all the same). He burned a few dozen copies and played Johnny Appleseed one Saturday morning right after the labs opened.

      He called it "Black Hat Linux". Them were crazy times; it was a wonder girls wouldn't talk to us.

    • simple solution: When I rebuilt the pcs in the front, I took out the drive cables to the cd-roms and floppies.

      Nobody noticed - or if they did, they realized they couldn't complain without tipping us off that they were installing games | stuff | whatever.

  • Stealing Secrets 101 (Score:5, Insightful)

    by MosesJones ( 55544 ) on Sunday August 04, 2002 @02:43PM (#4008675) Homepage

    If doing this for a living rather than being a sad muppet who thinks its "cool" (Snowboarding is cool, Skydiving is cool, hacking IIS is not cool).

    1) Buy people, rival firm has a product you need to sabotage... well hire their best brains so it turns out shit... and you get the product as well.

    2) Have a clipboard, 99% of companies and people in those companies will not query a suit with a clipboard. This gives you the ability to walk into any areas saying you are doing a "Time and motion" study for the new Quality Iniative. Or do an "assets" audit and take away servers for "verification" that aren't on the "official register".

    3) Buy the people

    4) Have someone join as a graduate, or even as a more senior person. Sure it violates their contract, but just pay them the cash.

    5) Supply the network upgrade at low low prices via a subsiduary, then ensure they can be "remotely administered as part of the outsourcing and support deal".

    6) Buy the people

    7) Walk into PC support, ask for a backup of your server from date X put onto new server Y. Or even better just get the required files burnt onto CD. Sure you have to fake the paper work, but that isn't hard.

    All of these will be more effective than hiring script kiddies.

    WARNING: Do not try the above at a military base, unless you want to get shot, corporations will normally just have you prosecuted.

    • Strangers accessing the network... (Score:4, Interesting)

      by Pollux ( 102520 ) <speter@[ ]ata.net.eg ['ted' in gap]> on Sunday August 04, 2002 @03:21PM (#4008815) Journal
      2) Have a clipboard, 99% of companies and people in those companies will not query a suit with a clipboard. This gives you the ability to walk into any areas saying you are doing a "Time and motion" study for the new Quality Iniative. Or do an "assets" audit and take away servers for "verification" that aren't on the "official register".

      At my local Walmart, the store's network backbone is located 20 feet from the door leading to the backstock room. There are no obtrusions (except for the occasional six-wheelers with merchandise), and the door's always open. Three-quarters of the time, there's no one in the room, and even if there is, it's typically a low-end manager (the high-end managers like to stick with their own offices) who don't know about how computers work. There's only a "regional" administrator...Walmart feels it's more efficient to let the machines work on their own and pay someone only when the machines don't work.

      All you need to do is look young, wear kahki's and a polo shirt, and carry your "geek-bag-o-goodies", and no one will question you being there. As long as you look like you know what you're doing, no one will think otherwise. In fact, there was even one time where I walked in there completely unanounced just to use the telephone (I work for a vendor, not for Walmart). A manager saw me as he walked on by outside the room, and had no problems with me being in that room.

      Now, realize that the computer network at Walmart controls everything...the lights, heating, TV / Radio / Announcement systems, the ATM network, evertything. Every Walmart has a satellite hookup to the mainframe (no idea where that is).

      My point is that people are way to afraid that someone's going to get them by hacking into the computer, while no one's worried at all about someone walking in and getting them from the inside. There are some wide-open doors when it comes to internal network security (or lack-thereof), and it doesn't take a Hollywood actor to pull off a slip into the server room of almost any company.

      • Walmart franchise computers are controlled from the mainframe cluster at the Home Office. I think that's in Huntsville, Alabama, but it's been a while since I worked for that evil company. I could be wrong.

        I do know that it's a pain in the ass when Home Office turns off all the store systems on sundays during christmas season, because it thinks that the store is closed.

        Regarding physical security to the store server, it was usually quite good. Only one door in, and that was almost always locked. Any non-manager, non-accounting personnel had to be escorted by a manager anytime they were there. I don't know if that's just a quirk of that store, or if it's corporate policy. All I know is that I like a fulltime job in a small business (nice little camera shop) a hell of a lot better than being a Walmart electronics monkey. :)
    • On my campus:

      1) Buy people, rival firm has a product you need to sabotage... well hire their best brains so it turns out shit... and you get the product as well.

      Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.

      2) Have a clipboard, 99% of companies and people in those companies will not query a suit with a clipboard. This gives you the ability to walk into any areas saying you are doing a "Time and motion" study for the new Quality Iniative. Or do an "assets" audit and take away servers for "verification" that aren't on the "official register".

      Our facility, though comprising over 300 people, functions as a closely knit team. Nobody unknown to us gets past the lobby, clipboard or not.

      3) Buy the people

      Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.

      4) Have someone join as a graduate, or even as a more senior person. Sure it violates their contract, but just pay them the cash.

      Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.

      5) Supply the network upgrade at low low prices via a subsiduary, then ensure they can be "remotely administered as part of the outsourcing and support deal".

      We manage all our networks internally. An "outsourcing and support deal" would be laughable.

      6) Buy the people

      Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.

      7) Walk into PC support, ask for a backup of your server from date X put onto new server Y. Or even better just get the required files burnt onto CD. Sure you have to fake the paper work, but that isn't hard.

      All of our change requests are managed electronically. To "fake the paperwork", you'd need access to a logged-in system, an acccount on the change management system, and you'd have to show up the next morning to represent your request at the daily change control meeting. Also, we manage our own backups. Nobody unkown to us would ever request one.

      All of these will be more effective than hiring script kiddies.

      None of these would be any more effective than hiring script kiddies. (Funny story: just this week a script kiddie was caught pounding one of our IPs. Security tracked him down and printed out a desist request on a printer on the kid's network. The attacks stopped a few minutes later.)

      • Our company is rated as one of the 50 best companies to work for [fortune.com] by its own employees.

        I fail to see your argument here. for a large sum of money I would have a very hard time doing the "right thing", even involving murder, theft, etc. Perhaps I'm cynical, but I feel everyone has a price and it's typically not much more than a few million.

        Working for a great company is one thing, but making enough to never have to work again is, in a word, priceless.

        • Certainly. And nobody's saying that solution is foolproof. But it's decidedly non-trivial, and anyway it's difficult to tempt a happy employee.

          Anyway, who's going to pay you "several million" to "never have to work again"? The whole reason that money's out there to begin with is they want you to work for them, instead of the competition.

          • The whole reason that money's out there to begin with is they want you to work for them, instead of the competition.

            I'm sorry,perhaps I misread the previous comments. My understanding what not that a company wanted to steal away employees as much a sabotage the competion. In the case of sabotage you most certainly would pay a large amount to never see a certain rival company's employee ever again.

  • what!!? (Score:2, Funny)

    by Anonymous Coward
    my PLAYSTATION has a built-in COMPUTER?

    holy SHIT!

    im taking it back to the shop before a fucking TERRORIST hacks into it

  • Linksys Vulnerabilities? (Score:1, Interesting)

    by Anonymous Coward

    Serious question [I thought about submitting to Ask Slashdot, but this thread should be just as good]: We've been using a LOT of Linksys devices (NAT routers, wireless access points, etc.). Does anyone have any info [preferably with URLs] about Linksys security vulnerabilities? Thanks.

  • The article's a bit late (Score:5, Funny)

    by bsharitt ( 580506 ) <(moc.ttirahs) (ta) (tegdirb)> on Sunday August 04, 2002 @02:46PM (#4008686) Journal
    I wish I would have know you could have used a Dreamcast, CD, or iPAQ to get access to a network. They caught me when when I tried to sneak my main frame in.

  • Changing passwords often (Score:1, Insightful)

    by Anonymous Coward
    My place of work is so secure it changes ALL the passwords almost every 3 days. And just as you would expect, 1 in every 2 or 3 workstations has every single user/pass combo on a Post-It(tm) stuck right to the monitor.

  • Printer trojans (Score:5, Interesting)

    by Restil ( 31903 ) on Sunday August 04, 2002 @02:51PM (#4008704) Homepage
    At first I took the notion with apprehension. But then I recalled, there was a time when we told people "You can't get a virus in a document file", "You can't get a virus from your email message" But even back in the day, you could cause extensive damage to your dos machine just by typing a text file with malicious ansi codes. Microsoft and others who have opted for the "feature rich" approach to dynamic documents have created more security problems than convienences.

