Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Novell server hacked, used to scan for vulnerable computers
ComputerWorld ^ | Sept 28, 2005 | Jaikumar Vijayan

Posted on 09/29/2005 6:15:26 PM PDT by Golden Eagle

SEPTEMBER 28, 2005 (COMPUTERWORLD) - A company server that some workers at Novell Inc. apparently used for gaming purposes was hacked into and then used to scan for vulnerable ports on potentially millions of computers worldwide, according to an Internet security consultant.

The scans, which have been going on since Sept. 21, are targeted at TCP Port 22 -- the default port for Secure Shell (SSH) services. SSH programs are used to log into other computers over a network or to execute remote commands and move files between machines in a secure fashion. Scans against the port are often an indication that hackers are looking for vulnerable SSH systems that they can break into and take control of.

(Excerpt) Read more at computerworld.com ...


TOPICS: Business/Economy; Crime/Corruption; News/Current Events
KEYWORDS: linux; novell; opensource; security
Navigation: use the links below to view more comments.
first previous 1-2021-4041-6061-62 next last
To: BIRDS
"'The employees that set it up apparently had no idea of security,' Brandon said. 'But what is really surprising is that Novell would allow employees to set up game servers on their corporate network and then allow the public to access it.'"

Quake servers are quite common in internal development organizations. ;-) The trick is to always have a couple of spare "test" machines attached. Getting it exposed to the outside world is the real problem. I've always thought, if you get caught, you deserve to get burned to the fullest extent.

21 posted on 09/29/2005 7:06:11 PM PDT by glorgau
[ Post Reply | Private Reply | To 15 | View Replies]

To: Golden Eagle

It isn't obvious the server was hacked at all, not that it's much better. A user with legitimate access to the box might well be responsible. Naughty, very naughty...


22 posted on 09/29/2005 7:10:09 PM PDT by Billthedrill
[ Post Reply | Private Reply | To 1 | View Replies]

To: ConservativeMind

Nonsense. NetWare at least through 5.5 have been very exploitable, except that no one bothers.


23 posted on 09/29/2005 7:12:54 PM PDT by Doohickey (If you choose not to decide, you still have made a choice...I will choose freewill.)
[ Post Reply | Private Reply | To 5 | View Replies]

To: BIRDS

I have those same experiences, and have a report on my desk every afternoon showing every unexpected request we received on unusual ports. Like you I used to contact them all, back before we got hundreds in a day, and on occasion I will still contact them if something is persistent, but in many instances it's impossible to get the granularity you need to actually contact the specific offender, and the subnet host either doesn't have time or care themselves. The good news is, it is of course possible to block those attempts, which is why we keep most everything locked down by default, and only open up when absolutely necessary, both ways.


24 posted on 09/29/2005 7:15:49 PM PDT by Golden Eagle
[ Post Reply | Private Reply | To 18 | View Replies]

To: Golden Eagle
Netware has had 15 advisories with NO "extremely critical" alerts and only ONE "highly critical" alert since 2003.

Microsoft, in its latest Windows 2003 Enterprise Server has had 64 advisories with ONE "extremely critical" and 23 "highly critical" alerts since 2003.

I think you need to learn a bit more about computer networking. It is something I have worked with for 20 years.

Enjoy!

http://secunia.com/product/78/

http://secunia.com/product/1174/
25 posted on 09/29/2005 7:21:18 PM PDT by ConservativeMind
[ Post Reply | Private Reply | To 16 | View Replies]

To: ConservativeMind

What's your point, this comparable Novell product has more.

http://secunia.com/product/2467/

Again, I'll ask, since you brought up Microsoft, has anything like this ever happened to them, especially where servers registered to them were out attacking computers on the internet? I guess your refusal to answer the question means no, it never has.


26 posted on 09/29/2005 7:21:42 PM PDT by Golden Eagle
[ Post Reply | Private Reply | To 19 | View Replies]

To: Doohickey
Comparing apples to apples, NT had similar vulnerabilities.

Check out my immediately prior post to compare Netware 6 against Windows 2003 Enterprise Server--both comparable.

There is no contest. Microsoft's network software continues to be much more vulnerable.

Get real.
27 posted on 09/29/2005 7:23:35 PM PDT by ConservativeMind
[ Post Reply | Private Reply | To 23 | View Replies]

To: Golden Eagle
SUSE is not Netware.

The story is about Netware.

Please read your own article post.
28 posted on 09/29/2005 7:24:47 PM PDT by ConservativeMind
[ Post Reply | Private Reply | To 26 | View Replies]

To: Golden Eagle

Same here. I work at a hospital with some top-notch network guys, and nothing gets by them.


29 posted on 09/29/2005 7:26:58 PM PDT by rlmorel ("Innocence seldom utters outraged shrieks. Guilt does." Whittaker Chambers)
[ Post Reply | Private Reply | To 17 | View Replies]

To: Golden Eagle
If they have any sort of actual security at the perimeter, somebody with authority to stop this should have been aware of this server long ago. This could indicate bigger problems with their configuration that need correction, in addition to a cleanup of whatever other servers that don't support their business but are out on their network. Wonder if we'll hear much else about it.

