Maxthon, a tabbed brower built of IE has released version 2.1. Liked by some geeks because it maximizes the size of the browser window, you can find out more at http://www.maxthon.com - posted by
Brett Hill
A McDonalds IIS server was defaced by a Chinese hacker angry that Taiwan was listed as a separate country on their server. They were lucky that is all they did. The server reports it is a Windows 2000 server running IIS 5 so I'd be curious as to what the administrators missed that this defacement was possible.
that concludes " It appears that the overall quality of code, and more importantly, the amount of QA, on various browsers touted as "secure", is not up to par with MSIE; the type of a test I performed requires no human interaction and involves nearly no effort. Only MSIE appears to be able to consistently handle [*] malformed input well, suggesting this is the only program that underwent rudimentary security QA testing with a similar fuzz utility."
Toward the issue of using mobile devices as a way into corporate networks, this article about a new trojan targeted for Symbian smart phones is exactly the kind of thing I'm talking about. The trojan is named MetalGear and disables anti virus software when run. While this particular piece of malware does not seem focused on gathering privledged information, it is the kind of thing that could. http://www.pcworld.com/news/article/0,aid,119035,00.asp
I am frequently asked how people can cost effectively scan and analyze security setups on their servers. Nessus is one way to go for sure, but others are available including the Center for Internet Security scanning tools at http://www.cisecurity.org/. The scanner currently does not scan XP SP2 or W2K3 Server but does Windows 2000. The tool should be updated shortly to bring the most current Microsoft OS's into view.
In response to the comment about apache on unix being "much more secure", I don't buy it. As far as I'm concerned, it's simply one of those persistant myths that IIS is any less secure than any other web server including Apache. An uniformed adminsitrator is just as likely to deploy an insecure apache server as they are an IIS server.
Oh, BTW, you might enjoy checking out the the 44 security flaws found by graduate students recently. http://cr.yp.to/2004-494.html
It just goes to show you that any networked device that is publicly avialable is a candidate for being hacked. Web servers that are not properly secured can have privledged information published by none other than Google. I was thinking that these days people had a bit more consiousness about web server security but I live in a world where people are really focused on such priorities. All too often, the person installing the web server is not skilled enough to do so properly, but nevertheless it falls to them to get the office web server on the internet somehow. Sites like this are prime candidates for leaching privledged info onto a search engine or being compromised by by attackers due to improper configuration.
If you're reading this and going "yeah that's me, but am I supposed to do", here are a few tips. 1. Browse your website completely. View everything that's viewable. Make sure that what you want is all that's exposed. You can find software that will make a list for you of all available content. 2. Use a firewall to restrict all but port 80 on your public NIC. 3. Install intrustion detection software on your server. 4. Keep your server patched with the most recent hotfixes. You're a SERVER admin now. 5. On IIS 5, read the article at http://www.iisanswers.com/articles/IIS_Lockdown/IISLockdown.htm and run the IIS Lockdown tool. Move to IIS 6 ASAP. With IIS 6 verify your NTFS permissions don't allow the IUSR account to do anything you don't require. If you don't know what NTFS or the IUSR account are, STUDY NOW. 6. Move your content to a drive other than the C: drive. 7. If the information on your server is important and you would be really seriously impacted if the information or server was compromised (keeping in mind that all computers and devices connected to the IIS server are likely to be compromised as well), then purchase or hire a simple penetration testing service or software. This can save you!
There is a great deal more of course, but these tips are directed toward actions that an inexperienced admin can take to keep them out of trouble.
Protecting your systems from attack is a key task of course, but I've got serious doubts about the effectiveness of any of the CyberTerror studies etc sponsored by the Federal govt. I can't think of anything that has come out of the boatloads of money spent other than very vauge and broad guidelines that are "suggestions".
The outgoing cyberterror czar had some intresting comments the other day on his way out. "cyberterrorism could be the most devastating weapon of mass destruction yet. And he says it could cripple the U-S economy." (http://www.crime-research.org/news/12.05.2004/825/) and I tend to agree. He provided an example where " assigning 50 computer specialists to see how hard it would be to shut down the nation's electric grid." It only took 2 days.
Now that's should be alaraming to someone but it passes by relatively unnoticed.
What I wonder is, would moving to IPv6 be of any assitance in hardening the nations infrastructure?
Yes, hacking servers is big news, but gazing into the digital crystal ball, PDA's are sitting ducks for hackers to penetrate corporate networks. Of course, this goes hand in hand with wireless traffic vulnerabilites, which is another topic. I mean, we've got XP pro SP2 with ICF and now Windows Server 2003 with ICF (via SP1) and a very ambitious security wizard that attempts to lockdown a server based on it's installed roles. But a Windows Pocket PC's have nothing at all in terms of security except for the optional up front entry of a pin.
If I put on my hacker hat, I start thinking that this sounds pretty attractive as a way to get a trojan into a corporate network. They're everywhere and people will often log on to any wireless network than can find when traveling in order to get a link. Perfect for capturing packets and sniffing out passwords,hashes, and other secrets as well as creating opportunities for downloading malware.
So best practices would be what? Don't connect to untrusted networks, install a virus scanner, encrypt the secret stuff your PDA holds and we all know they have a lot of secrets in them, that's why they're useful, turn off your wireless capability unless you're using it, keep software updated, etc. I'm no PDA expert, although to use one you have to sorta become one like it or not, so any links or suggestions on this topic would be appreciated.
Free CDs Offer Fundamental Content for IT Pros Are you up to speed on the latest technologies and solutions? Don't miss out on your chance to get up to speed quickly on fundamental, in-depth information on some of the hottest topics in our library of content.
Let Your Users Reset Their Own Passwords: Free Download Try a 30 day free trial of Desktop Authority Password Self-Service – it provides an easy-to-use, robust system for allowing users to reset their own forgotten passwords or locked accounts.
Get Windows IT Pro & Mark Minasi’s Favorite Power Tools Guide Order Windows IT Pro now and get "More of Mark Minasi's Favorite Power Tools"--a in-depth guide to the most useful Windows commands --FREE with your paid order! Subscribe today, and save 58% off the cover price!
Deep Dive into VMware vSphere, eLearning Series Join John Savill to explore the major functionality capabilities of the vSphere virtualization platform, including identification of the changes from ESX 3.5.
