So while administrators ought to be concerned, simple precautions can be taken to prevent break-ins. A Web page posted last week by Vitali Chkliar, a software developer at Imaginet Design Solutions Inc., in Hollywood, Fla., provides two Microsoft Active Server Page applications that can be used to expose any site that uses the base NT configuration without a firewall. Users then need only know a server's IP address to learn the server's group names. With the IP address and group name, a hacker could pull user names from the server, according to the site. To prove the point, Chkliar's Web page had links to the companies' hacked information.
Administrators can relax if they decided to do that.
In this situation, you haven't locked out the appropriate ports and haven't set the right access controls. We tell customers exactly how to lock down the systems. If you do it, this is a nonissue. Khanna also said that the API does not allow write access to any information on the server, but it will allow read capabilities. I've inherited these servers.