Hardware & Infrastructure
04:10 PM
Connect Directly
Repost This

Hack in Progress

Just how easy is it to break into your company's networks? Hire a hacker, then sit tight.

Breed sees something interesting. He points to lines and lists of numbers that may as well be written in Urdu as far as most everyone else in the room is concerned. "This usually means someone is outsourcing or has a different server range somewhere," he says, looking at the IT manager, who confirms that a good portion of the company's systems are outsourced.

Breed avoids scanning the hosted domains--no sense making their intrusion-detection systems light up. He finds a local server with an open port. Breed uses Netcat, a network-analysis tool, to figure out what type of Web server he's looking at. It's a Lotus Domino Server.

The IT manager has been toying with a white bottle-cap, and now his right leg breaks out in nervous thumping. Breed says he's found a mail server, two Web servers, and the Domino Notes server. "We're looking for services that are open. Anything that is open on port 80 [Web port] is worth looking for," he says.

chartThe next program he runs is Nikto, a free tool for scanning Web servers for vulnerabilities. Breed studies the lists and takes more notes. "We found a new host name, another potential target," he says.

"He hasn't broken into anything," the IT manager tells the director.

Breed is looking through files in the Domino database. Now he's looking at Lotus MTA routing tables. "MTA tables show how the system routes mail. It may or may not tell us something, but it's always worth looking at."

Breed pauses for a moment. He's accessed a file called names.nsf. Suddenly, the company's directory splashes on the screen. Breed is scrolling up and down, reading what appear to be the addresses and contact information for everyone in the company.

"That's my home address!" says the director.

Then Breed discovers he's able to download user IDs in Lotus Notes. These are files used to log on to the company's E-mail system. It's a long list, and includes the entire management team. "I could have total E-mail access in a matter of hours or days," Breed says. "Since they can be copied, you can do an offline attack on them all day until you crack one."

"Why don't we just close that up and pretend it didn't happen," jokes the IT manager.

Now Breed fires up another free security tool called Nessus, from the Nessus Project, which develops open-source toolsets and security scanners that look for potential ways crackers could break in or misuse applications. Lists of potential vulnerabilities, generated by Nessus, scroll across the screen. Breed asks the IT manager how often the company updates its servers. The IT manager says systems are patched regularly--a good step toward secure systems.

Breed didn't find much worth looking at with the Nessus scan, so he turns back to information he collected earlier. This time it's a server that, when he surfs with Internet Explorer, prompts him with a digital certificate. And the certificate is invalid. "This is something that a hacker could attempt to use against you," he says. Breed explains that if users get used to clicking "yes" to the invalid certificate, they could do so when a hacker has taken control of the machine. A hacker could exploit this, Breed says, by setting up what's called a "man-in-the-middle attack"--crafting his or her own digital certificate that would closely resemble the certificate users are used to signing. When a user clicks "yes" to trust it, portions of what they do on the Internet will be guided through a system under the control of the hacker. "It's an interesting way to collect passwords and other interesting things," he says.

2 of 3
Comment  | 
Print  | 
More Insights
The Agile Archive
The Agile Archive
When it comes to managing data, donít look at backup and archiving systems as burdens and cost centers. A well-designed archive can enhance data protection and restores, ease search and e-discovery efforts, and save money by intelligently moving data from expensive primary storage systems.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Elite 100 - 2014
Our InformationWeek Elite 100 issue -- our 26th ranking of technology innovators -- shines a spotlight on businesses that are succeeding because of their digital strategies. We take a close at look at the top five companies in this year's ranking and the eight winners of our Business Innovation awards, and offer 20 great ideas that you can use in your company. We also provide a ranked list of our Elite 100 innovators.
Twitter Feed
Audio Interviews
Archived Audio Interviews
GE is a leader in combining connected devices and advanced analytics in pursuit of practical goals like less downtime, lower operating costs, and higher throughput. At GIO Power & Water, CIO Jim Fowler is part of the team exploring how to apply these techniques to some of the world's essential infrastructure, from power plants to water treatment systems. Join us, and bring your questions, as we talk about what's ahead.