How to show problems with bad security???

Hello,

I'm a newbie when it comes to the side of hacking/penatrating systems, exposing holes, exploiting vulnerabilities, etc... I've always consentrated on simply learning what was needed to protect against the current threats. But it seems it has become necessary to learn in order to maintain security/stability...

I NEED help!!!

My problem is this;
We have a new guy here in my I.S. Dept that has become 'buddy buddy' with the manager. As such, his 'opinions' are now starting to be taken more seriously then mine - despite my 6yrs experience as a Admin.

The recent issue is "REALLY" bugging me, the manager has allowed this newbie operator to do the install and config on one of our new W2K servers. The problem being the newbie doesn't want to disable ANY services whether their being used or not. As its his 'opinion' that a complete 'vanilla' install/config of W2K is more stable and easier to maintain, and there is no good reason to turn the services off.

This is a stand alone server with always on internet access that stores confidential information, that is not acting as a website server. Well obviously this doesn't sit well with me, how the hell can you call a W2K server 'stable' or 'secure' when you have every service includding IIS running. On top of that, no AV software or firewall, as he says they just eat up resources...

Well after I complained enough, all I got from my manager as a response is "to prove him wrong" along with permission to do anything but access the physical machine to try to hack/break it...


Why I need help;
So now I need to find a way to show the vulnerability of this server, whether doing so breaks it or not, as I obviously don't want to sit back and wait for someone 'possibly malicious' finds this vulnerability and exploits it.

Is there some easyway to hack a W2K server via port 80, or to send it a program or a virus/worm thru that port???

I know of many past instances, like 'Code Red' and 'Nimda', where I was glad the other servers were secure - but I'd rather not wait for something like that to go around again, just to prove my point... (Hell I hope something like that never does go around again, really)...


Any help or direction to look would be appreciated,
RRP

http://www.microsoft.com/technet/tre...s/MBSAhome.asp

Run that, print the results, give them to your manager.
Trying to compromise the system is a waste of time and company resources. If you fail to meet the vendor's suggested secure configuration, you are not meeting "due care." Nothing else matters.

catch

Not that I'm any kind of an expert (I'm below beginner), but I'd think if you let it sit there long enough, you won't need to do anything at all.

Im sorry to tell you this bpiedlow,

but you sound like a jealous pathetic employee...No need to pull your pants down and expose the crack of your ass..Your giving us TMI..

You could have posted your question by simply asking,,
Are there any known vulnerabilities with win2K running port80/http services? ..

Sorry all if I seemed a bit rough with him, he had it coming and it was a
good time to balance my antipoint assignements..

cheers

Well, the post was a bit whiney, but I understand. I've seen this happen all to often in small outfits. Anyway, the one response with the URL is the appropriate one. Any fool who functions as the individual described in the original post won't last long. The problem is he/she will do a great deal of damage in the process.

For the rest, MS's web site has well written "best practices" documents for almost all occasions and they make for excellent justification to bosses and non-tech administrators. Keeping a secure system in this day and age is entirely too important. Use the resources available to you.

Thanks everyone,

Well eveyone but gunit0072003 who obviously just felt like flaming someone...

I'm mean really

Quote:

---

You could have posted your question by simply asking,,
Are there any known vulnerabilities with win2K running port80/http services? ..

---

Well DUH! I already said that I KNOW there are vulnerabilies with it, so why would asking that do me any good?

As I explained, what I'm looking for is ANYWAY to show the hole - and as I specifically said

Quote:

---

So now I need to find a way to show the vulnerability of this server, whether doing so breaks it or not

---

Which is exactly what I'm looking for...

It seems catch's URL should cover what i wanted 'perfectly'... Thanks again Catch...

RRP

Firstly...hello again to all AO'ers..Havent posted for quite some time now.

I would run a security scanner on the box like Nikto to test the security of the webserver, and to check the security of the OS, scan it with a testing tool like Nessus (but dont DOS the box).

The output will tell you that the box is insecure, which you could then pass on to your boss... And you have done it without hacking the machine or causing any downtime (hopefully)...

prove him wrong then rub his face in it ever chance you get!!!
all else failes wright a big fat report that happones to get on the desk of the highest person in manage ment, stipulating all this confidential data that is being exposed, and th possability of law suits if it gets out... (pending on what kind of bussiness your in)

also if this person is new and really as good as he thinks y the hell would he be leaving everyting open?
unless he has be cona buddy buddy to get free rain and access to the server, do what he likes with to, so he cae benifit from it, eg removing data for personal / profatable use.

Just a thought, Id be keeping an eye on him/her..


Nightfalls_Girl

Quote:

---

Originally posted here by gunit0072003
Im sorry to tell you this bpiedlow,

but you sound like a jealous pathetic employee...No need to pull your pants down and expose the crack of your ass..Your giving us TMI..

---

Yea, a bit too much, but if he didnt put any information as to what his situation is, members may mistake him for a hacker/cracker/gay prostitute and then either not give him information or just make posts about how they are not sure of their origions. I am not saying that he couldnt have made it all up, but it does help with the reasoning a bit.

I dont know what is more embarrassing; 1) to admit that my 13yr old nephew gained access to my PC or 2) accepting the remarks that were posted on my behalf..

bpiedlow, or anyone else, please accept my apologies for any rude remarks made in my name during last 2 hrs.

Ive been had by a 13 yr old using an external keyboard logger.....

sheepishly sincere
gunit

This seems unlikely at best by the comment attached to the negative anti-points you assigned me, on this thread.

catch

P.S.

Out of curiosity, is there any way to know or detect an external keyboard logger....

catch,

I apologize, as I am just realizing what else and to whom else neg points were assigned on my behalf...

no worries...

just follow the cord back to the box, I think it is a safe bet that no TEMPEST techniques were used. ;)

catch

The external keyboard logger he used was an entire keyboard, similiar in make to one I use,,he didnt use the 3 inch external keyloggers that you attach to keyboard....
.
anyways....sorry again,,

LMFAO you got done by a 13 year old!!!!!!!!!!!!


Nightfalls_Girl

Doing an unauthorised audit of the systems can land you in trouble. If I were you I would take your boss out to lunch and have a talk with him about the security issues related to the systems. I would also work on getting him to allow you to do an audit of the systems, and possibly set up a standards document for putting up a server and minimising risk.

Beforehand it may be a good idea to collect some best practices documents (sans.org is a good place to find them) and some examples of attacks and statistics on how often they occur. Not only will you increase your knowledge of it all but it should help you prove your point a little bit better.

In the end if your boss decides against it there isn't much you can do....but I'd also try to have a document trail that at least you tried to do something about it. That way when things hit the fan you can cover your ass.

I think a good start (until you learn all you need to about security) would be to run a vulnerability scanner on it. If you have knowledge of linux, nessus is probably one of the best vulnerabilty scanners out there. If not, then you're going to pay a pretty penny for a windows based product. Several of them will give you trial periods which will be enough for you to do the job. Afterwards, they will either cease to function, of you shell out the $$ to continue using it.

GFILANguard is a decent one that will do the job and is easy to use.

ISS security scanner also has a trial.

Retna has a short tiral.

There are plenty of other useful tools for various platforms here . Its a hell of a learning experience playing with this stuff... so enjoy!

Show them an example... say setup a box of your own and secure it as much as possible and then scan that. Then scan a the other box. Show them the differences and also explain to them why it security is so important. I'm really surprised that your manager doesn't know better and isn't the one enforcing the security.

Of course you will HAVE to have permission for all this. Make sure to get it in writing too... Everyone has offered some pretty good advise... but the number one to follow has to be Juridan. Cover your ass!

Thanks again everyone,

Hopefully with the infomation I get from SANs and the results from one of those scanners should be enough...

Sorry Gunit for the return-flame since/if it wasn't really you - I thought that response seemed a bit 'childish' for an AO'er...

And I think Juridian hit the nail on the head with what I'm trying to do - I just want to 'cover my own ass' so that as things continue to break because of this guy, I hopefully won't be the one the CEO keeps going to for his complaining/yelling...

Well that, and preferably to get them to relize the problems before its to late and either this system is compromised and confidential info is stolen - or worse even, they are talking about having him setup the new systems we're getting which will become our PDC and Webserver. Since if either of those break we'll experience downtime and really have the CEO on my ass...


Thanks again,
RRP

Hi bpiedlow,

I have bin there, done that, got the T-shirt..............well almost! My experience was with a whole division of a company working with no disaster recovery/business continuity possibilities......I was told "it was too expensive so we didn't bother" :rolleyes:

I did not make out from your posts whether this server has any access outside your LAN, or whether it is connected to your general LAN, where ther is outside access. In the Defence Industry we generally have two networks.........the ordinary one, and the "secure one"..........the secure one is not connected in any way to the general network.

I do not understand about "waste of resources" if the server was sized properly in the first place, that should have included firewall and AV?

I guess that there are two approaches................the "egg" and the "bees nest" The egg has one external wall, the bees' nest has a honecomb of internal walls? Your colleague is an "egg head"? which is all very well until something goes wrong.

