Hacker warns Nasdaq.com of security holes

[William Knowles <wk () C4I ORG>]

http://www.cnn.com/2000/TECH/computing/10/03/nashaq.idg/index.html

October 3, 2000
Web posted at: 10:09 a.m. EDT (1409 GMT)
by Joris Evers

(IDG) -- Web sites with financial news have become vital for
investors. Imagine the disarray that could occur if a hacker took over
such a site. A Dutch hacker claims he could have altered Nasdaq.com
and three sites run by MarketWatch.com.

He didn't, however. Instead he warned the administrators at
Nasdaq.com, CBS.MarketWatch.com, BigCharts.com, and FTMarketWatch.com.
Now the security holes have been patched up and the hacker is
disclosing his discoveries.

Gerrie Mansur, one of the leaders of Dutch hacking group Hit2000,
gained access to the global.asa file from the Web servers of the news
sites. This file regulates who gets access to what applications on the
server. The file also defines what the applications can do and
contains the global settings for the applications, as well as start-up
and shutdown routines. Nasdaq's global.asa file contains the password
to the site's main database, Mansur said.

The news sites run on IIS (Internet Information Server) software from
Microsoft.

"Mansur took advantage of known security holes," said Marco van
Berkum, a security specialist at Dutch IT security company Obit. Van
Berkum guessed that the hacker used a well-known security hole called
the Source Fragment Disclosure Vulnerability.

"Often the global.asa file will contain database passwords," Van
Berkum said. "It looks like that was the case with Nasdaq."

Details of this particular vulnerability, or security hole, were
published on the BugTraq mailing list on July 17. By adding "+.htr" to
a request for a known .asa (or .asp, .ini, etc.) file, Microsoft IIS
4.0 and 5.0 can be made to disclose fragments of source code that
should otherwise be inaccessible. (A description of the vulnerability
can be found via the link below.)

Mansur, however, denied having used this method to hack into the
servers.

"I did not use the Source Fragment Disclosure Vulnerability, but used
an exploit I wrote myself," he said. The exploit is software tool that
Mansur developed and then used to gain access to the servers.

"I will not publish the exploit," Mansur said.

"People will start using it, and that's just too dangerous. I was able
to log in as service administrator and get full access to the server.
I could even kick the administrator."

The hacker warned all the involved Webmasters by e-mail. Dan
Schindler, director of technical client service at CBSMarketWatch.com,
responded, "Many thanks for bringing this to our attention. We have
installed a patch and deployed it to all our data centers. We
appreciate your honesty and willingness to send this notification to
us," Schindler said in his e-mail.


--
*==============================================================*
"Communications without intelligence is noise;  Intelligence
without communications is irrelevant." Gen Alfred. M. Gray, USMC
================================================================
C4I.org - Computer Security, & Intelligence - http://www.c4i.org
*==============================================================*

ISN is hosted by SecurityFocus.com
---
To unsubscribe email LISTSERV () SecurityFocus com with a message body of
"SIGNOFF ISN".