Win2K security = 0

Undertoad · 05-08-2002, 11:15 AM

Granted I'm no MCSE, but...

All I did...

I loaded Win 2K on an empty machine.

I did a Windows Update and retrieved and applied all the patches.

I set a pretty strong Administrator password, and set up requiring ctrl-alt-del to log in.

I set up one non-Admin user for FTP access.

I started IIS and FTP. I did development work on the box for three weeks.

I notice some odd unexpected inbound traffic. Check it out and indeed, the box has been cracked. Somebody's put some warez into the non-Admin user's FTP section.

Now, granted FTP uses plain-text passwords, and granted I don't use a hardware firewall here, and granted a whole bunch of other stuff. But three weeks! Come on!

MaggieL · 05-08-2002, 01:36 PM

Ummmm...weak non-admin user password? How about the username?

My impression is that traffic on ntbugtraq seems pretty unhappy with using WU for security stuff, too.

Undertoad · 05-08-2002, 02:23 PM

The user was "anton", password was something like (but was not)"mpv5jd2i".

05-08-2002, 02:36 PM

i generally use a 27 character, alpha-numeric mixed-case password. i don't figure it's very likely that it's going to get cracked. you know. something like

82dwHE7dl29D69G30zltnfau26m

wee!

remembering it can be a bit of a pain in the ass, so i break it down like this:

8 8 6 5

and i always use the password generator that i wrote to come up with 'em. it's good stuff

russotto · 05-08-2002, 02:59 PM

I use a Mac. Even if you could break in, who would want to?

MaggieL · 05-08-2002, 04:14 PM

So the password was fairly strong as such things go. Looks like somebody either sniffed your packet logging on, or found a W2K exploit that the box isn't patched for. I'm guessing the latter.

Kris · 05-08-2002, 06:19 PM

windows update doesn't plug the swiss cheese... it's more geared towards the OS vs. add-ons. They've got a separate tool that'll let you check to see if IIS has all the latest hotfixes applied (similar to up2date, apt get, etc).

You can get it from here .

mbpark · 05-08-2002, 08:54 PM

FTP on Windows is complete evil.

FTP on any platform is completely bad.

I just run OpenSSH on production Windows boxes, and use WinSCP2 to SCP the files over just like Explorer.

I have actually had that happen to me with Windows 2000 and FTP, and vowed never again to use an unencrypted way to authenticate to a site.

BTW, there's about 40 registry hacks and ACL permissions you have to change.

It's a bitch to get 2K up to some sort of snuff, but it works well if you don't use FTP

.

Mitch

MaggieL · 05-08-2002, 10:30 PM

Quote:

Originally posted by mbpark
I just run OpenSSH on production Windows boxes, and use WinSCP2 to SCP the files over just like Explorer.

I'm delighted to hear there's SSH for Windows boxen. But "just like Explorer?" Is WinSCP2 a GUI app?

That Guy · 05-09-2002, 08:28 AM

Quote:

Originally posted by Undertoad
Granted I'm no MCSE, but...

Minesweeper Champion and Solitaire Expert?...

mbpark · 05-09-2002, 09:09 AM

Yep,

It's GUI. This makes me happy because it takes me 5 minutes to explain to someone how to use it, most of which is spent reviewing SSH authentication

.

As opposed to standard SCP, which is painful, WinSCP2 allows me to instruct our site people quickly on how to update web sites, without using evil unencrypted and bandwidth hogging FTP.

OpenSSH for Windows runs as a service, and also allows you to ssh right into the box, running multiple interactive command line sessions along with your VNC sessions.

By the time I am done with a Windows box, chances are it's got the following anyway:

1. OpenSSH for Windows, which is also a Cygwin port.
2. PuTTY ssh client, because it's nice.
3. Tunnelier SSH tunneling tool.
4. A Linux or OpenBSD box as a firewall

.
5. NAT, to make tunneling over a bitch that you need Tunnelier for.
6. A completely hacked registry.
7. ACL's like mad.
8. Most of IIS completely disabled, except for ASP and Perl scripting. This is how I avoided Code Red and Nimda, because we disabled most of IIS and don't do anything more than ASP with it.

