Maybe Microsoft and others should start signing their CDs and IS
Departments should start checking the signatures.

>----------
>From: Jan Nelson[SMTP:jnelson@narrows.com]
>Sent: Wednesday, August 27, 1997 7:02 AM
>To: 'Paul Leach'; 'Paul D. Robertson'
>Cc: ntsecurity@iss.net; 'Bill Stout'
>Subject: RE: [NTSEC] Interesting Active-X exploits
>
>Remember Tylenol. Anyone who is interested in mucking around can get
>software from anywhere, including Egghead and all other channels of
>distribution that are public and "two way", tamper with the product and
>replace it.
>
>By "two way" I mean the ability to take something off a shelf and replace it
>on the shelf. This has proven by way of product tampering history to be
>effective.
>
>By tampering, I mean taking advantage of the low cost of pressing CD-ROMs,
>coupled to any exploit in security that is known including massive
>opportunity for viral spread among mass consumer populations who will not be
>sophisticated enough to defend themselves against an attack like this.
>
>Consider taking an operating system as the product, having a run of CDs
>pressed within the low budget required to do so. The purchase of shrink
>wrapped product to obtain OEM packaging is much better than counterfeiting if
>part of the purpose is to attack the OEM as well as create chaos and damage.
>Make a copy of the commercial CD. Add your bit of anarchy to it and publish.
> Replace in the OEM package and shrink it. Put it on shelves in various
>locations, and...
>
>How many products have a security checksum (or whatever) compiled in the
>product to protect against such an effort?
>
>What my point in this dialog boils down to is that whether an exploit is
>possible in Active-X, VB or C, the security solutions need to be brainstormed
>on lists like this one so that folks who are empowered and listening (like
>Paul Leach) can take advantage of the enormous brain trust represented here.
>What clever ideas are out there that we can give to the NT developers to
>improve the product relative to the potential for Active-X exploits?
>
>Jan Nelson
>
On Wednesday, August 27, 1997 4:17 PM, Williams, 
Jeffrey[SMTP:Jeff_Williams@catellus.com] wrote:
> Maybe Microsoft and others should start signing their CDs and IS
> Departments should start checking the signatures.

Just make sure they sign it on the side with the label on it, otherwise 
CD-ROM drives wouldn't be able to read it...

(And make sure you use permanent ink, or hackers could use those 
white-board scrubbers to erase the signature and re-sign the CDs and really 
frustrate IS Departments!)

--
Gene Lee
genel@inforamp.net
genelee@ca.ibm.com


quit ntsecurity
>> You would be better off using a linux box as your proxy server too. For
>>linux clients to access a
>> proxy they must be recompiled to work with the specific proxy server
>>(except most WWW clients - they
>> are usually designed with proxy servers in mind.)

Apparently SOCKS v5 doesn't require the recompiling of clients, but I
know nothing about how this works. I've been looking for SOCKS v5
information, but I haven't found any.

PJDM
----
Peter Mayne
Digital Equipment Corporation (Australia),
Canberra, ACT
These are my opinions, not DEC's.
This was typed by an infinite number of monkeys.
>
At 10:58 AM 8/28/97 +1000, Peter Mayne wrote:
>Apparently SOCKS v5 doesn't require the recompiling of clients, but I
>know nothing about how this works. I've been looking for SOCKS v5
>information, but I haven't found any.

You either need an app with SOCKS support built in, or you can use a
socksifier such as AutoSOCKS or RunSocks.

For information on SOCKS see http://www.socks.nec.com or
http://www.aventail.com.

NOTE: I am an employee of Aventail so I may be a bit biased in my opinion
of which product is the better choice.

dan

------------------------------------------------------------
Dan Barrett dbarrett@aventail.com
NT Server Development Lead www.aventail.com
Aventail 206.777.5609
Dear All

yesterday our NT 3.51 server "forgot" its administrator password.
(As in the definitely correct password no longer logs admin on to server)

The machine's network functions were no longer responding (**) so we decided to reboot. When the machine was brought back on line the admin password wouldn't let us log in. < engage panic mode >

(**) By network functions I should say that we had successfully installed a HTTP proxy server which was working OK until about 10 mins later when all network functions such as disk access across the network all came to a halt. The event log simply said that " An unexpected network error has occurred on a vital circuit (err no 3012). 'The vital circuit' was just a Win 95 machine which doesn't do anything fancy its just a VB developer's PC

The administrator is disabled and we log in under a similar user name with Admin privs.(anti hack trick). We also have a back door administrator login for just such emergencies that allowed us to regain access < so panic mode off > 

The confusing thing is that we logged in and out during the day prior to the crash and all was well so I don't think it could be anything obvious like the password expiring.

If any one has any comment on the issue I would like to hear about it. Could it be a corrupt entry in the SAM.... some unknown point about logins with Admin privs? or am I just missing some really important point.??

Thanks for any feed back

Alex Oulton
AlexO@mindless.com
MKI International 
Wimbledon,
England.
_______

Forgive me if this isn't where this should be posted.

Is there a registry setting that can be modified so that NT4.0 doesn't
ask you the following:

 You locally stored profile is newer than your roaming profile. Would
 you like to use you local profile.

Now I know the reasons behind the message but I dont want any user 
replying yes.

I'd ideally like to modify something so that it ALWAYS uses the roaming
profile for users.

TIA

Jas.
Hi Jiva

I have been facing this persisting problem with Windows 95 + Win NT 4

I have 25 Windows 95 clients connecting to our NT 4 Domain .For security
practice Their login and passwords are unique and will only last for 30
days. However every end of the month, all users can still log on to the
domain but failed to get access to the files on the server claiming that
their password is not valid.

I asked them to delete off the .pwl file in their windows directory at the
end of every month and then restart. When the login prompt comes out, users
will require to key in login and new password. I keep getting this "
Microsoft Networking Password is Incorrect" please try again. ....

How do I rectify this problem ? Where to I get to control and to change the
"Microsoft Networking" Password ?

 ---
 Jay Heiser wrote:
 
 Why would an administrator let users have access to e-mail, given this 
 demonstrated threat, but prevent them from using Java or ActiveX, 
 which have never caused a documented security incident (outside of the 
 laboratory)?
 
 ---
 
 Wasn't there a demonstrated ActiveX attack where users of Quicken 
 accounting software could have their private details sent to a 
 designated mail address?
 
 Regards,
 Matthew See
 Perpetual Trustees Australia
 msee@perpetual.com.au

On Wed, 27 Aug 1997 11:33:06 -0400, you wrote:

>I agree with Steve that perspective on this issue seems to be skewed.
>While ActiveX certainly increases web browser vulnerability, no threat
>population has manifested itself yet. E-mail, on the other hand, has
>several demonstrated vulnerabilities. I've seen a number of macro
>viruses this year and I've recently encountered a trojan horse, all
>delivered by e-mail and executed by users.
Perhaps you should train your people on that stuff before letting
them work with it? Perhaps you should invest some work into
configuring your mail clients?
Sorry, but comparing the risks of ax & things embedded in emails
looks funny to me.

>
>Why would an administrator let users have access to e-mail, given this
>demonstrated threat, but prevent them from using Java or ActiveX, which
>have never caused a documented security incident (outside of the
>laboratory)? Unlike Java, which has a decent security architecture,
>plug-ins have full access to your system. Maybe plug-ins are too hard
>to control, so most sites ignore them.
Because email (as it) is not a great risk (see above) if used
properly. Whereas ax (and not Java, at least at that level) provides
no security at all. It provides some cheesy authentification, but
(lets repeat) no security mechanisms at all.

>
>My point is not that mobile code does not introduce new vulnerabilities,
>but that many (most?) organizations have a poor understanding of their
>risk environment. In general, uncontrolled e-mail represents a bigger
>risk. So do fire, earthquake, and employees with automatic weaponry.
>More computers have been destroyed by tidal waves than by rogue ActiveX
>code. I understand that fire ants sometimes destroy hardware, but I
>challenge anyone to show me a case where data was destroyed by a hostile
>Java applet..
With Java you are quite right. Java runs in a (quite) secure
environment (the sandbox) but ax has nothing like that.
And given the fact that ax has been out for about two years 
(not sure :)) there simply has not been much time to exploit it.

And more people have been dying from starvation that century than from
car crashes - and you'd recommend (based on that fact) to
ignore problems from cars???

>
>I'm just not impressed by anyone bragging about disabling Java & ActiveX
>unless they can show that they've taken the effort to understand their
>total risk enviroment, are aware of the productivity implications of
>disabling mobile code, and have also implemented countermeasures against
>the more commmon threats.
>
I am aware of the risks, I argue the value of mobile code based on 
a foul egg like ax/dcom and the countermeasures also exist and are
validated at least once per 24 h :) Am I allowed to brag about
ax?
You forgot another thing: This is also a discussion list - and the
foul eggs ouf our days will become the security problems of the 
next years.

-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
Does mobile code based on a diskette have value in your eyes?
If so, why then is getting code as an AX component worse
than getting code off a diskette? Like I said in the previous
post, I don't see that I'm any worse off with AX than I was with
the diskette.

Like I also said, I wasn't arguing it was perfect. But terms such
as "foul egg" are merely pejorative and add nothing to any
analysis or discussion.

Steve

> -----Original Message-----
> From: dietz_proepper@sepp.de [SMTP:dietz_proepper@sepp.de]
> Sent: 28 August 1997 12:04
> To: Jay Heiser
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Interesting Active-X exploits
> 
> On Wed, 27 Aug 1997 11:33:06 -0400, you wrote:
> I am aware of the risks, I argue the value of mobile code based on 
> a foul egg like ax/dcom 
> 
I got a similar problem when I installed NT4SP3 then de-installed it... no user were recognized anymore!!!!

Pazuzu


----- Mensagem original -----
De: Alexander Oulton [SMTP:alexo@mindless.com]
Enviada em: Wednesday, August 27, 1997 11:59 AM
Para: 'NT Security'
Assunto: [NTSEC] NT 3.51 forgetting passwords...

Dear All

yesterday our NT 3.51 server "forgot" its administrator password.
(As in the definitely correct password no longer logs admin on to server)

The machine's network functions were no longer responding (**) so we decided to reboot. When the machine was brought back on line the admin password wouldn't let us log in. < engage panic mode >

(**) By network functions I should say that we had successfully installed a HTTP proxy server which was working OK until about 10 mins later when all network functions such as disk access across the network all came to a halt. The event log simply said that " An unexpected network error has occurred on a vital circuit (err no 3012). 'The vital circuit' was just a Win 95 machine which doesn't do anything fancy its just a VB developer's PC

The administrator is disabled and we log in under a similar user name with Admin privs.(anti hack trick). We also have a back door administrator login for just such emergencies that allowed us to regain access < so panic mode off > 

The confusing thing is that we logged in and out during the day prior to the crash and all was well so I don't think it could be anything obvious like the password expiring.

If any one has any comment on the issue I would like to hear about it. Could it be a corrupt entry in the SAM.... some unknown point about logins with Admin privs? or am I just missing some really important point.??

Thanks for any feed back

Alex Oulton
AlexO@mindless.com
MKI International 
Wimbledon,
England.
_______


On Thu, 28 Aug 1997 12:27:20 +0100, you wrote:

>Does mobile code based on a diskette have value in your eyes?
of course not :) Nowadays CD roms are appropriate :)

>If so, why then is getting code as an AX component worse
>than getting code off a diskette? Like I said in the previous
>post, I don't see that I'm any worse off with AX than I was with
>the diskette.
The fact that I have to take that disk, put it into a disk drive
and use it (activity originating from me).
An ax control on the other hand can enter my system without
me noting it. OK, a proper configured browser wont allow
that, but given the fact that I can manipulate these settings
from within an ax control, the 'proper settings' are IMHO of little
value (activity originating from somewhere).. 

>
>Like I also said, I wasn't arguing it was perfect. But terms such
>as "foul egg" are merely pejorative and add nothing to any
>analysis or discussion.
Sorry you are right. Apologies for that.

I could have also said 'bad design' or s.t. like that.
All I wanted to express was that from my point of view
ax contains some principal weaknesses that might
(or better will?) result in lots of trouble in the future.
And given the fact that this is (also?) a discussion
list I have no problems to talk about them.


regards,
Dietz

>
>> -----Original Message-----
>> From: dietz_proepper@sepp.de [SMTP:dietz_proepper@sepp.de]
>> Sent: 28 August 1997 12:04
>> To: Jay Heiser
>> Cc: ntsecurity@iss.net
>> Subject: Re: [NTSEC] Interesting Active-X exploits
>> 
>> On Wed, 27 Aug 1997 11:33:06 -0400, you wrote:
>> I am aware of the risks, I argue the value of mobile code based on 
>> a foul egg like ax/dcom 
>> 
>

-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.

Gary Hein wrote:
> 
> If you're using the INW client for NT, you can also enable the NT
> workstation manager, which provides several features that simplify NT
> workstation management. For example:
> 
> 1. Workstation manager allows you to centrally configure the NT Workstation
> login screen, including the login tabs. From this configuration, you could
> disable the Windows NT login tab, which would prevent users from setting the
> "login into NT only" checkbox.

I understand that workstation manager is for 4.x, right? I have 3.12. Oh 
well. I did find the registry entry for this change, though, and my staff 
was very happy (there was much rejoicing.)

Thanks!

Patricia

Hello:

I am concerned about Microsoft's claims regarding NT as a "enterprise
solution". How can a vendor make that claim when almost all system
parameter changes require a reboot. Unix systems (AIX for example, can
be maintained, changed and rebuilt without ever requiring a reboot). I
am curious how people are dealing with this when using NT for mission
>critical, high availability systems. Comment?
>
Mahon, Sean wrote:
> 
> Hello:
> 
> I am concerned about Microsoft's claims regarding NT as a "enterprise
> solution". How can a vendor make that claim when almost all system
> parameter changes require a reboot. Unix systems (AIX for example, can
> be maintained, changed and rebuilt without ever requiring a reboot). I
> am curious how people are dealing with this when using NT for mission
> >critical, high availability systems. Comment?
> >
Good point however first of all define your requirements. are we talking
24/7/365 or percentage of availabilty. Are we talking of "during working
hours" or full fall-over transparent access. Even good old NetWare
should be brought down at set intervals :}
On 28 August 1997, 0522, you wrote:
>The fact that I have to take that disk, put it into a disk drive
> and use it (activity originating from me).
> An ax control on the other hand can enter my system without
> me noting it. OK, a proper configured browser wont allow
> that, but given the fact that I can manipulate these settings
> from within an ax control, the 'proper settings' are IMHO of little
> value (activity originating from somewhere)..

Are yousaying that an ActiveX control has the ability to change settings on 
my machine *before* I download it? I don't think so! You said it yourself 
- "a properly configured browser". If you *choose* to allow ActiveX 
controls to be downloaded without intervention, then you have implicitly 
originated that activity. If you are informed that an ActiveX control is 
required to be downloaded for a site, and you *accept* the certificate 
(enabling the download), then again *you* have originated the activity.


At 11:04 8/28/97 GMT, you wrote:

>Because email (as it) is not a great risk (see above) if used
>properly. Whereas ax (and not Java, at least at that level) provides
>no security at all. It provides some cheesy authentification, but
>(lets repeat) no security mechanisms at all.

You might not have seen some of the mayhem that can happen from e-mail.
Someone sends a document or even a .exe as an attachment. It comes up with
some silly icon, the user double-clicks it, and ker-boom. You can also
embed executables into documents - if Powerpoint isn't patched, you can
open a powerpoint presentation, wave your mouse over the wrong spot, and
away you go.

Some e-mail clients will _automatically_ open attachments. If the user has
an unpatched version of Word, any auto-open macros are going to run. Again
- kerboom.

In comparison, the evils of ActiveX are nothing. ActiveX will at least
normally try to tell you who wrote it, and refuse to run if there is no
certificate. So with e-mail, you have no security mechanisms at all _and_
no authentication.

>With Java you are quite right. Java runs in a (quite) secure
>environment (the sandbox) but ax has nothing like that.

Except that there have been around a dozen different holes in Java found so
far. Nothing is going to provide perfect security. Everything has good
and bad points.

>And given the fact that ax has been out for about two years 
>(not sure :)) there simply has not been much time to exploit it.

