IT Employment

Ask something
Discussion Locked

Hacker Help?

0 helpful
21 replies

by alex

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
Recently I had one of my webservers compromised with a fresh exploit that had been released. I was actually in the stage of testing the patch for it on my mock server. Guess he was just too fast for me. The thing is he didn't do anything, I mean didn't deface or touch anything. (Well I couldn't find any evidence and he said he didn't, the box was formatted regardless.)He simply emailed me and let me know of the opening. Well at first I was upset... my domain, my world had been violated. But then I realized... "Man I'm glad he wasn't a vicios web defacer punk!" I mean coming in to work and having my boss looking at a defaced website that I am in charge of securing... that would be awful. So now it was decision time. Of course I have always dealt with hacking as a 0% tolerance, but this was different. I actually felt a little appreciative. I decided not to persue after this individual. What would you do? Do you see "hackers ethics" as being useful or just bull? I see it as a double edged sword really.

21 replies

by teauteau

You are right to be relieved that the "hacker" only notified you of the hole in your security. I wouldn't pursue the person responsible. I don't see him or her as much different from the software reviewers that examine software and internet sites for holes and errors, and then post the results on the internet in a news format.

Consulting with this person, who obviously has good security knowledge may even benefit you in your job and prevent any defacement from occuring in the future. Just don't give away any of your secrets.

by tsqr1951

From reading 2600, the Hacker magazine, one article the author said, he just hacks for the challenge, as many of his friends do.

It seems to me that hacking is like any other persuit. The majority of hackers do it for the challenge, and a small minority do it out of jeoulsy or just to be malicous.

You were very lucky this time.

Regards,

Jess

by bryan.todd2

There are a wide number of groups who do nothing but hack and inform. One big group that was in the limelight a year or so ago was "L0pht". All they do is hack corporations and email thim with their vulnerabilities. All the true hackers want is the free-flow of data and freedom of information and it seems that thay passed the information on to you too.

by alex

He did not say he was part of any group. The mail was from a hotmail acct. You know that sounds good in theory to just email them and let them know and claim "no damage". But what do you expect the person to do? just patch that one hole and whistle dixie? Noone in their right mind would leave a server that has been exploited on their network. The only good thing about that is that taking it down yourself might be a little more convienent on you then having one cracked and burned unexpected.

by rzan

Dude, implement a firewall! The best firewall I have ever seen is Cisco System's PIX. Although you need to have a good solid understanding in TCP/IP, ports, and Cisco IOS commands, this little box kicks ass when it comes to security. Another device is the NetRanger, a device that monitors Denial of Service (DoS) attacks and will automatically shut down any port that is being actively scanned by port scanner software.

Roger Zan, CNE

by al macintyre

There's a news story on vnetunet.com "European firms getting security wrong" that says in Europe

97 % of e-business companies use anti-virus software, which tells me 3% are very vulnerable or are on a virus proof computer - check out my discussions for where I have posted about that kind of computer

67 % of them use fire walls, which tells me 33% are vulnerable to hackers or are on a hacker proof computer, but even those that cannot be hacked because they have no physical vulnerabilities are still at risk from social engineering.

by msamson

And count your blessings... although I agree with the general tone of the discussion... My personnal experience with firewalls would point you to www.gnatbox.com

Some awesome firewall solutions that don't break the bank and are still ICSA certified.

Good Lock... :)

M.

by fluxit

It seems that many of you think that this guys was doing alex a favor by notifying him of his vulnerabilities.

I think this guy was diabolical.

Ask yourself these questions:

1. What is this hacker's motives?
2. Does he desire to instill paranoia?
3. Is an hack only against the computer, what about the company?
4. What about the integrity of your information?
5. Did you turn your attention?

It is possible that the hack never occurred but the individual was looking to stir something up. Was he sucessful? Did you turn your attention away from something important to deal with the hack? It may have been the ole bomb scare tactic just before that big exam that perhaps someone was not ready for.

If the hack did occur - could it possibly be a competitor? Did he access/receive proprietary information? Was information altered?

