ZDNet UK / News and Analysis / Infrastructure / Networking

Hacker speaks out on security basics

By Jeanne Vida Douglas, ZDNet Australia, 25 March, 2002 11:10

Daily Newsletters

Sign up to ZDNet UK's daily newsletter.

Topics

Hacking, Email, Buffer overflow, hack2002, security advice, Viruses, Worm, Rain Forest Puppy

NEWS
"It's simple," says Rain Forest Puppy. "Don't feel you have to...take it from Microsoft, just figure out what services lead to security risks and turn them off." Pacing up an down the stage in a non-stop information-laden presentation at Hack 2002, held recently in Sydney, the "white hat" hacker known only as Rain Forest Puppy (RFP) reeled off a litany of security holes in operating systems and applications from Sendmail to Solaris and back again. "Security has to be flexible and militant," RFP told the audience. "You can run through all the security checklists you like but that still doesn't account for the weird and wacky stuff the script kiddies are coming out with." RFP's recipe for staying one step ahead of the script kiddies is surprisingly simple: "if you don't need it -- TURN IT OFF." Referring to a host of worms, viruses, and even malicious hacks, RFP demonstrated how system defaults made many systems easy pickings for automated techniques. "You can securely configure your applications, it is not too hard to configure IIS to be secure, it is just that most people either can't be bothered, or don't want to go into it in case they break something," RFT said. "Code Red just ran along the buffer cover overflow, and could have been stopped if someone had just gone along and changed the default." Advocating that systems administrators find out what each default pertains to and either delete or disable those that are not directly in use, RFP focused special attention on virtual directories, remote data services, scripts directories, connection time outs and of course, buffer overflows. "It is in your interests to turn this crap off," he railed. "Doing something as simple as lowering the connection time out to an astronomically low level will make it vastly more difficult to launch an attack against your system." However, he didn't stop at IIS. According to RFP, popular distributions of Apache also come with a series of activated defaults which essentially leave Web facing systems at serious risk of attack. "First up remove all unused modules; access, alias, autoindex, cgi, dir, env, log_config, mime, setnevif," RFP said. "Be cautious about where your alias and script aliases are mapping to, and disable multiview." While he concedes that some of these modules are required by some sites, some of the time, by and large they are a security hole and therefore pose a threat to most systems. "If you do ever need them you can always go back in and turn them on again, a cgi ban is enough to screw up most Web scanners, so the bad guys won't be able to look into your system in the first place, let alone hack in to it," he said. He went on to give a similar treatment to NetScape, ISC BIND, and warned of the tendency for PHP and Web site headers to reveal potentially sensitive system information. "PHP loves to advertise itself, it is even possible to trick it into going to another Web site, and downloading executable files without you even knowing about it," he warned. "Scanners looking for vulnerabilities often base their search on banners, and if you manage to modify your headers slightly it will reduce your exposure to script kiddies and automated attacks at the very least." Barely stopping for breath, RFP went on to discuss vulnerability scanning software which "didn't suck entirely." "You have to look at your system from a hacker's point of view," he said. "You need to realise what information you are giving away and what it looks like to them." Apart from his "if you don't use it, dump it," philosophy, RFP insists systems administrators need to stay informed via sites like Security Focus, Vulnwatch and SANS. In the mean time, anyone after RFP's tips from the Hack 2002 conference should visit his Web site. "The information is there to be shared," RFP says, welcoming people to his site. "I'm all for people getting informed."
For all security-related news, including updates on the latest viruses, hacking exploits and patches, check out ZDNet UK's Viruses and Hacking News Section. Have your say instantly, and see what others have said. Go to the Security forum. Let the editors know what you think in the Mailroom.

Related stories

Code Red is here to stay

Hackers can come in through the front door

Internal hacking: Stopping the mole within

Ofcom to make it easier to change broadband service

Google set to build backbone of its 1Gbps fibre network

Post your comment

In order to post a comment you need to be registered and logged in.

You can also log in with Facebook. Log in or create your ZDNet UK account below

  • Login

Will not be displayed with your comment

By signing up for this service, you indicate that you agree to our Terms and Conditions and have read and understood our Privacy Policy. Questions about membership? Find the answers in the Community FAQ

Get ZDNet UK's daily newsletter

Enter your email address to sign up

ZDNet UK Live

GrueMaster

Nice review and very informative. One thing I'd like to add (in reply to whs001's 1st question), the main reason to have the same interface from...

1 hour ago by GrueMaster on A tale of two distros: Ubuntu and Linux Mint
Frederick Wrigley

I'be been using Mint 12 since the RC came out, and I am far more happy with the Cinnamon, the Mate, and, yes (with extensions), theGnome 3...

2 hours ago by Frederick Wrigley via Facebook on A tale of two distros: Ubuntu and Linux Mint
bdantas

Excellent article. One small correction, though--although a fresh installation of Linux Mint 12 will, indeed, provide the user with a version of...

3 hours ago by bdantas on A tale of two distros: Ubuntu and Linux Mint
Alan Ralph

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

3 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material
Alan Ralph

In related news, the ISPs club together to get the members of the Home Affairs Select Committee (ya goofed on that part, ZDNet UK) copies of "The...

