On Wed, 14 Dec 2005 16:27:57 PST, Geoff Shively said: > In the attacks, Paller said, the perpetrators "were in and out with no > keystroke errors and left no fingerprints, and created a backdoor in less > than 30 minutes. How can this be done by anyone other than a military > organization?" > [/snip] > > Yes, it must have been military, becuase they rooted the box in under 30 > minutes, BAH! On the other hand, let's think about this for a moment. They weren't *IN* in 30 minutes, they were *IN AND OUT* in 30 minutes. Sure, *anybody* can just r00t a box and leave a backdoor in 30 seconds. But that doesn't actually *accomplish* anything unless your penis size is controlled by the number of boxes you've pnwed this week. These guys are hacking boxes with an actual *goal* in mind.... You hack into a big Oracle server. You're sitting there looking at a '#' prompt. *NOW* what do you do? Which database instances and tables and rows and columns are of interest? How long does it take you to find where in that database the CC numbers are stored? Think you can do that without mistyping a table name at least once? You hack into a file server. You're sitting there looking at a '#' prompt. *NOW* what do you do? Which home directories have interesting/useful information on them? Sure, you can do a 'find /home -type f | xargs grep', but what do you grep for? Do you know all the words/phrases you're likely to find on *this* server (remember that one box may have troop training info, while another may have deployment info, and so on)? How long does it take to sort the useful stuff from the trash? Think you can do that without mistyping a filename at least once?
Attachment:
pgpmX2LmdCOuq.pgp
Description: PGP signature
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/