Re: Someone is running his mouth again... [Hacker attacks in US linked to Chinese military: researchers]

[Valdis.Kletnieks () vt edu]

On Wed, 14 Dec 2005 16:27:57 PST, Geoff Shively said:

> In the attacks, Paller said, the perpetrators "were in and out with no
> keystroke errors and left no fingerprints, and created a backdoor in less
> than 30 minutes. How can this be done by anyone other than a military
> organization?"
> [/snip]
>
> Yes, it must have been military, becuase they rooted the box in under 30
> minutes, BAH!

On the other hand, let's think about this for a moment.  They weren't *IN*
in 30 minutes, they were *IN AND OUT* in 30 minutes.

Sure, *anybody* can just r00t a box and leave a backdoor in 30 seconds.  But
that doesn't actually *accomplish* anything unless your penis size is controlled
by the number of boxes you've pnwed this week.  These guys are hacking boxes
with an actual *goal* in mind....

You hack into a big Oracle server. You're sitting there looking at a '#'
prompt. *NOW* what do you do?  Which database instances and tables and rows and
columns are of interest?  How long does it take you to find where in that
database the CC numbers are stored? Think you can do that without mistyping
a table name at least once?

You hack into a file server.  You're sitting there looking at a '#' prompt.
*NOW* what do you do?  Which home directories have interesting/useful
information on them?   Sure, you can do a 'find /home -type f | xargs grep',
but what do you grep for? Do you know all the words/phrases you're likely to
find on *this* server (remember that one box may have troop training info,
while another may have deployment info, and so on)? How long does it take to
sort the useful stuff from the trash? Think you can do that without mistyping a
filename at least once?

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/