Sales Call or Social Engineering?

Quote:

---

3) Now, we are running an Apache Web server but we are running it on a Solaris OS (not Windows) and, while the vulnerability exist, the exploits in the wild are targeted at Windows.

---

the originating exploit was effective on multiplatforms and targetted sunos specifically. the poc exploit that was later released publicly was effective for openbsd only - but required minimal change to work with sunos. in fact the case that sparked interest into the investigation of the 'in-the-wild' variants was against an openbsd system. it was only after-the-fact that windows versions starting popping up.

Definatly screwy no matter how you look at it. Protect your network at all costs.

Actually I employed a rather low tech means to get to the root I simply called the admin of the system I was seeing used a bit of knowledge I know about getting to the right people from 10 years at a major dot edu. Right person where they were at on their system and they were nixed but they knew whom and from where and they took it from there. My cost was a long distant phone call who I called took legal action :) Ex civil employees are good at knowing resources. This case and one the other not 3 days into my new job with yet another, I was in a conf call on that one with 3 other places over a few days until the cops were at their door. Telephone is still a good tool especally when you know how to use it also, they employ it why should I not, rely upon reporting to [email protected]?

Truly an excellent example of the proper approach for someone asking for any information about your network. Despite all the technical work we do to secure our systems and networks, it's people who turn out to be our weakest link. The users of our systems and networks who don't know the ins and outs of security will usually buckle to a well rehearsed script full of technical jargon recited by someone just looking for a hole.

Kudos to Palemoon for puttin' da SMACK down on an obvious social engineer. :bigsmile: