Hacker Intrusion

I have decided with my friend to test my FTP server security. (it's not running now) my friend is a good hacker and I proposed him to hack my system (without any data destruction) . While I'm quite sure about my security without a running FTP sever, I'm new in networking and may miss smth.
I have
Win Me (yeah I know it sucks for its security)
Serv-U for ftp server soft (v 3.1)
double firewalls -
Zone Alarm Pro
Black Ice Defender.

So can you suggest me some really secure ftp server soft (with no programming, I have not so much time to learn smth complicated) and maybe some firewalls you think are the best. But I'm quite confident with Zone Alarm Pro and Black Ice cools me when I'm suspecting smthing.

So any suggestions for network security (especially ftp) and the best soft for server.
What ports should I watch more closely, any good sites on ntwork and ftp security.

Thanx in advance!

 

Log in or Sign up to hide all adverts.

Although I only know HTML code I heard a week or two ago that Black Ice was totally useless because of an obvious flaw of some sort. Well, good luck anyway [lol]

Please Register or Log in to view the hidden image!

 

Log in or Sign up to hide all adverts.

Most FTP hacks are down to mis-configurations of the FTP server software. Notibly, "ANONYMOUS" login.
The first main thing to do is kill that configuration for anonymous.

The next point is making sure your system isn't going to show any folders below the "Root" you've given it. So lets say you have a safe area at (C: )/safehouse/ftp/~bob
Let's say bob is suppose to only have access to /ftp/~bob

If user Bob, spots you have a configuration that allows you to view other documents and folders below, he can probe your system for "Other security flaws" (names of programs, even familiarise himself with the layout)

So you'll have to set up some form of method of stopping him "Dropping" below his folder. (Check .htaccess for this)

Make sure you control the CHMOD, and you should be able to stop anyone else outside of "Root" from being able to change Chmod's, If someone can get a CHMOD of 777, then they can write to that directory or file, and execute it on a HTTP server.
(Nasty trojans)

(Websites CGI-bin's should be 755, their executable should be 755, a folder inside the cgi-bin that's suppose to have files written in it to execute will be 777. You can drop a .htaccess in there to stop people "Reading" the folder)

Another flaw is the Amount of users that have FTP access, take for instance, if he Fingers your system (if *NIX) and/or looks to see who's on, he could find:

admin
Jane
Fred
Frank
Bob

That's 4 user names, he will then try the first crack method of common names, usually ones for a "Setup account", usually just their name as password.
(esp User:Admin Pass: Admin [admin administrator sysop])

Then he might pick a password cracking program that runs 5 sessions, and tries the password with each user, in succession.
(This causes a DoS attack, and possible lockup of a system)

If you want to keep your system secure, make sure you keep your user numbers down.
Make sure their passwords aren't words or numbers:

REDHERRING or 34gh22se95 is easier to crack than:
Qv8H@)n!#1

Make sure your "PASSWORD FAIL RETRY" and "TIMEOUT" is set to a long period, this stops automated codes from processing methods of entry quickly. (Notible for protecting Remote Server access)
(3 attempts, 15 seconds between each, on third fail wait 20 minutes)

Make sure you keep the user count down as well (this is for more than just a mate accessing) the more accesses, the less responsive your system, the more chance of someone doing something)

If you think something is up, Either throw a software switch to shut the server offline or pull the plug out off the wall.

That should keep you thinking

Please Register or Log in to view the hidden image!

 

Log in or Sign up to hide all adverts.

Thanx you both!
I'll consider everything you said Stryder.

Black Ice has a big hole?????

Please Register or Log in to view the hidden image!

Please Register or Log in to view the hidden image!

I didn't know tht.
Well maybe a triple firewall would do

Please Register or Log in to view the hidden image!

Please Register or Log in to view the hidden image!

Bye!

 

I rechecked my server configuration and made changes in some places.
I didn't even first make an admin account, because I feared tht smone could crack it. Say if smone cracks a simple_user account, can he make tht user admin?

And what is
NAGLE ALGORITHM
and
passive mode data transfer

 

For administration accounts, it's pretty much dependant on how you want to go about it and what OS you are using:

I know from Windows that most programs are APP based, if they run a command it's usually at the level of the user thats using the system. In most cases windows is very insecure for this, that's why it's so easy to run arbitory code.

Admittedly some advancements were made when NT was first released but even that contained the same error's of the normal windows system. I'm sure that most of the errors have been patched for Win2000 and XP, but I know that new problems and exploits are being found and resolved all the time.

