Just how easy is it to break into your company's networks? Hire a hacker, then sit tight.
Breed sees something interesting. He points to lines and lists of numbers that may as well be written in Urdu as far as most everyone else in the room is concerned. "This usually means someone is outsourcing or has a different server range somewhere," he says, looking at the IT manager, who confirms that a good portion of the company's systems are outsourced.
Breed avoids scanning the hosted domains--no sense making their intrusion-detection systems light up. He finds a local server with an open port. Breed uses Netcat, a network-analysis tool, to figure out what type of Web server he's looking at. It's a Lotus Domino Server.
The IT manager has been toying with a white bottle-cap, and now his right leg breaks out in nervous thumping. Breed says he's found a mail server, two Web servers, and the Domino Notes server. "We're looking for services that are open. Anything that is open on port 80 [Web port] is worth looking for," he says.
The next program he runs is Nikto, a free tool for scanning Web servers for vulnerabilities. Breed studies the lists and takes more notes. "We found a new host name, another potential target," he says.
"He hasn't broken into anything," the IT manager tells the director.
Breed is looking through files in the Domino database. Now he's looking at Lotus MTA routing tables. "MTA tables show how the system routes mail. It may or may not tell us something, but it's always worth looking at."
Breed pauses for a moment. He's accessed a file called names.nsf. Suddenly, the company's directory splashes on the screen. Breed is scrolling up and down, reading what appear to be the addresses and contact information for everyone in the company.
"That's my home address!" says the director.
Then Breed discovers he's able to download user IDs in Lotus Notes. These are files used to log on to the company's E-mail system. It's a long list, and includes the entire management team. "I could have total E-mail access in a matter of hours or days," Breed says. "Since they can be copied, you can do an offline attack on them all day until you crack one."
"Why don't we just close that up and pretend it didn't happen," jokes the IT manager.
Now Breed fires up another free security tool called Nessus, from the Nessus Project, which develops open-source toolsets and security scanners that look for potential ways crackers could break in or misuse applications. Lists of potential vulnerabilities, generated by Nessus, scroll across the screen. Breed asks the IT manager how often the company updates its servers. The IT manager says systems are patched regularly--a good step toward secure systems.
Breed didn't find much worth looking at with the Nessus scan, so he turns back to information he collected earlier. This time it's a server that, when he surfs with Internet Explorer, prompts him with a digital certificate. And the certificate is invalid. "This is something that a hacker could attempt to use against you," he says. Breed explains that if users get used to clicking "yes" to the invalid certificate, they could do so when a hacker has taken control of the machine. A hacker could exploit this, Breed says, by setting up what's called a "man-in-the-middle attack"--crafting his or her own digital certificate that would closely resemble the certificate users are used to signing. When a user clicks "yes" to trust it, portions of what they do on the Internet will be guided through a system under the control of the hacker. "It's an interesting way to collect passwords and other interesting things," he says.
5 Top Federal Initiatives For 2015As InformationWeek Government readers were busy firming up their fiscal year 2015 budgets, we asked them to rate more than 30 IT initiatives in terms of importance and current leadership focus. No surprise, among more than 30 options, security is No. 1. After that, things get less predictable.