COM1 Folders are COM1~1 Folders
As I soon discovered, the COM1 folder actually had a few spaces after the name. Windows doesn't allow folders to end with spacesit truncates them to the last character. It is possible, through POSIX tools, to create folders with reserved system names. Heck, it's even possible to create folders with spaces only.
This nasty trick allows the intruder to park his MP3s, movie files, photos of his ugly mother, and just about anything else he wants on your hard drive. Keep in mind that you haven't invited the fellow to put his stuff on your server, but you might as well have if you're allowing FTP with anonymous Write access. Which is what my client did. Poor guy.
We've all heard of hacks, phreaks, and warez masters parking all sorts of crap onto servers, but fortunately for me I've not run into this exact problem until now. And here's the rub: I can't delete the COM1 folder. In reality, there are three COM1 folders in three different directories. I can't delete any of them. Well, not just yet
With strong coffee in hand, I went to work hardening this server. For starters, I took away the anonymous FTP rights through IIS. Next, I added proper NTFS security, checked the event logs, and ran a virus scan. I also checked for any unusual apps that may have been installed to monitor or undo the business I was about to do. After testing for the connection for security and accessibility, I could set about deleting the video files.
The directory structure looked a little something like this:
Now the structure didn't exactly say MORONit was some moron's code name. (Note to MORON: ooh, a code name. Cool. Do you have a secret handshake, too?) Anyway. As it turns out "tagged" is similar to the way animals claim their territory. If other hacks stumble onto this open FTP site and see "tagged\by\MORON", they'd know MORON had already claimed this site and they should move along. Fascinating. Where's my "Dungeons and Dragons" set when I need it?
I immediately learned what happens in Explorer when you click, right-click, look at, or even breathe on a folder magically named COM1: Windows Explorer locks up. Ah-hah! I hopped out to a command prompt and tried to navigate through the directory. I can move through the folders until I get to COM1and then it's Accessed Denied. Okay, so MORON is slightly smarter if not more aggravating than his name.