Industrial espionage is big business. I know of a guy who flew over a mfg plant after the roof blew off and took photos of thier process. He was arrested and put in jail. I would not be surprised if the same is happening over the interent which is like inviting everyone into your home by swinging open the patio doors.

The PIX firewall is good since it works at line speed. Turing off ports such as in net ranger is another good tactic. But what if the attack is long and slow. these may never detect it unless you are running a history and trend but even at that over time the network noise could look like an attack.

You really need to think about your security and have a plan on how to respond. A hacker may want to deny you service but can achieve the same effect without slamming your ports. He can simply send you an email and you respond by turing off the router to protect yourself. Then no one has service to the internet and you did it to yourself.

You may have been a victim of Information Operations against your company.

by fluxit

You cannot operate at 100% readiness all the time - that will exhaust you. You need to establish a DMZ, channel the hacker, feed him BS, and be in his face about it all the time. Basic military linear warfare tactics.

In your DMZ trap the hackerby putting up a machine that looks good to him. The low hanging fruit. Stock it with porno pictures and fake documents labelled secret. When he bites it, have the system alert you. He'll be wearing the emperor's cloth's. You'll see all of him but hewon't know it. Tease him while monitoring his activities. Be in his face.

If you can, find out what IP he is coming from and validate his domain. You could use logs on your system to identify his IP. Then send him an email thanking him for entering your system. WOW that would be wild! I would not hack him or slam his ports as that is illegal for you to do.

It could be illegal for you to identify him but are you going to prosecute him? Chances are that nothing legal will come of either effort and the law is still being developed in this area. The FBI is overwhelmed with crimes like this and does not have time to deal with petty stuff. Take advantage of it.

Freak the hacker out. The I know what you did syndrome!

by mat_vishal

I strongly belive in the "I KNOW WHAT YOU DID SYNDROME". By time they come up with the rules it time for us to play with the ports of the remote servers.
The technology can track you but if you are clear enough they would never be able to even knowthat you were surfing in there servers.
Probably it satifys the URGE to defeat system and there defense support architecture. After all its a human brain...

by bryan.todd2

Ever heard of entrapment?
The best thing to do would be to hire someone who specializes in network security.
Even then, you can still be prone to hackers who manage to get into your system. There is no such thing as a secure system.
I take that back....
one computer inside a room made entirely of steel, no windows, no modem, no network, protected by heavily armed men who let no one in or out of the room.
No one uses it, no potential for it being hacked.

by Member 21361443

You forgot to weld the door shut and unplug the PC. Then cut all the power lines to the building.

First off, let me say that hackers don't bother me. It's crackers that bother me. Many people are hackers that don't break into systems for any reason. The term can even be applied to certain non-computer fields. Crackers work on "cracking" a system with intent to create fear, steal, or otherwise deface or destroy.

Anyway, although this hacker seemed rather benign, I would still be a little hot under the collar with him. Who knows? He might have been drumming up some security business via profiteering, which is pretty unethical by itself. Or, he could have copied critical information. Whether benign or not, though, doesn't make the act right or responsible. Now, if someone wants to benignly check my security, voluntarily or otherwise, give me a call, or e-mail me first! I'd be happy to work with an experienced and honest person! But, I'm not going to consider anything benign that permission wasn't requested first.

Brian Lusk

P.S. Would you feel happy and safe if someone broke into your house, didn't steal anything and left a note on the kitchen table telling you that your house is vulnerable to burglars and how to fix his entry point?

by fluxit

Entrapment is a term used in the legal realm when policing authorities entice you to do something illegal by performing illegal acts themselves then bust you for breaking the law.

Network admin have the right to defend the networks. Moreover, if the individual has broken into your networks (ie smashed a window and climbed in) you can bait him and lead him away from your critical stuff using honey pots. That is legal. However, identifying him by name and location is illegal unless you are a policing activity but for the small boys and minor incidents I think its the wild west. Every man for himself.

by al macintyre

There is such a thing as a secure computer system. There are in fact several, manufactured by about 2 dozen different computer vendors. Check out
http://www.radium.ncsc.mil/tpep/epl/epl-by-vendor.html

However, most companies either do not buycomputer systems that can be made secure, or do not invest in the appropriate training & thinking & policies to make what they buy secure. Check out other discussions I am in for more detailed discussion of this notion.