I believe that the article said that the server was actually outside their firewall. Thereby, completely open to attack. I'm thinking that this isn't a Netware server, but a Linux server, and obviously, one that wasn't secured at all.

Mark

30 posted on 09/29/2005 7:30:14 PM PDT by MarkL (I didn't get to where I am today by worrying about what I'd feel like tomorrow!)
[ Post Reply | Private Reply | To 11 | View Replies]

To: Billthedrill
It isn't obvious the server was hacked at all, not that it's much better. A user with legitimate access to the box might well be responsible.

Absolutely. Any thorough investigation should start with an internal audit, since that doesn't even require initial compromise. If the hacker was any good, they'll never know where he came from, or where he went. They'll need someone good to find him/her, and the best leads would probably come in where he was continually collecting any data from those external probes, since it would be a repeated action. I doubt any of that will ever be shared externally, though, just not smart since that exposes their security/methods as well. Their situation sounds so loose they probably need an external review.

31 posted on 09/29/2005 7:32:11 PM PDT by Golden Eagle
[ Post Reply | Private Reply | To 22 | View Replies]

To: ConservativeMind
The story is about Netware. Please read your own article post.

What are you talking about now? I just searched for the word "Netware" and it doesn't appear anywhere on that page. Do you even know that Novell owns SUSE?

32 posted on 09/29/2005 7:36:47 PM PDT by Golden Eagle
[ Post Reply | Private Reply | To 28 | View Replies]

To: Doohickey
Nonsense. NetWare at least through 5.5 have been very exploitable, except that no one bothers.

Huh? First off, there's not such thing as "NetWare 5.5," and in fact, until NetWare 5.0, NetWare servers didn't even "speak TCP/IP." (Servers starting with NW 3.0 could, however route IP, but there was nothing to exploit.)

Now, if you're talking about GroupWise 5.5 and ealier, well for the most part, you're talking about Word Perfect Office and Mail. Until GroupWise 5.0, they didn't even work natively with IP. You needed an SMTP gateway. Again, nothing really to exploit. There were some relay vulnerablilties, but they could be blocked without too much difficulty. However, the GroupWise clients have always been less vulnerable to virus infections on the network.

Mark

33 posted on 09/29/2005 7:38:29 PM PDT by MarkL (I didn't get to where I am today by worrying about what I'd feel like tomorrow!)
[ Post Reply | Private Reply | To 23 | View Replies]

To: MarkL
I believe that the article said that the server was actually outside their firewall.

Said they were "test servers" outside the firewall. Obviously not a good idea, we only have one server outside, production only, and it's security is highest priority including a local software firewall.

34 posted on 09/29/2005 7:40:37 PM PDT by Golden Eagle
[ Post Reply | Private Reply | To 30 | View Replies]

To: rlmorel

You and I, we have the right ideas. Let's run for Congress. ;)


35 posted on 09/29/2005 7:44:59 PM PDT by Killborn (God bless the rescuers, God bless the Commander in Chief, and God bless America.)
[ Post Reply | Private Reply | To 10 | View Replies]

To: Golden Eagle

So his original sentence should have been 30 years. Add his extension and he would be in jail for 55 years.

Sounds good to me.


36 posted on 09/29/2005 7:48:40 PM PDT by Killborn (God bless the rescuers, God bless the Commander in Chief, and God bless America.)
[ Post Reply | Private Reply | To 14 | View Replies]

To: Golden Eagle
Since you brought up Microsoft, ever heard of anything like this ever happening with them?

Doesn't Mircrosoft use some Linux servers?

37 posted on 09/29/2005 7:50:35 PM PDT by PAR35
[ Post Reply | Private Reply | To 7 | View Replies]

To: Golden Eagle
And I'm pretty sure that it would be a SuSe Linux server too, although theoretically, it could be an OES or NW65 server... Given the fact that NW6.5 does support ssh (if you load the sshd.nlm, and enable it) and the fact that you've got perl and php, as well as apache, it could have theoretically been done on a NetWare based system, although it would have to be tough to use a guess on the passwords.

On the other hand, if they used the default user name of "admin" and a password of "novell," then they got what they deserved.

Mark

38 posted on 09/29/2005 7:52:09 PM PDT by MarkL (I didn't get to where I am today by worrying about what I'd feel like tomorrow!)
[ Post Reply | Private Reply | To 34 | View Replies]

To: Killborn

No kidding. I am serious, though. Shame is no longer a valid form of punishment. Everyone thinks being judgemental is "bad".

Man, I can tell you when my radiology department went down (we are all digital) because of viruses, those people responsible should be thankful they were anonymous. That stuff just enrages me. It is like stupid kids spray painting graffiti on cars.


39 posted on 09/29/2005 7:54:41 PM PDT by rlmorel ("Innocence seldom utters outraged shrieks. Guilt does." Whittaker Chambers)
[ Post Reply | Private Reply | To 35 | View Replies]

To: PAR35

They have a "lab" I've heard, but I've never heard of it getting hacked.


40 posted on 09/29/2005 8:13:24 PM PDT by Golden Eagle
[ Post Reply | Private Reply | To 37 | View Replies]


Navigation: use the links below to view more comments.
first previous 1-2021-4041-6061-62 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson