Re: [cobalt-security] URGENT Hacking

[Hugh Taylor <hrtlist@xxxxxxxxxxxx>]

I know I'm coming in late to this thread, but please bear with me. I would
suggest, as has been previously suggested, that you go to www.sans.org and look
there for the next level one classes they are offering. I took the whole track
in July in DC and found it very ineteresting and informative. One thing you will
learn from the courses, is that brute force password cracking WILL ALWAYS WORK,
it is just a matter of time. The only way to prevent this type of attack is to
make sure you have strong passwords and change them regularly. How often depends
on how strong the passwords are, how fast the current PCs are, and how important
it is to protect the data (there are some other variables also).

The other thing you'll learn is NEVER run a password cracking program without
prior written permission from your management, preferably at least two levels
above you. I would suggest that if you are using a hosting service, getting
written permission from them also. Without written, signed permission you may
find yourself looking for another job and/or being criminally prosecuted.


Mark Baker - Cobalt Lists wrote:

> Hi All,
>
> We've just had an account hacked on our RaQ3, the person who did this claims
> he got it from the log files just above the user name e.g. domain.com/~user
> Apparently he got the FTP password from there, and used it to chance the
> site e.t.c
> He claims he used brute force, this is all i know so please help anyone out
> there!!
>
> Is this a known fault and when do cobalt expect to fix it?
>
> Regards,
>
> Mark Baker
> Dark Marketing Ltd
> http://www.yoursitehere.co.uk
> ------------------------------------------------------------------
> Low cost Internet Solutions including Hosting,
> Domain Registration and Design.
> http://www.yoursitehere.co.uk | info@xxxxxxxxxxxxxxxxxx
> ------------------------------------------------------------------
> FREE .co.uk with Unix hosting package 2 to 7 at
> http://www.yoursitehere.co.uk !!
> ------------------------------------------------------------------
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security

--
Hugh Taylor
Supervisor, IS
The Johns Hopkins University
Chemical Propulsion Information Agency
10630 Little Patuxent Parkway, Suite 202
Columbia, MD 21044-3204