Network Computingwww.networkcomputing.com

	Issue TOC Print full article Print this page Download as PDF E-Mail this URL Flame the author     In this article Introduction What We Really Want Okena StormWatch 3.0 & StormFront 2.0 Other Products Reviewed How We Tested Report Card

For our host machines, we installed Sun Microsystems Solaris 8 on an Ultra 10, Windows 2000 Server on Dell OptiPlex GX1s and Red Hat Linux 7.1 on a Dell OptiPlex GX1. We didn't patch or apply service packs to any of the systems we were protecting. We searched through various archives, including SecurityFocus (online.securityfocus.com/bid) and Packet Storm (packetstormsecurity. org), for tools that would let us exploit known application vulnerabilities on our target operating systems. We found many to choose from, including remote buffer overflows, directory traversal tricks and local exploits.

Our goal for Windows 2000 and IIS as well as for Solaris 8 with Apache was to let the Web server have read access only to webroot, and no write access. That stops most attacks that try to break out of webroot or attempt to copy or execute files, such as command shells. We even assumed the attacker had access to the console and could add software to the system locally. For example, copying command.exe into c:\inetpub\scripts so that it could be reached by using http://server.ip/scripts/command.exe/c+