Steal my data, please

31.10.2006
Last year I landed a job as assistant IT manager at a midsize university. The network there was a typical mix of NetWare and Windows servers, with one big surprise: Our most critical database, the one that handled dorm-room assignments and payment records for the Housing Department, was still running on a Windows NT4 server, long after Microsoft had dropped support for the platform.

It turns out my boss had been in his job for only a few months, and his predecessor had been a bit of a dinosaur. Many security patches hadn't been applied, and the most critical upgrade -- to Windows 2000 Server or something even more current -- hadn't been made at all.

The Housing database stored students' names, addresses, phone numbers, Social Security numbers, and more. And if that wasn't bad enough, the same server was our Windows domain controller and handled syncing users between the Novell and Windows environments. Needless to say, the thought of something bad happening to this machine scared the pants off both of us. But it seemed to be running fine, so rather than rush down an upgrade path, my boss figured we could hang on until it was time to implement the next revision of the database.

Then one day end-users discovered that they couldn't log in. We rushed to the server room and found the monitor riddled with error messages. We tried rebooting, but the server complained endlessly about this missing .DLL and that corrupt file. Even worse, it wouldn't let us copy those files from the installation disks. After finding some files on the backup tapes and downloading others from the Net, we got it to boot into Windows and run the database server. But it was ugly. No support, remember?

Then it dawned on me. I looked at my boss and said, "Did you see a firewall?"

"Firewall?" he said, looking troubled.