Full Disclosure mailing list archives
Re: Someone is running his mouth again... [Hacker attacks in US linked to Chinese military: researchers]
From: Valdis.Kletnieks () vt edu
Date: Thu, 15 Dec 2005 13:42:47 -0500
On Wed, 14 Dec 2005 16:27:57 PST, Geoff Shively said:
In the attacks, Paller said, the perpetrators "were in and out with no keystroke errors and left no fingerprints, and created a backdoor in less than 30 minutes. How can this be done by anyone other than a military organization?" [/snip] Yes, it must have been military, becuase they rooted the box in under 30 minutes, BAH!
On the other hand, let's think about this for a moment. They weren't *IN* in 30 minutes, they were *IN AND OUT* in 30 minutes. Sure, *anybody* can just r00t a box and leave a backdoor in 30 seconds. But that doesn't actually *accomplish* anything unless your penis size is controlled by the number of boxes you've pnwed this week. These guys are hacking boxes with an actual *goal* in mind.... You hack into a big Oracle server. You're sitting there looking at a '#' prompt. *NOW* what do you do? Which database instances and tables and rows and columns are of interest? How long does it take you to find where in that database the CC numbers are stored? Think you can do that without mistyping a table name at least once? You hack into a file server. You're sitting there looking at a '#' prompt. *NOW* what do you do? Which home directories have interesting/useful information on them? Sure, you can do a 'find /home -type f | xargs grep', but what do you grep for? Do you know all the words/phrases you're likely to find on *this* server (remember that one box may have troop training info, while another may have deployment info, and so on)? How long does it take to sort the useful stuff from the trash? Think you can do that without mistyping a filename at least once?
Attachment:
_bin
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Someone is running his mouth again... [Hacker attacks in US linked to Chinese military: researchers] Geoff Shively (Dec 14)
- Re: Someone is running his mouth again... [Hacker attacks in US linked to Chinese military: researchers] InfoSecBOFH (Dec 14)
- Re: Someone is running his mouth again... [Hackerattacks in US linked to Chinese military: researchers] sk / GroundZero (Dec 15)
- RE: Someone is running his mouth again... [Hackerattacks in US linked to Chinese military: researchers] Paul Melson (Dec 15)
- Re: Someone is running his mouth again... [Hacker attacks in US linked to Chinese military: researchers] Valdis . Kletnieks (Dec 15)