December 11, 2001

Protective Life

After some Chapter Business and a discussion of Current Security Events, we moved into our program:

Joe Popinski spoke to us on Network Security Reviews Made Easy, giving a six step process for running the assessment. A handout was provided detailing the six steps. I know that I will benefit from some of the "thinking like a business project" aspects, rather than having Network Security Assessment be "something the security geeks do".

Chris Green gave a great presentation on Network Security Assessment Tools, sharing some experiences regarding how he uses the tools at UAB.

Marty Bostick ended our meeting with a talk on SQL Server Insecurity, including a demonstration which exploited a vulnerable SQL Server. If an SQL server is set up using all "default" configurations, the userid "sa" is available with no password! In addition, improperly coded HTML forms leave SQL-based scripts open to "SQL Injection Attacks". Marty discussed removing unnecessary stored procedures, such as "xp_cmdshell", and making sure that your firewall doesn't allow open access to port 1433, the SQL service port. After discussing these issues, Marty attached to an SQL server and used the above methods to open a "NetCat" window, allowing himself to telnet in to the server and get a DOS prompt, as Administrator! He has promised a follow-up document.