I know that 2000 (the unofficial NT5) has the ability to do similar things to a *NIX system by deciding on which owners have access to what folders and applying groups.

(I know with the 98 systems on a LAN that you should get use to using NETWATCHER to make sure that you haven't given access to the wrong people. It's better using that than just allowing File Sharing as that can open a whole load of trouble from the internet ~Internet Explorer 6 Will warn you if you have File Sharing enabled as a security measure, unless the measure is turned off~)

The only time you should really worry about someone "Upgrading" their user to admin, is when your on a *NIX system, as it is possible to eventually crack the SU (Superuser) or even (if configuration is wrong) cause the command SU to run an Arbitory bit of code (which means the sysop logs in, and logs his password somewhere for a normal user to collect)

On a *Nix box though, it's possible to decide "who" has access, for instance, you plugging information in from your Keyboard has a different TTY than someone who's using SSL to sneak into your computer. In fact in some cases there is a way of naming a File to lock anyone out from accessing remotely. (Since these systems use IP-chains and firewalls that are built into the kernal modules.)

NAGLE ALGORITHM was covered in:
searchnetworking.techtarget.com/sDefinition/0,,sid7_gci754347,00.html

In short, it's a method of coding packets into small packets to lessen the load through bandwidth.


From www.ipswitch.com/Support/WS_FTP/guide/wsftpug7/03transfer.html :

Passive Transfers
--------------------------------------------------------------------------------

Normally, when you connect to an FTP site, the site establishes the data connection to your PC. However, some FTP sites allow passive transfers. This means that your PC establishes the data connection.

Note that passive mode may be required in the following instances:

For users on networks behind some types of router-based firewalls
Users on networks behind a gateway requiring passive transfers
If transfers are erratic
If you keep getting failed data channel errors

----------------------------------------------------------------------------------

It can be used to do a Reverse DNS of a persons connection, in cases of multiple FTP servers sharing files between one another, they can Block the IP if it fails the look up, or by Zones.

 

Av,
Dont forget to give address to me after you"re done

Please Register or Log in to view the hidden image!

bye!

 

don't worry I will, you little hacker

Please Register or Log in to view the hidden image!

but I formated my pc yesterday and now I have to resetup everything

Please Register or Log in to view the hidden image!

. it takes time.
and I have to call my ISP and get rid of tht external proxy firewall it has put on their client accounts. no one now can not really access to my pc through ftp.
cheers!

 

Sorry,

what went wrong?

Please Register or Log in to view the hidden image!

bye!

 

it appears tht I' ll have to format my system once more

Please Register or Log in to view the hidden image!

Please Register or Log in to view the hidden image!

last time - I duno what had happened

Please Register or Log in to view the hidden image!

at startup my pc yust froze for some 5-6 minutes. I ran mad searchin for error, and then thought - maybe my RAM was dammaged

Please Register or Log in to view the hidden image!

, but after format all went on good.
this time it is with Zone Alarm Pro 3.0
DON' T download it. v2.84 was the best, but this has so many errors. it has almost completely "arrested" me, allowing me nthing to do(advanced) and .........errors.....
waiting for patch.
so my system no is so "configured" thanx to ZAP 3.0 tht I' ll have less trouble formating my system tht actually diabling al those problems (I don' t know the source of most of them at the moment, so the search would take some ~8 hours,,,,,,,,, no way I' m doing tht, errorus systems make me nervous

Please Register or Log in to view the hidden image!

, so I' m doing a format on tuestday (I gave my cd/rw to a friend and no can not make any backups

Please Register or Log in to view the hidden image!

Please Register or Log in to view the hidden image!

)
ok, bye!

 

Please Register or Log in to view the hidden image!

I understand as i have gone through the whole sucking thing many times.btw why dont you try a Winxp pro,cracked version may also do.although i have the original one

Please Register or Log in to view the hidden image!

bye!

 

unfortunately my 128Mb RAM PII 333 is not fast enough for winxp, also a 5Gb HDD is not much.
I keep pressing on my father for a unique 1800$ donation, but he says tht only in the strat of the summer

Please Register or Log in to view the hidden image!

another prob - PLEASE help, it' s urgent.
everytime @ startup popup messages appear and say tht my version of IEXPLORER can not be combined with my OS (WINME). I have ie 6.0 and I know it works fine, but I can get rid of these messeges. it also says smth about unabling to access iexplorer.exe, but later when I manually start IE it works fine.

I now reinsttalled IE and will see wht happens now.

see ya!