Yeah, right. With all the different ways people have been beating up MS
over security?

>And more people have been dying from starvation that century than from
>car crashes - and you'd recommend (based on that fact) to
>ignore problems from cars???

No - they are all problems, and we have to look out for all of them.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

On Thu, 28 Aug 1997, William P. Hood wrote:

> Are yousaying that an ActiveX control has the ability to change settings on 
> my machine *before* I download it? I don't think so! You said it yourself 
> - "a properly configured browser". If you *choose* to allow ActiveX 
> controls to be downloaded without intervention, then you have implicitly 
> originated that activity. If you are informed that an ActiveX control is 
> required to be downloaded for a site, and you *accept* the certificate 
> (enabling the download), then again *you* have originated the activity.

 As a matter of curiosity, I'd like to ask a few questions here. 

 Please assume I'm a total novice. (Shouldn't be hard).

 Can I embed activeX controls into a Word or Excel document (e.g., press 
 here, and IE gets invoked as a shortcut and automatically connects 
 to a site with "a different" configuration, and downloads a file - which 
 gets passed to Word or Excel for execution via an embedded macro within 
 Word or Excel). (That may have been a very bad example)?

 If so, can I then attach or mail that document to another user? 

 If so, when they open the document, and the embedded macro executes
 (of course, now they have to have a "correct" setup for Word or
 Excel) what damage could occur? I'm asking this because I need to 
 assess the level of damage that can occur if I recommend that all users
 be allowed to update their own systems at will (or at the will and
 recommendation of some vendor).

 Hope I didn't stretch my imagination too far there. If I did, then
 please forgive, you have my apologies in advance.

 Also, I've asked (very random) 10 users, what the "proper configuration"
 is for a browser. Also, what do they do when a window pops up while
 using the browser. I was amazed. The answer in _every_ case was "Oh,
 I seen that before, I just click ok, otherwise, it won't let me do it."
 For them, it seems that "security" is something that happens "somewhere
 else," and really doesn't affect them.

 As for knowing what the "proper configuration" (security-wise), it's
 an on/off switch thing for them. They were not aware of any granularity
 that let them accept one activex component for "one" product from
 a vendor, but not other activex components from the same vendor, that
 they didn't want. It appeared to be an all or nothing deal for them.

 Is this the case? 

 Also, how hard is it to "steal" another companies "certificate"?

 Just questions. Not trying to induce any folks with flame-throwers
 to point them my way.

.jam
.peace

[ all opinions here are my own. my company has their own opinions ]
Does anyone know of a list, document or Web site that describes the
different bugs and holes found in NTServer?

Thanks, Megan


How about the Kane Security Monitor.
It monitors in real time whats happening on your network. It helps catch
trojan horses, and in combo with Real Secure, you should be doing very
vell.

> -----Original Message-----
> From: porterj@lbm.com [SMTP:porterj@lbm.com]
> Sent: Thursday, August 28, 1997 9:03 AM
> To: 'NT Security List'
> Subject: Security Tools for NT?
> 
> Hello guys-
> 
> I'm new to the list, and would like to start out with a request for
> suggestions. What applications out there really do a good job of
> intrusion detection from the NT 4.0 platform? I'm familiar with
> RealSecure, and am pretty impressed, but I'd like to know what else
> might be out there.
> 
> Thanks!
> 
> James Porter
> MIS Manager
> 
Hello all,
I apologize if this question has been asked before, but I've been reading 
this list for several months and have not seen it asked.
I have an NT 4.0 Server with IIS 3.0 that I'm setting up to be a dedicated 
web server. What I want to do is setup tight enough security (re: User 
Permissions) so that everything on the machine is locked down. What I have 
done so far is put the actual web sites on a separate drive, and the IIS 
components (Inetsrv) on a separate partition. My goal is to set up the 
entire machine so that the basic permission needs (both by the machine and 
the user) are covered, but security is tight enough that the Everyone Group 
does not have any rights.
I've looked on various web sites and books for anything that talks about 
this, but haven't found anything. They primarily deal with the permissions 
for the web sites themselves, rather than the actual machine. If worse 
comes to worse, I'll take an entire day and just look at the permissions of 
everything (what the hay, Labor Day is coming) and figure it out myself. 
 However I was wondering if anyone else has done this. I want to focus 
more on permissions effected on the WINNT directory to run IIS.
Here's the setup for the machine right now:
Compaq Proliant
200 MHz Pentium
96 Meg RAM
2 SCSI-Wide (not positive about that) drives, 4 Gig each
1st Drive partitioned C: and E:, 2nd drive F:
IIS 3.0 with FP97 Extensions, ASP, entire MCIS suite (except news)

Thanks in advance for any assistance,
Tom
On Thu, 28 Aug 1997, David LeBlanc wrote:
> Some e-mail clients will _automatically_ open attachments. If the user has
> an unpatched version of Word, any auto-open macros are going to run. Again
> - kerboom.

This all argues for non-global file associations. i.e. associate Word with
files accessed via Explorer or My Computer, but Word Viewer with files
accessed from the Web or received via e-mail. I appreciate that this is a
*far* from perfect solution (can we all say "Temporary Internet Files"),
but can NT do this?

> >With Java you are quite right. Java runs in a (quite) secure
> >environment (the sandbox) but ax has nothing like that.
> 
> Except that there have been around a dozen different holes in Java found so
> far. Nothing is going to provide perfect security. Everything has good
> and bad points.

But aren't the majority (all?) *implementation* problems, rather than
indicative of a massive security-brokenness of the underlying concept.
What's the difference? Only of them can be patched fairly easily...

> >And given the fact that ax has been out for about two years 
> >(not sure :)) there simply has not been much time to exploit it.
> 
> Yeah, right. With all the different ways people have been beating up MS
> over security?

I think you may be missing the point -- many of the best hackers look for
security problems as an academic exercise, and ActiveX isn't much exercise...

> >And more people have been dying from starvation that century than from
> >car crashes - and you'd recommend (based on that fact) to
> >ignore problems from cars???
> 
> No - they are all problems, and we have to look out for all of them.

But you don't accept that there might be tiny problems with ActiveX's
security model?

Cheers,

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346

Hello all,

 I have question about NT Auditing. Given that a decently busy NT Server
can generate large logs per day (if file auditing or other such things are
enabled), and also given that Event viewer, while it is good for browsing,
does not have any abilities to create reports or anything along that line,
what tools (if any) do people use to moniter NT's logs? I have seen maybe
one or two tools (the DumpEvt utility from Somarsoft) and have looked at a
few unix based ones as well (swatch) to see if they could be converted
easily. But, I haven't run across any tools that enable you to easily
process large logs and discard uninteresting events or produce usage
reports without going thru a lot of work in the process.

So, does anyone have any comments on available tools or ways or dealing
with large logs?

MJ Stromberg
mjstrom@itisolutions.com

The interesting point with this new Active-X attack is that you only need to
trust a stolen or bad signature once, and your machine is trojaned from then
on. If it can be Microsofts' or other 'big co' stolen signature, it would
be major news.

The 'change of security level' and 'getadmin' applications are no big deal,
they're just two of countless secondary attacks than can be run on the
trojaned machine. IMHO - The page should have only listed the primary attack.

Problems with the Active-X issue is that security takes a back seat, since
the potential productivity to customers is very attractive(as is Java), and
Microsoft's rush to market Active-X; to displace Java, and lock users into a
proprietary standard.

Bill Stout

Probably serves me right for my last few postings, but please, only send
replies to the list. I have over 60 messages titled "Re: [NTSEC]
Interesting Active-X Exploits". Mostly duplicate or triplicate.

Hello all,
I apologize if this question has been asked before, but I've been reading 
this list for several months and have not seen it asked.
I have an NT 4.0 Server with IIS 3.0 that I'm setting up to be a dedicated 
web server. What I want to do is setup tight enough security (re: User 
Permissions) so that everything on the machine is locked down. What I have 
done so far is put the actual web sites on a separate drive, and the IIS 
components (Inetsrv) on a separate partition. My goal is to set up the 
entire machine so that the basic permission needs (both by the machine and 
the user) are covered, but security is tight enough that the Everyone Group 
does not have any rights.
I've looked on various web sites and books for anything that talks about 
this, but haven't found anything. They primarily deal with the permissions 
for the web sites themselves, rather than the actual machine. If worse 
comes to worse, I'll take an entire day and just look at the permissions of 
everything (what the hay, Labor Day is coming) and figure it out myself. 
 However I was wondering if anyone else has done this. I want to focus 
more on permissions effected on the WINNT directory to run IIS.
Here's the setup for the machine right now:
Compaq Proliant
200 MHz Pentium
96 Meg RAM
2 SCSI-Wide (not positive about that) drives, 4 Gig each
1st Drive partitioned C: and E:, 2nd drive F:
IIS 3.0 with FP97 Extensions, ASP, entire MCIS suite (except news)

Thanks in advance for any assistance,
Tom

 Try doing a web search of products by KANE and SOMARSOFT.....

-------------------
Mark Fearer
mfearer@securid.com
voice 617 687 7361
page 888 274 4139
http://pages.prodigy.com/NH/tollbooth/tollbooth.html

> ----------
> From: porterj@lbm.com[SMTP:porterj@lbm.com] on behalf of James
> Porter[SMTP:porterj@lbm.com]
> Reply To: James Porter
> Sent: Thursday, August 28, 1997 12:02 PM
> To: 'NT Security List'
> Subject: Security Tools for NT?
> 
> Hello guys-
> 
> I'm new to the list, and would like to start out with a request for
> suggestions. What applications out there really do a good job of
> intrusion detection from the NT 4.0 platform? I'm familiar with
> RealSecure, and am pretty impressed, but I'd like to know what else
> might be out there.
> 
> Thanks!
> 
> James Porter
> MIS Manager
> 
> 
>Does anyone know of a list, document or Web site that describes the
>different bugs and holes found in NTServer?
>

http://www.dhp.com/~fyodor/sploits_microshit.html (from a hostile point 
of view)
http://www.ntsecurity.com (news and links relating to NT Security)

Doug Roberts
dougr@headspace.com
Try some of Frank Heyne's tools at: 
http://rcswww.urz.tu-dresden.de/~fh/nt/eventlog/index.html


Ray Galloni
INFOSEC Engineer
MITRE Corporation

I'm glad you asked that question.
No, there are no documented cases of people losing money through an
ActiveX/Quicken exploit.

What happened was that a German TV show wanted to do something dramatic
and dared the Chaos Computer Club to come up with a way to steal money
over the Internet and get themselves on TV. Naturally, they jumped on
this opportunity immediately and came up with a clever little hack that
made great TV coverage and brought them worldwide recognition. They
entered a bogus money transfer request (a capability not avail in the US
with Quicken) which was sent along with the legitimate transactions the
next time Quicken was used to upload data to the bank. This was all
debated on the security groups last Feb-March, so I won't go through the
history of it. For several reasons, I don't believe this is a
practical way to steal money. The US version of Quicken, the one I use,
shows me all transactions before I upload them, so it would be pretty
obvious if my data had been hacked

Aside from the question of whether Quicken users should be worried,
ActiveX isn't necessarily the most efficient way to do this. If you're
worried about this, throwing away your browser won't necessarily make
you more secure. Throwing away your modem would be much better. See
my answer to Dick Dastardly for more on this.

See, Matthew wrote:

> ---
> Jay Heiser wrote:
> 
> Why would an administrator let users have access to e-mail, given
> this
> demonstrated threat, but prevent them from using Java or ActiveX,
>
> which have never caused a documented security incident (outside
> of the
> laboratory)?
> 
> ---
>
> Wasn't there a demonstrated ActiveX attack where users of Quicken
>
> accounting software could have their private details sent to a
> designated mail address?
>
> Regards,
> Matthew See
> Perpetual Trustees Australia
> msee@perpetual.com.au



--
Jay Heiser, 703-847-1703, jay@homecom.com
Homecom Internet Security Services


-----Original Message-----
From: Dick Dasterdly [SMTP:morrison@ladyred.rsoc.rockwell.com]
Sent: Thursday, August 28, 1997 4:13 AM
To: ntsecurity@iss.net
Subject: RE: [NTSEC] Interesting Active-X exploits

 As a matter of curiosity, I'd like to ask a few questions here.

 Please assume I'm a total novice. (Shouldn't be hard).

 Can I embed activeX controls into a Word or Excel document (e.g., press
 here, and IE gets invoked as a shortcut and automatically connects
 to a site with "a different" configuration, and downloads a file - which
 gets passed to Word or Excel for execution via an embedded macro within
 Word or Excel). (That may have been a very bad example)?

 If so, can I then attach or mail that document to another user?

 If so, when they open the document, and the embedded macro executes
 (of course, now they have to have a "correct" setup for Word or
 Excel) what damage could occur? I'm asking this because I need to
 assess the level of damage that can occur if I recommend that all users
 be allowed to update their own systems at will (or at the will and
 recommendation of some vendor).

[William P. Hood] Anyone - please correct any misinformation...

The *code* for an ActiveX control is not contained in a page; rather, a 
reference to the control is created, along with parameters to be used when 
the control is activated. When the reference is accessed, the browser (or 
app) checks whether the control is registered with the system, and if not, 
will initiate the process of informing the user that the control is 
required, display certificate info, request approval to download, etc.

Even if the *code* for a control was embedded in a Word/Excel document, 
AFAIK the same process would have to occur before the control could be 
activated.

 Hope I didn't stretch my imagination too far there. If I did, then
 please forgive, you have my apologies in advance.

 Also, I've asked (very random) 10 users, what the "proper configuration"
 is for a browser. Also, what do they do when a window pops up while
 using the browser. I was amazed. The answer in _every_ case was "Oh,
 I seen that before, I just click ok, otherwise, it won't let me do it."
 For them, it seems that "security" is something that happens "somewhere
 else," and really doesn't affect them.

 As for knowing what the "proper configuration" (security-wise), it's
 an on/off switch thing for them. They were not aware of any granularity
 that let them accept one activex component for "one" product from
 a vendor, but not other activex components from the same vendor, that
 they didn't want. It appeared to be an all or nothing deal for them.

 Is this the case?

[William P. Hood] The 'intervention' process allows just that - it 
requests approval to download a single control; users can *optionally* 
choose to accept all controls from the same publisher. As far as IE goes, 
you can configure the browser to consider the following as trustworthy, and 
thus download controls without intervention:

individual software vendors
all commercial software publishers
sites with certificates from specific certificate providers

Quite a lot for the typical user to deal with - that's why we decided to 
use the IE Administrator's Kit to create a customized browser with a 
pre-set configuration. We also lock down a great deal of the config; users 
have to go through the proxy server, they cannot change the security level 
setting, and they can't change the Internet Mail/Newssettings, for example. 
 Aspects such as the appearance of the toolbar, font settings, colors, etc. 
*can* be changed by the user.

 Also, how hard is it to "steal" another companies "certificate"?

[William P. Hood] I can't speak directly to that - my understanding is 
that *my* certificate is stored physically on my machine, and certificate 
information is included with controls I might create. You could walk off 
with my machine, obviously, but I don't know if there would be a way to 
hack a machine and extract someone else's certificate.

 Just questions. Not trying to induce any folks with flame-throwers
 to point them my way.

.jam
.peace

[ all opinions here are my own. my company has their own opinions ]
> At 10:35 8/27/97 +0100, acr@als.co.uk (Alan C. Ramsbottom) wrote:
>
> >The IE4 preview 2 installs a new service under NT - the "Protected 
> >Storage Server". Anyone know what this does i.e. what is stored 
> >where and how it is protected?

No luck there then, considering IE is becoming an integral part of 
the NT landscape. Let's try another approach.

 Is the Protected Storage Server:

 1) An app that safely hides away all your downloaded pictures 
 of ~Chelsea Clinton/Jenna Jameson/Brad Pitt/FrouFrou The 
 Cat/Oranges? 
 ~delete according to preference

 2) An app that implements the storage for MS Wallet i.e. "where 
 you can securely store all of your private information, 
 including credit card numbers, ATM card information, digital 
 certificates, and more"?

 (Note: apparently uses SHA-1 to encrypt the data)
 
 3) A Microsoft secret?

 4) None of the above?

 5) All of the above?

