[loot]

Hi there,

last days i saw that someone hacked onto a Client in a bigger network.
How is it possible,that this dude hacked about 90% of all Clients.
I saw that the first wasnt patched(Dameware :/ )
Are there tools to check security inside a LAN.
He do not have the Domain Passwort because its to weird to brute :P
thanks for ya help

LooT

[jockel]

maybe he sniffed your network with the hacked machine ?

there are many t00ls ... sniffers like cain & abel or so ..
or he could have installed remote security scanners on the compromised machine ...
there are many of em ... expl. x-scan

[Blake]

As part of any continual security program I suggest that you use a vulnerability scanner. Nessus is free and available at http://www.nessus.org Use it and I would say you can locate the fact that 90% of your problems are patch related. ;)

[loot]

thx for these useful links
:>

[alexsen]

It all comes down to how knowledgable you are about your lan,

Ask yourself this: (they might help)
how many external devices (links to the internet) it has, are they protected (prober routted firewalled proxied), do you use any DMZ for further protection,
the pc's that are connected directly to internet what kind of services do they run?
Are they updated? Do they have weak passwords? Will they lead to the internal network copromization? And many more that are just basic. Just to give you the idea.

Upon a succefull entry in one of the computer that are connected to the net, all the internal network is easy to get, either by passwords of the already copromised computer (mail logins,sql logins, whatever) or sniffing or RE or services that run internally which are easy exploitable.


i am toooo sleepy and to make a long story short, you can use what GSecur suggested and try to keep as much update you can...

goodnight all

[Jeremy]

alexsen: you forgot the most important question. How can you prevent the users from creating holes, or from screwing up the LAN? Internal users are the top of the list of ppl who hack networks.

[alexsen]

yes you are, the sleepy feature of mine took some lan security features off :D

w00dy thanks for feeling me

training of users ( the hardest and slowest i could say :P )

[st3@1th]

IF you create an admin group for the pcs and then put users in it, your hosed once one of your pcs get comprimised. Its a temptation, since its easy to setup and keeps users from asking to install stuff for them, but very risky, esp. share spreading worms, one pc gets infected, then uses the users credentials to infect all the other machines on the lan.

Besides that as the group says, you probably have some missing patches on your workstations that would allow a hacker to run some type of autorooter to gain access to all machines almost instantly.