Windows = one bitch and a half to set up, but remarkably stable if you take the time to lock it down and don't use unsigned video drivers.

It takes me about 4-5x the time it takes me to set up a Linux box to set up a Windows one, since Microsoft turns on EVERYTHING by default.

Mitch

05-09-2002, 09:25 AM

Eh, so does RedHat. It's just really easy to turn off RedHat shit.

# chkconfig sendmail off

is usually one of the first things I do.

Undertoad · 05-09-2002, 09:58 AM

Thanks for the tips folks.

After this current project I'm just gonna turn all the services off that I won't need, and run a software firewall on it. And never offer any Windows-based hosting.

MaggieL · 05-09-2002, 10:30 AM

Quote:

Originally posted by mbpark

As opposed to standard SCP, which is painful, WinSCP2 allows me to instruct our site people quickly on how to update web sites, without using evil unencrypted and bandwidth hogging FTP.OpenSSH for Windows runs as a service...

Now, that's a cool thing. Goes right into my bag-o-tricks.

Quote:

It takes me about 4-5x the time it takes me to set up a Linux box to set up a Windows one, since Microsoft turns on EVERYTHING by default.

The more features they leave turned on, the more likely that some less-than-clueful local junior developer will build a dependancy on them.

Oh, Tony....one tip I know if you absolutely must run an FTP service is to change the greeting message, making it harder for a script to figure out which exploits to try first. But with the ability to run scp, FTP is much less necessary.

jaguar · 05-10-2002, 01:45 AM

ISS is very hard to secure, is is far from by deafult
get one of the many free tools around that can secure, i know microsoft has one, tis probably not the best
furthermore can you give me any of the details that was on the warez, group tags etc, i can probably tell you who hacked it.

05-08-2002, 11:15 AM	#1
Undertoad Radical Centrist Join Date: Jan 2001 Location: Cottage of Prussia Posts: 31,423	Win2K security = 0 Granted I'm no MCSE, but... All I did... I loaded Win 2K on an empty machine. I did a Windows Update and retrieved and applied all the patches. I set a pretty strong Administrator password, and set up requiring ctrl-alt-del to log in. I set up one non-Admin user for FTP access. I started IIS and FTP. I did development work on the box for three weeks. I notice some odd unexpected inbound traffic. Check it out and indeed, the box has been cracked. Somebody's put some warez into the non-Admin user's FTP section. Now, granted FTP uses plain-text passwords, and granted I don't use a hardware firewall here, and granted a whole bunch of other stuff. But three weeks! Come on!

05-08-2002, 01:36 PM	#2
MaggieL in the Hour of Scampering Join Date: Jan 2001 Location: Jeffersonville PA (15 mi NW of Philadelphia) Posts: 4,060	Ummmm...weak non-admin user password? How about the username? My impression is that traffic on ntbugtraq seems pretty unhappy with using WU for security stuff, too. __________________ "Neither can his Mind be thought to be in Tune,whose words do jarre; nor his reason In frame, whose sentence is preposterous..."

05-08-2002, 04:14 PM	#6
MaggieL in the Hour of Scampering Join Date: Jan 2001 Location: Jeffersonville PA (15 mi NW of Philadelphia) Posts: 4,060	So the password was fairly strong as such things go. Looks like somebody either sniffed your packet logging on, or found a W2K exploit that the box isn't patched for. I'm guessing the latter. __________________ "Neither can his Mind be thought to be in Tune,whose words do jarre; nor his reason In frame, whose sentence is preposterous..."

05-08-2002, 06:19 PM	#7
Kris Drawn Druid Join Date: Aug 2001 Location: Over there Posts: 32	Just a note... windows update doesn't plug the swiss cheese... it's more geared towards the OS vs. add-ons. They've got a separate tool that'll let you check to see if IIS has all the latest hotfixes applied (similar to up2date, apt get, etc). You can get it from here .

