Identifying the hack. I opened the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in and looked at the user accounts. Someone had created a rogue user account that was a member of the Administrators group. I knew an intruder had hacked the network, so I shut down all external connections and started looking for a compromised computer. It didn't take long. My client had two Web servers in the demilitarized zone (DMZ). One server ran the company's Web page; the other ran timekeeping software. I checked the registry Run subkeys and investigated suspicious batch files on the C drives of both servers. The server running the timekeeping software was severely compromised. It held rogue FTP and SMTP programs with multiple root kits. This server connected to a Microsoft SQL Server system on the LAN side and allowed only SQL Server traffic to pass from the DMZ to the LAN. The server was running Win2K with Service Pack 2 (SP2) and was missing a lot of critical Win2K updates.
Repairing the damage. I rebuilt the server from scratch, moved the server to the LAN side of the firewall, and eliminated public access to it. I then reconnected the external lines and monitored them closely for suspicious activity.
Picking a favorite product from an impressive crowd of competitive offerings is never an easy task, and such was the case with our Editors' Best and Community Choice awards this year. ...
An often irreverent look at some of the week's other news, including some post-PDC some soul searching, a Google Chrome OS announcement and a Microsoft response, Windows 7 off to a supposedly strong start, the Jonas Brothers and Xbox 360, and so much more ...
Free CDs Offer Fundamental Content for IT Pros Are you up to speed on the latest technologies and solutions? Don't miss out on your chance to get up to speed quickly on fundamental, in-depth information on some of the hottest topics in our library of content.
Let Your Users Reset Their Own Passwords: Free Download Try a 30 day free trial of Desktop Authority Password Self-Service – it provides an easy-to-use, robust system for allowing users to reset their own forgotten passwords or locked accounts.
Get Windows IT Pro & Mark Minasi’s Favorite Power Tools Guide Order Windows IT Pro now and get "More of Mark Minasi's Favorite Power Tools"--a in-depth guide to the most useful Windows commands --FREE with your paid order! Subscribe today, and save 58% off the cover price!
Deep Dive into VMware vSphere, eLearning Series Join John Savill to explore the major functionality capabilities of the vSphere virtualization platform, including identification of the changes from ESX 3.5.
Register
