full-disclosure - Someone is running his mouth again... [Hacker attacks in US linked to Chinese military: researchers]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu Dec 15 18:43:08 2005
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: Someone is running his mouth again... [Hacker
	attacks in US linked to Chinese military: researchers] 

On Wed, 14 Dec 2005 16:27:57 PST, Geoff Shively said:

> In the attacks, Paller said, the perpetrators "were in and out with no
> keystroke errors and left no fingerprints, and created a backdoor in less
> than 30 minutes. How can this be done by anyone other than a military
> organization?"
> [/snip]
> 
> Yes, it must have been military, becuase they rooted the box in under 30
> minutes, BAH!

On the other hand, let's think about this for a moment.  They weren't *IN*
in 30 minutes, they were *IN AND OUT* in 30 minutes.

Sure, *anybody* can just r00t a box and leave a backdoor in 30 seconds.  But
that doesn't actually *accomplish* anything unless your penis size is controlled
by the number of boxes you've pnwed this week.  These guys are hacking boxes
with an actual *goal* in mind....

You hack into a big Oracle server. You're sitting there looking at a '#'
prompt. *NOW* what do you do?  Which database instances and tables and rows and
columns are of interest?  How long does it take you to find where in that
database the CC numbers are stored? Think you can do that without mistyping
a table name at least once?

You hack into a file server.  You're sitting there looking at a '#' prompt.
*NOW* what do you do?  Which home directories have interesting/useful
information on them?   Sure, you can do a 'find /home -type f | xargs grep',
but what do you grep for? Do you know all the words/phrases you're likely to
find on *this* server (remember that one box may have troop training info,
while another may have deployment info, and so on)? How long does it take to
sort the useful stuff from the trash? Think you can do that without mistyping a
filename at least once?

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20051215/f65c870c/attachment.bin