05-08-2002, 08:54 PM	#8
mbpark Lecturer Join Date: Jan 2001 Location: Carmel, Indiana Posts: 761	FTP? FTP on Windows is complete evil. FTP on any platform is completely bad. I just run OpenSSH on production Windows boxes, and use WinSCP2 to SCP the files over just like Explorer. I have actually had that happen to me with Windows 2000 and FTP, and vowed never again to use an unencrypted way to authenticate to a site. BTW, there's about 40 registry hacks and ACL permissions you have to change. It's a bitch to get 2K up to some sort of snuff, but it works well if you don't use FTP . Mitch

05-08-2002, 02:23 PM	#3
Undertoad Radical Centrist Join Date: Jan 2001 Location: Cottage of Prussia Posts: 31,423	The user was "anton", password was something like (but was not)"mpv5jd2i".

05-08-2002, 02:36 PM	#4
dave Guest Posts: n/a	i generally use a 27 character, alpha-numeric mixed-case password. i don't figure it's very likely that it's going to get cracked. you know. something like 82dwHE7dl29D69G30zltnfau26m wee! remembering it can be a bit of a pain in the ass, so i break it down like this: 8 8 6 5 and i always use the password generator that i wrote to come up with 'em. it's good stuff

05-08-2002, 02:59 PM	#5
russotto Professor Join Date: Jan 2001 Posts: 1,788	I use a Mac. Even if you could break in, who would want to?

05-09-2002, 09:09 AM	#11
mbpark Lecturer Join Date: Jan 2001 Location: Carmel, Indiana Posts: 761	WinSCP2 = GUI Yep, It's GUI. This makes me happy because it takes me 5 minutes to explain to someone how to use it, most of which is spent reviewing SSH authentication . As opposed to standard SCP, which is painful, WinSCP2 allows me to instruct our site people quickly on how to update web sites, without using evil unencrypted and bandwidth hogging FTP. OpenSSH for Windows runs as a service, and also allows you to ssh right into the box, running multiple interactive command line sessions along with your VNC sessions. By the time I am done with a Windows box, chances are it's got the following anyway: 1. OpenSSH for Windows, which is also a Cygwin port. 2. PuTTY ssh client, because it's nice. 3. Tunnelier SSH tunneling tool. 4. A Linux or OpenBSD box as a firewall . 5. NAT, to make tunneling over a bitch that you need Tunnelier for. 6. A completely hacked registry. 7. ACL's like mad. 8. Most of IIS completely disabled, except for ASP and Perl scripting. This is how I avoided Code Red and Nimda, because we disabled most of IIS and don't do anything more than ASP with it. Windows = one bitch and a half to set up, but remarkably stable if you take the time to lock it down and don't use unsigned video drivers. It takes me about 4-5x the time it takes me to set up a Linux box to set up a Windows one, since Microsoft turns on EVERYTHING by default. Mitch

05-09-2002, 09:25 AM	#12
dave Guest Posts: n/a	Eh, so does RedHat. It's just really easy to turn off RedHat shit. # chkconfig sendmail off is usually one of the first things I do.

05-09-2002, 09:58 AM	#13
Undertoad Radical Centrist Join Date: Jan 2001 Location: Cottage of Prussia Posts: 31,423	Thanks for the tips folks. After this current project I'm just gonna turn all the services off that I won't need, and run a software firewall on it. And never offer any Windows-based hosting.

05-10-2002, 01:45 AM	#15
jaguar whig Join Date: Apr 2001 Posts: 5,075	ISS is very hard to secure, is is far from by deafult get one of the many free tools around that can secure, i know microsoft has one, tis probably not the best furthermore can you give me any of the details that was on the warez, group tags etc, i can probably tell you who hacked it. __________________ Good friends, good books and a sleepy conscience: this is the ideal life. - Twain

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)