PToN
join:2001-10-04
Houston, TX | OS or app?
Is the list on the post made at insecure.org is true, i would wonder if it would be a new vulnerability in *nix..? There is a lot of HP-UX listed there as well as AIX and Sun... |
|
bigfitch
Premium
join:2005-06-01
Murrayville, IL
clubs: | If this is true. It just adds more proof that everything is accesable if you have the know how and the time.
Wonder if said hacker left himself a backdoor to get more info for his next auction. Lol |
|
PToN
join:2001-10-04
Houston, TX
| Well, once he said he got it he close any possible backdoor he/she might have left.
He wanted this for $$$ and not for any other purpose. Any respectable hacker/cracker knows that one of the rules is to never close any doors to a system you might need later, else he would have said nothing and he might have been able to use the servers for much bigger things. However, this is just an extortion case.. |
|
KodiacZiller
join:2008-09-04
73368
| reply to PToN
said by PToN  :Is the list on the post made at insecure.org is true, i would wonder if it would be a new vulnerability in *nix..? There is a lot of HP-UX listed there as well as AIX and Sun... Could just be that the T-mobile admins were lazy about security updates. This is how their systems were breached back in 2005. They failed to patch a security exploit that had been widely known about for a while. |
|
cyclone_z
join:2006-06-19
Ames, IA
 ·Qwest.net
| said by KodiacZiller :said by PToN :Is the list on the post made at insecure.org is true, i would wonder if it would be a new vulnerability in *nix..? There is a lot of HP-UX listed there as well as AIX and Sun... Could just be that the T-mobile admins were lazy about security updates. This is how their systems were breached back in 2005. They failed to patch a security exploit that had been widely known about for a while. Having worked for one of the companies that sells one of those operating systems, I will tell you that often times big companies are lax on internal security. They have a good firewall, but systems on the other side are unpatched. They make the mistake of trusting the network, but all it takes is one security breach, and then someone is in a wonderland of vulnerable systems. The company I worked for was running a number of unpatched Windows servers, and that got them in trouble when a windows virus got through via email. It then started spreading on the internal network. There were also engineers using Unix workstations running outdated releases of our Unix-based OS for which we were no longer making security patches. They were also using things like rsh, telnet, etc., which don't encrypt anything. Were someone from the outside to get a compromised machine and set ethernet in promiscuous mode -- oh man, a cornucopia of passwords!
T-Mobile may be doing something similar. The lesson is don't trust the network, even if you have a firewall. |
|
PapaMidnight
join:2009-01-13
Baltimore, MD
| said by cyclone_z :said by KodiacZiller :said by PToN :Is the list on the post made at insecure.org is true, i would wonder if it would be a new vulnerability in *nix..? There is a lot of HP-UX listed there as well as AIX and Sun... Could just be that the T-mobile admins were lazy about security updates. This is how their systems were breached back in 2005. They failed to patch a security exploit that had been widely known about for a while. Having worked for one of the companies that sells one of those operating systems, I will tell you that often times big companies are lax on internal security. They have a good firewall, but systems on the other side are unpatched. They make the mistake of trusting the network, but all it takes is one security breach, and then someone is in a wonderland of vulnerable systems. The company I worked for was running a number of unpatched Windows servers, and that got them in trouble when a windows virus got through via email. It then started spreading on the internal network. There were also engineers using Unix workstations running outdated releases of our Unix-based OS for which we were no longer making security patches. They were also using things like rsh, telnet, etc., which don't encrypt anything. Were someone from the outside to get a compromised machine and set ethernet in promiscuous mode -- oh man, a cornucopia of passwords! T-Mobile may be doing something similar. The lesson is don't trust the network, even if you have a firewall. Not quite sure the lesson is so much of "Don't trust the network".
More along the lines of as we always say in the security world: "The weakest element in any security system is the human element." |
|
KevNYC
Premium
join:2002-03-31
Seattle, WA | SkyNet anyone? |
|
NonSecPer
@holdenandrew.com | reply to cyclone_z
It is not "Don't trust the network", but "don't trust the users"! |
|
