They simply knew about a known password problem with Pirahna in the default RedHat 6.2 configuration. They were the first of multiple people who attempted access victim this way. After they got in, they promptly changed the password. This kept them from being bothered, and resulted in more than one person asking if we had changed the password to the 'pirahna' account. We disclose the relevant configuration information on the web site on victim.
People can see what services are running on victim.
At it's heart, CylantSecure is a tool for spotting and stopping new exploits and attacks. It does this by effectively representing the allowed normal system behavior. Therefore, the existence of vulnerabilities in installed software is something we take for granted. We simply enforce the behavior exhibited during calibration. We have observed that the processes used by attackers tend to be very noisy from a behavioral measurement point of view.