Analysts: Any Web site can be a hacking target

What do Bubbles Car Wash in Houston, Primal Elements Inc. in Garden Grove, Calif., and the city of Kerville, Texas, have in common?

Security analysts said all three are examples of how automated scanning tools and hacking probes can make random prey out of any Web site, including those that might otherwise seem to be improbable targets of malicious attackers bent on defacing home pages or compromising systems.

Web sites run by the two companies and Kerville's local government were victims of the recent spat between Chinese and American hackers that broke out after the recent spy plane crisis involving the two countries. But there likely wasn't any particular reason why those sites were defaced by anti-American graffiti.

Sites often get hacked simply because they present an opportunity for vandalism and not because they espouse any ideology or cause that an attacker may oppose, said Ira Winkler, president of the Internet Security Advisors Group in Severna Park, Md., and author of Corporate Espionage (Prima Publishing, 1999). "To a hacker, you're just an IP address," Winkler said. "You get hit because you let yourself be an easy mark."

Because most automated scanning tools are prowling the Web in search of systems that are susceptible to known security vulnerabilities, he added, companies often can mitigate their risks by applying recommended software patches and updates whenever they become available.

Two other things companies can do to minimize their exposure to attacks is to make their home pages "read only" and to get rid of the cmd.exe DOS prompt on their Web servers, said Russ Cooper, an analyst at Reston, Va.-based security firm TruSecure Corp. The DOS prompt is often exploited by attackers to generate malicious commands, he noted.

In attacks that rely on automated hacking tools, "the first thing to remember is that the actual target is often not one that is chosen, but one that is found," Cooper said. The tools basically search entire ranges of IP addresses for systems that aren't protected against known vulnerabilities that can then be exploited.

Cooper said that even large companies with vigorous security measures protecting their main Web servers often overlook smaller Internet-connected systems within their IT networks, such as an Exchange server with Internet e-mail access. Such servers can be easily discovered by scanning and then used to enter corporate sites, he added.

Earlier this week, the CERT Coordination Center at Carnegie Mellon University in Pittsburgh issued an updated warning about a "dramatic increase in network reconnaissance activity" involving known security holes in various network services.

Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world

• Email
• Print
• Share
  • Slashdot
  • Digg
  • Stumble
  • Reddit
  • Newsvine