[LINK] More IIS Horror Stories

[Glen Turner]

Malcolm Miles wrote:

> So they connected an operating system with a known vulnerability
> to the Internet where packets exploiting the vulnerability are
> running rampant and the server got infected. Well surprise,
> surprise. Exactly what was this outstanding bit of research
> meant to tell us?

That the "install/deploy" methodology is wrong.  The user
has done the Right Thing, it's the computer that has done
the wrong things and that design fault needs to be fixed.

One obvious suggestion is for Internet-connected servers
to check an Internet-hosted database for known exploits and
do not activate that component, perhaps offering to patch
the software.

-- 
 Glen Turner                                 Network Engineer
 (08) 8303 3936      Australian Academic and Research Network
 glen.turner@aarnet.edu.au          http://www.aarnet.edu.au/
--
 The revolution will not be televised, it will be digitised