Printable View
The Proof Of Concept project has started from a Danish website located
warlab.infowarfare.dk
He has proven that a Windows 2000 server With IIS 5.0 can't be defaced
he has published it all over the globe on IRC, websites, Chats and so on.
Give it a try
CrC_Error
LOL.What a joke.We'll see how long that lasts.It's pretty much a rule of thumb(short of govt encryption and such)that anything that can't be hacked/cracked/defaced,or whatever else is broken down within a week.If these people had half a brain,they'd quit letting their heads swell and not publish rediculous claims like that,and their products might remain secure for a little longer.Claims like that just grab the attention of every skiddy,hacker,and cracker on the face of the planet.
Just what the senior AO'ers have been saying forever; set up the system properly, keep the patches and updates current and you're "GtoG". It's easy to blame the OS for SysOp mistakes or lack of knowledge, but you have to invest the time required to set it up properly, which is nearly a 24/7 project after your masters degree, or equivalent. Very good link, i enjoyed it and i'm not even a SysOp pro. :)
lol. . . you are right gghornet
Actually, he said "...my first goal is to prove that a Microsoft Windwows 2000 server with IIS 5.0 can be as secure as you want it to be.". He said nothing about defacement being impossible. He is advocating that where most people blame the system they run as being insecure, they are simply passing the buck so as to not look like morons and admit fault. It precisely this kind of misplaced faith in a security system that leads to problems like this. The security of any system is inversely proportionate to the trust we place in that system. Be careful.
Well , I m just a fng , but what is the point of putting up a statement like that when the site has Rules to abide by.... Um I might not understand the whole scope of the Idea, but EVERY Penetration specialist I Know, Does not "play by the rules".... so should the anouncer of this statement announce a "no holds barred" Contest? ....Im wondering if His statement would Valid then.??
Securing your system is one thing (any OS can be secure). Creating a website challenging someone to break the security is another. In fact, it is just plain dumb. When will people learn that NOTHING is perfect, yes that means no OS is completely secure, even my BSD systems ;)Quote:
Originally posted here by The Old Man
Just what the senior AO'ers have been saying forever; set up the system properly, keep the patches and updates current and you're "GtoG". It's easy to blame the OS for SysOp mistakes or lack of knowledge, but you have to invest the time required to set it up properly, which is nearly a 24/7 project after your masters degree, or equivalent. Very good link, i enjoyed it and i'm not even a SysOp pro. :)
The point is to eliminate as many potential vulnerabilities as possible and minimize your level of exposure. Some systems are more restrictive out of the box than others, which means less risk of an exploit. It is all about numbers, whether you want to spend 5 mins hacking a default windows IIS install or 5 months on a server that took someone 2 months to secure (figuratively speeking), the point is that it can, and will, be done.
I just can't figure why people and companies insist on setting themselves up for failure.
iNViCTuS, you are correct. It's the same thing with being the toughest guy on the block; as long as someone tougher doesn't move in. With this thread link, the guy is saying he's the toughest dude on his sphere of cyberspace. Maybe he's correct, until some guy from MIT who knows more than he does puts up a greeting on his site. I think what he's saying (maybe i'm wrong) is that if you set up a premium server with all it's capabilities enabled then it is pretty secure in general. The fact that he's tooting his own horn is kind of beside the point, but you can bet that a tougher dude will show up eventually, no matter how deeply he has studied the server OS. Some of the premium sites on the net have been compromised, including the high-visibility security companies. JP and crew even have a tough time keeping the attacks on the AO servers out on the front lawn instead of up on the porch. But eventually, who knows... :) Anyway, it's pretty certain that he who works out longest and hardest will win, all other things being equal. :D
The chap at the danish site is absolutely correct. If fact I have an IIS5/Win2k box at home that is impenetrable...... Course I wouldn't dare connect it to the internet unless I switched it off first..... (and no..... The NIC does not support "wake-up over LAN") :D
Honestly though.... Keeping up with the patches and all that is all fine and dandy but all you are doing is _reacting_. Reacting to something that is already known and patched. If someone hits your box with a "zero day" none of the patches in the world will help.... Your hacked.....
The question then is what have you done to mitigate the damage on the back end. How quickly can s/he escalate privilege? Can they move files undetected onto the system? How quickly can they hop to another box inside your system and set up shop there? Can they clean up after them and erase only those log entries that pertain to them? Can they even find your log files, (think stealth logging)? Can they be sure that they are not being sniffed while they work and could they defeat the sniffer and erase the entries there?
Security is, unfortunately, not one dimensional - in fact it has a few more than the standard three we are all used to which, correspondingly, makes it that little more difficult to grasp and execute effectively.
