RE: [MLUG - DISCUSSION] Hello

["Matthew Ross" <EMAIL:PROTECTED>]

The initial hack starts with putting a file in winnt\system32\ called ntdnu26.exe or some small variation thereof. Afterwards the kiddie's script puts in whatever control device it happens to come with.

Also, we've tested and installed SP4. Nothing's blown up on our test server for a while, so we're assuming the bugs are minor compared to the pre-existing ones in Win2k. :-)

> > Script Kiddies are l33t! Actually most script kiddy attacks need an
> > admin on the other side with a box who is behind on patches or has
> > accounts with easy/no passwords.
> > 
> > Not saying that is what happened in this incident. 
> 
> We haven't installed SP4 yet (came out yesterday, IIRC), due 
> to the bugs in SP2 we put off the SP's for a while to make 
> sure they aren't hellspawn worse than any script kiddie. 
> Other than that, we've got everything up to date on patches 
> for all our servers. I suspect that its the latter. With 
> 1000+ users, and only about half of them able to log into 
> their PC without a sticky note, its almost a certainty.
> 
> _______________________________________________
> discussion mailing list
> EMAIL:PROTECTED
> http://mlug.missouri.edu/mailman/listinfo/discussion
> 

_______________________________________________
discussion mailing list
EMAIL:PROTECTED
http://mlug.missouri.edu/mailman/listinfo/discussion