Shutting down an SMTP AUTH Relay attack

We recently had a client whose Exchange Server (configured by another I.T. company, mind you) was continously being blacklisted with no immediately identifiable cause. Our first responders checked the normal stuff and verified that the server was not an open relay in any obvious way. At the time I jumped in on the support ticket, the server did not have the proper logging enabled, so we couldn't see exactly what was occuring.

Does your network stink? Make a sniffer!

Sometimes there is just no substitute for looking at raw packet capture data when infiltrating troubleshooting a network. In normal situations, I'm content with loading Wireshark or Network Monitor up on a system that sits in-line with the data I require (e.g. sniffing packets from a DHCP server when you have clients that cannot get an IP address). However, there are many times when you cannot load sniffing software on the device in question, or don't want to. Perhaps you want to monitor inbound traffic to your ISP to a border router, or watch for packets leaving a device you don't manage. In these situations, you need a passive network tap to capture the traffic without touching the two end points to be monitored.

Cracking & Defending a Terminal Server

This is a copy of a guide I posted to our local DEFCON group last week. Enjoy.

Cracking & Defending a Terminal Server

**** has been on my back about getting some content in here (and rightfully so), so I started pondering what type of content would be relevant to our members. My professional IT experience consists almost exclusively, and lamentably, to network administration in Windows environments. However, since I'm not the only one in this boat, I thought I would extend a collection of knowledge (read: no original thoughts here) on Terminal Services security to the group and allow for some constructive observations and reflections from others.

If you give a hacker a cookie, he'll ask for a session ID.

Most clients I talk to have a basic understanding that a wireless network should be "secure". They do what they can to make their home and office wireless networks have some semblence of security. However, no one seems to have an issue checking their Facebook account from the local bookstore or pulling up some sensitive company emails at the airport. People make the assumption that since they have no sensitive information on their hard drive and they are running a really good anti-whatever, safety is assured.

I can promise you, it is not. And seeing what you are searching for is not the worse thing that a hacker can do. Let me explain: