Network Hacking 175
Wrighter the Pessimist writes: "In this article on Yahoo, they report that computer hacking has become easier, partially because of devices that have built-in computers, like printers and playstations. However, it also lists a number of 'ordinary' (obsolete?) methods of 'hacking' - such as gaining physical access to a corporate computer, and social engineering. It would be interesting to see a study done on this, to see how many attacks are actually carried out from such devices." The article touches on the Dreamcast Attack mentioned the other day, but also some slightly less bulky approaches. Be on the lookout for dark-clad intruders slipping CD-Rs into machines at your workplace ...
Linksys Vulnerabilities? (Score:1, Interesting)
Serious question [I thought about submitting to Ask Slashdot, but this thread should be just as good]: We've been using a LOT of Linksys devices (NAT routers, wireless access points, etc.). Does anyone have any info [preferably with URLs] about Linksys security vulnerabilities? Thanks.
Printer trojans (Score:5, Interesting)
Postscript is a pretty powerful programming language, and most printers today have it embedded. While I don't think it has TCP/IP capability yet, it wouldn't surprise me if someone doesn't find a stupid reason to implement at feature into the printer language, or even something that allows more low level control of the printer hardware could be used to gain access to the network. Remember people, it doesn't have to be easy. Virus/Trojan writers pride themselves on invading the bold new frontier. Don't get complacent.
As more appliances get network connectivity and more flexible embedded processors and operating systems, they'll all be subject to the same concerns. I'm already addressing some of these issues with my simple home automation projects. The computer I use to control things is isolated from the rest of the network other than the single open port for commands. Despite the security I might have implemented on my network, I can't assume that the network is always safe. And while right now I only have lamps and sprinklers on this system, when more complex (and potentially dangerous) appliances get added, a comprised system becomes a serious liability.
-Restil
Related article, also on Yahoo! (Score:3, Interesting)
Other avenues of attack . . . (Score:3, Interesting)
Those viruses and trojans slip neatly by all the elaborate MS Exchance server based virus scanners we have.
And since this is a non-technology sector corporation, they try to cut costs where ever they can, which means McAffee virus scan on the local computers, which has caused so many conflicts between the latest virus definitions and programs like Microsoft Word that most end users tend to turn automatic virus checking off without permission.
In the end, social engineering will never be "obsolete".
Strangers accessing the network... (Score:4, Interesting)
At my local Walmart, the store's network backbone is located 20 feet from the door leading to the backstock room. There are no obtrusions (except for the occasional six-wheelers with merchandise), and the door's always open. Three-quarters of the time, there's no one in the room, and even if there is, it's typically a low-end manager (the high-end managers like to stick with their own offices) who don't know about how computers work. There's only a "regional" administrator...Walmart feels it's more efficient to let the machines work on their own and pay someone only when the machines don't work.
All you need to do is look young, wear kahki's and a polo shirt, and carry your "geek-bag-o-goodies", and no one will question you being there. As long as you look like you know what you're doing, no one will think otherwise. In fact, there was even one time where I walked in there completely unanounced just to use the telephone (I work for a vendor, not for Walmart). A manager saw me as he walked on by outside the room, and had no problems with me being in that room.
Now, realize that the computer network at Walmart controls everything...the lights, heating, TV / Radio / Announcement systems, the ATM network, evertything. Every Walmart has a satellite hookup to the mainframe (no idea where that is).
My point is that people are way to afraid that someone's going to get them by hacking into the computer, while no one's worried at all about someone walking in and getting them from the inside. There are some wide-open doors when it comes to internal network security (or lack-thereof), and it doesn't take a Hollywood actor to pull off a slip into the server room of almost any company.
Uh oh, possible future FUD avenue... (Score:1, Interesting)
How long until our favorite company (ahem) uses this to spin some tale about how the "signed OS" BIOS replacement is the right way to go? "Get this, and you don't have to worry about rogue hax0rs".
Unfortunately it also lets them tighten their grip like with the DRM stuff that keeps coming up. Blah.
uneducated users (Score:4, Interesting)
There are users I call who hand over the same information without any thought. Most of the time, I am there busy telling users to please not give me that information. The comparison of the username/password being like an ATM card and pin just doesn't work.
Our abuse department (yes we have one) has a two strikes and you're out policy. That is to say, if anything happens from your account the first time, you are given a warning and forced to read the entire IT policy. The second time, you account is deactivated in effect terminating your employment/affiliation with the university. You pretty much need your account for everything.
This issue has been spoken about for years and things rarely improve, but I still believe educating users is the best way to eventually solve the problems here.
