#cisco
03 January 2008
Total 4 pages. You are browsing page 1/4.
First :: Prev :: [1] [2] [3] [4] [5] [...] :: Next :: Last
--- Log opened Thu Jan 03 00:00:01 2008
--- Day changed Thu Jan 03 2008
00:00 <****> oh ouch
00:00 <****> that sucks
00:00 <****> yup
00:00 <****> did you expire everyone's password this morning?
00:00 <****> yeah, it causes massive problems, but needed to be done, and I couldn't figure out what exploit he ran. went through like 2 months of data
00:00 <****> doolak: are you coding sql databases or using microsoft ISA? (the answer is likely no).
00:00 <****> nemith, exactly
00:00 <****> doolak: standard will be just fine
00:00 <****> he had a password list of passwords we had for the last 2 years, and was using rainbow tables to crack more
00:01 <****> doolak, no idea, this is #cisco
00:01 <****> ugh
00:01 <****> that's miserable.
00:01 <****> i am coding sql databases - but they dont
00:01 <****> he is persistent i'm sure he will be back, but at least we mitigated the damage for future attacks from him
00:01 <****> what'd he compromise, if you don't mind me asking?
00:01 <****> doolak, sorry man, im a network admin, i dont know anything about any of that stuff
00:02 <****> MSDE is appropriate too
00:02 <****> for me its the opposite
00:02 <****> or sql desktop edition
00:02 <****> loather: i am not sure, possibly SQL brute force, but I did see shellcode alerts (although what I sifted through looked false)
00:02 <****> you don't need sql server
00:02 <****> so i don't know..
00:02 <****> i now about xhtml, css, javascript and phph and sql - but networking is not my part...
00:02 <****> ;-)
00:02 <****> I saw a backdoor with a cmd shell on port 1337, and found the rainbow tables software, password list on that box with the backdoor
00:03 <****> xhtml! fancy
00:03 <****> and noticed it was attacking other machines
00:03 <****> so thx a lot for your help! cool
00:03 <****> dwxreaper: heh, lovely :(
00:03 <****> doolak, i know about all of that too... just not about windows server and ms sql crap
00:03 <****> always close port 1337 *nods*
00:04 <****> perdition: he can choose whatever port he wants, probably netcat tied to cmd on x port
00:04 <****> ms sql.... uuuhhh - THAT i dont use neither
00:04 <****> yeah
00:04 <****> but yeah, the xhtml/css/php stuff i know very very well.
00:04 <****> its what i did before i got into networking
00:04 <****> anyhow, bbl. i have machines to kick
00:04 <****> i know i know, just saying if the hacker doesn't get to use port 1337 he might feel it won't be funny enough :P
00:05 <****> hello..
00:05 <****> hey
00:05 <****> Perdition: or he's too stupid to change the script
00:05 <****> perdition, i saw that, and i thought like..what an asshole
00:05 <****> i need a example to cisco1600 with X25
00:05 <****> LOL
00:05 <****> well, i hope i dont get any customer who wants to have a ms sql database in future...
00:05 <****> asshole sums it up nicely
00:05 <****> check cisco.com
00:06 <****> grifter: i'm sure he can change scripts, he's obviously lazy, he left a large footprint
00:06 <****> i am happy that i switched to mac a few months ago so i could get rid of all of that ms crap
00:06 <****> ms sql is probably microsoft's best product imo
00:07 <****> nope, edlin is! hehe
00:07 <****> you'd think they could make a nice OS of all things
00:07 <****> if all you need is a sql database, sql express, or the msde version of sql will be fine
00:08 <****> but ok, i will find out whats the difference between that standard edition and windows server premium and then i will tell them to choose that 1801 and a 5 clients-version of windows server
00:08 <****> gadi: isn't x25 really old
00:08 <****> i just told you the diffence
00:09 <****> premium includes sql server 2005 & microsoft ISA
00:09 <****> how does IPSEC complicate network management, loather mentioned it's scalable
00:09 <****> Standard does not
00:09 <****> if they REALLY want to use that free stuff from windows and NOT linux...
00:09 <****> so they dont need the premium, sartan
00:09 <****> no, most definately not
00:09 <****> and for such a small company, too.
00:09 <****> no, they dont use a sql database
00:09 <****> only a ms access database
00:10 <****> lol
00:10 <****> Right. I've done a few windows sbs installations
00:10 <****> only one took premium for sql
00:10 <****> but enough from that ms crap
00:10 <****> lol
00:10 <****> perdition: my opinion is it's nice to have your own dedicated circuits, but tunnels are here to stay i guess
00:10 <****> Yay for free online consulting, that =you= get paid for.
00:10 <****> =P
00:10 <****> as IPv6Freely said: this is cisco - channel here...
00:11 <****> i meant ipsec in our own private network
00:11 <****> to encrypt host data
00:12 <****> perdition: you could make the network truly private to start, then maybe you don't need IPSEC
00:12 <****> it is truly private, but i still want to make sure there are no man in the middle attacks on the site itself
00:12 <****> it's a demand in the RFP
00:13 <****> i'm confused, if the network is truly private, how could there be a man in the middle
00:13 <****> like say you used private VLANs, you say what host can talk to what other hosts, and that's truly it
00:13 <****> by connecting a switch between the host and the authenticating switch
00:13 <****> yeah but vlans don't have passwords
00:13 <****> it's just a number between 1 to 4096
00:13 <****> at that point your physical security is compromised
00:14 <****> couldn't they steal the data from the server console, smash it with a hammer
00:14 <****> yea, console logs are venurable
00:14 <****> very
00:14 <****> I don't save them on specific machines
00:15 <****> well, if it's a matter of collecting data and not brute force hammer and guns, then it would be nice if there way a way to ensure there was no snooping
00:16 <****> Perdition: look at ip source guard and arp inspection/dhcp snooping
00:17 <****> you mean DAI? does that really work to not only avoid arp poisoning but mac spoofing?
00:18 <****> thats the idea
00:18 <****> well if that will do the trick, and it's been proven to, then sure it beats IPSEC
00:18 <****> hehe
00:18 <****> hope it's not difficult to manage, supposedly you have to make all ports untrusted don't you?
00:19 <****> its the combination of the tools, you can deploy ip source guard with port security
00:19 <****> for example
Total 4 pages. You are browsing page 1/4.
First :: Prev :: [1] [2] [3] [4] [5] [...] :: Next :: Last