    Postscript is a pretty powerful programming language, and most printers today have it embedded. While I don't think it has TCP/IP capability yet, it wouldn't surprise me if someone doesn't find a stupid reason to implement at feature into the printer language, or even something that allows more low level control of the printer hardware could be used to gain access to the network. Remember people, it doesn't have to be easy. Virus/Trojan writers pride themselves on invading the bold new frontier. Don't get complacent.

    As more appliances get network connectivity and more flexible embedded processors and operating systems, they'll all be subject to the same concerns. I'm already addressing some of these issues with my simple home automation projects. The computer I use to control things is isolated from the rest of the network other than the single open port for commands. Despite the security I might have implemented on my network, I can't assume that the network is always safe. And while right now I only have lamps and sprinklers on this system, when more complex (and potentially dangerous) appliances get added, a comprised system becomes a serious liability.

    -Restil
    • I see your point - and just to add some other examples - most larger printers have some form of web server in them too, plus telnet and ftp in the case of a Xerox DC for example. I've not done any digging on whats actually running in those things, but I'd be willing to bet it's a general purpose OS and that there are other capabilities lurking in there..

    • But even back in the day, you could cause extensive damage to your dos machine just by typing a text file with malicious ansi codes.

      for those that can't remember the venerable ANSI.SYS: you could remap keys to do something completely different. i.e. map the enter key to do 'echo y | deltree c:\*.*', or the obvious format c: equivalent.

      I used ANSI.SYS for my ueber kewl customized prompts of course :)

    • Come to think of it, would it be that hard to gut a laser printer and stick a PC inside? Printers use the same power/network connections. That would be a little less obvious than a dreamcast. Heck, as long as we're talking about sneaking devices onto a LAN to get remote access, why not plug in a small WAP then do your intrusion from outside the building? This might be particularly effective if the office in question does not use a WAN--they wouldn't even be looking for the signals.
  • ...hmmm...based on my experience I'd have to say network hacking reached its "easiest" level right after the year 2000 turned over. There were just so many holes in the software, so packages to choose from, so many unprotected systems, etc. As people have gained wisdom (still without the +1 modifier) about security, I'd have to say systems have been getting steadily harder to hack. (This will probably change if .NET gets widely accepted however.) Of course, this article relies heavily on physical security risks, but I think orgs have greatly tightened these up too since 9/11.

  • Dark-clad intruders? (Score:4, Funny)

    by CoolVibe ( 11466 ) on Sunday August 04, 2002 @02:52PM (#4008708) Journal
    Be on the lookout for dark-clad intruders slipping CD-Rs into machines at your workplace ...

    You mean outsourced sysadmins? Yeah them's a nasty lot.

    ;-)

  • Related article, also on Yahoo! (Score:3, Interesting)

    by Mr. Sketch ( 111112 ) <`mister.sketch' `at' `gmail.com'> on Sunday August 04, 2002 @02:52PM (#4008710)
    There's another related article [yahoo.com] on Yahoo! that mentions that it's okay to hack back.

  • Dark clothes (Score:3, Funny)

    by Anonymous Coward on Sunday August 04, 2002 @02:54PM (#4008721)
    Yeah it sucks. Every time I want to jaywalk or speed a little in the car, I have to put on my robber mask and black cape.

    Who started this crap anyway? All bad guys must wear stereotypical clothing?
    • Good point though. Live social engineering is so much easier if you're wearing a suit. People really are affected if you dress the part. What's even better (if you're looking to get into restricted elevators, say), is wear a tux, and look frantically around for the "wedding" you're missing. Somebody with a key will be glad to help you out.
  • Just think, all those computers on the corporate networks out there, and I without an install CD for the setiathome client.
  • Me and about ten close college buddies are thinking about hacking thermostats with wireless connectivity and connecting them directly into target servers. The hard part is sneaking them into the server rooms without getting noticed. I figure a problem with the printer or air-conditioning would be easy enough to cause, but it's risky.
    Any Ideas?
  • Better give security guys more cash.

    All these "what if" scenarios and "theoretical" hacks, and very little in the way of real world demonstration.

    Now Printers are vulnerable....but I didn't see or read about any demonstrations that showed how to determine what printer was on a network, how to get into that network and how to "own" a printer, and what could be done after the printer was compromised. Did anyone do an nmap -sS -O on an IP of a Lexmark 1200 to see what processor and OS came up?....doubtful. Anyone demonstrate how to connect and get a banner and prompt with netcat? (if they did, what would they do, print with only magenta or screw around with the queue?)

