A software security company has had its own front yard defaced by a hacker, suspected to be a disgruntled employee. The missive goes on to rubbish the company for allegedly treating its employees badly, and criticises its products, which include the network sniffer, Spynet. The chief victim of the hack attack is eEye employee Marc Maiffret, dubbed the Chief Hacking Officer. Paul Rogers, network security analyst at MIS, said that he suspected the attack was by an unhappy employee, which means it could be internal or external.
Internal security is weaker than external.
The hack could have occurred through him having employee access to the systems. If the attack is external, the hacker could have exploited a known weakness in the web server. The latest IIS unicode exploit would allow him to execute commands on the website without any log-in authentication if there is no patch. At the end of the day humans are the weakest link in the chain and you have to rely on trust. Even internal access should be restricted to trusted users, or you can come unstuck.eEye was unable to respond at the time of publication.