Could be wrong, but I'm currently guessing that it's a combination of 
both 2 and 3 ;-)

Regards,

--Alan--
acr@als.co.uk
David LeBlanc writes:

>
>Some e-mail clients will _automatically_ open attachments. 
 

AHUUURRRRPPPPP? (Tim Allen belch) I was under the impression that E-mail client developers generally considered auto-launching of attachments NOT such a hot idea--long before the BS chain letters.

You can pick your context on "BS chain letter", "bomb scare" or otherwise.








Floyd Johnson
Global Securities Information
"Nothing impresses...so much as common sense and plain dealing."
--Ralph Waldo Emerson

I am trying to lockdown some of the ports on my machine. Is there anyway
to specify the ports to lockout rather than adding each port one by one
that are allowed. What is the name of the file or hkey that controls the
security of the ports. I know how to enable security feature and add
ports, but this is very tiresome to add ports one by one.

Greg Guhin
TSG
Internet Alaska Inc.
FAQ http://www.alaska.net/tsg/iaifaq
(907) 455-4638 FBKS
(907) 562-4638 ANCH


William P. Hood wrote:
> 
> -----Original Message-----
> From: Dick Dasterdly [SMTP:morrison@ladyred.rsoc.rockwell.com]
> Sent: Thursday, August 28, 1997 4:13 AM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Interesting Active-X exploits
> 
> As a matter of curiosity, I'd like to ask a few questions here.
> 
> Please assume I'm a total novice. (Shouldn't be hard).
> 

Bill...ActiveX is really just another fancy name (in essence) for OLE.
Basically, on the Doze platform, you can do anything with ActiveX (over
networks) that you can do with OLE. And, that pretty much means
anything.



Folks,


Trying to implement both "Basic" and "NT challenge/response" authentication

features of IIS 3.0. 


The IIS server is separate from the PDC/BDC for the domain (wick).

Although the IIS server is a member of the "wick" domain.


Using basic authentication (which will support Netscape as well as IE),

authentication ONLY appear to work with "locally" defined accounts on the

IIS server itself...


What we would like is to have the people authenticate via the PDC and/or

BDC...

This is the piece that is currently NOT working..


We have added the users in the PDC, and gave them the "log on locally"

right on the IIS server machine itself....

But, still fails..


We have enabled logging of "logon failures". The failure messages indicate

that the user is ALWAYS be authenticated against the local IIS machine

instead of going to the PDC....


What else is required to make this authentication against the PDC work

properly..

What "simple" thing am I missing??????


Thanks in Advance,








^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

** Sami Mousa, 
ffff,0000,0000FORE ATM(WAN) Certified 
**

** International Network Services Office: (908)603-8541 x320 
 **

** Network Systems Engineer e-mail: sami_mousa@ins.com 
 **

** 120 Wood Ave South Pager: (888)896-4064 
 **

** Suite #615 Fax: (908)548-5630 
 **

** Iselin, New Jersey 08830 www.ins.com 
 **

=============================================================================

 "My statements in this message are personal opinions \

 which may have no basis whatsoever in fact."






Check out this possible explanation:

http://www.fastlane.net/homepages/thegnome/faqs/nt/nt_sec05.html#05-2

-bryan


-----Original Message-----
From: Alexander Oulton [SMTP:alexo@mindless.com]
Sent: Wednesday, August 27, 1997 7:59 AM
To: 'NT Security'
Subject: [NTSEC] NT 3.51 forgetting passwords...

Dear All

yesterday our NT 3.51 server "forgot" its administrator password.
(As in the definitely correct password no longer logs admin on to server)

The machine's network functions were no longer responding (**) so we decided to reboot. When the machine was brought back on line the admin password wouldn't let us log in. < engage panic mode >

(**) By network functions I should say that we had successfully installed a HTTP proxy server which was working OK until about 10 mins later when all network functions such as disk access across the network all came to a halt. The event log simply said that " An unexpected network error has occurred on a vital circuit (err no 3012). 'The vital circuit' was just a Win 95 machine which doesn't do anything fancy its just a VB developer's PC

The administrator is disabled and we log in under a similar user name with Admin privs.(anti hack trick). We also have a back door administrator login for just such emergencies that allowed us to regain access < so panic mode off > 

The confusing thing is that we logged in and out during the day prior to the crash and all was well so I don't think it could be anything obvious like the password expiring.

If any one has any comment on the issue I would like to hear about it. Could it be a corrupt entry in the SAM.... some unknown point about logins with Admin privs? or am I just missing some really important point.??

Thanks for any feed back

Alex Oulton
AlexO@mindless.com
MKI International 
Wimbledon,
England.
_______

On Thu, 28 Aug 1997, Jay Heiser wrote:

> You don't actually need to invoke IE or use ActiveX. Don't focus on
> the browser as the source of the exposure -- it's the Internet
> connectivity that is the problem. You can do ANYthing in a word macro,
> including deleting the entire hard drive or accessing data and e-mailing
> it or ftp'ing it back out. This has been known for years.

 Ok. I can buy that. Excuse me, but this is scary.

> In my taxonomy, word macros, Java, JavaScript and ActiveX are all forms
> of self-executing code. So are self-extracting archives. Only Java
> and ActiveX actually enforce a security policy. You might not like the
> policy and the implementation may be weak, but at least an attempt is
> made to protect the unwary user. You are on your own with macros.
> Anything can happen and it has happened with all the forms of
> self-executing code with the exception of Java & ActiveX. Nobody has
> ever been sucessfully attacked using Java or ActiveX.

 I've heard (well, lets say I know of it being used) a java program 
 called IIServerSlayer.

 This appears to be able to send a BSOD attack (once modified) at IIS
 servers that are in either your bookmarks (favorites) or (once modified)
 looks through your cache for all *.htm entries, and sends BSOD attacks
 against them. This didn't "steal" data from those systems, but as
 an annoyance factor, it rates pretty high.

> I don't think its practical to expect users to make this decision. The
> new admin kits from both Netscape and MS are supposed to allow central
> config of a security policy. Again, the idea is sound, it's just the
> implementation that is a concern. I'm anxious to see what the vendors
> come up with.

 Ok. This seems like a plan for corporate users. What about the
 several million non-corporate users? Those that have MS products
 at home. I'd hazard a guess that most "banking", and "online shopping"
 will occur from the home pc, rather then from the corporate desktop.

 I guess I could be very wrong here, but I personally don't know of
 anyone who has the resource kits at home, and I know a LOT of people
 that use these products (except myself).

 An interesting thing happened to me the other day. I upgraded my 
 browser(s). (Both netscape and IE). The new PUSH technology seems
 to be an interesting trend. I noticed that to receive CNN, and other
 news services, that I had to enable what the browsers considered "unsafe"
 policies. This has me worried. We seem to be at ends here, with 
 vendors trying to get us to use and install products for evaluation
 purposes, and we have no way of knowing just what is being installed.

 It's a blind trust situation. This has never been acceptable in the
 past. Why is it acceptable now? Has it become inherently "safer" of
 late?

> You can protect a certificate to any arbitrary level of assurance. It
> is always a tradeoff between convenience, cost, and level of
> assurance. The important element of a certificate infrastructure is
> the ability to revoke a certificate. 

 Ok. If a certificate has been compromised. How is it known that a
 compromise occured? If it's known to have been compromised, does the
 certificate authority currently revoke ALL certificates from that
 vendor? What about certificates which have already been accepted at
 a users desktop. How are the users notified, their bad 
 certificates revoked at the desktop, and software repaired with new
 certificates?

 If I'm asking "novice" level questions where the answers are a 
 "common-sense" thing, then once again, please forgive me. I'm not 
 out to bash anyone. I am out to learn exactly "how" much safer I
 am now.

.jam
.peace
I really don't want to start the NT vs. Unix war (besides the charter for this mailing list forbids it). I would just like to point out 2 things:

1. "mission critical, high availability systems" should not need constant reconfiguration.
2. Many versions of Unix (and some of the applications that run on that OS) require a recompile to take affect. Which scares you more?

-bryan

-----Original Message-----
From: Mahon, Sean [SMTP:SMAHON2@ITP.EDS.COM]
Sent: Thursday, August 28, 1997 7:05 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] NT: system availability

Hello:

I am concerned about Microsoft's claims regarding NT as a "enterprise
solution". How can a vendor make that claim when almost all system
parameter changes require a reboot. Unix systems (AIX for example, can
be maintained, changed and rebuilt without ever requiring a reboot). I
am curious how people are dealing with this when using NT for mission
>critical, high availability systems. Comment?
>

 

-----Original Message-----
From: Mac Thang 
To: 'Tim Chovanak (Digital Equipment Corporation)' ; 'NT Security Mailing List' 


>> -----Original Message-----
>> From: Mac Thang [SMTP:MThang@GRIZZARD.com]
>> Sent: Thursday, August 28, 1997 10:55 AM
>> To: 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
>> Security Mailing List'; 'NT Security Mailing List'; 'NT Security
>> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing 


And here's another part of the original message... note the subtle hint

X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net

X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net




A few of my personal favorites:

http://www.ilinks.net/~486578/hack_NT/hacknt.html

http://blkbox.com/~renegade/nt/

http://www.securityserver.com/cgi-local/ssis.pl/home2.htm

http://www.iss.net/

http://ntbugtraq.rc.on.ca/ntexploits.htm

http://www.fastlane.net/homepages/thegnome/faqs/nt/index.html

http://www.microsoft.com/ntserver/info/cooperswp_con2.htm#a25


-bryan

-----Original Message-----
From: Megan Reinhardt [SMTP:meganr@wagged.com]
Sent: Thursday, August 28, 1997 9:19 AM
To: 'NT Security List'
Subject: [NTSEC] Bug/Hack listing

Does anyone know of a list, document or Web site that describes the
different bugs and holes found in NTServer?

Thanks, Megan







Mike Stoico@METLIFE
08/28/97 12:51 PM

You said:
You might not have seen some of the mayhem that can happen from e-mail.
Someone sends a document or even a .exe as an attachment. It comes up with
some silly icon, the user double-clicks it, and ker-boom. You can also
embed executables into documents - if Powerpoint isn't patched, you can
open a powerpoint presentation, wave your mouse over the wrong spot, and
away you go

I say:
Never mind the problem with dealing with attachments, all you need is a
user getting a copy of a hoax message like penpal, panicking and then
sending a warning out to his entire department, who each in turn send it
out to their co-workers. This'll bring a mail system to it's knees without
once introducing an evil executable.

Mike Stoico
IT Security Management
MetLife

My opinions are not necessarily those of my employer

Paul Ashton and
Luke Leighton present the NT domain
authentication protocol. Comments and corrections are welcome.

Definitions
-----------

Add(A1,A2): Intel byte ordered addition of corresponding 4 byte
 words in arrays A1 and A2

E(K,D): DES ECB encryption of 8 byte data D using 7 byte key K

lmowf(): Lan man hash

ntowf(): NT hash

PW: md4(machine_password) == md4(lsadump $machine.acc)
 == pwdump(machine$)
 (initially) == md4(lmowf(unicode(machine)))

RC4(K,Lk,D,Ld): RC4 encryption of data D of length Ld with key K
 of length Lk

v[m..n(,l)]: subset of v from bytes m to n, optionally padded 
 with zeroes to length l

Cred(K,D): E(K[7..7,7],E(K[0..6],D)) computes a credential

Time(): 4 byte current time

Cc,Cs: 8 byte client and server challenges
Rc,Rs: 8 byte client and server credentials

Protocol
--------

C->S ReqChal,Cc
S->C Cs

C & S compute session key Ks = E(PW[9..15],E(PW[0..6],Add(Cc,Cs)))

C: Rc = Cred(Ks,Cc)
C->S Authenticate,Rc
S: Rs = Cred(Ks,Cs), assert(Rc == Cred(Ks,Cc))
S->C Rs
C: assert(Rs == Cred(Ks,Cs))

On joining the domain the client will optionally attempt to change
its password and the domain controller may refuse to update it
depending on registry settings. This will also occur weekly
afterwards.

C: Tc = Time(), Rc' = Cred(Ks,Rc+Tc)
C->S ServerPasswordSet,Rc',Tc,
 rc4(Ks[0..7,16],lmowf(randompassword())
C: Rc = Cred(Ks,Rc+Tc+1)
S: assert(Rc' == Cred(Ks,Rc+Tc)), Ts = Time()
S: Rs' = Cred(Ks,Rs+Tc+1)
S->C Rs',Ts
C: assert(Rs' == Cred(Ks,Rs+Tc+1))
S: Rs = Rs'

User: U with password P wishes to login to the domain (incidental
data such as workstation and domain omitted)

C: Tc = Time(), Rc' = Cred(Ks,Rc+Tc)
C->S NetLogonSamLogon,Rc',Tc,U,
 rc4(Ks[0..7,16],16,ntowf(P),16),
 rc4(Ks[0..7,16],16,lmowf(P),16)
S: assert(Rc' == Cred(Ks,Rc+Tc)) assert(passwords match those
 in SAM)
S: Ts = Time()

S->C Cred(Ks,Cred(Ks,Rc+Tc+1)),userinfo(logon script,UID,SIDs,etc)
C: assert(Rs == Cred(Ks,Cred(Rc+Tc+1))
C: Rc = Cred(Ks,Rc+Tc+1)

Comments
--------

On first joining the domain the session key could be computed by
anyone listening in on the network as the machine password has
a well known value. Until the machine is rebooted it will use
this session key to encrypt NT and LM one way functions of
passwords which are password equivalents. Any user who logs
in before the machine has been rebooted a second time will have
their password equivalent exposed. Of course the new machine
password is exposed at this time anyway.

None of the returned user info such as logon script, profile path
and SIDs *appear* to be protected by anything other than the TCP
checksum.

The server time stamps appear to be ignored.

The client sends a ReturnAuthenticator in the SamLogon request
which I can't find a use for. However its time is used as the
timestamp returned by the server.

The password OWFs should NOT be sent over the network reversibly
encrypted. They should be sent using RC4(Ks,md4(owf)) with the
server computing the same function using the owf values in the
SAM.


> ----------
> From: See, Matthew[SMTP:msee@CCMGATE.PERPETUAL.COM.AU]
> Reply To: See, Matthew
> Sent: Thursday, August 28, 1997 4:23 PM
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] Interesting Active-X exploits
> 
> --- 
> Wasn't there a demonstrated ActiveX attack where users of Quicken
> 
> accounting software could have their private details sent to a 
> designated mail address?
> 
Was that ActiveX control signed by a company that you (or anyone else)
ever heard of?

Paul

make sure your typing in DOMAIN\user in the username field. (wick\user).

-joav kohn
 sr. technical consultant - MCSE/MCP
 it/workgroup communications
 landis & staefa
"inside...we're all wet" - bjork

> -----Original Message-----
> From: Sami Mousa [SMTP:sami_mousa@INS.COM]
> Sent: Thursday, August 28, 1997 2:32 PM
> To: Mark Schoonover; Christopher G. Waters; 'WinNT Security List
> (E-mail)'
> Subject: [NTSEC] Browser Authentication with IIS 3.0
> 
> The IIS server is separate from the PDC/BDC for the domain (wick). 
> Although the IIS server is a member of the "wick" domain. 
> 
> Using basic authentication (which will support Netscape as well as
> IE), 
> authentication ONLY appear to work with "locally" defined accounts on
> the 
> IIS server itself... 
> 
> What we would like is to have the people authenticate via the PDC
> and/or 
> BDC... 
> This is the piece that is currently NOT working.. 
> 
> We have added the users in the PDC, and gave them the "log on locally"
> 
> right on the IIS server machine itself.... 
> But, still fails.. 
> 
> We have enabled logging of "logon failures". The failure messages
> indicate 
> that the user is ALWAYS be authenticated against the local IIS machine
> 
> instead of going to the PDC.... 
> 
Scheisse. I forgot to change the field in the reply.

Steve M. Wood writes:
>What scares me is that this MAY be a security administrator or auditor?
>

Or worse, an overall systems administrator. 

I've seen the handiwork of (ostensibly) well-intentioned SysAdmins who, by the installation of third-party shells, manage to prevent their users from accomplishing much except "Run applications A,B,C, and possibly D." You can forget troubleshooting, even if the user has the vendor on the phone.

In that regard, I think NTW is cool, for it offers relative power to the people, and it's so complicated, no sane administrator would dare to rip parts out in the quest to hamstring their users. I was once stupid enough to yank RPC--oh what a mess!