Cant hack into a Mac OS! NEVER done once (BugTraq) (Score:1, Interesting)
I know some indication of that particular news piece is regarding cheap local machine packet grabbing, not WAN exploits, but the fact is still the same, no Mac OS 8x or 9x have EVER once been rooted.
In fact in the entire securityfocus (bugtraq) database history there has never been a Mac exploited over the internet remotely.
That is why the US Army gave up on MS IIS and got a Mac for a web server.
I am not talking about BSD derived MacOS X (which already had a couple of exploits) I am talking about current Mac OS 9.x and earlier.
Why is is hack proof? These reasons
1> No command shell. No shell means no way to hook or intercept the flow of control with many various shell oriented tricks found in Unix or NT
2> No Root user. All mac developers know their code is always running at root. Nothing is higher (except undocumented microkernel stufff where you pass Gary Davidians birthday into certain registers and make a special call). By always being root their is no false sense of security.
3> Pascal strings. ANSI C Strings are the number one way people exploit Linux and Wintel boxes. The mac avoids C strings historically in most of all of its OS. In fact even its roms originally used Pascal strings. As you know pascal strings are faster than C (because they have the length delimiter in the front and do not have to endlessly hunt for NULL), but the side effect is less buffer exploits. Individual 3rd party products may use C stings and bind to ANSI libraries, but many do not.
4>: Macs running Webstar have ability to only run CGI placed in correct directory location and correctly file "typed" (not file name extension).
5> Macs never run code ever merely based on how a file is named. ".exe" suffixes mean nothing. For example the file type is 4 characters of user-invisible attributes, along with many other invisible attributes, but these 4 bytes cannot be set by most tool oriented utilities that work with data files. For example file copy utilities preserve launchable file-types, but JPEG MPEG HTML TXT etc oriented tools are physically incapable by designof creating an executable file. The file type is not set to executable for hte hackers needs. In fact its even more secure than that. A mac cannot run a program unless it has TWO files. The second file is an invisible file associated with the data fork file and is called a resource fork. EVERY mac program has a resource fork file containing launch information. It needs to be present. Typically JPEG, HTML, MPEG, TXT, ZIP, C, etc are merely data files and lack resource fork files, and even if the y had them they would lack launch information. but the best part is that mac web programs and server tools do not create files with resource forks usually. TOTAL security.
4> Stack return address positioned in safer location than some intel osses. Buffer exploits take advantage of loser programmers lack of string length checking and clobber the return address to run thier exploit code instead. The Mac places return address infornt of where the buffer would overrun. Much safer.
7> There are less macs, though there are huge cash prizes for cracking into a MacOS based WebStar server. Less macs means less hacker interest, but there are millions of macs sold, and some of the most skilled programmers are well versed in systems level mac engineering and know of the cash prizes, so its a moot point, but perhaps macs are never kracked because there appear to be less of them. (many macs pretend they are unix and give false headers to requests to keep up the illusion, ftp http, finger, etc). But some huge high performance sites use load-balancing webstar
8> MacOS source not available traditionally, except within apple, similar to Microsoft source availability to its summer interns and engineers, source is rare to MacOS. This makes it hard to look for programming mistakes, but I feel the restricted source access is not the main reasons the MacOS has never been remotely broken into and exploited.
Sure a fool can install freeware and shareware server tools and unsecure 3rd party addon tools for e-commerce, but a mac (MacOS 9) running WebStar is the most secure web server possible and webstar offers many services as is.
One 3rd party tool created the only known exploit backdoor in mac history and that was back in 1995 and is not, nor was, a widely used tool. I do not even know its name. From 1995 to 2002 not one macintosh web server on the internet has been broken into or defaced EVER. Other than that event ages ago in 1995, no mac web server has ever been rooted,defaced,owned,scanned,exploited, etc.
I think its quite amusing that there are over 200 or 300 known vulenerabilities in RedHat over the years and not one MacOS 9.x or older remote exploit hack. There are even vulnerabilities a month ago in OpenBSD.
Not one exploit. And that includes Webstar and other web servers on the Mac.
--- too bad the linux community is so stubborn that they refuse to understand that the Mac has always been the most secure OS.
BugTraq concurs.
Web server written in PostScript (sources) (Score:3, Interesting)
As it points out, you can't listen on any port you want, because PostSCript lacks the ability to open sockets, post listens, or accept connections.
On the other hand, a few modifications, and it can listen on the LPR port of an HP network printer (all it has to do is intecept new connections, not listen or accept by itself).
-- Terry