Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
From: Katie M (k8ek8egmail.com)
Date: Mon Nov 12 2007 - 11:57:31 CST
Lots of places have older OSes deployed, perhaps only internally as you
mentioned, but companies are rife with them, and sometimes closer to the
perimeter than you'd expect. On a consulting enagagement, I met a Fortune
50 company that had a massive internal deployment of Windows 98 (yeah, I
know, weird but here's why) because they had some biz critical crapplication
that nearly everyone needed to use that would only run on Win98. I told
them to hire some developers or interns or somebody, anybody, to rewrite the
thing from scratch. :-)
Of course they and all those other places that run old OSes *should*
welcome themselves into this millenium's operating systems -- we all agree
there. No need to start arguing the obvious. But the point is that more
than enough orgs (won't or) don't have the resources to upgrade (or to
update) due to app compatibility. That's the reality and the reason why
attacking older OSes at a CTF-like event is still pertinent and practical.
My 0.01 pence.
On Nov 12, 2007 3:03 AM, Dave aitel <daveimmunityinc.com> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> So every CTF I've played recently (like the one at CSI last week) has a
> target set of Windows 2000 and extremely old Linux (say, RedHat 8). I'm
> pretty sure that on any modern network you don't find a whole lot of
> either of these. There's always the people who still run NT4 and SCO
> OpenServer, but you have to look pretty far for them. But yet, no real
> remote exploits exist for Fedora Core 1, much less 7. Solaris has XFS
> and a few other remotes, but no one runs Solaris any more except the US
> Government, that I can tell. Even assuming you see some Solaris or AIX
> or whatever, you end up being so deep in the network already to find it
> that you've already got all the passwords and don't need exploits.
> But old operating systems will continue to live forever in CTF, I assume.
> Sort of as a sign of the times, while I was playing CTF on the Windows
> machine provided, I browsed the web briefly and my machine was
> immediately taken over by some really annoying spyware. So for the rest
> of the game I got to spend a lot of time clicking "close" on IE windows
> that kept popping up.
> Anyways, if you want to chat about it or grieve the pain of lost 0day,
> and you live in London then you should come to Immunity Pub Night In
> London Saturday Nov 24 at 6pm at the Price Arthur 80-82 Eversholt
> Street. I'll put 200 quid on the bar to help you drown your sorrows.
> RSVP to adminimmunityinc.com!
> - -dave
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.6 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> -----END PGP SIGNATURE-----
> Dailydave mailing list
Dailydave mailing list