His company arranges weekly and monthly rentals of homes, villas and timeshare units. He explained that he was concerned about the integrity and privacy of the personal and credit card information of nearly 28,000 families and individuals who had and continue to rent property through his agency. Central to the agency's business is a UNIX server running a rental inventory, management, and invoicing application. Applications are accessed via the root account and critical file systems, including the inventory, management, and invoicing databases, are world accessible. A simple port scan revealed over a dozen unnecessary services were enabled and listening.
User accounts support an internal mail system, and the passwords are shared and posted on monitors.
This is a classic example of the kind of configuration you are likely to find in most small businesses, where UNIX, internetworking, and security expertise is non-existent. And it's a good example of why business LANs need firewalls. A firewall policy that at least denies all inbound connections is essential to the business integrity and long-term operation of businesses like Bob's. An attacker who gains root on this system can cripple the company by destroying or modifying its databases, and can use this system as a launch pad for other attacks. Picture Bob and his employees with several hundred irate families and individuals who have been double-booked into the same villa, or whose rental record has been lost or cancelled.