The fundamental problem that I have with your colleague's architecture is that it totally ignores the "enemy from within"?......if someone opens a dodgy e-mail and that server is on the network??????????? or brings in some software from a boot sale (shouldn't be able to load it but ...)

I guess the time has come to update your CV :( and distance yourself from it all.

Perhaps something along the lines of:

"Dear xxxxx,

It is with the deepest regret that I find myself having to write you this memorandum, but I feel that I have to do so in order to preserve my professional integrity and reputation...."

I hope that you follow my drift?

If you need anymore please PM or e-mail


Best of luck................I do not believe that you are jealous of an idiot :D

BTW: a 13 year old would not use TEMPEST...that's 1950's technology........he would use NONESTOP?

bpiedlow -

You may want to get a few articles from AO & other security sites that demonstrate best practice.

Do some reasearch on ISO17799 : https://www.bspsl.com/secure/iso17799software/cvm.cfm to provide evidence.

Suggest to your manager that his new 'star' is either incompetant or is deliberatly setting up you networks to be hacked (Getting a job somewhere is an excellent socail engineering trick). If you get no joy complain to your manager's boss.

Remember that what is being done is leaving your company open to attack and you as an employee have a duty of care to protect the assets of your company.

You can demonstrate what you say is true so make a fuss.

Steve

The sad/informational part about this post is that this is an issue that many people face daily.
Generally it happens when an upper manager leaves and has to be replaced and HR is looking for someone that will have a good attitude and keep moral up as they roll in for the first day. But this is usually mistaken first off by "Well, He's a great guy, Very outgoing and intelligent" Well, duh, he was in a ....Job....Interview. So then you have a kiss ass at the top with no technical skills running the show. Generally, the guys with the skills under him will usually just kind of "give up" and just come to work to make a paycheck instead of being proactive in anything anymore. We face this type of situation because not only is the IT market soft (picking back up though) you have people from all fields trying to get in IT and it's becoming a market that is saturated with Idiots and Paper Tigers. Now days, those who can kiss ass the best and dress the best and those who hob knob it with the upper management are the ones that get the big bucks. The people with the skills are the ones that make these kinds of people look good. (In most cases of course, There are still a handfull of REAL IT Depts. out there) But this post is truly a type of scenario that many face daily and it is one that will cause someone to quit there job even if they cannot afford to. I had a co-worker that was an excellent technician that quit his job for reasons such as this. They re-organized the dept. and he wasn't the tech in the lime-light anymore and he got a really really nasty attitude and he quit just because he felt so much rage at work. Sad, but True.

I work in the same environment. New MCSE hired in with political guns at full blast. I just left the guy alone and he blew up the exchange servers and brought one domain to it's knees. Thought that WIS and DNS were no longer necessary. Guy still works here but he proved himself an idiot and I was directed to remove all admin rights from his account. Just give the new guy plenty of room - he'll hang himself

Quote:

---

Just give the new guy plenty of room - he'll hang himself...

---

Thats what I thought too, at first...

But he's now already caused me to have to do a preservation install of UNIX once (because he wrote over my backup tapes the same week our ODM became corrupted).

He's brought our warehouse printing to a stop for most of a day because he decided he was going to run something on the server despite the fact that both I and the manager had asked him not to run it (which is big deal to not be able to print packing slips when your sending out thousands of orders each day).

Etc, Etc, etc...

Yet the manager just keeps letting him barrel through it -

Quote:

---

So then you have a kiss ass at the top with no technical skills running the show. Generally, the guys with the skills under him will usually just kind of "give up" and just come to work to make a paycheck instead of being proactive in anything anymore.

---

Ain't that the truth, I'm so close to giving up and letting it all just break around him - but I'd really rather not have to pick up the pieces once he's done... What makes it worse, is that I truelly 'like' the company I work for and what we do here, and I don't want to see it suffer due to this idiot...

RRP

Quote:

---

Originally posted here by dinowuff
Just give the new guy plenty of room - he'll hang himself

---

True. I've seen this happen first hand. When you have someone in your Dept. that is always quick to "pull the trigger", you find that when you step in and interviene, not only are you saving the company from a hardship, but you are also helping that certain someone not look like an idiot and hence they keep their job longer. Eventually this becomes a frustrating cycle and you will find that if you continue to do things "in the best inerest of the company" you will always face ridicule, confrontation and technical arguments. Sometimes it is just easier to let people break things and then fix them. I'm really disapointed that this type of scenario happens more oftent than it used to.