Floyd Johnson
Global Securities Information
"Nothing impresses...so much as common sense and plain dealing."
--Ralph Waldo Emerson

Hello all,
I apologize if this question has been asked before, but I've been reading 
this list for several months and have not seen it asked.
I have an NT 4.0 Server with IIS 3.0 that I'm setting up to be a dedicated 
web server. What I want to do is setup tight enough security (re: User 
Permissions) so that everything on the machine is locked down. What I have 
done so far is put the actual web sites on a separate drive, and the IIS 
components (Inetsrv) on a separate partition. My goal is to set up the 
entire machine so that the basic permission needs (both by the machine and 
the user) are covered, but security is tight enough that the Everyone Group 
does not have any rights.
I've looked on various web sites and books for anything that talks about 
this, but haven't found anything. They primarily deal with the permissions 
for the web sites themselves, rather than the actual machine. If worse 
comes to worse, I'll take an entire day and just look at the permissions of 
everything (what the hay, Labor Day is coming) and figure it out myself. 
 However I was wondering if anyone else has done this. I want to focus 
more on permissions effected on the WINNT directory to run IIS.
Here's the setup for the machine right now:
Compaq Proliant
200 MHz Pentium
96 Meg RAM
2 SCSI-Wide (not positive about that) drives, 4 Gig each
1st Drive partitioned C: and E:, 2nd drive F:
IIS 3.0 with FP97 Extensions, ASP, entire MCIS suite (except news)

Thanks in advance for any assistance,
Tom


Hey all,
Sorry if my question about IIS got posted 3 times, I kept getting a message 
bounced back to me and I thought it was from the list server. Of course, 
had I looked at my new NTSEC messages, I wouldn't have done it.

Sorry again,
Tom
-----BEGIN PGP SIGNED MESSAGE-----


I'm setting up workstations for our public access areas. I need to lock our 

users out of all functions except netscape and a terminal program.


I set the users permissions to rx for the entire drive with the exception of 

the area where netscape needs to write some files. 


I stumbled across a gaping security hole in that the user is able to get into 

the registry editor and make changes even though they have only read and 

execute for everything. If I take make the \winnt only r then they can't 

login.


Where is my hole and how do I plug it?


Is policy editor a solution, or do they just use their own version of policy 

editor to unlock the pc? This is also why I have locked them from regedit as 

they could just use their own copy on a floppy to edit the registry since 

they seem to be able to bypass my permissions.


Any help would be greatly appreciated.



-----BEGIN PGP SIGNATURE-----

Version: PGP for Personal Privacy 5.0

Charset: noconv


iQEVAwUBNAYAjsdkzYGunyULAQH8MAf/QFUXzMK2LfkClFay35DdYkaGEstvk39p

diWJB4cI+TkFlHNo20P1FAkJtbGWRa2d6vH1f1+5Vc7Yzrw8fomSsn1xy9IgQSVx

s1IWuk9X06o9luc0FrKyImEYNDh5yqIufuyJFs3b4MDoLQPmk6usMZopuZjNb4/+

OhNAxdyeUe1tx95uWM5nHoKEsFO95XEygUIZJ5Ge2F/srYkarcH2+yMlpxKL/MDC

aBRB5qFCV2oQ4AmhfTF4AD2p6fbjtM8wM/BVvJiMryvsW0/OBpdUirc+MxgI2P80

5X5PvAIIRgd9SC73dXzVgrIlZmOz/pfBEMihHBX9Qbz8zmToED8g8A==

=6Y8z

-----END PGP SIGNATURE-----
______________________________________

All Rights Reserved


Howard L. Bloom t/a PC-MAN

305 Earlington Road

Havertown, Pa. 19083

610-853-2828 Fax 610-622-5944

8080,0000,0000consult@pc-man.com
-----BEGIN PGP PUBLIC KEY BLOCK-----

Version: 4.5


mQENAjHfN5UAAAEIALHrGMFvJJu3PxAcg7T1Z2NFgV8u/Z7eYVkcSoc0I8bAEXJA

jndyCdd/9Xt6OhWc2uBi+WoXlusLpfCWJx1ZqL2OApQZGppIbHDKJ8+nYrhs+bmi

saicENsO3WKQ9cSBG/IBcwIFZyAbk+6AHz47A7ZNvGneWm5G7macXXyqeWiq766a

GLYwoGEiJh7zrC1E2Pa7AWuZUVNwmuKnBGnIJdBPq0L0bzDtL98aE5WWtPJE1aTr

PPh2peyiNxQIcOLtKfxJwl5Nx2ewrPwf4T7esU/NefYMCNdJtZRV+btX36iNcnRS

nUKp5wbYQUC4f7qihLcnC1IDHQuox2TNga6fJQsABRG0KUguIEhvd2FyZCBMZXdp

cyBCbG9vbSA8cGMtbWFuQG5ldGF4cy5jb20+iQEVAgUQMemIQUWh885V62ZpAQHV

mAf+ONKYTr3L92x2NEfwiPoqSxhTvUUbkcMZsWS4ZuqrMnI7fTwcs+JW55rKJeWx

4aSju/fVVkdeZWvVM/l3z0QYLfyYX5ZNwDKydDKYr6gGCk7/GWigDuzKhpYtXBRe

spyv2AKZFSJwkrpDxvESRHo+StBUSKahsICjTDI1wvrkzI+2b0/wjWHVklcwJeAf

yf+fA2x2uNGveqkHr1oesPzh5A4TW8Xku/l8TkwVOl7nvWjbVX2gcZ5v209SAyBF

Rjn0eSlfbsuHQtmqZCh299C6YGEaN7GlArVCLvnLuXE5aiWz0LWJcLM5S6XDLKFc

U1BVm+qNHL63CEAqhL/veSbw2okBFQIFEDHj6MvEquGBMmxbvQEBqWoIAKgE3NB7

MqkbipXrDj3wT2Um7Kggi0iyULmWmx8zEmSuWjjBP/qZs8F0JWCdhtG51l2Opf1n

lmodwcCSoSrdq9ySKk/XAQ1XbDLW1K1IrpU6M0LVJIJcTW+sxJncVy3DlSqLn7sp

OsODQ4EiyydU/SJQ72W1ByH8JjklUtg0A6vb5hGrfpX9rj2ESNJ4ItigihEDYDJ3

mbZttBX8X6YXZx7IKUoTGMeapdwZsfAotF1MdW3lbqTJuzI4EphvHF/UT3adTNkI

lkm3ut4N9GBJnQx+H/66cJvs1yn0Kx4YfxaDzv5Q6GxAe4y8I8hzCgsDwpQI3TDY

6qnh4QwFTSTP3oSJAJUCBRAx4BcnKvdwrj+Z8FEBATP9BACeUZNG0n+Hc7mv6ol5

0NhrqY+b+pnMqzVgmicLu09+IUdJ1KbXQRvr2CgkC0cNZN/cG0/qfQHocKN/NZIl

3cD57vhPnm/WS3yjEJZhgkwqKYCETxHPwfkpRyLROz/c5TtHOTGY6aGR8L5bP/Ik

om9622kqPfXnLHq6qew+0Phtr4kBFQIFEDHgFv3HZM2Brp8lCwEBQ/8H/RQSvm62

CAqayRdDpWa9Jg3obfUGYzpZR2dVr/uQSfna4y3h0Zl+ZM3B338Q1OsxgbVlLIMQ

Xtt+kPs3g2/e0/ly+Z8jXbCctdjfaSQ7jN0Lzx26x4WWVoAFjlJoGxc5zXRzrpTt

aflf75QUkIP0uQ+V+sFUT3xbc88qxE0qNjLlD2Ibcl1v5yZLVdEmP7YLYXTfmVul

rpRB852eMLx0ev+BLCG+OC1xWCyF9Qau6Z3FhXULxQrHYZ7NEzRfSqi8znDheUYt

eDrVR3j/+oLCaTjwEtm6QyvM2r0wQrFekEOS7JKRymSQnWhz7jpSDu9h4HVBcs0e

kD3q2gIz2iin9D+JARUCBRAx3zwb6BRr/1d/QH0BAS3+B/9Gip/v1zQYq8xSalb6

aGZVwLQeHG01kyfRlfZcFYzimwHJCvRtuwZBvNCgThJrqFaIskaj+YAJMUiibWpC

Ta/eM6NitupNGQBObbBLHFyqBploAL+iwNsRN4RxCbICyCkXc0pxpPsRk3VIhmVb

gWTdw79TZv3ZSFsKxbTaispmMrH9knZeOKYzUvyCghy5Kfmx9RSMbJs5MKNBk81q

toe6c0ZHtqRoiuYve9Xp3vfejxq2snBwlUvWPCZNM3zMmDr8Aoj+mQBqygGzG76+

MsDRD9BBezvxwEHVAvyhCmpSUSn/nZ390L6OVu7feR1OFMCV7Cffvy2OXQ/JLq//

Czto

=bnEf

-----END PGP PUBLIC KEY BLOCK-----




Apparently you have to die (cyber death -- e-mail account closed) to get off this list. And by the responses I get whenever I send something to this list, I'd say quite a few people have done just that. Let's face it this list is poorly managed.

But wait... all of you who are trying to get off the list. I happen to have the instructions (I knew these would come in handy)....

If you ever want to remove yourself from this mailing list,
you can send mail to with the following
command in the body of your email message:

 unsubscribe ntsecurity user@maildrop.com

Make sure you put it in the body and not the subject.

-bryan 

-----Original Message-----
From: Steve M Wood [SMTP:swood@duke-energy.com]
Sent: Thursday, August 28, 1997 1:03 PM
To: ntsecurity@iss.net
Subject: Re: [NTSEC] RE: Please UNSUBSCRIBE ME!

What scares me is that this MAY be a security administrator or auditor?




MThang@GRIZZARD.com on 08/28/97 01:56:07 PM

Please respond to MThang@GRIZZARD.com

To: v-timc@microsoft.com, ntsecurity@iss.net
cc: ntsecurity@iss.net, ntsecurity@iss.net, ntsecurity@iss.net (bcc:
 Steve M Wood/MIS/PSC/PEC)
Subject: [NTSEC] RE: Please UNSUBSCRIBE ME!




Really? Isn't it terrible. I've been trying to get off the list for
a couple week now. Is it not possible to get off this list once
you're on it or something?
----------
From: Tim Chovanak (Digital Equipment
Corporation)[SMTP:v-timc@microsoft.com]
Sent: Thursday, August 28, 1997 11:50 AM
To: Mac Thang
Subject: RE: Please UNSUBSCRIBE ME!
That's obnoxious.
> -----Original Message-----
> From: Mac Thang [SMTP:MThang@GRIZZARD.com]
> Sent: Thursday, August 28, 1997 10:55 AM
> To: 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
> Security Mailing List'; 'NT Security Mailing List'; 'NT Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'
> Cc: 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
> Security Mailing List'; 'NT Security Mailing List'; 'NT Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
List';
> 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
Security
> Mailing List'
> Subject: Please UNSUBSCRIBE ME!
>
> Take me off your list.
>
> UNSUBSCRIBE MTHANG@GRIZZARD.COM



 << File: att1.unk >> 
Hola,

I'm receiving the same message and I am confused about the answer, do You
know the reason for that message?

Thanks.

------------------------------------------------------------------------------
 Victor M Vega-Villa Fax:(525)747-7100
 Depto. de Genetica y Biologia Molecular Tel:(525)747-7000
 CINVESTAV-IPN, AP 14-740, ext. 5355 & 5370
 Mexico, DF 07000, MEXICO
 victor@gene.cinvestav.mx
------------------------------------------------------------------------------

On Thu, 28 Aug 1997, Jason Jarvis wrote:

> Forgive me if this isn't where this should be posted.
> 
> Is there a registry setting that can be modified so that NT4.0 doesn't
> ask you the following:
> 
> You locally stored profile is newer than your roaming profile. Would
> you like to use you local profile.
> 
> Now I know the reasons behind the message but I dont want any user 
> replying yes.
> 
> I'd ideally like to modify something so that it ALWAYS uses the roaming
> profile for users.
> 
> TIA
> 
> Jas.
> 



> ----------
> From: Dick Dasterdly[SMTP:morrison@ladyred.rsoc.rockwell.com]
> Sent: Thursday, August 28, 1997 4:13 AM
> 
> Also, how hard is it to "steal" another companies "certificate"?
> 
The certificate is public knowledge. You have to steal the company's
private key in order to forge their signature. How hard depends on whow
they protect it. Ours is in a "black box" from a well known vendor of
such devices and is locked in a vault.

Paul



 
 Not unless the Chaos Computer Club (which I have heard of) are signing 
 their own stuff. :)
 
 If I recall, Jay didn't refer to signed ActiveX in his email, he just 
 suggested that there had been no real Java or ActiveX security 
 incidents outside the lab.
 
 Regards,
 Matthew.

______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] Interesting Active-X exploits
Author: Paul Leach at INTERNET
Date: 29/8/97 8:50


 
> ----------
> From: See, Matthew[SMTP:msee@CCMGATE.PERPETUAL.COM.AU] 
> Reply To: See, Matthew
> Sent: Thursday, August 28, 1997 4:23 PM 
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] Interesting Active-X exploits 
> 
> --- 
> Wasn't there a demonstrated ActiveX attack where users of Quicken 
> 
> accounting software could have their private details sent to a 
> designated mail address?
> 
Was that ActiveX control signed by a company that you (or anyone else) 
ever heard of?
 
Paul
 

>> Wasn't there a demonstrated ActiveX attack where users of Quicken
>> accounting software could have their private details sent to a 
>> designated mail address?
>> 
>Was that ActiveX control signed by a company that you (or anyone else)
>ever heard of?
>
Yes: Sun. Wasn't that the anti-ActiveX demo that was given by the Java 
folk?

That may invalidate the demo since Sun obviously wouldn't sign and 
distribute such software, but obviously the code exists and worse can be 
written. I'm not taking sides on the Java vs ActiveX front - just 
clarifying.

Doug Roberts
dougr@headspace.com
One of the requirements for high availability is some sort of
redundancy. Regardless of the platform. In the Microsoft case, their
plan is to provide redundancy through Microsoft Cluster Server
(Wolfpack). This is in addition to any server redundancy you may have
built (see Compaq Proliant 7000 for highly redundant single server).

Wolfpack will allow you to make changes to the failover server, transfer
the process to the failover server, make changes to the primary server,
transfer the process back.

These are just parts of the solution, but they go a long way toward
solving the problem.

$0.02

=======================================================
Andy Webb awebb@swinc.com www.swinc.com
Simpler-Webb, Inc. Austin, TX 
 "Mauve has more RAM" - Dilbert
=======================================================

> -----Original Message-----
> From: Mahon, Sean [SMTP:SMAHON2@ITP.EDS.COM]
> Sent: Thursday, August 28, 1997 9:05 AM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] NT: system availability
> 
> Hello:
> 
> I am concerned about Microsoft's claims regarding NT as a "enterprise
> solution". How can a vendor make that claim when almost all system
> parameter changes require a reboot. Unix systems (AIX for example,
> can
> be maintained, changed and rebuilt without ever requiring a reboot).
> I
> am curious how people are dealing with this when using NT for mission
> >critical, high availability systems. Comment?
> >
Bob Love wrote:
> 
> 
> 
> -----Original Message-----
> From: Mac Thang 
> To: 'Tim Chovanak (Digital Equipment Corporation)' ; 'NT Security Mailing List' 
> 
> 
> >> -----Original Message-----
> >> From: Mac Thang [SMTP:MThang@GRIZZARD.com]
> >> Sent: Thursday, August 28, 1997 10:55 AM
> >> To: 'NT Security Mailing List'; 'NT Security Mailing List'; 'NT
> >> Security Mailing List'; 'NT Security Mailing List'; 'NT Security
> >> Mailing List'; 'NT Security Mailing List'; 'NT Security Mailing
> 
> 
> And here's another part of the original message... note the subtle hint
> 
> X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
> 
> X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
Don't you think Mac Thang already tried this. I know I have several 
times and still I get this mailing all day long. I am sick of it and 
also would liket to know how to get the hell off this list!!
Well I just resubscribed to ntsecurity. Guess nothing changes.
Since I am killing this thread in BugTraq I'll drop my two cents here.

Paul,

 The flaws of ActiveX signing an object only tells you where the object
came from, not how secure it is. So even if the object is signed by a well
known company (say Microsoft) I may use it own my own pages and manipulate
its enviroment to exploit some vulnerability in it. As an example of a
similar situation look at Macromedia's Shockwave plugin that allowed a
rouge site to read your email. The Java virtual machine attempts to make
such attacks less likely. Also, you may wish to give the object access to
only a certain area of your machine, say a directory, but not to the whole
machine. The should be layers or types of access.

 Furthermore, the current implementation makes a fatal assumtion, that is
that just becuase I trust company X's object Y and accept their
certificate I also trust their object Z. This is like saying that just
because I installed Microsoft Office 97 on my PC you will also instatll
Microsoft Bob.

 Also, we all know that Microsoft's wishes that as many people use
ActiveX in their web site. After all the aim of any company is to spread
the use of their technology. If that happens a dialog box asking the user
to accept company X's certificate will be displayed at every webpage they
hit. We know it is human nature that they will then select to accept it or
simple lower the security level. You may claim this is the users fault, it
is. But is also very irresponsible from Microsoft.

 I wonder how you, an intelligent individual, can argue with this
statements. There is no need for a reply. All this debate is just noise.
The truth will be played out when some serious ActiveX object are
developed and in use, and when people start posting exploits for them in
BugTraq. Till then, good luck.

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 


Hi,

I would suggest you to write a Perl script, the Perl For Win32 include a
Win32::Eventlog package. 
Check :
 : Perl distribution
 : Docs and samples on Win32::Eventlog

Regards,
 
Philippe Le Berre
SSG - CSBU R&D
Advance Technology Lab, Europe
----------------------------------------------------------------
Hewlett-Packard 
5 av Raymond Chanas Tel : 33 4 76 14 66 05
38053 Grenoble Cedex 9, France Fax : 33 4 76 14 14 65

Hello Folks,

Just a little (Maybe it is big) about the subject !

Are there dificulties on my way when I install ms-proxy server 2.0 beta
I mean I have installed NT 4.0 with SP3 on a machine.
On the same machine I have installed MS Exchange 5.0 enterprise edition.

Now I want to connect to the internet through a different machine.
On that machine is also NT 4.0 with SP3 with IIS 3.0 installed (so I am
ready to go)

I mean does the proxy server know that Exchange is behind it. Can my
mail from the internet come 
Through onto the other server or must I install proxy-server on the same
machine as Exchange.
(I hope not)

Please give me some feedback !
Thanx in advance

Greetinx


Bart Hermus 
E-mail: Barth@wcc.nl 

WCC Services B.V
Eekholt 54; 1112 XH Diemen-Zuid
Tel: +31 (0)20-4160266 ; Fax: +31 (0)20-4160267
On Thu, 28 Aug 1997 12:01:28 -0400, you wrote:

>
>You might not have seen some of the mayhem that can happen from e-mail.
I know about them - as from my original posting: 'configure your
mailers properly' i.e. not to execute the 'suspicious' mime types.
Or change file access for downloads to (rwd).
>Someone sends a document or even a .exe as an attachment. It comes up with
>some silly icon, the user double-clicks it, and ker-boom. You can also
>embed executables into documents - if Powerpoint isn't patched, you can
>open a powerpoint presentation, wave your mouse over the wrong spot, and
>away you go.
>
>Some e-mail clients will _automatically_ open attachments. If the user has
>an unpatched version of Word, any auto-open macros are going to run. Again
>- kerboom.
I know, and I've also seen it 'live'. Unfortunately, it might be
difficult (depending on mail client ;)) to close all of these holes.

But - I would not recommend a mailer whose auto-launch 
can't be disabled for individual mime types or file extensions or
which does not allow at least something like setting a default
download dir or (better) default perms for downloads.

>
>In comparison, the evils of ActiveX are nothing. ActiveX will at least
>normally try to tell you who wrote it, and refuse to run if there is no
>certificate. So with e-mail, you have no security mechanisms at all _and_
>no authentication.
Sorry but I have a different POV: Security of an emailer relies on the
implementation of the mailer software. ActiveX is (from my HPOV)
from the very design insecure and I simply can't imagine viable
solutions for M$ to fix these holes. The best solution that comes to 
my mind is s.t. like isolating 'non-trusted' controls in separate
address spaces s with very low access rights disabling them
to bind any 'dangerous' libraries, but I am not sure whether this
is currently implementable (are there many controls around
that do not require vast parts of the win32 api?).

>
>>With Java you are quite right. Java runs in a (quite) secure
>>environment (the sandbox) but ax has nothing like that.
>
>Except that there have been around a dozen different holes in Java found so
>far. Nothing is going to provide perfect security. Everything has good
>and bad points.
Of course - Java is quite young (from the point of security) therefore
implementations tend to be buggy. But the _design_ as it at least
has a notion of security that, under a correct implementation provides
sufficient (stupid word I know, perhaps 'some' fits better?)
protection. BTW - have there been any 'really' useable exploits?
All I've seen so far have been minor bugs hardy exploitable in
practice.

In contrast, ActiveX has not been designed for security (I should
perhaps be more exact - controlled/restricted resources access) at
all. The authentification mechanism is better than nothing - but 
IMHO it makes very very little sense without at least some
sort of access restriction. 
What is all certification useful for as long as a offending control
can do anything with the hosting system?
A nice scenario at that point:
- user opens page w. control & accepts it (ok it's his fault)
- control installs trojan that executes three days later
- three days later: *kaboom* & you won't tell me that
 user has the slightest chance to ever figure out what 
 has happened. (even super-user ;) might have a hard
 time with this).
(we should leave out the question, how did the offending
control get to that server;))
Of course, I see the 'optimistic' assumptations in that
scenario, but what I want to point out is that there are
_significant_ differences between letting a (still evolving)
interpreter or pure unadorned binary code from a stranger
run on a system.

>
>>And given the fact that ax has been out for about two years 
>>(not sure :)) there simply has not been much time to exploit it.
>
>Yeah, right. With all the different ways people have been beating up MS
>over security?
There have been at least interesting demos.
Imho 95% of M$ bashers do not really know, what they
are talking about (other numbers for ppl on that list, for sure ;))

And the real hackers often still play with unix systems ;)

>
>>And more people have been dying from starvation that century than from
>>car crashes - and you'd recommend (based on that fact) to
>>ignore problems from cars???
>
>No - they are all problems, and we have to look out for all of them.
Sorry - I'll try to hold back my e-feather from drifting off in the
future ;( 
Yeah you're right - we've got to look out for them - wasn't
that one of the aims of this list? ;) 

regards,

Dietz Proepper
-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
On Thu, 28 Aug 1997 08:45:24 -0700, you wrote:

>On 28 August 1997, 0522, you wrote:
>>The fact that I have to take that disk, put it into a disk drive
>> and use it (activity originating from me).
>> An ax control on the other hand can enter my system without
>> me noting it. OK, a proper configured browser wont allow
>> that, but given the fact that I can manipulate these settings
>> from within an ax control, the 'proper settings' are IMHO of little
>> value (activity originating from somewhere)..
>
>Are yousaying that an ActiveX control has the ability to change settings on 
>my machine *before* I download it? I don't think so! You said it yourself 
>- "a properly configured browser". If you *choose* to allow ActiveX 
>controls to be downloaded without intervention, then you have implicitly 
>originated that activity. If you are informed that an ActiveX control is 
>required to be downloaded for a site, and you *accept* the certificate 
>(enabling the download), then again *you* have originated the activity.
You are wrong. The initiating control (the one I mentioned above)
looks totally harmless (OK - it's signed by a stranger).
And once again - I've seen many users who asked whether I could
not remove those stupid boxes about accepting certificates.
(I did - installed netscape :))
You are falling into the common pit - the average user has _no_
notion of security. And you won't be able to change his or her
attitude - they often simply do not have the necessary background.
Or even better (s.t. I heared sometimes): 'You're the tech. Make
it go away!".

regards, 
Dietz Proepper
-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
On Thu, 28 Aug 1997 23:23:47 -0500 (CDT), you wrote:

[...]
>
> I wonder how you, an intelligent individual, can argue with this
>statements. There is no need for a reply. All this debate is just noise.
>The truth will be played out when some serious ActiveX object are
>developed and in use, and when people start posting exploits for them in
>BugTraq. Till then, good luck.
That's the point I wanted to express in my recent postings.
thx alot Aleph.

Now on to more interesting NT problems :)

regards,

Dietz Proepper

-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
Hey guys:

For those of you that are trying to get out from this list, read the 
message below. That was the welcome message that I got once I 
subscribed to this list (the list from hell) ;) **kidding**

Hope this inf. can help you.
Carlos Santana
US. DOL

----------
From: Majordomo@iss.net[SMTP:Majordomo@iss.net]
Sent: Saturday, August 09, 1997 2:01 PM
To: 
Subject: Welcome to ntsecurity

--

Welcome to the ntsecurity mailing list!

Please save this message for future reference. Thank you.

If you ever want to remove yourself from this mailing list,
you can send mail to with the following
command in the body of your email message:

 unsubscribe ntsecurity 

If you ever need to get in contact with the owner of the list,
(if you have trouble unsubscribing, or have questions about the
list itself) send email to .
This is the general rule for most mailing lists when you need
to contact a human.

 Here's the general information for the list you've subscribed to,
 in case you don't already have it:

 NT Security Mailing List

This is an unmoderated mailing list discussing Windows NT security as 
well
as the Windows 95 and Windows For Work Group security issues.

The issues discussed will be everything at the host and application 
level
security as well as at the network level.

This mailing list is for security discussions so please keep personal 
emails offline.

This list is NOT for:
flamewars of any type
discussions about NT vs. UNIX
general administration issues
bashing Microsoft or other vendors

We expect all list participants to behave in a civil and professional 
manner. If you feel the need to engage in flamewars, please go find 
the
USENET newsgroup of your choice. If you must disagree impolitely 
with
another list participant, take it to personal e-mail.

The list owner can be reached at ntsecurity-owner@iss.net if there is 
any problems
that need to be addressed.

I have been known to moderate the list when our mail queue has grown 
too
large, or there have been auto-responder messages, going across the 
list.

If you would like to send mail to the list, send it to:

ntsecurity@iss.net.

Please do not send it to majordomo, majordomo-owner, or
ntsecurity-owner.

To unsubscribe, send email to:

majordomo@iss.net w/ the body of

unsubscribe ntsecurity 

 is optional. Majordomo will extract your email from the
headers if you do not include it. If majordomo comes back with errors 
like
you are not on list ntsecurity, try not including your email.

There is a digest version of the list. It is 
ntsecurity-digest@iss.net.
To unsubscribe from this list, and subscribe to the digest version 
send
email to majordomo@iss.net with the BODY of:

unsubscribe ntsecurity 
subscribe ntsecurity-digest 

Again is optional.

It is possible that you are receiving this message through a local
exploder. There are several on the list. If you have a problem send 
it
to ntsecurity-owner@iss.net, not the general list.

Please keep this message for future reference.

Thank you,
ISS


I spent some time looking for the solution to this and testing it out so
I thought I'd share...

The challenge is to set up an Exchange server behind a proxy server and
have both inbound and outbound SMTP mail delivered. In
Proxy 1.0, this required an SMTP relay agent on the Proxy server. In
Proxy 2.0, we no longer need the relay agent as the Proxy
server will allow protected access to the Exchange Server.

The latest proxy 2.0 beta faq describes this quite well (posted to
news:microsoft.public.proxybeta weekly). To paraphrase:

1. Install proxy server
2. Enable Dynamic Packet Filtering on the Proxy Server
3. Install the WSP client on the internal Exchange Server
4. In the %ExchangeServer%\Connect\MSEXCIMC\BIN directory create a file
"WSPCFG.INI" with contents:
 [MSEXCIMC]
 ServerBindTcpPorts=25
 Persistent=1
 KillOldSession=1
5. Restart the IMC / IMS
6. Configure External DNS records to point MX record at Proxy Server

Voila!

Regards
Andy [MVP - Exchange]

-- 
=======================================================
Andy Webb awebb@swinc.com.spamsucks.com www.swinc.com
Simpler-Webb, Inc. Austin, TX "Mauve has more RAM..." - Dilbert
 -- E-Mail address munged due to SPAM cretins.
=======================================================


=======================================================
Andy Webb awebb@swinc.com www.swinc.com
Simpler-Webb, Inc. Austin, TX 512-322-0071
 "Mauve has more RAM" - Dilbert
=======================================================

> -----Original Message-----
> From: Bart Hermus [SMTP:BartH@wcc.nl]
> Sent: Friday, August 29, 1997 2:32 AM
> To: '[NTSEC]'
> Subject: [NTSEC] MS Exchange and MS Proxy 2.0 Beta ?
> 
> 
> Hello Folks,
> 
> Just a little (Maybe it is big) about the subject !
> 
> Are there dificulties on my way when I install ms-proxy server 2.0
> beta
> I mean I have installed NT 4.0 with SP3 on a machine.
> On the same machine I have installed MS Exchange 5.0 enterprise
> edition.
> 
> Now I want to connect to the internet through a different machine.
> On that machine is also NT 4.0 with SP3 with IIS 3.0 installed (so I
> am
> ready to go)
> 
> I mean does the proxy server know that Exchange is behind it. Can my
> mail from the internet come 
> Through onto the other server or must I install proxy-server on the
> same
> machine as Exchange.
> (I hope not)
> 
> Please give me some feedback !
> Thanx in advance
> 
> Greetinx
> 
> 
> Bart Hermus 
> E-mail: Barth@wcc.nl 
> 
> WCC Services B.V
> Eekholt 54; 1112 XH Diemen-Zuid
> Tel: +31 (0)20-4160266 ; Fax: +31 (0)20-4160267
On Friday, August 29, 1997 5:34 PM, Jay Heiser [SMTP:Jay@HomeCom.com] 
wrote:

btw, Netscape 4.0 allows Java application to jump out of sand box if they 
have a certificate - just like an ActiveX. For example Netscapes own 
SmartUpdate does it.

Good topic for a new discussion :)

--------------------------------------------------------------------
Alex Libenson E-mail: alex@dan.lv
DAN Communications Homepage: http://www.bit.lv/alex/
 Phone: +371-7336070
8, Antonijas str. +371-7336071
LV-1010, Riga, Latvia Fax: +371-7334929
--------------------------------------------------------------------


>Are there dificulties on my way when I install ms-proxy server 2.0 beta
>I mean I have installed NT 4.0 with SP3 on a machine.
>On the same machine I have installed MS Exchange 5.0 enterprise
edition.

>Now I want to connect to the internet through a different machine.
>On that machine is also NT 4.0 with SP3 with IIS 3.0 installed (so I am
>ready to go)

>I mean does the proxy server know that Exchange is behind it. Can my
>mail from the internet come 
>Through onto the other server or must I install proxy-server on the
same
>machine as Exchange.
>(I hope not)

 Let's see if I understand how this is set up:

Phone Line
 |
Exchange Server
 |
Rest of your network.

 And what you want to do is substitute the proxy server for the
exchange server
on the diagram, putting the Exchange server somewhere inside "rest of
your 
network." It's theoretically doable. I haven't been able to accomplish
it, but there
are people who have. If you do so, you need to point your MX entry at
the proxy
server, not the exchange server. (There's other stuff involved. It's
explained in
the proxybeta FAQ available from Microsoft's NEWS server.)
 On the other hand, you could just stick the proxy machine behind the
exchange
server, and tell the exchange machine to route packets. Then your
network would
look something like:

Phone Line
 |
Exchange Server
 |
Proxy Server
 |
Rest of your network.


Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com 
Home: swaim@phoenix.net or maybe swaim@c-com.net, I don't know.
Disclaimer: I Lie

Hmmm. Don't think I'm that fond of abandoning the Exchange server
outside any semblance of security. Since there are workable solutions
with both Proxy 1.0 and Proxy 2.0 (beta), it should definitely be inside
the proxy server.

Andy

=======================================================
Andy Webb awebb@swinc.com www.swinc.com
Simpler-Webb, Inc. Austin, TX 
 "Mauve has more RAM" - Dilbert
=======================================================

> -----Original Message-----
> From: Swaim, Mike [SMTP:mpswaim@gdseng.com]
> Sent: Friday, August 29, 1997 9:49 AM
> To: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] MS Exchange and MS Proxy 2.0 Beta ?
> 
> >Are there dificulties on my way when I install ms-proxy server 2.0
> beta
> >I mean I have installed NT 4.0 with SP3 on a machine.
> >On the same machine I have installed MS Exchange 5.0 enterprise
> edition.
> 
> >Now I want to connect to the internet through a different machine.
> >On that machine is also NT 4.0 with SP3 with IIS 3.0 installed (so I
> am
> >ready to go)
> 
> >I mean does the proxy server know that Exchange is behind it. Can my
> >mail from the internet come 
> >Through onto the other server or must I install proxy-server on the
> same
> >machine as Exchange.
> >(I hope not)
> 
> Let's see if I understand how this is set up:
> 
> Phone Line
> |
> Exchange Server
> |
> Rest of your network.
> 
> And what you want to do is substitute the proxy server for the
> exchange server
> on the diagram, putting the Exchange server somewhere inside "rest of
> your 
> network." It's theoretically doable. I haven't been able to accomplish
> it, but there
> are people who have. If you do so, you need to point your MX entry at
> the proxy
> server, not the exchange server. (There's other stuff involved. It's
> explained in
> the proxybeta FAQ available from Microsoft's NEWS server.)
> On the other hand, you could just stick the proxy machine behind the
> exchange
> server, and tell the exchange machine to route packets. Then your
> network would
> look something like:
> 
> Phone Line
> |
> Exchange Server
> |
> Proxy Server
> |
> Rest of your network.
> 
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com 
> Home: swaim@phoenix.net or maybe swaim@c-com.net, I don't know.
> Disclaimer: I Lie
I wish to express my gratitude to the members of this list. I've raised
a few questions about Activex and JAVA, hopefully in such a way as to NOT
lead to a bashing against either implementation. A lot has fallen out 
from this. My appreciation to those who provided excellent content and
explanations of my "novice" questions.

I also need to provide my apologies to the list. I lied (a small white 
one). I DO know something about the workings of both ActiveX and JAVA.
I could say that I know someone who is currently writing some code to 
demonstrate specifics. Lets call it a hobby.

Unfortunately, in the midst of this "exploration" real issues walked in
the door.

Problem: Adobe Acrobat 3.0. If I configure it to NOT use ActiveX 
 controls and content within IE, then Acrobat will not display
 the PDF files which all employees are required to read. If we 
 do away with IE, and go to Netscape, we've just cost the 
 corporation several million dollars. This is not an easy sell. 
 However, I am finding that once controls are enabled for an 
 application, that content CAN be executed (which is created by 
 a third party) which can do tremendous damage. This introduces 
 a new element in the equation that hasn't been discussed 
 anywhere before (to my knowledge - i.e., the it's not the viewers
 fault, it's whoever made the "document").

 In my day-job environment, PDF files are a requirement. Now that Adobe
 has switched to the use of ActiveX, the corporation I work with, and
 a major government organization has been hit with a dilema. If we
 enable ActiveX control for this application, then content (from
 anywhere) will execute "within" the application that we've allowed 
 ActiveX controls in. 

 Should we be worried? Am I being too paranoid? Work which is being
 performed now to "evaluate" specific conditions lead me to believe
 that I should be. How do I sell it to management? Managements
 position is: "You've got to be kidding. We bought these products to
 turn ON these neat bells and whistles, and now you want us to turn 
 them off? Then why the h*ll did we buy them in the first place?"

 This is a serious problem. Perhaps I need to find easier work? If
 the only people that will listen and understand are those within the
 "choir", then what am I accomplishing as a security consultant? It
 appears that any "common sense" is being undermined from "out-of-band"
 channels (i.e., marketing).

 Maybe it's time to ALLOW a meltdown. Sit back and watch as many 
 corporations and governments sue other corporations for a false ad
 campaign, or for damages caused (no matter what the "disclaimer
 states). Sorry, I'm just sitting here in frustration.

 Again. I thank each of you. You've assisted in confirming many things.

.with respect

.jam


Bart:

 It's best to have the proxy on a seperate system that is strictly a member
server and has no other functions except for proxy services. I run mine on
an older P90/48MB/2GB system, and it servers my 40 users just fine. Your
Exchange system will be sitting behind the proxy, even though it is
installed on the same computer. Load the WSCLIENT program and go from
there.

Mark Schoonover
American Geotechnical
Soil, Foundation and Geologic Studies

----------
> From: Bart Hermus 
> To: '[NTSEC]' 
> Subject: [NTSEC] MS Exchange and MS Proxy 2.0 Beta ?
> Date: Friday, August 29, 1997 12:32 AM
> 
> 
> Hello Folks,
> 
> Just a little (Maybe it is big) about the subject !
> 
> Are there dificulties on my way when I install ms-proxy server 2.0 beta
> I mean I have installed NT 4.0 with SP3 on a machine.
> On the same machine I have installed MS Exchange 5.0 enterprise edition.
> 
> Now I want to connect to the internet through a different machine.
> On that machine is also NT 4.0 with SP3 with IIS 3.0 installed (so I am
> ready to go)
> 
> I mean does the proxy server know that Exchange is behind it. Can my
> mail from the internet come 
> Through onto the other server or must I install proxy-server on the same
> machine as Exchange.
> (I hope not)
> 
> Please give me some feedback !
> Thanx in advance
> 
> Greetinx
> 
> 
> Bart Hermus 
> E-mail: Barth@wcc.nl 
> 
> WCC Services B.V
> Eekholt 54; 1112 XH Diemen-Zuid
> Tel: +31 (0)20-4160266 ; Fax: +31 (0)20-4160267
Due to this list rambling on about ActiveX, Exchange Server, and anything 
and everything BUT NT, I have chosen to leave it. Thanks for the info on NT 
when it was on topic and discussed.
 -------------------------------------------------
 ---------------------------------------------------
| RezPhreak Server Administrator |
|___________________________________________________|
|IRC Clients: minn.starchat.net |
|IRC via the WWW: http://irc.minn.net:8080 |
|Homepage: http://www1.minn.net/~sathia |
 ---------------------------------------------------
 -------------------------------------------------


On Fri, 29 Aug 1997, Jan Nelson wrote:

> It seems to me that we are starting to understand that everyone being =
> connected to everyone else is a wonderful thing coupled to a serious =
> risk. =20

 Yes. This is a concept I'm attempting to "educate" certain vendors
 about. It's difficult getting past their "enthusiasm".

> Due to the liability laws and lawsuit culture, I suspect that we will =
> see a backlash to this connectivity that will force a stronger extranet =
> push. The concept of domain trusts seems to be implied here. If your =
> organization requires a certain feature and costs dictate that you stay =
> the course, then responsibility to the company seems to be to severely =
> restrict access to any source of rogue code.

 Farther then that I'm afraid. What if I create a document, that you
 use a "viewer" to read. That application uses ActiveX controls. That
 application has been signed and certified. My company trusts them.

 Does that mean I can use an application that I trust, BUT can't use
 any data (which is the reason for using the application in the first
 place) to be processed IN the application? Unless I write it myself?

 This should NOT be acceptable.

> Could an inexpensive model of reasonable security be to pre-qualify and =
> authorize ALL Active-X, Java applets as a sort of firewalling and then =
> post those essential documents to a private net? Are the PDF docs so =
> dynamic that the content changes too frequently for this to work?

 In this environment. Yes. As a matter of fact, for any company who
 is moving towards automating ISO-9000 standards into the workplace,
 it can be a major logistical problem just keeping up with the 
 documentation required to maintain the ISO certification.

> Although a meltdown would demonstrate the seriousness, could a demo =
> meltdown be just as effective if shown to CEO/COO types whose =
> shareholder responsibilities require them to pay attention?

 No. At least, in my humble opinion, it could not. From past experience,
 I've only seen management (from ANY company) make dramatic decisions
 (in regards to Security and how they do business) only AFTER they have
 been hit. Demonstrations don't affect them. It has to actually 
 affect them. Of course, by then it's too late.

> Regards,
> 
> Jan A. Nelson
> Instructor, Microcomputer Technology
> Henderson Bay Alternative High School
> 3510 Grandview Street
> Gig Harbor, WA 98332
I will be out of the office and non-contactable until 2nd September
1997. Please contact John Licci, Brian Saluzzo, or Bob Knapp for
NTrigue issues. For ETS please contact Eric Kaplan, Mark Sinner, or
Mary Byron. I will reply to your E-Mail on my return.
biggels@i3d.es - no such user here.

: Message contains [1] file attachments
Received: from iss.net [208.21.0.5] by i3d.es [194.179.88.9] with SMTP (MDaemon.v2.5.rB.b2.32-R) for ; Fri, 29 Aug 97 21:50:18 +0200
Received: (qmail 17344 invoked by alias); 29 Aug 1997 19:42:46 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 17338 invoked by alias); 29 Aug 1997 19:42:46 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 17333 invoked by uid 15); 29 Aug 1997 19:42:45 -0000
Received: (qmail 17310 invoked by alias); 29 Aug 1997 19:42:40 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 17306 invoked from network); 29 Aug 1997 19:42:40 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 19:42:40 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id PAA06436; Fri, 29 Aug 1997 15:44:13 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 12:44:46 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Thu, 28 Aug 1997 23:00:04 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-MDMail-Server: MDaemon v2.5 rB b2 32-R
X-MDaemon-Deliver-To: biggels@i3d.es
biggels@i3d.es - no such user here.

: Message contains [1] file attachments
Received: from iss.net [208.21.0.5] by i3d.es [194.179.88.9] with SMTP (MDaemon.v2.5.rB.b2.32-R) for ; Fri, 29 Aug 97 21:57:42 +0200
Received: (qmail 17403 invoked by alias); 29 Aug 1997 19:42:50 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 17384 invoked by alias); 29 Aug 1997 19:42:49 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 17358 invoked by uid 15); 29 Aug 1997 19:42:47 -0000
Received: (qmail 17325 invoked by alias); 29 Aug 1997 19:42:42 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 17320 invoked from network); 29 Aug 1997 19:42:41 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 19:42:41 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id PAA06440; Fri, 29 Aug 1997 15:44:14 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 12:44:46 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Thu, 28 Aug 1997 23:00:04 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-MDMail-Server: MDaemon v2.5 rB b2 32-R
X-MDaemon-Deliver-To: biggels@i3d.es
biggels@i3d.es - no such user here.

: Message contains [1] file attachments
Received: from iss.net [208.21.0.5] by i3d.es [194.179.88.9] with SMTP (MDaemon.v2.5.rB.b2.32-R) for ; Fri, 29 Aug 97 22:06:07 +0200
Received: (qmail 17794 invoked by alias); 29 Aug 1997 19:43:14 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 17784 invoked by alias); 29 Aug 1997 19:43:13 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 17754 invoked by uid 15); 29 Aug 1997 19:43:12 -0000
Received: (qmail 17682 invoked by alias); 29 Aug 1997 19:43:07 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 17674 invoked from network); 29 Aug 1997 19:43:07 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 19:43:07 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id PAA06451; Fri, 29 Aug 1997 15:44:40 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 12:45:17 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Thu, 28 Aug 1997 23:00:04 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-MDMail-Server: MDaemon v2.5 rB b2 32-R
X-MDaemon-Deliver-To: biggels@i3d.es

[008] Failure delivering user mail due to mailbag contention.
Mail item was not delivered to:


------------------------------------------------------------------------
------
Microsoft Mail v3.0 (MAPI 1.0 Transport) IPM.Microsoft Mail.Note
From: ntsecurity-digest
To: ntsecurity-digest@iss.net
 owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Date: 1997-08-29 02:00
Priority: 3
Message ID: 8E9806608F20D11193B1080009ED75C8

 
 

biggels@i3d.es - no such user here.

: Message contains [1] file attachments
Received: from iss.net [208.21.0.5] by i3d.es [194.179.88.9] with SMTP (MDaemon.v2.5.rB.b2.32-R) for ; Fri, 29 Aug 97 22:15:24 +0200
Received: (qmail 17850 invoked by alias); 29 Aug 1997 19:43:17 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 17810 invoked by alias); 29 Aug 1997 19:43:15 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 17774 invoked by uid 15); 29 Aug 1997 19:43:13 -0000
Received: (qmail 17720 invoked by alias); 29 Aug 1997 19:43:09 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 17706 invoked from network); 29 Aug 1997 19:43:08 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 19:43:08 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id PAA06456; Fri, 29 Aug 1997 15:44:41 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 12:45:18 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Thu, 28 Aug 1997 23:00:04 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-MDMail-Server: MDaemon v2.5 rB b2 32-R
X-MDaemon-Deliver-To: biggels@i3d.es

[008] Failure delivering user mail due to mailbag contention.
Mail item was not delivered to:


------------------------------------------------------------------------
------
Microsoft Mail v3.0 (MAPI 1.0 Transport) IPM.Microsoft Mail.Note
From: ntsecurity-digest
To: ntsecurity-digest@iss.net
 owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Date: 1997-08-29 02:00
Priority: 3
Message ID: C39A06608F20D11193B1080009ED75C8

 
 

On Friday, August 29, 1997 9:39 AM, Webb, Andy [SMTP:Andy.Webb@swinc.com] wrote:
> I spent some time looking for the solution to this and testing it out so
> I thought I'd share...
> 
> The challenge is to set up an Exchange server behind a proxy server and
> have both inbound and outbound SMTP mail delivered. In
> Proxy 1.0, this required an SMTP relay agent on the Proxy server. In
> Proxy 2.0, we no longer need the relay agent as the Proxy
> server will allow protected access to the Exchange Server.
> 
> The latest proxy 2.0 beta faq describes this quite well (posted to
> news:microsoft.public.proxybeta weekly). To paraphrase:
> 
> 1. Install proxy server
> 2. Enable Dynamic Packet Filtering on the Proxy Server
> 3. Install the WSP client on the internal Exchange Server
> 4. In the %ExchangeServer%\Connect\MSEXCIMC\BIN directory create a file
> "WSPCFG.INI" with contents:
> [MSEXCIMC]
> ServerBindTcpPorts=25
> Persistent=1
> KillOldSession=1
> 5. Restart the IMC / IMS
> 6. Configure External DNS records to point MX record at Proxy Server
> 
> Voila!
> 
> Regards
> Andy [MVP - Exchange]
> 
> -- 
> =======================================================
> Andy Webb awebb@swinc.com.spamsucks.com www.swinc.com
> Simpler-Webb, Inc. Austin, TX "Mauve has more RAM..." - Dilbert
> -- E-Mail address munged due to SPAM cretins.
> =======================================================
> 
> 
> =======================================================
> Andy Webb awebb@swinc.com www.swinc.com
> Simpler-Webb, Inc. Austin, TX 512-322-0071
> "Mauve has more RAM" - Dilbert
> =======================================================
> 
> > -----Original Message-----
> > From: Bart Hermus [SMTP:BartH@wcc.nl]
> > Sent: Friday, August 29, 1997 2:32 AM
> > To: '[NTSEC]'
> > Subject: [NTSEC] MS Exchange and MS Proxy 2.0 Beta ?
> > 
> > 
> > Hello Folks,
> > 
> > Just a little (Maybe it is big) about the subject !
> > 
> > Are there dificulties on my way when I install ms-proxy server 2.0
> > beta
> > I mean I have installed NT 4.0 with SP3 on a machine.
> > On the same machine I have installed MS Exchange 5.0 enterprise
> > edition.
> > 
> > Now I want to connect to the internet through a different machine.
> > On that machine is also NT 4.0 with SP3 with IIS 3.0 installed (so I
> > am
> > ready to go)
> > 
> > I mean does the proxy server know that Exchange is behind it. Can my
> > mail from the internet come 
> > Through onto the other server or must I install proxy-server on the
> > same
> > machine as Exchange.
> > (I hope not)
> > 
> > Please give me some feedback !
> > Thanx in advance
> > 
> > Greetinx
> > 
> > 
> > Bart Hermus 
> > E-mail: Barth@wcc.nl 
> > 
> > WCC Services B.V
> > Eekholt 54; 1112 XH Diemen-Zuid
> > Tel: +31 (0)20-4160266 ; Fax: +31 (0)20-4160267

Or you could use the TFS gateway www.tenfour.com to talk between Exchange and the internet. TFS
can be on the same box as exchange or on it's own.


[008] Failure delivering user mail due to mailbag contention.
Mail item was not delivered to:


------------------------------------------------------------------------
------
Microsoft Mail v3.0 (MAPI 1.0 Transport) IPM.Microsoft Mail.Note
From: ntsecurity-digest
To: ntsecurity-digest@iss.net
 owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Date: 1997-08-29 02:00
Priority: 3
Message ID: D79B06608F20D11193B1080009ED75C8

 
 

biggels@i3d.es - no such user here.

: Message contains [1] file attachments
Received: from iss.net [208.21.0.5] by i3d.es [194.179.88.9] with SMTP (MDaemon.v2.5.rB.b2.32-R) for ; Fri, 29 Aug 97 22:32:41 +0200
Received: (qmail 20432 invoked by alias); 29 Aug 1997 19:45:46 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 20422 invoked by alias); 29 Aug 1997 19:45:45 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 20370 invoked by uid 15); 29 Aug 1997 19:45:42 -0000
Received: (qmail 20286 invoked by alias); 29 Aug 1997 19:45:37 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 20277 invoked from network); 29 Aug 1997 19:45:37 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 19:45:37 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id PAA06662; Fri, 29 Aug 1997 15:47:10 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 12:47:48 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Thu, 28 Aug 1997 23:00:04 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-MDMail-Server: MDaemon v2.5 rB b2 32-R
X-MDaemon-Deliver-To: biggels@i3d.es
biggels@i3d.es - no such user here.

: Message contains [1] file attachments
Received: from iss.net [208.21.0.5] by i3d.es [194.179.88.9] with SMTP (MDaemon.v2.5.rB.b2.32-R) for ; Fri, 29 Aug 97 22:40:23 +0200
Received: (qmail 20517 invoked by alias); 29 Aug 1997 19:45:51 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 20488 invoked by alias); 29 Aug 1997 19:45:50 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 20436 invoked by uid 15); 29 Aug 1997 19:45:46 -0000
Received: (qmail 20325 invoked by alias); 29 Aug 1997 19:45:39 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 20318 invoked from network); 29 Aug 1997 19:45:39 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 19:45:39 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id PAA06667; Fri, 29 Aug 1997 15:47:11 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 12:47:48 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Thu, 28 Aug 1997 23:00:04 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
X-MDMail-Server: MDaemon v2.5 rB b2 32-R
X-MDaemon-Deliver-To: biggels@i3d.es
ntsecurity-digest wrote:
> 
> Thanks for using NetForward!
> http://www.netforward.com
> v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v


FYI,


I am geeting a lot of mail from you with NO content



Andrew Cummins
Your email message RE: "[NTSEC] ntsecurity-digest V2 #647" addressed to Steven 
Wallstedt has been successfully delivered. Steven Wallstedt is currently out of 
the office.

Message: Please contact Dinesh Awatramani at 5-0418 for assistance in my 
absence.


[008] Failure delivering user mail due to mailbag contention.
Mail item was not delivered to:


------------------------------------------------------------------------
------
Microsoft Mail v3.0 (MAPI 1.0 Transport) IPM.Microsoft Mail.Note
From: ntsecurity-digest
To: ntsecurity-digest@iss.net
 owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Date: 1997-08-29 02:00
Priority: 3
Message ID: 279E06608F20D11193B1080009ED75C8

Why am I receiving a blank e-mail????

Alvin Siagian                           Loma Linda University Medical Center
asiagian@ahs.llumc.edu      11175 Mt. View Ste. D
909.478.3265                          Loma Linda, CA 92354

-----Original Message-----
From:   ntsecurity-digest [SMTP:ntsecurity@iss.net]
Sent:   Thursday, August 28, 1997 11:00 PM
To:     ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
Subject:        [NTSEC] ntsecurity-digest V2 #647

Why am I receiving a blank e-mail????

Alvin Siagian                           Loma Linda University Medical Center
asiagian@ahs.llumc.edu      11175 Mt. View Ste. D
909.478.3265                          Loma Linda, CA 92354

-----Original Message-----
From:   ntsecurity-digest [SMTP:ntsecurity@iss.net]
Sent:   Thursday, August 28, 1997 11:00 PM
To:     ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
Subject:        [NTSEC] ntsecurity-digest V2 #647

> ----------
> From: ntsecurity-digest[SMTP:ntsecurity@iss.net]
> Sent: Friday, August 29, 1997 1:00 AM
> To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> Subject: [NTSEC] ntsecurity-digest V2 #647
> 
> 


> ----------
> From: ntsecurity-digest[SMTP:ntsecurity@iss.net]
> Sent: Friday, August 29, 1997 1:00 AM
> To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> Subject: [NTSEC] ntsecurity-digest V2 #647
> 
> 


> ----------
> From: ntsecurity-digest[SMTP:ntsecurity@iss.net]
> Sent: Friday, August 29, 1997 1:00 AM
> To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> Subject: [NTSEC] ntsecurity-digest V2 #647
> 
> 


> ----------
> From: ntsecurity-digest[SMTP:ntsecurity@iss.net]
> Sent: Friday, August 29, 1997 1:00 AM
> To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> Subject: [NTSEC] ntsecurity-digest V2 #647
> 
> 


> ----------
> From: ntsecurity-digest[SMTP:ntsecurity@iss.net]
> Sent: Friday, August 29, 1997 1:00 AM
> To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> Subject: [NTSEC] ntsecurity-digest V2 #647
> 
> 


> ----------
> From: ntsecurity-digest[SMTP:ntsecurity@iss.net]
> Sent: Friday, August 29, 1997 1:00 AM
> To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> Subject: [NTSEC] ntsecurity-digest V2 #647
> 
> 


> ----------
> From: Dick Dasterdly[SMTP:morrison@ladyred.rsoc.rockwell.com]
> Reply To: Dick Dasterdly
> Sent: Friday, August 29, 1997 4:22 AM
> To: nt
> Subject: [NTSEC] Thank you
> 
> Problem: Adobe Acrobat 3.0. If I configure it to NOT use ActiveX 
> controls and content within IE, then Acrobat will not
> display
> the PDF files which all employees are required to read. If
> we 
> do away with IE, and go to Netscape, we've just cost the 
> corporation several million dollars. This is not an easy
> sell. 
> However, I am finding that once controls are enabled for an 
> application, that content CAN be executed (which is created
> by 
> a third party) which can do tremendous damage. This
> introduces 
> a new element in the equation that hasn't been discussed 
> anywhere before (to my knowledge - i.e., the it's not the
> viewers
> fault, it's whoever made the "document").
> 
> In my day-job environment, PDF files are a requirement. Now that
> Adobe
> has switched to the use of ActiveX, the corporation I work with, and
> a major government organization has been hit with a dilema. If we
> enable ActiveX control for this application, then content (from
> anywhere) will execute "within" the application that we've allowed 
> ActiveX controls in. 
> 
Are you saying that Acrobat has only two settings -- trust any signed
control (regardless of who signed it) and don't trust any signed
controls?
> 
Paul
 This list needs some serious maintenance. I been back on it for two
days and have posted once. In that time frame I have received about 15
empty messages or with garbage, and about another 10 to 15 bounces from
dead accounts. May I also notice that this bounces are from account that
where bouncing 3 months ago. David you are from ISS and obviously post to
the list a lot. You must be getting the same messages. Cant you forward
them to the list maintainer to have them handled? This is silly.

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

Your message has encountered delivery problems
to local user mcdonnell.
(Originally addressed to mcdonnell@sewkis.com)

User not known

Your message reads (in part):

Received: from iss.net (208.21.0.5) by proxy1.sewkis.com
 (Rockliffe SMTPRA 1.2.2) with SMTP id ;
 Fri, 29 Aug 1997 19:35:14 -0400
Received: (qmail 26553 invoked by alias); 29 Aug 1997 20:38:03 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 26546 invoked by alias); 29 Aug 1997 20:38:03 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 26536 invoked by uid 15); 29 Aug 1997 20:38:02 -0000
Received: (qmail 26516 invoked from network); 29 Aug 1997 20:38:00 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 20:38:00 -0000
Received: from jpmorgan.com (firewall-user@[169.71.1.10]) by arden.iss.net (8.8.7/8.7.3) with ESMTP id QAA09980 for ; Fri, 29 Aug 1997 16:39:33 -0400
Received: (from root@localhost)
 by jpmorgan.com (8.8.5/8.8.5) id QAA07587
 for ; Fri, 29 Aug 1997 16:39:29 -0400 (EDT)
Received: from mrzip.ny.jpmorgan.com(146.149.1.2) by threshold.jpmorgan.com via smap (3.2)
 id xma007579; Fri, 29 Aug 97 16:39:01 -0400
Received: from NYC-NTGW-N02.ny.jpmorgan.com (nyc_ntgw_n02.ny.jpmorgan.com [198.75.84.103]) by mrzip.ny.jpmorgan.com (8.8.4/8.7.6) with SMTP id QAA01619 for <@mrzip.ny.jpmorgan.com:ntsecurity@iss.net>; Fri, 29 Aug 1997 16:39:01 -0400 (EDT)
Received: by NYC-NTGW-N02.ny.jpmorgan.com (IBM OS/2 SENDMAIL VERSION 1.3.17/1.0)
 id AA8324; Fri, 29 Aug 97 16:38:59 -0700
Message-Id: <9708292338.AA8324@NYC-NTGW-N02.ny.jpmorgan.com>
Received: by JPMORGAN (Lotus Notes Mail Gateway for SMTP V1.1) id
 A67DB5D55BC8C6CB8525650200712390; Fri, 29 Aug 97 16:38:59 EDT
To: ntsecurity-digest 
From: Out of Office Agent 
Date: 29 Aug 97 16:35:46 EDT
Subject: [NTSEC] Out of Office Notification
Mime-Version: 1.0
Content-Type: Text/Plain
Original-sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Out of Office Agent 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
Sender: mmcdonnell@sewkis.com
Resent-Message-Id: 

Your email message RE: "[NTSEC] ntsecurity-digest V2 #647" addressed to Steven 
Wallstedt has been successfully delivered. Steven Wallstedt is currently out of 
the office.

Message: Please contact Dinesh Awatramani at 5-0418 for assistance in my 
absence.


> Why am I receiving a blank e-mail????

 Sigh... Some stupid twit decided to start sending these things
into the list. I've had to place their entire domain on our hostile
site list. I haven't figured out if this was merely the pinacle of
stupidy or if this was an openly hostile attack on the list. The
system sending these messages does not even acknowledge a "postmaster"
address. They have been terminated.

> Alvin Siagian Loma Linda University Medical
> Center
> asiagian@ahs.llumc.edu 11175 Mt. View Ste. D
> 909.478.3265 Loma Linda, CA 92354
> 
> > -----Original Message-----
> > From: ntsecurity-digest [SMTP:ntsecurity@iss.net]
> > Sent: Thursday, August 28, 1997 11:00 PM
> > To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> > Subject: [NTSEC] ntsecurity-digest V2 #647
> > 
> > 

[text/html is unsupported, treating like TEXT/PLAIN]

> 
>
>
> 
> 
> 
>
>
>
Why am I receiving a blank e-mail????
>
>
Alvin Siagian                           Loma Linda University Medical Center
>
asiagian@ahs.llumc.edu      11175 Mt. View Ste. D
>
909.478.3265                          Loma Linda, CA 92354
>
>

-----Original Message-----
>
From:   ntsecurity-digest [SMTP:ntsecurity@iss.net]
>
Sent:   Thursday, August 28, 1997 11:00 PM
>
To:     ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
>
Subject:        [NTSEC] ntsecurity-digest V2 #647
>
>
>
>
>
>
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
> Why am I receiving a blank e-mail????

 Sigh... Some stupid twit decided to start sending these things
into the list. I've had to place their entire domain on our hostile
site list. I haven't figured out if this was merely the pinacle of
stupidy or if this was an openly hostile attack on the list. The
system sending these messages does not even acknowledge a "postmaster"
address. They have been terminated.

> Alvin Siagian Loma Linda University Medical
> Center
> asiagian@ahs.llumc.edu 11175 Mt. View Ste. D
> 909.478.3265 Loma Linda, CA 92354
> 
> > -----Original Message-----
> > From: ntsecurity-digest [SMTP:ntsecurity@iss.net]
> > Sent: Thursday, August 28, 1997 11:00 PM
> > To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> > Subject: [NTSEC] ntsecurity-digest V2 #647
> > 
> > 

[text/html is unsupported, treating like TEXT/PLAIN]

> 
>
>
> 
> 
> 
>
>
>
Why am I receiving a blank e-mail????
>
>
Alvin Siagian                           Loma Linda University Medical Center
>
asiagian@ahs.llumc.edu      11175 Mt. View Ste. D
>
909.478.3265                          Loma Linda, CA 92354
>
>

-----Original Message-----
>
From:   ntsecurity-digest [SMTP:ntsecurity@iss.net]
>
Sent:   Thursday, August 28, 1997 11:00 PM
>
To:     ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
>
Subject:        [NTSEC] ntsecurity-digest V2 #647
>
>
>
>
>
>
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
Hi. This is the qmail-send program at iss.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

:
This message is looping: it already has my Delivered-To line. (#5.4.6)

--- Below this line is a copy of the message.

Return-Path: 
Received: (qmail 14773 invoked from network); 30 Aug 1997 05:59:36 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 30 Aug 1997 05:59:36 -0000
Received: from mail.eunet.ch (mail.eunet.ch [146.228.10.7]) by arden.iss.net (8.8.7/8.7.3) with ESMTP id CAA27308 for ; Sat, 30 Aug 1997 02:01:12 -0400
Received: from chzimex5 (zimex.dial.eunet.ch [193.72.1.209]) by mail.eunet.ch (8.8.6/1.34) via SMTP id GAA28932
 for ; Sat, 30 Aug 1997 06:00:57 GMT
 env-from (ntsecurity@iss.net)
Received: from [127.0.0.1] by chzimex5 (NTMail 3.02.13) with ESMTP id wa001556 for ; Fri, 29 Aug 1997 23:30:22 +0200
Received: from iss.net (qmailr@phoenix.iss.net [208.21.0.5]) by mail.eunet.ch (8.8.6/1.34) via SMTP id UAA09136
 for ; Fri, 29 Aug 1997 20:17:22 GMT
 env-from (owner-ntsecurity@iss.net)
Received: (qmail 17850 invoked by alias); 29 Aug 1997 19:43:17 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 17810 invoked by alias); 29 Aug 1997 19:43:15 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 17774 invoked by uid 15); 29 Aug 1997 19:43:13 -0000
Received: (qmail 17720 invoked by alias); 29 Aug 1997 19:43:09 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 17706 invoked from network); 29 Aug 1997 19:43:08 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 19:43:08 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id PAA06456; Fri, 29 Aug 1997 15:44:41 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 12:45:18 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Thu, 28 Aug 1997 23:00:04 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #647
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net


Hi. This is the qmail-send program at iss.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

:
128.164.127.252 does not like recipient.
Remote host said: 550 ... User unknown
Giving up.

:
193.61.128.17 does not like recipient.
Remote host said: 553 ... No Such Address
Giving up.

:
194.115.213.2 does not like recipient.
Remote host said: 550 ... User unknown
Giving up.

:
194.211.15.28 does not like recipient.
Remote host said: 550 ... User unknown
Giving up.

:
Sorry, I couldn't find any host named connectNET.net.au. (#5.1.2)

:
Sorry, I couldn't find any host named popnet.dtu.dk. (#5.1.2)

:
148.59.1.20 does not like recipient.
Remote host said: 550 ... User unknown
Giving up.

:
199.182.120.67 does not like recipient.
Remote host said: 550 ... User unknown
Giving up.

:
207.82.250.83 does not like recipient.
Remote host said: 550 Unknown user 
Giving up.

:
Sorry, I couldn't find any host named Internet.UbiSoft.Fr. (#5.1.2)

:
205.150.56.3 does not like recipient.
Remote host said: 550 ... User unknown
Giving up.

:
200.239.126.34 does not like recipient.
Remote host said: 550 Unknown User.
Giving up.

:
199.182.120.65 does not like recipient.
Remote host said: 550 ... User unknown
Giving up.

