holes in their firewall."
"Do you see any?"
"Not yet, but they're there."
"How can you be sure."
"One of the roles of a website is to provide the world with access to the organization's network. Here you can see the Wingate Clinic has it set up for people to send in health-related data and to get information back. Any time there is such an exchange there's the possibility of unauthorized access. In fact, in general, the more interactive a site is, the easier it is to hack. In other words, the more traffic, the more holes."
Deborah nodded but she wasn't sure she understood. Her use of computers was restricted to her biological research work, using the Internet as a resource, and sending E-mail.
"But what about passwords?" Deborah questioned. Whenever she used the computer in the lab, she had to enter her password, which only she knew. "Don't those keep people out?"
"Yes and no," David said. "That's supposed to be the idea, but it doesn't always work like it should. A lot of network managers are lazy and they never change the manufacturer default passwords, so that narrows down what has to be tried. Also with a www. server there's no limit to how many attempts you can make, so we can try a brute-force password-guessing program like the one I brought with me."
Deborah rolled her eyes for Joanna's benefit. "It's actually a lot of fun," David said, sensing Deborah's doubt. "It's like an intellectual arcade game."
"I can't imagine it's too much fun for the people being hacked," Joanna said.
"It's usually pretty innocuous," David said. "Most hackers I know aren't malicious. It's like an ongoing competition between them and the people designing the security. Or they're just doing someone a favor like me with you guys. You're not interested in doing anything other than getting the information that it seems to me you're entitled to."
"It would have been a lot easier if the clinic saw it that way," Joanna said.
All at once David stopped typing. He stroked his beard thoughtfully. "Well, I have to give credit where credit is due. Seems like a pretty tight site. Certainly no glaring holes. In fact it seems to me to be fairly sophisticated. They've got an authentication server. Does this organization have a lot of bucks to throw around?" "That would be my guess," Joanna said.
"I'm getting the feeling we're up against some pretty good security here," David said, "which means we'll have to get more sophisticated ourselves."
"What is it exactly that you would like to be able to do?" Deborah asked.
"I'd like the web server to recognize and authenticate us," David said. "Then we'd have the run of all their files. What I'm going to try now is to fill up the buffer on their new patient form and see if I can throw in some assembly-level commands in the space after the buffer to Bypass the authentication. It's like riding in through the CGI on the patient-form coattails."
"Could you tell me that in English?" Deborah said.
David looked up to Deborah's face. She was watching over his left shoulder. "I was actually simplifying the process when I just described it."
"Fine1." Deborah said, pretending to be irritated. "If that's the case, then I'll take myself over to the couch and lie down. I'll let you two computer wizards attend to business."
David looked up at Joanna over his other shoulder. "I want to make sure you understand that if I do this, and it works, there will be an electronic trail through your Internet service provider to this machine. If the hack is picked up, they could come after you. Are you okay with that?"
Joanna mulled the question for a moment. She knew what they were doing was technically breaking the law, yet the information was important to her, even necessary for her peace of mind in view of the changes in her life. And what were the chances such an intrusion would be noticed if all they did was trace their own eggs? She thought the chances seemed small indeed.
"What do you think, Deborah?" Joanna
"Do you see any?"
"Not yet, but they're there."
"How can you be sure."
"One of the roles of a website is to provide the world with access to the organization's network. Here you can see the Wingate Clinic has it set up for people to send in health-related data and to get information back. Any time there is such an exchange there's the possibility of unauthorized access. In fact, in general, the more interactive a site is, the easier it is to hack. In other words, the more traffic, the more holes."
Deborah nodded but she wasn't sure she understood. Her use of computers was restricted to her biological research work, using the Internet as a resource, and sending E-mail.
"But what about passwords?" Deborah questioned. Whenever she used the computer in the lab, she had to enter her password, which only she knew. "Don't those keep people out?"
"Yes and no," David said. "That's supposed to be the idea, but it doesn't always work like it should. A lot of network managers are lazy and they never change the manufacturer default passwords, so that narrows down what has to be tried. Also with a www. server there's no limit to how many attempts you can make, so we can try a brute-force password-guessing program like the one I brought with me."
Deborah rolled her eyes for Joanna's benefit. "It's actually a lot of fun," David said, sensing Deborah's doubt. "It's like an intellectual arcade game."
"I can't imagine it's too much fun for the people being hacked," Joanna said.
"It's usually pretty innocuous," David said. "Most hackers I know aren't malicious. It's like an ongoing competition between them and the people designing the security. Or they're just doing someone a favor like me with you guys. You're not interested in doing anything other than getting the information that it seems to me you're entitled to."
"It would have been a lot easier if the clinic saw it that way," Joanna said.
All at once David stopped typing. He stroked his beard thoughtfully. "Well, I have to give credit where credit is due. Seems like a pretty tight site. Certainly no glaring holes. In fact it seems to me to be fairly sophisticated. They've got an authentication server. Does this organization have a lot of bucks to throw around?" "That would be my guess," Joanna said.
"I'm getting the feeling we're up against some pretty good security here," David said, "which means we'll have to get more sophisticated ourselves."
"What is it exactly that you would like to be able to do?" Deborah asked.
"I'd like the web server to recognize and authenticate us," David said. "Then we'd have the run of all their files. What I'm going to try now is to fill up the buffer on their new patient form and see if I can throw in some assembly-level commands in the space after the buffer to Bypass the authentication. It's like riding in through the CGI on the patient-form coattails."
"Could you tell me that in English?" Deborah said.
David looked up to Deborah's face. She was watching over his left shoulder. "I was actually simplifying the process when I just described it."
"Fine1." Deborah said, pretending to be irritated. "If that's the case, then I'll take myself over to the couch and lie down. I'll let you two computer wizards attend to business."
David looked up at Joanna over his other shoulder. "I want to make sure you understand that if I do this, and it works, there will be an electronic trail through your Internet service provider to this machine. If the hack is picked up, they could come after you. Are you okay with that?"
Joanna mulled the question for a moment. She knew what they were doing was technically breaking the law, yet the information was important to her, even necessary for her peace of mind in view of the changes in her life. And what were the chances such an intrusion would be noticed if all they did was trace their own eggs? She thought the chances seemed small indeed.
"What do you think, Deborah?" Joanna
Similar Books
