Hacked systems and the law

[Bradley Miller]

At 02:32 PM 4/21/2003 -0500, Jonathan Hutchins wrote:

>Quoting Bradley Miller <bradmiller at dslonramp.com>:
>
> > Ok -- then we should all sue anyone for putting out flawed systems in
> > the first place.
>
>See, there you go again.  Anybody's responsible except you.

How this degraded to a "let's jump the victim" tribunal is beyond me.  Next 
we'll probably be arguing for rape victims "that just brought it on 
themselves because they don't have a penis".  Sad.

>
>Obviously, something wasn't patched.
>
>Do you know what vulnerability they used to crack your system?  Have you 
>fixed
>it yet?

My fear is it was a telnet session or perhaps a sniff of traffic at my new 
server's location.  In case you don't know, the RAQ4 boxes are shipped with 
Redhat 6.2 (if memory serves me right) and have telnet and a GUI to get 
into the system.  My other box has SSH, but this one didn't have it running 
and I telneted in -- my bad . . . I guess.  It woudn't make much 
difference, to have had SSH running, as the GUI also transmits 
username/password combo free text.  Obviously this time the chamber came up 
with a bullet in the Russian Roulette scenario.

What am I doing to fix it?   Simple -- both of these machines are going 
away in a matter of a week or so and being replace with a box that I'll 
have built from the ground up to be secure as hell.  I got most of my 
teething with Linux done on the RAQ boxes, learned their limitations / 
weaknesses / and I'm now moving on.  The next one will have Debian on it 
and Netstandard is installing it.  I'll consolidate two RAQ4's into one 
P4-2.4G box.  I'm also installing a new Windows box to support some of my 
new Flash / ColdFusion / Communications Server work.

Lessons learned:
1) Never let down your guard
2) KCLUG loves the word Draconian

-- Bradley Miller