Re: Security Concern

From: Steven L Umbach (n9rou@attbi.com)
Date: 03/16/03 

From: "Steven L Umbach" <n9rou@attbi.com>
Date: Sun, 16 Mar 2003 01:36:27 GMT

      Hi Steve. A number of things could have happened. Somebody acquired
local administrator access on that machine. Obtaining passwords can happen a
number of ways including - guessing, cracking, watching (hidden camera),
keyboard logging, network packet sniffer, social engineering, finding,
bribing, extorting, etc. Some people just are too lazy to secure their
workstations when logged on and walk away. This can happen on the local
network or from the internet if connected. Computers that are not physically
secured are at particular risk especially if they can be booted from a
floppy, cdrom, etc - there are floppy disks that can boot and crack the sam
fairly easily. Domain controllers should be locked up, maybe even with
burglar alarms or at very least in a secure heavy duty case that also locks
access to front and back. Your workstations should have locked cases with a
password protected cmos and configured to have the hard drive to be first in
the boot order. W98 leaves you particularly vulnerable to packet sniffing if
they do not have Active Directory Client (free from MS) installed/enabled
along with at least SP4 on all the NT4.0 machines. W98 uses lm
authentication which is very weak and even a visit to an internet site can
capture the hash for cracking. You want to get all computers up to ntlm v2.
If connected to the internet be sure to use a good SPI firewall that has
control over OUTBOUND as well as inbound access, intrusion detection, and
logging. Firewalls like this can be purchased for around $500 or less. After
you think you have your firewall configured correctly be sure to do a port
scan from the wan side and do that on a regular basis. You may even want to
consider personal firewalls on workstations. Enable auditing for log ons,
review your password/lockout policies, keep all computers up to date as far
as security patches, take special precautions protecting/using the
administrator accounts (they can not be locked out and never use an
administrator account for routine tasks), use an up to date virus scanning
program that can scan in and outbound emails on all computers, etc. See
various links for more info on securing/cleaning/hardening your computers
and network. --- Steve

http://www.netscreen.com/products/appliances.html#ns5xp_xt
http://www.zywall.com/firewall_products/internet_security_gateway/zywall10.h
tm
http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/
default.asp
http://securityadmin.info/faq.htm
http://securityadmin.info/faq.htm#harden

"Steve Manswell" <sm2122@columbia.edu> wrote in message
news:034201c2eace$b320a9a0$a401280a@phx.gbl...
> Hi Everyone,
> I am a support tech for a company. It has a
> winnt4.0 domain with W2kPro and W98 clients. I recently
> discovered a strange happening.It appears that someone
> access our network and created a user on the local
> computer. They also place that user in the local security
> policy under the "Access this computer from the network"
> setting. Has anyone heard of this? Does any one know how
> it was done? And how do I prevent it.
> Thanks in advance for your response.
>
>
>
>

Relevant Pages

  • Re: LAN problem: cant browse network computers
    ... was created when you computers were set up. ... Likewise, there are no passwords. ... Network Access – Let everyone permissions apply to anonymous users – Enable ... My Network Places> View Network Connections> ...
    (microsoft.public.windowsxp.network_web)
  • Re: Networking Vista and XP
    ... About 4 or 5 weeks ago, a lot of people were making posts describing their problems successfully achieving file sharing in Vista (especially between Vista and XP computers, in both directions) and asking for help. ... this is caused by a "feature" that exists in both XP and Vista involving zero-length passwords. ... Media Center and Vista will not allow network access to network computers that have zero-length passwords. ...
    (alt.sys.pc-clone.dell)
  • Re: How to disable domain administrator get local administrators group ?
    ... > In a big network, ... some computers have security data(e.g. ... > administrator can logon domain administrator via these computers and ...
    (microsoft.public.win2000.security)
  • Re: Basic Security Help
    ... a network is weak or no passwords followed by malicious user on your ... -- Use password policy to enforce strong passwords in the domain by enabling ... -- Be sure that computers are kept current of critical security updates from ... Windows Updates or using a SUS server to authorize and distribute security ...
    (microsoft.public.security)
  • FW: Hydra or network logon cracker for Windows?
    ... login as Administrator is most definitely a "battle worth fighting". ... Given that, if I were to test for your list of passwords on my network, I ... Original> against a small list of passwords like Tomcat, Tomcat1, TomCat, ...
    (Security-Basics)