Friday, June 03, 2005

Putting It All Together Well, after spending the last two days cleaning up compromised machines and doing some forensics, it appears as though we have determined how we were compromised.  The initial servers--there were two--run some Oracle components to allow connectivity to our Oracle database.  These Oracle components have not been patched, and Oracle released a large batch of patches on 13 April 2005.  Additionally, these servers were open to the Internet.  They did not need to be, so we have now disabled their access.  It looks like our hacker probably gained access to the boxes via the Oracle vulnerabilities.  Once they were in, they ran some password cracking tools to determine the passwords for local accounts on the machine.  They also determined the services running on the machine.  They discovered Terminal Services was running on the server, and they gained access to it via the now easily guessable password for the Administrator account.  It was not too far a leap for them to essentially run this same script to compromise hosts on the same subnet.  Fortunately, it was not completely successful on those machines that had the latest version of VirusScan.  Also, not all servers were hosting pirated content.  The host that connected and installed all of these services resided in Edinburgh, Scotland.  We are still working with the information technology staff at the University of Edinburgh to get the offending host examined.  As a resultof this incident, all passwords have been changed.  Those servers that do not need outside access have now been blocked to campus-only.  We are also crafting some better policies to govern the patching of the applications that reside on this machine.  In addition to the vulnerability scans that our Security group performs, we will do some proactive monitoring of the servers to alert us to any unexpected open ports.  Finally, this is speeding up the deployment of the campus firewall that has been talked about greatly in the last few months.  The lesson here is that security is not merely making sure that the operating system is fully patched.  The applications that run on the operating system also need to be patched.  3:51:20 PM    comment []  trackback []