Re: [OT] IIS security
From: Matt Gibson (mattg_at_blueedgetech.ca)
Date: 05/25/04
- Next message: David Copeland [MSFT]: "Re: Users not visible in 'Active Directory Users'"
- Previous message: Dennis Comeau: "POP3 connector not receiving external mail"
- In reply to: James Reather: "Re: [OT] IIS security"
- Messages sorted by: [ date ] [ thread ]
Date: Tue, 25 May 2004 15:07:46 -0700
"James Reather" <james.news@reather.com> wrote in message
news:eWj0tFqQEHA.2468@tk2msftngp13.phx.gbl...
> "Matt Gibson" <mattg@blueedgetech.ca> wrote in message
> news:O6zhZ%23pQEHA.3012@TK2MSFTNGP09.phx.gbl...
> > *Raises Hand*
> >
> > Notice how it says they were attacked?
>
> Where does it say that?
Sorry, I should have been more specific. On the Daily-Dave mailing list,
from Dave Aitel of Immunitysec.com, it was said that "They found the
administration page and performed a SQL injection attack, allowing them to
manage the content of the section."
>
> > Through a web based administration
> > page, and then using SQL injection.
> >
> > That's got no effect on IIS security.
>
> "No effect" ...err... <shakes head> I suppose that insecure "web
based
> administration page" was running on a rogue Apache server, was it? ;-)
> Better still, perhaps the SQL database in question was actually MySQL?
:-)
> :-)
That's like saying that since one car was stolen becase the doors were
unlocked, all cars are vulnerable. They got hacked because someone wrote
sloppy code. They did not get hacked because of a problem in IIS.
>
> I suppose we could sum it up like this: if Microsoft's MSPress division
> can't keep their IIS servers secure, what makes you think *you're* so much
> more capable? Better be sure of yourself before you stick your head above
> the parapet...
Actually, I do think I'm more capable than the people who set that one up.
There are no scripts that run on my site and I don't parse content like they
did. Ergo, I'm not succeptble to the same flaws that got them hacked.
>
> James
>
>
- Next message: David Copeland [MSFT]: "Re: Users not visible in 'Active Directory Users'"
- Previous message: Dennis Comeau: "POP3 connector not receiving external mail"
- In reply to: James Reather: "Re: [OT] IIS security"
- Messages sorted by: [ date ] [ thread ]
Relevant Pages
|
