Just how easy is it to break into your company's networks? Hire a hacker, then sit tight.
Breed sees something interesting. He points to lines and lists of numbers that may as well be written in Urdu as far as most everyone else in the room is concerned. "This usually means someone is outsourcing or has a different server range somewhere," he says, looking at the IT manager, who confirms that a good portion of the company's systems are outsourced.
Breed avoids scanning the hosted domains--no sense making their intrusion-detection systems light up. He finds a local server with an open port. Breed uses Netcat, a network-analysis tool, to figure out what type of Web server he's looking at. It's a Lotus Domino Server.
The IT manager has been toying with a white bottle-cap, and now his right leg breaks out in nervous thumping. Breed says he's found a mail server, two Web servers, and the Domino Notes server. "We're looking for services that are open. Anything that is open on port 80 [Web port] is worth looking for," he says.
The next program he runs is Nikto, a free tool for scanning Web servers for vulnerabilities. Breed studies the lists and takes more notes. "We found a new host name, another potential target," he says.
"He hasn't broken into anything," the IT manager tells the director.
Breed is looking through files in the Domino database. Now he's looking at Lotus MTA routing tables. "MTA tables show how the system routes mail. It may or may not tell us something, but it's always worth looking at."
Breed pauses for a moment. He's accessed a file called names.nsf. Suddenly, the company's directory splashes on the screen. Breed is scrolling up and down, reading what appear to be the addresses and contact information for everyone in the company.
"That's my home address!" says the director.
Then Breed discovers he's able to download user IDs in Lotus Notes. These are files used to log on to the company's E-mail system. It's a long list, and includes the entire management team. "I could have total E-mail access in a matter of hours or days," Breed says. "Since they can be copied, you can do an offline attack on them all day until you crack one."
"Why don't we just close that up and pretend it didn't happen," jokes the IT manager.
Now Breed fires up another free security tool called Nessus, from the Nessus Project, which develops open-source toolsets and security scanners that look for potential ways crackers could break in or misuse applications. Lists of potential vulnerabilities, generated by Nessus, scroll across the screen. Breed asks the IT manager how often the company updates its servers. The IT manager says systems are patched regularly--a good step toward secure systems.
Breed didn't find much worth looking at with the Nessus scan, so he turns back to information he collected earlier. This time it's a server that, when he surfs with Internet Explorer, prompts him with a digital certificate. And the certificate is invalid. "This is something that a hacker could attempt to use against you," he says. Breed explains that if users get used to clicking "yes" to the invalid certificate, they could do so when a hacker has taken control of the machine. A hacker could exploit this, Breed says, by setting up what's called a "man-in-the-middle attack"--crafting his or her own digital certificate that would closely resemble the certificate users are used to signing. When a user clicks "yes" to trust it, portions of what they do on the Internet will be guided through a system under the control of the hacker. "It's an interesting way to collect passwords and other interesting things," he says.
IT's Reputation: What the Data SaysInformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business really views IT's performance in delivering services - and, more important, powering innovation. Our results suggest IT leaders should worry less about whether they're getting enough resources and more about the relationships they have with business unit peers.
What The Business Really Thinks Of IT: 3 Hard TruthsThey say perception is reality. If so, many in-house IT departments have reason to worry. InformationWeek's IT Perception Survey seeks to quantify how IT thinks it's doing versus how the business views IT's performance in delivering services - and, more important, powering innovation. The news isn't great.
InformationWeek Must Reads Oct. 21, 2014InformationWeek's new Must Reads is a compendium of our best recent coverage of digital strategy. Learn why you should learn to embrace DevOps, how to avoid roadblocks for digital projects, what the five steps to API management are, and more.