Subject: RE: [hackers-il] Redhat 7 account access

From: rtuci rtuci <[email-masked]>
Date: Thu, 9 Nov 2000 09:34:36 -0800 (PST)

Those are the list of open ports...
How can he enter my system?
Any of those systems have an authentication method...
he must make many tries before he succeed... and I
would see error messages in the log files.

ftp
telnet
smtp
http
tac news
pop3
sunrpc
auth
nntp
htpps
spooler

--- Ishay Sommer <[email-masked]> wrote:
> 
> Depends on your password scheme, it might take much
> less then a billion...
> He can also connect to the pop3 and do the same...
> Are you sure that these are the only open ports?
> Finger could be very
> helpful
> to a hacker...
> 
> Also, various DoS attacks, or other vulnurabilities
> of RH7 which will be
> discovered shortly
> I am sure, will allow a hacker to perhaps even run
> code on your machine.
> 
> The policy is, if you don't need it, don't run it.
> 
> -----Original Message-----
> From: rtuci rtuci [mailto:[email-masked]]
> Sent: Wednesday, November 08, 2000 3:24 AM
> To: [email-masked]
> Subject: [hackers-il] Redhat 7 account access
> 
> 
>  
> 
> 
> Hi,
> 
> I installed RedHat 7 in a computer connected to the
> internet.
> The following deamons are running:
> telnet, ftp, smtp, pop3.
> 
> Beside, connecting with telnet and/or ftp and trying
> 1
> billion passwords -
> there is any way that a hacker can get access to my
> user accounts?
> 
> How can I log these kind of acction - to find out
> how
> get access to the account?
> 
> Thank you,
> 
> Tuci
> 
> P.S. please send me a copy to [email-masked]
> 
> 
> 
> 
> __________________________________________________
> Do You Yahoo!?
> Thousands of Stores.  Millions of Products.  All in
> one Place.
> http://shopping.yahoo.com/
> 
> -------------------------- eGroups Sponsor
> 
> To unsubscribe from this group, send an email to:
> [email-masked]
> 
> 

__________________________________________________
Do You Yahoo!?
Thousands of Stores.  Millions of Products.  All in one Place.
http://shopping.yahoo.com/

---

From: Moshe Zadka <[email-masked]>
Date: Thu, 9 Nov 2000 20:01:32 +0200 (IST)

> How can he enter my system?

By guessing passwords correctly?
By watching passwords transmitted in the clean and then retrying them?
Or do you just leave telnet open without needing it?

In short, your system opens its legs widely.

> telnet
...
> pop3

And let me guess, the passwords for those are all the same, just
to make sure any potential cracker's life is *really* *really* easy,
right?

--
Moshe Zadka <[email-masked]> -- 95855124
http://advogato.org/person/moshez

---

From: Gilad Ben-Yossef <[email-masked]>
Date: Sat, 11 Nov 2000 22:40:43 +0200

> would see error messages in the log files.

My dear children, have no one told you about stack smashing, buffer
overflows and such ilk?

If you have a machine conencted to the net you better educate yourself:

A Good premier:
http://www.linuxdoc.org/HOWTO/Secure-Programs-HOWTO/buffer-overflow.html

The original Aleph One paper from Phrack 49:

http://www.codetalker.com/whitepapers/other/p49-14.html

And my personal favorite, from the good people that brought us Back
Orifice - the cult of the dead cow, for your viewing pleasure we bring
you: The Tao of Windows Buffer Overflow (so you wont think this is Unix
thing as some people I know... <chukle>:

http://www.cultdeadcow.com/cDc_files/cDc-351/

> spooler

I'd bet a leaking oil tanker  to a silver dollar that you got at least
one daemon running with a known buffer overflow listening to one of
these  :-(

Better get and use nmap and/or nissus to lock things down.

Gilad.