Weak monitoring lets hackers run riot