[ISN] Analysts: Any Web site can be a hacking target

From: InfoSec News (isnat_private)
Date: Mon May 14 2001 - 13:38:19 PDT

  • Next message: William Knowles: "[ISN] The May Report: 05/14/2001: Electronic banking security problems at Bank One? (fwd)"

    May 11, 2001 
    What do Bubbles Car Wash in Houston, Primal Elements Inc. in Garden
    Grove, Calif., and the city of Kerville, Texas, have in common?
    Security analysts said all three are examples of how automated
    scanning tools and hacking probes can make random prey out of any Web
    site, including those that might otherwise seem to be improbable
    targets of malicious attackers bent on defacing home pages or
    compromising systems.
    Web sites run by the two companies and Kerville's local government
    were victims of the recent spat between Chinese and American hackers
    that broke out after the recent spy plane crisis involving the two
    countries. But there likely wasn't any particular reason why those
    sites were defaced by anti-American graffiti.
    Sites often get hacked simply because they present an opportunity for
    vandalism and not because they espouse any ideology or cause that an
    attacker may oppose, said Ira Winkler, president of the Internet
    Security Advisors Group in Severna Park, Md., and author of Corporate
    Espionage (Prima Publishing, 1999). "To a hacker, you're just an IP
    address," Winkler said. "You get hit because you let yourself be an
    easy mark."
    Because most automated scanning tools are prowling the Web in search
    of systems that are susceptible to known security vulnerabilities, he
    added, companies often can mitigate their risks by applying
    recommended software patches and updates whenever they become
    Two other things companies can do to minimize their exposure to
    attacks is to make their home pages "read only" and to get rid of the
    cmd.exe DOS prompt on their Web servers, said Russ Cooper, an analyst
    at Reston, Va.-based security firm TruSecure Corp. The DOS prompt is
    often exploited by attackers to generate malicious commands, he noted.
    In attacks that rely on automated hacking tools, "the first thing to
    remember is that the actual target is often not one that is chosen,
    but one that is found," Cooper said. The tools basically search entire
    ranges of IP addresses for systems that aren't protected against known
    vulnerabilities that can then be exploited.
    Cooper said that even large companies with vigorous security measures
    protecting their main Web servers often overlook smaller
    Internet-connected systems within their IT networks, such as an
    Exchange server with Internet e-mail access. Such servers can be
    easily discovered by scanning and then used to enter corporate sites,
    he added.
    Earlier this week, the CERT Coordination Center at Carnegie Mellon
    University in Pittsburgh issued an updated warning about a "dramatic
    increase in network reconnaissance activity" involving known security
    holes in various network services.
    CERT, a security research and information service, also posted an
    advisory warning users about new worm code that it said can infect
    computers running Sun Microsystems Inc.'s Solaris operating system and
    then use the machines to attack Web servers based on Microsoft Corp.'s
    software (see story).
    The self-propagating worm, known as sadmind/IIS, takes advantage of a
    Solaris security hole that was discovered two years ago and a hole in
    Microsoft's Internet Information Services (IIS) Web server software
    that was uncovered last fall. Software patches that are supposed to
    fix the problems have long been available from both Sun and Microsoft.
    Last weekend, meanwhile, the FBI-affiliated National Infrastructure
    Protection Center (NIPC) warned about a significant increase in
    Unix-based network scanning and probing activities. The scans were
    looking for vulnerabilities that could be used to launch
    denial-of-service attacks, according to the NIPC's alert (see story).
    At Bubbles Car Wash, the company's home page was defaced with crude
    anti-American graffiti last Sunday. "I was real surprised, because we
    are not a high-profile site," said CEO William Lawrence. He added that
    the company quickly closed down the site, applied a security patch and
    had it back up and running by midday Monday.
    Primal Energy, a manufacturer of soaps and beauty products, was also
    hit by hackers who claimed to be pro-Chinese. "Obviously, we were all
    aware of the issue, but we certainly didn't expect to be a target,"
    said Allan Guarino, a vice president at the company. From now on, he
    added, Primal Energy plans to quickly install all recommended patches.
    ISN is hosted by SecurityFocus.com
    To unsubscribe email isn-unsubscribeat_private

    This archive was generated by hypermail 2b30 : Mon May 14 2001 - 23:21:28 PDT