    I'd worry more about the fact that they got on the network in the firt place than the fact that they could take over the printer.

    And the CDROM attack...A Hacker could mail a CDROM and get it to install on a PC because some luser is curious? Yah, I suppose. Or the sysadmin could make accounts in NT and W2k that doesn't allow programs to be installed...hell, they don't even have to allow CDROM access.

    Maybe they should testify before congress and claim that they can bring down the internet in 30 minutes from a HP Plotter, or that Osama Bin Laden will now mail CD's promising free "Click Art" to unsuspecting secretaries around the US with a thing for "Precious Moments" themes. Because Congress will shovel any amount of money to greedy bastards wearing a propeller beanie, and talking about things they know nothing about.

    Ironic that these guys often start out by breaking into places, then demanding alot of money to protect the world from people like them, and then advocating jail time for future business competitors down the road.

  • That's a 1337 hack (Score:3, Funny)

    by Rolo Tomasi ( 538414 ) on Sunday August 04, 2002 @03:12PM (#4008783) Homepage Journal
    The speakers demonstrated for the crowd how an attacker can slip a tunneling CD into a [...] Compaq iPaq, and connect to the network.

    I'd really like to see that ... I'm curious as to what kind of axe is used.

  • Where I work, if someone showed up with a Dreamcast and plugged it into our network, the poor sap would be fired before you can say "choo choo rockets".

    Now I had thought that was a reflection of the mean streak in management.

    Now I learn that its a security precaution. That's alright then.

    Patrick

  • famous quotes (Score:1, Funny)

    by Anonymous Coward
    640k is all you will need.

    There's a market for 3, maybe 4, computers in the world.

    DMCA will foster innovation.

    Social engineering is obsolete.

  • Uh oh, possible future FUD avenue... (Score:1, Interesting)

    by Anonymous Coward
    So, you can burn a bootable CD, feed it to a machine for a few seconds, then walk away and have it become your zombie slave.

    How long until our favorite company (ahem) uses this to spin some tale about how the "signed OS" BIOS replacement is the right way to go? "Get this, and you don't have to worry about rogue hax0rs".

    Unfortunately it also lets them tighten their grip like with the DRM stuff that keeps coming up. Blah.
  • I find it so funny that in this day and age, getting a password is so easy. I've had friends posing as campus computer specialists get passwords into the most "holy grail" of computer systems. I can't get into much detail here but what people don't understand is that your password is more than your house key. It has your life behind it. Especially when these days people use online stock trading, medical record databases, personal e-mail, financial accounts, bills, etc. I routinely have to go to my parents house to make sure that they aren't saving passwords on their home computer to extremely sensitive sites. I have to make sure there system's drives are encrypted for that just-in-case scenerio. People I guess just don't understand.

    As for these small devices that people use to "hack", I largely doubt there is much to worry about.
    • +1

      and whats even worse is when they use the same password for lots of accounts. Just one accident with a keystroke recorder or social engineer and they've given someone else access to everything.

  • uneducated users (Score:4, Interesting)

    by Snowbeam ( 96416 ) on Sunday August 04, 2002 @03:41PM (#4008880) Homepage
    Till this day, I have users who call and are handing over their username and password without me saying anything more than "Hello!".

    There are users I call who hand over the same information without any thought. Most of the time, I am there busy telling users to please not give me that information. The comparison of the username/password being like an ATM card and pin just doesn't work.

    Our abuse department (yes we have one) has a two strikes and you're out policy. That is to say, if anything happens from your account the first time, you are given a warning and forced to read the entire IT policy. The second time, you account is deactivated in effect terminating your employment/affiliation with the university. You pretty much need your account for everything.

    This issue has been spoken about for years and things rarely improve, but I still believe educating users is the best way to eventually solve the problems here.
  • Hmm.

    You can get unauthorized access to a network easily by gaining physical access first.

    As computers proliferate and approach ubiquity, security becomes a larger issue.

    These are the central themes I identified. This is not news. It is hardly even analysis.

    Actually, it struck me more as a kind of public service announcement designed to raise levels of awareness.

  • I mean it. I'm a consultant and its surprising how much I can get a sys admin to do for me over the phone, from across the country.

    Recent example - we were converting 17 years of production data from a mainframe into a the replacement system. With the volume, we needed an uninterrupted 40 hour window, but the client performed a cold backup of the database nightly.