Quote:

---

Originally posted here by bpiedlow
What makes it worse, is that I truelly 'like' the company I work for and what we do here, and I don't want to see it suffer due to this idiot...
RRP

---

I've watched others deal with a situation like this and usually the best thing to do is to get a job lined up before you get disgruntled. Once you have a job lined up, you can either move on, or jump the chain of command and see how much you can get done, and if you face ridicule at that point, at least you can roll out.......

Ok the most interesting part of this thread for me at least is the 13 year old with an external key logger...

"The external keyboard logger he used was an entire keyboard, similiar in make to one I use,,he didnt use the 3 inch external keyloggers that you attach to keyboard..."

#1 what the heck is that?????? I thought loggers where generally software to log your keys, what did he have another keyboard that when you pressed a key it mimicked it?

#2 what are they teach 13 year olds now adays? even though he flamed on the response it was still rather technical, and the fact that he assigned negative points to people and had spelling and formatting perfect are amazing

are you sure you werent having a bad day and flamed and then felt bad? its ok if you did, we all do it

Oh Dear,

It has descended to that has it..............it usually does: professionals versus politicians...........I have just polished my bayonet and fixed it :) after annointment with garlic.


bpiedlow.................just tell me where you want the "thin red line"...we're in Iraq with you, I see no reason to stop there?

Seriously, you might try sounding out the Users ( yeah, yeah I now go to wash my mouth out with soapy water)............I once had a beautiful experience (and I was stone cold sober!)...EVP Finance turned to the guy and said "if Johnno had been in charge, it would have been done six weeks ago and done properly"................

Sometimes the pains in the ass are a help, because they respect the years of duty, not the BS


Bloody good luck to you mate.........that's all I can say

cheers

I am going to say a couple of things.

First, all those posting, there is still the possibility that this is a Social Engineering attempt to get information from us on how to hack/crack a server (no offense Pie, I merely mention the very real possibility). For this reason I am most pleased to see the two pieces of advice that make the most sense: Vulnerability Scanner and Research from Respected Sources.

First get documentation on known vulnerabilities from respected sources. SANS institute is excellent and also from Microsoft themself. They openly publish procedures to secure their servers, warn against unsecured servers, and have tools to help out (i.e. iislockdown). Have these prepared.

Then, if possible, run a vulnerability scan. Present these to your manager in a supportive manner but make sure the documentation is delivered and that he is a signatory that it has. Keep one copy to CYA. If he fails to see the danger from the other failures of this guy and does not accept industry standard then, since he is your boss, all you can do is document your warnings. Saved E-mails, the affore mentioned presentation, etc. all can go to ensuring that if something happens you are as covered and protected as possible. However, he is the decision maker and probably controls your raises and promotions so I would be very careful about openly defying him.

One last thing, if he is taken in with certifications then get some. Get an A+, MCP, or work towards a Sec+. I am not saying certifications will make you a better employee or more knowledgeable (although you may learn something studying for them) but they may make you more credible in his eyes and in the eyes of his bosses. A few letters after you name never hurt.

dpiedlow,
I know I pm'd you before, if I'm reading you right,
'He's brought our warehouse printing to a stop for most of a day because he decided he was going to run something on the server despite the fact that both I and the manager had asked him not to run it '
Maybe your boss isn't so buddy, buddy after all with this guy. Maybe he's waiting for you to do your job and show this guy wrong, so he can take it to his boss and say this brother-in-law you gave me is an idiot and he's fired. So, get in there and get it done and come back and tell us how it went. Good Luck and let AO be with you or is that the force. I never could that right.

Freddy

Hey Guys, I must be the biggest cynical old fart on AO?

But I believe this guy is genuine..............he talks "too good a job" for someone wanting to hack a server..............hell I could go on the "darkside" and get a shedload of tools/bots/viruses etc........................we all could.

It is my personal belief that this is a genuine request for help, from a fellow professional, and I think that Fred Brown might have a better insight as to why..........................not often you see senior people like his boss, hell bent on professional suicide?..................."after a while he will get tired and the Colt .45 auto will fall from his hand"..........................??????????????

Also, his objections are "professionally correct" IMHO..........he is not a "jobsworth" complaining about being replaced by a newer model..........his objections are legit....and if they are not the truth, then the answers we have been giving are totally useless???

This one sounds spot on to me.............but I have been there so maybe I am prejudiced?

I still believe in supporting him to the best of our collective ability................and I now have the bayonet in horse droppings :D

Good luck to all

johnno

Dang, I didn't realize just how open he really left this server...

