Analysts: Any Web Site Can be a Hacking Target

What do Bubbles Car Wash in Houston, Primal Elements Inc. in Garden

Grove, Calif., and the city of Kerville, Texas, have in common?

Security analysts said all three are examples of how automated scanning

tools and hacking probes can make random prey out of any Web site,

including those that might otherwise seem to be improbable targets of

malicious attackers bent on defacing home pages or compromising

systems.

Web sites run by the two companies and Kerville's local government were

victims of the recent spat between Chinese and American hackers that

broke out after the recent spy plane crisis involving the two

countries. But there likely wasn't any particular reason why those

sites were defaced by anti-American graffiti.

Sites often get hacked simply because they present an opportunity for

vandalism and not because they espouse any ideology or cause that an

attacker may oppose, said Ira Winkler, president of the Internet

Security Advisors Group in Severna Park, Md., and author of Corporate

Espionage (Prima Publishing, 1999). "To a hacker, you're just an IP

address," Winkler said. "You get hit because you let yourself be an

easy mark."

Because most automated scanning tools are prowling the Web in search of

systems that are susceptible to known security vulnerabilities, he

added, companies often can mitigate their risks by applying recommended

software patches and updates whenever they become available.

Two other things companies can do to minimize their exposure to attacks

is to make their home pages "read only" and to get rid of the cmd.exe

DOS prompt on their Web servers, said Russ Cooper, an analyst at

Reston, Va.-based security firm TruSecure Corp. The DOS prompt is often

exploited by attackers to generate malicious commands, he noted.

In attacks that rely on automated hacking tools, "the first thing to

remember is that the actual target is often not one that is chosen, but

one that is found," Cooper said. The tools basically search entire

ranges of IP addresses for systems that aren't protected against known

vulnerabilities that can then be exploited.

Cooper said that even large companies with vigorous security measures

protecting their main Web servers often overlook smaller Internet-

connected systems within their IT networks, such as an Exchange server

with Internet e-mail access. Such servers can be easily discovered by

scanning and then used to enter corporate sites, he added.

In May, the CERT Coordination Center at Carnegie Mellon University in

Pittsburgh issued an updated warning about a "dramatic increase in

network reconnaissance activity" involving known security holes in

various network services.

CERT, a security research and information service, also posted an

advisory warning users about new worm code that it said can infect

computers running Sun Microsystems Inc.'s Solaris operating system and

then use the machines to attack Web servers based on Microsoft Corp.'s

software.

The self-propagating worm, known as sadmind/IIS, takes advantage of a

Solaris security hole that was discovered twwo years ago and a hole in

Microsoft's Internet Information Services (IIS) Web server software

that was uncovered last fall. Software patches that are supposed to fix

the problems have long been available from both Sun and Microsoft.

Meanwhile, the FBI-affiliated National Infrastructure Protection Center

(NIPC) warned about a significant increase in Unix-based network

scanning and probing activities. The scans were looking for

vulnerabilities that could be used to launch denial-of-service attacks,

according to the NIPC's alert.

At Bubbles Car Wash, the company's home page was defaced with crude

anti-American graffiti last Sunday. "I was real surprised, because we

are not a high-profile site," said CEO William Lawrence. He added that

the company quickly closed down the site, applied a security patch and

had it back up and running by midday Monday.

Primal Energy, a manufacturer of soaps and beauty products, was also

hit by hackers who claimed to be pro-Chinese. "Obviously, we were all

aware of the issue, but we certainly didn't expect to be a target,"

said Allan Guarino, a vice president at the company. From now on, he

added, Primal Energy plans to quickly install all recommended patches.

Insider: How the basic tech behind the Internet works
Join the discussion
Be the first to comment on this article. Our Commenting Policies