Had a call today from our ISP, in a bit of a panic, seems some script kiddies were causing his website some woes and he wondered if I might be able to spare some time to help out. Now, knowing his machines are Windows 2k of which all I know is that I don't want to know, but I offered to do a security audit.
Simple enough, I fired up Nessus and even produced the fine LaTeX-typeset report into a slick PDF that itemized a long list of naivities, even found a few ports with logins that began "W3lc0m3 t0 th15 D15tr0" (which I highly doubt is the work of those fine folks up in Redmond) and shipped it off with an invoice to follow, but y'know, it's so easy, and I realize this report could save his business thousands of dollars by the time he's followed each individual crack-fix tidbit Nessus appends, but still, it's like taking candy from a baby.
Why is it people don't do these things themselves? Wouldn't you think that part of buying the equipment for an ISP-class set of servers would prompt the vendor to throw in a CD of security tools? Well, yeah, it is Microsoft and where ever it was vended is probably a similar take the money and run, but still, really, why?
Stuff like this is all over the place, it's no wonder we're all prey to spammers and crackers. Our little town is under the kind auspices of at least half a dozen ISPs and I'll bet I could run a report on each one of them and find at least as many backdoors, unpatched holes and the like, and it's really damn hard to sit here and restrain myself from just unleashing a test on them and sending them the report as a "gesture of goodwill" ... 'ceptin' I'm sure I'd probably hear from their legal dept more than their tech support.