    The process in place says we call the production DBA's (who know us, and are employees, not contractors like us) and they pass official word to the operators in the datacenter.

    Well, after 9 hours of loading, the database goes down at 5:00am. We call the prod dba's, and the on-call guy doesn't answer. So I call the ops center. The story I get is that a contractor on another project requested a backup of some critial files stored on the db box. He did this directly with the operator at 11:00 the night before, and the operator didn't even remember his name.

    If a simple phone call to ops is all it takes to take the system down, why bother with the standard exploits?

  • I can just see (Score:3, Funny)

    by Herkum01 ( 592704 ) on Sunday August 04, 2002 @04:02PM (#4008943)

    Spammers going after a network printer...

    loop (1..1000)
    line.font = bold;
    line.size = 18pt;
    line.output = "Need more toner? Call us at ###-####"
    line.pagebreak
    endloop()
  • I've never known a time period when "hacking" was particularly difficult, especially if one wasn't targeting a specific machine or network. The sad truth that has always been, and shows little evidence of changing anytime soon is... most people don't plug obvious, well-known, long-discovered vulnerabilities. Most "hacking" could be cleared up overnight by simply applying the knowledge and fixes that are readily available.

  • Cant hack into a Mac OS! NEVER done once (BugTraq) (Score:1, Interesting)

    by Anonymous Coward
    The MacOS running WebStar and other webservers as has never been exploited or defaced.

    I know some indication of that particular news piece is regarding cheap local machine packet grabbing, not WAN exploits, but the fact is still the same, no Mac OS 8x or 9x have EVER once been rooted.

    In fact in the entire securityfocus (bugtraq) database history there has never been a Mac exploited over the internet remotely.

    That is why the US Army gave up on MS IIS and got a Mac for a web server.

    I am not talking about BSD derived MacOS X (which already had a couple of exploits) I am talking about current Mac OS 9.x and earlier.

    Why is is hack proof? These reasons :

    1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT

    2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidians birthday into certain registers and make a special call). By always being root their is no false sense of security.

    3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits. Individual 3rd party products may use C stings and bind to ANSI libraries, but many do not.

    4>: Macs running Webstar have ability to only run CGI placed in correct directory location and correctly file "typed" (not file name extension).

    5> Macs never run code ever merely based on how a file is named. ".exe" suffixes mean nothing. For example the file type is 4 characters of user-invisible attributes, along with many other invisible attributes, but these 4 bytes cannot be set by most tool oriented utilities that work with data files. For example file copy utilities preserve launchable file-types, but JPEG MPEG HTML TXT etc oriented tools are physically incapable by designof creating an executable file. The file type is not set to executable for hte hackers needs. In fact its even more secure than that. A mac cannot run a program unless it has TWO files. The second file is an invisible file associated with the data fork file and is called a resource fork. EVERY mac program has a resource fork file containing launch information. It needs to be present. Typically JPEG, HTML, MPEG, TXT, ZIP, C, etc are merely data files and lack resource fork files, and even if the y had them they would lack launch information. but the best part is that mac web programs and server tools do not create files with resource forks usually. TOTAL security.

    4> Stack return address positioned in safer location than some intel osses. Buffer exploits take advantage of loser programmers lack of string length checking and clobber the return address to run thier exploit code instead. The Mac places return address infornt of where the buffer would overrun. Much safer.

    7> There are less macs, though there are huge cash prizes for cracking into a MacOS based WebStar server. Less macs means less hacker interest, but there are millions of macs sold, and some of the most skilled programmers are well versed in systems level mac engineering and know of the cash prizes, so its a moot point, but perhaps macs are never kracked because there appear to be less of them. (many macs pretend they are unix and give false headers to requests to keep up the illusion, ftp http, finger, etc). But some huge high performance sites use load-balancing webstar

    8> MacOS source not available traditionally, except within apple, similar to Microsoft source availability to its summer interns and engineers, source is rare to MacOS. This makes it hard to look for programming mistakes, but I feel the restricted source access is not the main reasons the MacOS has never been remotely broken into and exploited.

    Sure a fool can install freeware and shareware server tools and unsecure 3rd party addon tools for e-commerce, but a mac (MacOS 9) running WebStar is the most secure web server possible and webstar offers many services as is.