Wow I'm glad to see this person is in a lofty tower on top of the building when most systems are buried in a basement and often times in comm closest even big enough to stand in side ways. What an automated system to secure Windows? It will be out of date or cost for a subscription update, what is MS count this year 65 updates, how much they gonna cost from this person? Reality check here Sys Admin is not lax in their duties they handle everything from network expansions, to I cannot find my favorite screen saver. Work load users how much time in a day and how many hours at a server (s). I wish I had time to invite such things as these bold statements, if there is an OS it has bugs and why pay a 3rd party to supply them when I pay top dollar to the MFG? Firewall OS is different from the server (s) OS 90% of the network crap pulled would be better spent in a good firewall and proper polocies on it. Other 10% is picked up on active netstat :)
Wrong...technically someone could break into your house and have access to your computer, right? You have to make sure EVERY aspect of security is taken into account. The deeper you get into it, the more potential risks you will find. So NEVER say something is impossible. However, if you re-phrased it and said "nearly impenetrable" that might be true ;)Quote:
Originally posted here by Tiger Shark
The chap at the danish site is absolutely correct. If fact I have an IIS5/Win2k box at home that is impenetrable...... Course I wouldn't dare connect it to the internet unless I switched it off first..... (and no..... The NIC does not support "wake-up over LAN") :D
You never met Emma and Hank?
Emma is 95 pounds of pure bred German Shepherd from working stock. Hank is 80 pounds of pure bred German Shepherd from champion stock including being a direct descendant of a line of Schutzhund III champions, (schutzhund training is the ultimate training for German shepherds - it culminates at level III which is attack training where the dog _must_ attack on command and in certain circumstances should decide to protect the owner regardless of whether commands are given. They are required to "....bite, and bite hard..." as part of their evaluation yet they must also be docile and friendly despite any aggravation they might get from kids etc. Truly remarkable animals - The NJ police began using them about 10 years ago and cannot sing the praises highly enough)...... They have complete freedom of the house and all interior doors are left open. Wanna come play....... :D
Seriously, though your point is correct and well taken - I only said in a post the other day that security is not one dimensional and that it has more then the three dimensions we are used to making it more difficult to comprehend and effect fully.
lmao...I also have a German Shepherd, and they truly are the greatest animals. Extremely intelligent and amazingly gentle, unless the circumstance requires otherwise.
If I come to your house, I now have enough knowledge that I will need to come up with another tactic, perhaps a tranquilizer gun....You would have been better of not telling me that ;)
Unfortunately, you will not need the traquilizer gun. I was actually talking a little bit of history. We had to put Hank down 2 1/2 years ago after many years of problems at the age of nine and Emma had to be put down a year later when she could no longer walk, aged 14. They truly are the best dogs without doubt. I do keep the sign on the back gate though. It has the silhouettes of 2 German Shepherds and the inscription "We can reach the fence in 3 seconds, can you"? It keeps most people out...... :)
But I believe we are wandering off topic..........
Now I've blown my security, (or lack of it), allow me to rephrase.....
I have a win2k/IIS5 box at home that is impenetrable IF people don't go breaking into my house...... Better? ;)
perhaps someone has come up with a method to detect, read and decipher electromagnetic signals generated by your computer from a distance. ;)
OK...I'll stop now ;)
You know, who's to say this is not just some ploy to learn as he watches log files zip by? Wouldn't you like to attract the most intelligent intruders in a situation like he's set up? Why not say your machine's unhackable??? That will attract more people to try to break it! IMHO I don't think this person's bragging just to brag... I think it's bait to catch some knowledge.
He just Seem to be just that type of Elitist .. who wishes he knew more than he really does....
LOL- hehe
[OK - this is my virgin post on Anti Online so go easy with me...]
I think in the case of Internet Information Server 5.5 (don't even bother with previous versions - they're obviously swiss cheese and undisputed as such I imagine) you have to look at this in the "marketing vs. security" light. As we all (should) know, installing IIS in the normal Microsoft fashion performs the kitchen-sink install, turning on a ton of features that aren't needed.
It's really quite silly, considering that the "features" that are least often used are the very features that I'm sure some security guy in Microsoft suggested in a meeting at some point not be enabled by default - only to get a sound trouncing by someone in marketing holding the ace of spades to his queen of hearts. Silly stuff like the handful of ISAPI filters that don't need to be mapped are a good example. Less than 1% of the folks using IIS need this stuff. Were they to be unmapped in the default install, Microsoft would be better served in doing the one thing they've been terribly unsuccessful at thus far - mitigating bad press.
Given Mr. Gates' cry for more security in his organization, I expect we will see some serious changes to the default installation schemes in .Net and/or whatever other versions of Windows are coming down the pipeline. This will certainly be an indication as to whether or not Bill is _serious_ about security. If the default install changes - and they start requiring an administrator of an IIS machine to know how to turn on (as well as off I guess in this case) those features that are needed, we'll know he was serious. If things don't change, we'll know that Microsoft is first and foremost a marketing company. (Which currently stands as the truth IMHO.)
I certainly agree that any fool who says "I've got product XYZ over on IP address x.x.x.x and it is utterly un-hackable!" deserves to wind up on the front page of the trade rags in full regalia with their pants down around their ankles. Alas, I don't believe this is what was said in the original article. The statement made was (to paraphrase) "you can make it as secure as you care to". This means that some form of intellect other than "click the Yes or OK button" is involved.
Personally, I'm a huge fan of Open Source. I use a lot of Linux, OpenBSD, Apache, and a host of other open source releases. I also admin Windows by day, which helps me keep up with my two most favorite past times - living indoors and eating. I've used both, made both secure, and seen both hacked to hell in a handbasket as well.
Cheers,
Kyrka