I made these screenshots about a year ago and posted them on my "old blog". I decided to post about this again on my "new blog".

About two years ago I set up Microsoft Virtual Server for one of my customers. To get the idea about the environment, this customer has more than 600 client computers on the network on more than 10 remote sites.

Unfortunately, for privacy reasons, I can’t say more about the customer. For same reason, I had to blank out some data in the screenshots.

This Virtual Server was at that time responsible for running few business critical services (e.g. RSA Server, Exchange Front-End server, domain controller, etc). All in all, this turned out to be a very busy Virtual Server.

Host server was running without any interruption for 510 days – which can be seen on the screenshots. In my opinion this is quite impressive. Unfortunately we had to take the server down after 510 days for hardware upgrade.

Larger image

I know, I know, these servers were not patched for more than 500 days. I will get into this in one of my future posts. ;-)

Social engineering is always a fun subject to talk about. It is always interesting to watch companies trying to protect their data from being taken out of the company (e.g. paper copies, physical hard drives or even whole computer). Unfortunately I am still yet to see a company that tries to protect their network from people who bring the equipment into the network – this could be employees, visitors, maintenance workers etc.

Imagine someone bringing a Wi-Fi Access Point and connecting it to your network and hiding it. You can use your imagination on hiding the access point. Access points come in almost any shape and sizes.

Such access point will in most cases allow the "owner" a full access to the network it is connected to, at any time from outside of physical perimeter of the company. In other words, the attacker can sit in a coffee shop across your office on a Sunday afternoon drinking their favorite choice of caffeine-rich drink while data is being copied from your network.

My main question here is – how long will it take for an average company to find such access point?

I wanted to dig a bit further into these automated attacks. Two main goals of my digging were:

• what passwords are run against my servers
• what are they trying to do once they gain access

To achieve my first goal, I installed Wireshark (once also known as Ethereal) on the server and set it to listen only for FTP traffic. I didn't have to wait too long.

Couple of days later I logged on to the server just when the attack was in progress.

Attackers run 10.399 passwords against the Administrator account. Here is a complete list of all the passwords that they used. Make sure that you don't use them on your server ;-). It took them a bit more than 3 hours to carry out (unsuccessful) attack.

Click image to enlarge.

For part two of this blog post I plan to write about what happens once an attackers gets correct password.

Larger image.

It is true that these files can be protected with a password, but there is nothing stopping users from leaving blank password on the file or picking a bad password that might be same as the name of the file (e.g. klik)… We know how users pick their passwords. It is also possible to brute force these passwords for as long as anyone wants. Hackers and other criminals are usually very motivated and have all the time in the world.

I recognized few names such as “klik.pfx” and “dohodnina.pfx”. “Klik.pfx” file contains the private key that gives the owner a full access to their online bank account. The other file gives the owner online access to their tax statements.

Larger Image

I guess this is another good reason why banks should only allow access to online bank accounts through two factor authentication (e.g. smart cards or one time password systems).

After searching for pfx files I decided to do a search on any file that has word “contract” or “pogodba” in it. Again, I was rewarded with more than 60 results of files with promising names (and some of the names are really hm – let’s say funny. E.g. "Girlfriend Contract.doc". I will just let my mind run wild on that one) :-) …

Larger Image

The only thing that we can say for certain is that these users, whose files were copied from their computers, don’t have to worry about backup. Their files are “safely” stored on the internet – more or less forever.