| Newsgroups |
gmane.comp.security.virus |
| Message-ID |
<[email protected]> |
Just an observation ... by renaming admin accounts you'll thwart the simpliest of script kiddies.
Anyone with an 'ounce' of skill will enumerate your box and look at the sid of the user ids.
e.g.
Username SID
WishICouldFoolYou S-1-5-21-329067152-789339058-725245543-500
500 is your admin.
Using a tool like DUMPSEC will give you this info as well as other info on inconspicuous admins on
box. I'm not saying it's completely worthless to do against a scripted attempt, but if you have a
live body, or a dead one juiced up on caffeine they will enumerate and continue their attack.
my2c
Jay
"John D. Patota" <[email protected]>
08/16/2005 12:26 PM
To: Nick Wells <[email protected]>
cc: [email protected]
Subject: Re: zotob
The first two points are really for securing the administrator account
on a server or other secure machine. The admin which doesnt belong to
any group has no access to the system. If a hacker of virus were trying
to break into the Administrator, it would be nothing more than a decoy.
Blending the real administrator account is also a trick to hide its true
identity. If you have a naming scheme like lastn.f, rename the admin
account to match. That way when someone is enumerating your machine they
wont know the first place to look.
This is a real great guide for locking down admin accounts but might be
better suited for some sort of security list
http://www.microsoft.com/downloads/details.aspx?FamilyID=04d81d4f-3b02-4486-b37a-c3469048c662&Displa
yLang=en
The first and last chapters are fluff but the rest is good
Nick Wells wrote:
> The first to points are interesting, but it would be easier to just
rename
> the admin account /me thinks.
>
> Nick Wells
> Windows Administrator
> I-2000, Inc
>
> -----Original Message-----
> From: John D. Patota [mailto:[email protected]]
> Sent: Monday, August 15, 2005 14:13
> To: [email protected]
> Subject: zotob
>
> Its my estimate it will only be a few days until this hits windows XP.
>
> Some useful information is at
http://www.f-secure.com/v-descs/zotob_a.shtml
>
> The biggest thing I can think of is to have users assign strong
> passwords to their Administrator accounts. If you want to do things
> right, take the following steps:
>
> - Disable the Admin account entirely and take it out of every group
> - Create a separate account with administrator permissions whose
> username is inconspicuous
> - Primarily use an account with minimal permissions, when installing
> programs and doing other various administrative duties you can right
> click on the program and select "run as"
>
> This is the type of mentality UNIX and subsequently macs use that most
> windows users haven't caught on to yet. I just hope when vista comes out
> Microsoft will smarten up and tighten administrator access.
>
>
>
>
>
-----------------------------------------
This communication is for informational purposes only. It is not intended
as an offer or solicitation for the purchase or sale of any financial
instrument or as an official confirmation of any transaction. All market
prices, data and other information are notwa rranted as to completeness or
accuracy and are subject to change without notice. Any comments or
statements made herein do not necessarily reflect those of J.P. Morgan
Chase & Co., its subsidiaries and affiliates.