Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security FullDisclosure
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

Re: [lists] [Full-Disclosure] Terminal Server vulnerabilities

from [Jan Muenther] Network Security [Permanent Link]
Subject: Re: [lists] [Full-Disclosure] Terminal Server vulnerabilities
Date: Thu, 27 Jan 2005 17:18:14 +0100 
There are ways to find out the usernames that are admin they begin with 500_
( do a Google search if you want )

Any script kiddy worth his salt will tell u this... So this one is off
because renaming admin account will only be security thru obscurity witch is
not good for the internet...


It's also only possible when you've got NetBIOS/CIFS open to the Internet, 
which is something even worse on the Internet. Even though the SID/RID of the
administrator can be determined remotely under these conditions, I'd
still recommend the renaming of the account as a standard hardening procedure. 

And fwiw, the fact that a security safeguard can be overcome is not a reason to
completely disregard it. With this argumentation, you could sell your firewalls.

Cheers, j.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  Re: [Full-Disclosure] Terminal Server vulnerabilities, Valdis . Kletnieks
Next by Date:  [Full-Disclosure] Remotely exploitable file traversal vulnerability in SnugServer 3.0.0.40 FTP Service, muts
Previous by Thread:  RE: [lists] [Full-Disclosure] Terminal Server vulnerabilities, ALD, Aditya, Aditya Lalit Deshmukh
Next by Thread:  RE: [lists] [Full-Disclosure] Terminal Server vulnerabilities, ALD, Aditya, Aditya Lalit Deshmukh
Indexes:  [Date] [Thread] [Top] [All Lists]