Is your automobile securefrom theft?

Do you leave the doors open & the keys in the ignition? That is what a lot of people do with their computers.

by alex

Thanks for all of your input. I agree I was lucky in this incident. Since then I have developed a DMZ with an IDS box. This incident gave me the chance to push the budget to get it.(ironic that this hack is gonna actually help me avoid hackers in the future, huh). By the way, I did have a firewall in place, but when your webservice is exploited you very well can't block port 80 on your webserver. Given that a firewall will keep some exploits that may be loaded on your system from getting out, but I beleive too many people are overdependent on firewalls. I was hoping to hear about some other net admins that were put on the spot of whether to persue prosecution or not.

*By the way, the domain I administer is not the domain in my email addy. So put your scanners away. You know who you are. :)

by netw3

Good points made. I was doing a vulnerability scan of a site the other day and found a gaping RDS vulnerability on their NT server. I spoke with the site admin who said that they would be putting their firewall in soon. I told him that the firewall would not stop this type of attack. He was startled to hear this, but as long as they were allowing full access to the .dll in question then the RDS exploit would have likely succeeded. I'm suprised that cracker had not found their site before then. Unless they change the NTFS permissions or the IIS permissions on the RDS enabled directories, or disable RDS in the first place, they would be at risk. An IDS could, of course, detect the attack and drop the connection, but an attacker could simply come in from another IP address, or could perhaps use other means to evade an IDS (see Whisker, the scanner written by Rain Forest Puppy for more on cgi/web scanning using methods to bypass intrusion detection systems. IIS is particuarly bad about allowing URL encoded and other methods of URL obscuring.

I have been working with security for several years but am just now starting to take on consulting work, and some local businesses have been very happy that I've come forward with an analysisof network holes that can then be patched. Then, I give them my card and make a connection. I feel that this is a good thing, because they get benefits from fixing the problem and I get the experience and exposure around the region.

Good evening,
Curt Wilson - netw3.com consulting

by spam

If your Web server is NT of W2K CyberwallPLUS host based firewall can prevent denial of service attacks. How?
CyberwallPLUS allows you to create polcies that open only the ports required for the service/services running. It also dectects DOS signatures that specific to NT & W2K servers, logs the packet information, then discontects the sessions while sending you an email alarm. CWP-SV allows you to place your internet accessed servers outside your perimeter firewall allowing you to protect the integraty of your internal network by creating policy specific to your internal users. while giving each server a dedicated 100 mbs of band width and dont forget for Network Access Controls that allow you to map in users so only the nodes you create and communicate to the server, which is invisible to anyone else. CyberwallPLUS is the ultimate in Network Security Solutions
becuase it gives you Control. See www.network-1.com for your free evaluation and tell them spam sent you.

by spam

CyberwallPLUS host based firewalls for NT & W2K servers can prevent denial of service at

CyberwallPLUS allows you to create polcies that open only the ports required for the service/services running.

It also dectects D.O.S. signatures that specific to NT & W2K servers, logs the packet information, then discontects the sessions while sending you an email alarm.

CWP-SV allows you to place your internet accessed servers outside your perimeter firewall. www.network-1.com

by alex

I think that some of the comparisons made to computer security, while entertaining, are like comparing apples and oranges.
The one about if someone broke into your house and left a note on your table(i liked that one by the way.), or the one about leaving your keys in your car. Well a computer on the internet is different. It is exposed to the world. And yes, technically your house and car are too, but it is unlikely that a guy fom the phillpines is gonna travel all the way to Ohio to run asecurity check on your farmhouse. On the other hand when you log on your AOL acct to check the latest stockyard prices that same guy form the phillipines can get you at a keystroke. Also, it is a point of knowledge. Most people know that if you parkyour car in a ghetto and leave your keys in your car with the windows down.... well you deserve to have it stolen. But how many computer users have a clue on setting computer security? With all the "loose" security in software released targeted for sales to the average computer user that are so easy for them to use. Most of the time it is sooo easy for them to get invaded also.

This discussion is closed to new replies.