Identifying the hack. I opened the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in and looked at the user accounts. Someone had created a rogue user account that was a member of the Administrators group. I knew an intruder had hacked the network, so I shut down all external connections and started looking for a compromised computer. It didn't take long. My client had two Web servers in the demilitarized zone (DMZ). One server ran the company's Web page; the other ran timekeeping software. I checked the registry Run subkeys and investigated suspicious batch files on the C drives of both servers. The server running the timekeeping software was severely compromised. It held rogue FTP and SMTP programs with multiple root kits. This server connected to a Microsoft SQL Server system on the LAN side and allowed only SQL Server traffic to pass from the DMZ to the LAN. The server was running Win2K with Service Pack 2 (SP2) and was missing a lot of critical Win2K updates.
Repairing the damage. I rebuilt the server from scratch, moved the server to the LAN side of the firewall, and eliminated public access to it. I then reconnected the external lines and monitored them closely for suspicious activity.
An often irreverent look at some of the week's other news, including some more Windows 7 sales momentum, some Sophos stupidity, Microsoft's cloud computing self-loathing, more whining from the browser makers, Zoho's "Fake Office," and much, much more ...
Let Your Users Reset Their Own Passwords: Free Download Try a 30 day free trial of Desktop Authority Password Self-Service – it provides an easy-to-use, robust system for allowing users to reset their own forgotten passwords or locked accounts.
Get Windows IT Pro & Mark Minasi’s Favorite Power Tools Guide Order Windows IT Pro now and get "More of Mark Minasi's Favorite Power Tools"--a in-depth guide to the most useful Windows commands --FREE with your paid order! Subscribe today, and save 58% off the cover price!
Deep Dive into VMware vSphere, eLearning Series Join John Savill to explore the major functionality capabilities of the vSphere virtualization platform, including identification of the changes from ESX 3.5.
Register
