Re: [PEN-TEST] Looking for slides

["William D. Colburn (aka Schlake)" <wcolburn () NMT EDU>]

Hmmmm.  I found a stock redhat 5.2 box on my campus last week.  It seems
to have been up and running (and on the internet) since 1998.  It was
running a web server (and had web pages on it), DNS, news, printing, and
every other inane service that got installed by default.  I searched it
really hard for any evidence of a compromise, but as far as I can tell
it was a pure as freshly fallen snow.  I was, to say the least, suprised.

The juiciness of the target has a lot to do with the speed of its
demise.

The box I found was old outdated hardware when Redhat was first
installed on it.  The person who installed redhat skipped all the
development stuff (not sure why, the hard drive was big enough), so
there was no compiler.  The network it was on was a patched together
hunk of copper almost a hundred miles long between it and the router.

In short, it was a slow machine on a slow link, without any tools.  No
doubt that no one was interested in it.

PS: That machine isn't on our network anymore.  :)

On Tue, Oct 31, 2000 at 03:11:29PM -0500, Bennett Todd wrote:
> 2000-10-31-11:15:28 Ed Lamaster:
> > About 6 months ago I stumbled on a Powerpoint presentation that
> > had some interesting information about how long it took a stock
> > RedHat box (think it was 5.2, but I might be wrong) to be
> > discovered and completely compromised on a university network.
> > My recollection was that the total time elapsed was around 3 or
> > 4 months.
>
> Whew. I find that astonishing. I'd have put the expected time at a
> few days, and I'd be completely unsurprised to see a stock Unix
> system (any vendor, never seen one secure out of the box[*]) get
> knocked flat even before the install finished. It all depends on the
> current climate of folks running automated scanners in your part of
> the net. I always and only install on secured private networks, and
> don't expose servers to the internet until inetd is killed, sendmail
> is killed, lpd is killed, BIND is killed, portmapper is killed, ....
>
> -Bennett

--
William Colburn, "Sysprog" <wcolburn () nmt edu>
Computer Center, New Mexico Institute of Mining and Technology
http://www.nmt.edu/tcc/     http://www.nmt.edu/~wcolburn