3 hours ago by Alan Ralph via Facebook on MPs urge ISPs to take down terrorist material
Moley

For Gnome 2 die-hards, it is possible to add icons to the bottom panel (or top top panel, if you prefer) which provide the exact Gnome 2...

4 hours ago by Moley on A tale of two distros: Ubuntu and Linux Mint
ramwellian

Your comments would seem pretty naive and immature. Your 'solution' appears to be, "gee, let's all just give in to the hackers and give them...

4 hours ago by ramwellian on Cloud computing security: no more oxymoron?
BugStalker

"Interesting thought ... If you installed Win7 as a dual boot on a machine that previously only had Linux, and it wrecked your Linux installation,...

5 hours ago by BugStalker on Windows 7 Declares War on GRUB
whs001

This is an excellent summary of Ubuntu and Mint and the interface differences between them. Most such articles take a very partisan position for...

5 hours ago by whs001 on A tale of two distros: Ubuntu and Linux Mint
Moley

@ewallace. Not so clear. Anyone can obtain the text, for example from here http://www.ustr.gov/webfm_send/2379. I support ACTA so long as it and...

5 hours ago by Moley on ACTA: Facts, misconceptions and questions
45283

I think WinRT is fantastic. I just wish it was an option for people that didn't want to go through Microsoft's App Store with its attendant...

8 hours ago by 45283 on Why Windows 8 needs architectural hygiene for WOA
Burn-IT

Nine people? £30m? Who's back pocket is that lot going in? And IF they say it is for new buildings, what about all the ones the government has...

9 hours ago by Burn-IT on Police set to launch three £30m e-crime hubs
ewallace

Just to be clear, nobody knows what is in the text of ACTA, here is a photograph of the text of ACTA http://twitpic.com/8h9iju as submitted to the...

9 hours ago by ewallace on ACTA: Facts, misconceptions and questions
fgvrg56

Unfortunately main issue is that ASUS is refusing to accept that they make some mistake on this version of asus Transformer prime. 1 - GPS sensor...

10 hours ago by fgvrg56 on Asus Eee Pad Transformer Prime Wi-Fi & GPS problems?
Ben Woods

@Marcus A fair question. Just talked with Archos which said it was working on an announcement for next week....

11 hours ago by Ben Woods on Archos confirms G9 Ice Cream Sandwich update schedule
Marcus Karlsson

Any update on this, considering the claimed "first week of February"?

13 hours ago by Marcus Karlsson via Facebook on Archos confirms G9 Ice Cream Sandwich update schedule
apexwm

Bill Goodrich : Just as al_langevin pointed out, with Windows Server 2008 there is no Services for Macintosh anymore. It's gone, not available....

21 hours ago by apexwm on Windows Server 2008 drops the ball for Mac compatibility
txtrainguy

Replying to an old topic that I'm currently facing with my CEO (who is on a Mac). Our servers are primarily Windows Servers, office is about...

1 day ago by txtrainguy on Windows Server 2008 drops the ball for Mac compatibility
k0tcs3

Sure, that makes perfect sense. Pay wrong-doers money and thank them for breaching your security and pointing out your flaws, that would surely...

1 day ago by k0tcs3 on US indicts Romanian over NASA climate change hack
Random_Error

I think he's referring specifically to Android apps, as Apple do regulate their App Store, but Google seem to let any old crap onto the Android store!

1 day ago by Random_Error on RIM: BlackBerry will keep 'garbage' apps out of store

Latest in Networking

Ofcom to make it easier to change broadband service

Google set to build backbone of its 1Gbps fibre network

Nicira reveals network virtualisation details

Featured white papers

Six iPad tests for multimedia-grade Wi-Fi

Aruba Networks

Six iPad tests for multimedia-grade Wi-Fi

The University of Ottawa, Apple, Aruba Networks and others validate a multimedia grade Wi-Fi environment for scaling voice and video... Read more

Enterprise wireless networks add speed with 802.11n

Aruba Networks

Enterprise wireless networks add speed with 802.11n

This Aruba white paper explains the advanced technology introduced in the 'final' 802.11n certification, allowing enterprise network managers to understand its benefits and to plan their own upgrade... Read more

Solution Brief: Top 5 Reasons to Choose Blue Coat WAN Optimization

Blue Coat Systems

Solution Brief: Top 5 Reasons to Choose Blue Coat WAN Optimization

There's a pretty good chance your wide area network (WAN) looks like a mess right now. The rapid adoption of... Read more

Inside ZDNet UK

A tale of two distros: Ubuntu and Linux Mint

A tale of two distros: Ubuntu and Linux Mint

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

2012 Predictions: VCE FastPath, VI SAN Probe & Hadoop

BlackBerry Bold 9790

BlackBerry Bold 9790

Case study: How cloud enables growth

Case study: How cloud enables growth

Ten factors that make Ubuntu 11.10 a hit

Ten factors that make Ubuntu 11.10 a hit

Toshiba Portégé Z830-10P Review

Toshiba Portégé Z830-10P Review

BT's archive: Pictures from the vault

BT's archive: Pictures from the vault