    One 3rd party tool created the only known exploit backdoor in mac history and that was back in 1995 and is not, nor was, a widely used tool. I do not even know its name. From 1995 to 2002 not one macintosh web server on the internet has been broken into or defaced EVER. Other than that event ages ago in 1995, no mac web server has ever been rooted,defaced,owned,scanned,exploited, etc.

    I think its quite amusing that there are over 200 or 300 known vulenerabilities in RedHat over the years and not one MacOS 9.x or older remote exploit hack. There are even vulnerabilities a month ago in OpenBSD.

    Not one exploit. And that includes Webstar and other web servers on the Mac.

    --- too bad the linux community is so stubborn that they refuse to understand that the Mac has always been the most secure OS.

    BugTraq concurs.
    • hummm, not sure RedHat is the best exemple in linux security :-)
      The big problem with RedHat is that by default, the box is HIGHLY unsecure. Lots of stuff running and possibly hackable.

      And even if all you say is surely true, you are wrong, the most secure server is not a MAC.....It's simply the system that is managed by a good admin. I'm pretty sure 95% of the hacks were made possible because the admins didn't do their work( like updating the packages ).
  • I would expect Slashdot, of all places, to avoid misusing the word "hacking".

    Even if we were to give up the battle over the original meaning of the word (a concession I do not make), the meaning being propagated by the media seems deliberately designed to cause confusion. When the same word is used to refer to (a) exploring and/or modifying a system you own, (b) breaking or bypassing the security features of a system someone else owns, and (c) breaking into and vandalizing a system someone owns, it gives the impression that anyone who does any of these things is a criminal -- or, conversely, that anyone who vandalizes someone else's computer system is just having a little innocent fun.

    If you want to talking about someone breaking into someone else's computer system, call it what it is -- trespassing. If you want to talking about someone deliberately modifying someone else's computer system without permission, call it what it is -- vandalism.
  • Gee, I know not a day goes by that I don't walk through and see people plugging their Dreamcast into my network. Nope, nothing unusual about that. Carry on.
  • gaining physical access for DOS attacks:
    this hi-tek method consists of unpluging a server or network cable.

  • I was wondering if anyone here has ever gone to you local Wal-Mart or similiar retail computer dealer, rebooted the machine to DOS, and FDISKed it?

  • Web server written in PostScript (sources) (Score:3, Interesting)

    by tlambert ( 566799 ) on Sunday August 04, 2002 @06:13PM (#4009392)
    http://www.pugo.org:8080/

    As it points out, you can't listen on any port you want, because PostSCript lacks the ability to open sockets, post listens, or accept connections.

    On the other hand, a few modifications, and it can listen on the LPR port of an HP network printer (all it has to do is intecept new connections, not listen or accept by itself).

    -- Terry

  • Wow. (Score:1)

    by awx ( 169546 )
    ...The speakers demonstrated for the crowd how an attacker can slip a tunneling CD into a CD-ROM drive, a Sega Dreamcast ( news - web sites) gaming console, or a Compaq iPaq, and connect to the network...

    To be fair, any hacker who can slip a CD into an iPaq deserves net access from whoever they choose...
    • To be fair, any hacker who can slip a CD into an iPaq deserves net access from whoever they choose...

      I believe that you mean "whomever".

    • an iPaq is a small form factor computer, as well as a handheld device. If you'd like, I can take a picture of one and email it to you, but they're the shittiest computers ever made
  • Well, I always thought passwords to accounts and stuff were pretty secure. About a month ago, I started working for a local non proft organization in my spare time, helping with tech things, one of those things being redoing the website. Unfortunately, no one knew the host, username, password.. etc etc. So, I called up the host (which was pretty easily discerned) and prepared myself for a long, long time of persuation, arguing, threatening, etc etc to get our password changed :)

    Five minutes later, we had a new password. I wasn't asked for an invoice number, name, or anything. I was a little worried. Should ISPs and such start taking 'hints' and stuff (mother's maiden name.. etc)?

    Personally, I think it's a dilemma. Customer service reps think that since someone went to the effort to call, they must be the account owners. It's no surprise Kevin Mitnick knows more about the Vegas phone system than the phone company does! Ask, and ye shall receive. Someone else ask, and they shall receive too. :(

  • Let's see... 75 to 85 percent of all computer break-ins are made through social engineering. How obsolete is that?
  • I send this CD in order to have your advice.

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close