Hacker speaks out on security basics

"It's simple," says Rain Forest Puppy. "Don't feel you have to...take it from Microsoft, just figure out what services lead to security risks and turn them off."

Pacing up an down the stage in a non-stop information-laden presentation at Hack 2002, held recently in Sydney, the "white hat" hacker known only as Rain Forest Puppy (RFP) reeled off a litany of security holes in operating systems and applications from Sendmail to Solaris and back again.

"Security has to be flexible and militant," RFP told the audience. "You can run through all the security checklists you like but that still doesn't account for the weird and wacky stuff the script kiddies are coming out with."

RFP's recipe for staying one step ahead of the script kiddies is surprisingly simple: "if you don't need it -- TURN IT OFF."

Referring to a host of worms, viruses, and even malicious hacks, RFP demonstrated how system defaults made many systems easy pickings for automated techniques.

"You can securely configure your applications, it is not too hard to configure IIS to be secure, it is just that most people either can't be bothered, or don't want to go into it in case they break something," RFT said. "Code Red just ran along the buffer cover overflow, and could have been stopped if someone had just gone along and changed the default."

Advocating that systems administrators find out what each default pertains to and either delete or disable those that are not directly in use, RFP focused special attention on virtual directories, remote data services, scripts directories, connection time outs and of course, buffer overflows.

"It is in your interests to turn this crap off," he railed. "Doing something as simple as lowering the connection time out to an astronomically low level will make it vastly more difficult to launch an attack against your system."

However, he didn't stop at IIS. According to RFP, popular distributions of Apache also come with a series of activated defaults which essentially leave Web facing systems at serious risk of attack.

"First up remove all unused modules; access, alias, autoindex, cgi, dir, env, log_config, mime, setnevif," RFP said. "Be cautious about where your alias and script aliases are mapping to, and disable multiview."

While he concedes that some of these modules are required by some sites, some of the time, by and large they are a security hole and therefore pose a threat to most systems.

"If you do ever need them you can always go back in and turn them on again, a cgi ban is enough to screw up most Web scanners, so the bad guys won't be able to look into your system in the first place, let alone hack in to it," he said.

He went on to give a similar treatment to NetScape, ISC BIND, and warned of the tendency for PHP and Web site headers to reveal potentially sensitive system information.

"PHP loves to advertise itself, it is even possible to trick it into going to another Web site, and downloading executable files without you even knowing about it," he warned. "Scanners looking for vulnerabilities often base their search on banners, and if you manage to modify your headers slightly it will reduce your exposure to script kiddies and automated attacks at the very least."

Barely stopping for breath, RFP went on to discuss vulnerability scanning software which "didn't suck entirely."

"You have to look at your system from a hacker's point of view," he said. "You need to realise what information you are giving away and what it looks like to them."

Apart from his "if you don't use it, dump it," philosophy, RFP insists systems administrators need to stay informed via sites like Security Focus, Vulnwatch and SANS.

In the mean time, anyone after RFP's tips from the Hack 2002 conference should visit his Web site.

"The information is there to be shared," RFP says, welcoming people to his site. "I'm all for people getting informed."

Have your say instantly, and see what others have said. Go to the Security forum.

Let the editors know what you think in the Mailroom.