After running MS's baseline security analyser (thanks again catch) it shows;
- not only has IISlockdown not been ran
- Telnet is installed and running on default settings
- SMTP is installed and running on default settings
- multiple critical security updates are missing
- etc
- etc
- etc

It was enough for the new manager to comment - but I don't think its helped much more then that... I guess I can to wait and see if he creates any kind of action item from it, but I'm having my doubts these days...

RRP

I must say that the last post by gunit was the most entertaining of the entire thread. Give my congradulations to your nephew. I laughed my ass off when I read that. As for the security threat just let it be, and take credit for it when it is hacked. A totaly open install of win2k running on a direct line to the net with no firewall will probably be killed before you even figure out what crack your going to attempt. If not, the security scanners should do nicely.

deaflamb

I gotta check in here humm looks like I'm the old fart again LOL. The work place always is a challange. First off an MCSE is a hunk of paper (costly) and with each release it is also outdated quickly now days. I'd say watch the logs on the server print them out and oh go to that person and say BTW I'm busy you did the install can you correct it? You made no mention of any sort of firewall or I may have missed that part. But this person may think if there is one there is no need to do anything but a default install (a newbie MCSE thinking seen it many times). Manage the firewall right and the risk to the server is small from the outside. But being a work place you have to take into account the lame users and how they might exploit the server. Say access those files they should not or directories, only takes one lame user to have the wrong access to a server to really mess a network up.

One thing I have found in some 20 years in IT is yeah there are people smarter, and at my age now to damn quick they can hit re-start faster then I can say WAIT! My advantage over these people 30 years supporting the business, knowing it all. Sometimes out geeking a geek is simply a matter of knowing the operations and functions of the business you support better then they can. Like I know A/E inside and out maybe there is a better geek then me to do it but I know what the end users need and what A/E operations are about, an MCSE knows well MCSE...dah lets re-boot and not tell anyone..or humm lets Fdisk and re-install to fix that problem cause I have no clue. Forget the MGR and brown nose stick with business operations and what functions are needed on the network, the newbe will hang himself.

The mcse comments above are a sad bit of stereotyping. Just like any other area, some are good,s ome are mediocre, and lots don't have a clue.

Slightly off topic, but Gunit did raise it in this thread.................I once worked on a high security (defence) site and wondered why the base unit, screen, AND KEYBOARD for each individual workstation had the same unique inventory number.

I hadn't thought of a physical keylogger :confused: ............that has just explained and taught me something................thanks.

BTW I have seen TWO guys get 11 years for trying to sell military secrets, so it does happen.

One last thing which you might use to support your argument Pie, new gov. regulations.

Now I work for a Financial Institute and we are bound by the Graham Leach Bliley Act (GLBA) which has imposed far stricter controls on the protection of customer information. The Patriot Act has far broader regulations that are not as specific or restrictive as the GLBA but still hit the area of protection of customer information and customer identification very strongly.

If this server contains customer data and is open to the net then your company is most likely in violation of some very severe Federal Regulations. The compromise of that data would force your company to notify any potentially affected customer, could lead to civil and criminal prosecution (no criminal cases have been brought yet although there is provision for it), and would cause a severe loss of confidence in the corporation. BTW a manager knowingly ignoring warnings about a danger borders on criminal prosecution but probably doesn't cross the line unless he informs outsiders so they can take advantage of the breach. It does, however, open the company up to huge civil claims.

Maybe bringing this up in casual conversation or in a planning meeting would spark some interest.

It is interesting to note that the dweeb who built a ticking time bomb server (TTBS) is probably the safest from Federal repurcussions because he would be deemed merely incompetent and the ultimate decisions were made by the manager.

Again, I urge you to make sure to CYA because if this TTBS does blow up you don't want to be in the blast radius. E-mails, memos, and documentation are your bomb shelter.

P.S.

And if you couldn't tell from the use of Acronyms I too spent 8 years working for the gov. on Secret and TS weapon's programs. There 80% of you job was to CYA. I think every missile fired has more plausible deniability behind it than rocket propellent.

CYA...CYA...CYA...always CYA

If your manager lets this new guy wreak havoc on your companies network and you have some documented proof that you disagreed with some of the things going on and discussed them with your manager and he did nothing. Depending on your background, you may find yourself presented with the opportunity to become the manager. If **** hits the fan and you can show that you discussed the fact that industry standard security practices were not being followed, that will make you look good(or at least better).

On a bit of a side note: I worked this one gov contract and over the course of 2 months, I had to go in and clean the exchange server 4 times. Some bonehead officers had "sneaker-net'd" some docs off the secure network and mailed them on the unsecured network. Not a thing happened to any of these people and on 2 of the occasions it was the same officer!