THE OFFICIAL BLOG OF THE SBS DIVA

I'd like to point out some problems with your study you did in particular about the claims on SBS 2003.

In your information you indicate that on a SBS 2003 box you had  "Mitnick and Ryan Russell, an independent security researcher and author of Hack Proofing Your Network, were contracted by Avantgarde to set up and carry out the experiment."

"To hijack the Windows Small Business Server, the attacker finagled his way into a function of the Windows operating system that allows file sharing between computers. He then uploaded a program that gave him full control."

As a person who day in and day out is in the SBS newsgroups, this doesn't happen.  We're road kill out here.  We don't have attackers specifically targeting our boxes so the scenerio you have described doesn't happen.

The reality is we are more hurt by misconfigurations, weak passwords and what not.

You don't give details as to whether this was an attack from the inside or remotely from the outside. Given our file and printer sharing ports are closed from the outside, but obviously open and needed from the inside I'm guessing {I could be wrong} that it appears that the firm has an Human Resource issue [how to fire someone, perhaps?] rather than worrying about outside attackers?  However since the article is unclear as to the technical detail of “finagle“, it's hard to say from what location the attack was launched from.

Could a specifically targeted attack get into our systems?  Ever seen Dr. Jesper Johansson  aka Dr. J, “hack” his way into a fully patched network?  I have no doubt that you can "finagle" yourself into ANY network given enough time, expertise and talent [and a dash of social engineering thrown in if the normal methods don't work].

Reality is folks, that Ryan Russell and Kevin Mitnick would not be wanting to go after SBS boxes.  The reality is that spybots and malware are our issues. Stupid passwords and SMTP auth attacks.

Security is about Risk.  Ryan and Kevin are so NOT my risk factors. 

• Stupidly misconfiguring my SBS box
• Weak passwords
• Not patching
• No backup
• Not paying attention to the risks of my desktops

Now “THAT'S“ my risk factors.

{READ THIS FOLLOWUP - it was a stupid password that is our “finagle” vulnerability}