--- Below this line is a copy of the message.

Return-Path: 
Received: (qmail 15098 invoked by alias); 30 Aug 1997 06:08:21 -0000
Delivered-To: owner-ntsecurity-digest@phoenix.iss.net
Received: (qmail 14746 invoked from network); 30 Aug 1997 05:59:28 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 30 Aug 1997 05:59:28 -0000
Received: from mail.eunet.ch (mail.eunet.ch [146.228.10.7]) by arden.iss.net (8.8.7/8.7.3) with ESMTP id CAA27266 for ; Sat, 30 Aug 1997 02:01:05 -0400
Received: from chzimex5 (zimex.dial.eunet.ch [193.72.1.209]) by mail.eunet.ch (8.8.6/1.34) via SMTP id GAA28930
 for ; Sat, 30 Aug 1997 06:00:58 GMT
 env-from (ntsecurity@iss.net)
Received: from [127.0.0.1] by chzimex5 (NTMail 3.02.13) with ESMTP id va001581 for ; Sat, 30 Aug 1997 08:00:25 +0200
Received: from iss.net (qmailr@phoenix.iss.net [208.21.0.5]) by mail.eunet.ch (8.8.6/1.34) via SMTP id WAA16041
 for ; Fri, 29 Aug 1997 22:34:51 GMT
 env-from (owner-ntsecurity@iss.net)
Received: (qmail 7780 invoked by alias); 29 Aug 1997 20:13:02 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 7773 invoked by alias); 29 Aug 1997 20:13:02 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 7746 invoked by uid 15); 29 Aug 1997 20:13:00 -0000
Received: (qmail 7652 invoked by alias); 29 Aug 1997 20:12:55 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 7638 invoked from network); 29 Aug 1997 20:12:55 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 20:12:55 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id QAA08433; Fri, 29 Aug 1997 16:14:27 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 13:14:56 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Tue, 26 Aug 1997 23:00:02 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #644
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net


Hi. This is the qmail-send program at iss.net.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.

:
This message is looping: it already has my Delivered-To line. (#5.4.6)

--- Below this line is a copy of the message.

Return-Path: 
Received: (qmail 14757 invoked from network); 30 Aug 1997 05:59:31 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 30 Aug 1997 05:59:31 -0000
Received: from mail.eunet.ch (mail.eunet.ch [146.228.10.7]) by arden.iss.net (8.8.7/8.7.3) with ESMTP id CAA27269 for ; Sat, 30 Aug 1997 02:01:06 -0400
Received: from chzimex5 (zimex.dial.eunet.ch [193.72.1.209]) by mail.eunet.ch (8.8.6/1.34) via SMTP id GAA28929
 for ; Sat, 30 Aug 1997 06:00:58 GMT
 env-from (ntsecurity@iss.net)
Received: from [127.0.0.1] by chzimex5 (NTMail 3.02.13) with ESMTP id qa001576 for ; Sat, 30 Aug 1997 08:00:24 +0200
Received: from iss.net (qmailr@phoenix.iss.net [208.21.0.5]) by mail.eunet.ch (8.8.6/1.34) via SMTP id WAA15405
 for ; Fri, 29 Aug 1997 22:20:11 GMT
 env-from (owner-ntsecurity@iss.net)
Received: (qmail 7123 invoked by alias); 29 Aug 1997 20:12:16 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 7117 invoked by alias); 29 Aug 1997 20:12:16 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 7099 invoked by uid 15); 29 Aug 1997 20:12:15 -0000
Received: (qmail 7010 invoked by alias); 29 Aug 1997 20:12:11 -0000
Delivered-To: ntsecurity-digest@phoenix.iss.net
Received: (qmail 6999 invoked from network); 29 Aug 1997 20:12:10 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 29 Aug 1997 20:12:10 -0000
Received: from microserve.ca (rotinni.microserve.ca [207.194.43.46]) by arden.iss.net (8.8.7/8.7.3) with SMTP id QAA08379; Fri, 29 Aug 1997 16:13:43 -0400
Received: from Microserve-Message_Server by microserve.ca
 with Novell_GroupWise; Fri, 29 Aug 1997 13:14:23 -0700
Message-Id: 
X-Mailer: Novell GroupWise 4.1
Date: Tue, 26 Aug 1997 23:00:02 -0700
From: ntsecurity-digest 
To: ntsecurity-digest@iss.net, owner-ntsecurity-digest@iss.net
Subject: [NTSEC] ntsecurity-digest V2 #644
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: ntsecurity-digest 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net


Basically what is happening is that the profile can not be stored back on 
the server when you logoff. Rather than destroying your changes to the 
profile it caches it locally and then offers you the chance to update next 
time you logon.
This obviously creates problems for backup centrally etc, but MS ..........

You can add a key to registry that will delete all cached user profiles on 
a machine or use delproff.exe as a batch job overnight. You will of course 
loose modifications either way and if you have mapped your home directories 
to \profiles\user\personal they will loose all work saved !!!

It sounds like you have network problems by not being able to connect to 
the server frequently. Perhaps looking at these might be prudent.

On Friday, August 29, 1997 1:24 AM, Victor Vega 
[SMTP:victor@gene.cinvestav.mx] wrote:
> Hola,
>
> I'm receiving the same message and I am confused about the answer, do You
> know the reason for that message?
>
> Thanks.
>
> ---------------------------------------------------------------------- 
--------
> Victor M Vega-Villa Fax:(525)747-7100
> Depto. de Genetica y Biologia Molecular Tel:(525)747-7000
> CINVESTAV-IPN, AP 14-740, ext. 5355 & 5370
> Mexico, DF 07000, MEXICO
> victor@gene.cinvestav.mx
> 
------------------------------------------------------------------------ 
------
>
> On Thu, 28 Aug 1997, Jason Jarvis wrote:
>
> > Forgive me if this isn't where this should be posted.
> >
> > Is there a registry setting that can be modified so that NT4.0 doesn't
> > ask you the following:
> >
> > You locally stored profile is newer than your roaming profile. 
Would
> > you like to use you local profile.
> >
> > Now I know the reasons behind the message but I dont want any user
> > replying yes.
> >
> > I'd ideally like to modify something so that it ALWAYS uses the roaming
> > profile for users.
> >
> > TIA
> >
> > Jas.
> > 
.jam,

The scenario you're describing is identical to the one that befell
PowerPoint recently. Namely its ability to execute an application from
within a presentation became an issue when a PowerPoint viewer was used
in IE.

IMO, the problem is in the Viewer, not the data. The Viewer should be
able to support the exclusion of functionality which you deem risky in
its configuration.

Of course there's another problem, which is that you stated that your
company trusts the application, the viewer. If the viewer is incapable
of giving you the necessary control to enable acceptable risk, then how
can you say your company "trusts" it? Clearly your basis for trust is
false??

Your company's desire to switch to PDF and IE, for whatever reasons,
have given rise to an unacceptable (to you) level of risk. If you're
unable to articulate that to your management, then either you or they
misunderstand the risk analysis. Remember, its your responsibility as a
security consultant to inform your customer of the risks they may be
facing, and any methods to eliminate, reduce, or manage those risks..
Its then their responsibility to determine whether or not those methods
are acceptable and choose from amongst your recommendations which they
wish to employ/accept.

Does your office have a nuclear fallout shelter? If not, then either the
risk of a nuclear meltdown is small enough not to warrant one, or the
cost of building one outweighs its potential value based on the
potential risk. If the cost of your proposed "meltdown" in terms of cost
to recover is less than the cost of not using PDFs in IE, or Adobe
re-engineering Acrobat to provide you a mechanism to reduce the risk,
then you haven't met the requirements of a honoring a threat/risk
analysis. That doesn't mean its any less risky, or that you shouldn't
still approach Adobe, MS or your company about making changes. It just
means that the risk will have to be borne in the meantime.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security

Paul Ashton and
Luke Leighton present the NT domain
authentication protocol. Comments and corrections are welcome.

Definitions
-----------

Add(A1,A2): Intel byte ordered addition of corresponding 4 byte
 words in arrays A1 and A2

E(K,D): DES ECB encryption of 8 byte data D using 7 byte key K

lmowf(): Lan man hash

ntowf(): NT hash

PW: md4(machine_password) == md4(lsadump $machine.acc)
 == pwdump(machine$)
 (initially) == md4(lmowf(unicode(machine)))

RC4(K,Lk,D,Ld): RC4 encryption of data D of length Ld with key K
 of length Lk

v[m..n(,l)]: subset of v from bytes m to n, optionally padded 
 with zeroes to length l

Cred(K,D): E(K[7..7,7],E(K[0..6],D)) computes a credential

Time(): 4 byte current time

Cc,Cs: 8 byte client and server challenges
Rc,Rs: 8 byte client and server credentials

Protocol
--------

C->S ReqChal,Cc
S->C Cs

C & S compute session key Ks = E(PW[9..15],E(PW[0..6],Add(Cc,Cs)))

C: Rc = Cred(Ks,Cc)
C->S Authenticate,Rc
S: Rs = Cred(Ks,Cs), assert(Rc == Cred(Ks,Cc))
S->C Rs
C: assert(Rs == Cred(Ks,Cs))

On joining the domain the client will optionally attempt to change
its password and the domain controller may refuse to update it
depending on registry settings. This will also occur weekly
afterwards.

C: Tc = Time(), Rc' = Cred(Ks,Rc+Tc)
C->S ServerPasswordSet,Rc',Tc,
 rc4(Ks[0..7,16],lmowf(randompassword())
C: Rc = Cred(Ks,Rc+Tc+1)
S: assert(Rc' == Cred(Ks,Rc+Tc)), Ts = Time()
S: Rs' = Cred(Ks,Rs+Tc+1)
S->C Rs',Ts
C: assert(Rs' == Cred(Ks,Rs+Tc+1))
S: Rs = Rs'

User: U with password P wishes to login to the domain (incidental
data such as workstation and domain omitted)

C: Tc = Time(), Rc' = Cred(Ks,Rc+Tc)
C->S NetLogonSamLogon,Rc',Tc,U,
 rc4(Ks[0..7,16],16,ntowf(P),16),
 rc4(Ks[0..7,16],16,lmowf(P),16)
S: assert(Rc' == Cred(Ks,Rc+Tc)) assert(passwords match those
 in SAM)
S: Ts = Time()

S->C Cred(Ks,Cred(Ks,Rc+Tc+1)),userinfo(logon script,UID,SIDs,etc)
C: assert(Rs == Cred(Ks,Cred(Rc+Tc+1))
C: Rc = Cred(Ks,Rc+Tc+1)

Comments
--------

On first joining the domain the session key could be computed by
anyone listening in on the network as the machine password has
a well known value. Until the machine is rebooted it will use
this session key to encrypt NT and LM one way functions of
passwords which are password equivalents. Any user who logs
in before the machine has been rebooted a second time will have
their password equivalent exposed. Of course the new machine
password is exposed at this time anyway.

None of the returned user info such as logon script, profile path
and SIDs *appear* to be protected by anything other than the TCP
checksum.

The server time stamps appear to be ignored.

The client sends a ReturnAuthenticator in the SamLogon request
which I can't find a use for. However its time is used as the
timestamp returned by the server.

The password OWFs should NOT be sent over the network reversibly
encrypted. They should be sent using RC4(Ks,md4(owf)) with the
server computing the same function using the owf values in the
SAM.
To manually set a domain controller's role to either PDC or BDC you can
edit the following registry key value:

HKLM\SECURITY\POLICY\PolSrvRo: 03000000 sets the DC to PDC, 02000000 to
a BDC

> -----Original Message-----
> From: Robert Ward [SMTP:robertw@IP.COM.AU]
> Sent: Thursday, August 28, 1997 11:46 PM
> To: NTBUGTRAQ@NTADVICE.COM
> Subject: NT Server to NT Workstation - Huh?
> 
> > Hi All,
> >
> > Just had a doozy happen.
> >
> > My NT Primary Domain Controller, running Exhange, Proxy and Web
> Server
> > was playing up. Couldnt work out what was going on.
> >
> > Going into Server Manager, it told me that I was now a backup
> > controller, no longer a primary domain controller.
> >
> > Hmmm
> >
> > NT's Server Manager does allow you to promote (to a domain
> > controller), so I tried that with no luck
> >
> > I watched the process it went throught, disabling net logon, etc, so
> I
> > tried ton replicate that manually
> >
> > Result. Bugger me with a fishfork, it converted it from a backup to
> a
> > workstation.
> >
> > I'm really confused.
> >
> > It's as if I've been attacked by some wicked virus or somebody's
> > hacked into my box.
> >
> > Anyone aver heard of this?
> > What's the solution?
> I've heard that there is a registry hack to change the role of a
> server
> to PDC, what is it?
> What can I do to get back my domain admin priviledges?
> 
> > HELP!!!!
> >
> > Thanks
> >
> >
> > Rob
> >
On Fri, 29 Aug 1997, Paul Leach wrote:
> Are you saying that Acrobat has only two settings -- trust any signed
> control (regardless of who signed it) and don't trust any signed
> controls?
> > 
> Paul

 No. I'm saying that in the default installation of adobe, that it 
 writes it's controls into the registry. Once there, the application
 is trusted. Documents that the application processes can contain 
 embedded commands that operate on the local system. If the settings
 in IE are "Allow ActiveX Controls and ActiveX Content", then what
 happens is that a document may provide a warning to a user that a
 potentially harmfull operation may occur if they press on a URL
 tag or such.

 Since the users (serveral tens of thousands of them) trust documents
 created by the company or government concern, it's an automatic "click"
 each time the warning comes up. After ten warnings, it's an annoyance
 to the user and not even read or noticed.

 The problem now, is when they use their browser to go to another site,
 and read a document that is in pdf format. They've been desensitized
 and continue to automatically click the "are you sure" button. 

 If we reinstall adobe, in the manner suggested to us by adobe, then 
 controls (from IE) can be disabled along with content, and the 
 documents can now be displayed. 
 
 If (in the default build of acrobat), you DISABLE ActiveX controls
 and content, then Acrobat will not display the document (actually, it
 won't even be invoked from IE).

 Talking to Adobe, they faxed me a 21 step process that removes Acrobat
 and reinstalls in as a "helper" instead of a plugin - this does allow
 us to deactivate the ActiveX Controls and ActiveX Content within IE
 and still be able to view the documents. However, to make it work
 requires the user to find all instances of two types of files 
 through-out his/her drive space, and individually unregister them - 
 I had 12. Not a task we'd like to give to every user. Mistakes will 
 cause many more hours in trouble-shooting time to repair then sending 
 teams around to manually do this (while other fires continues to rage). 
 (Our security policy is no ActiveX).

 This is a labor intensive task that must be accomplished on each 
 individual system throughout the government concern complexes 
 and throughtout the corporations that support them. This is a guess,
 but it's probably around 30-40 thousand systems in just one location.

 Any way we look at it, it's a huge expense in either man-power or
 replacement costs. The real worry, is that this is the first 
 application we've looked at. If every application which uses
 ActiveX controls and content puts us into the position of trying to
 find a work-around then the cost of using these products versus
 their benefits is much higher then had been anticipated.

 Please keep in mind, this is a single case. When we introduce Office
 97 into the environment, the labor costs increase dramatically, due to
 the amount of virus incidents (macro) that may plague us, causing many
 departments at once to be hit and infected. Even while spending 
 enormous amounts of money to "protect us" against this.

 As we are beginning to see it, the landscape looks like this:

 - Product is pretty, complex, huge and at times extremely clumsy. 

 - However, it's the prettiest product available and does some 
 really nice things, and of course, the users love it.

 - Network downtime has not decreased. (If we get hit by BSOD DoS
 attacks, how can we tell? Same symtoms. Is this "Normal" 
 operations? Experience says yes. If an attack occurs, is it 
 reported? No. Users are desensitized into rebooting, as a
 normal mode of operation.) 

 - Product is aimed at having users demand the product. (Sort of "the
 tail wags the dog" approach). Very good marketing.

 - Costs associated with use and maintenance of the product outcosts
 the product itself, and is the true "hidden cost" of the product.
 (i.e., I may spend 20% of the corporations budget in the purchase of
 the base product, but to support it may consume 70% of the rest of
 the budget).

 - Has the office place become more efficient? Not that I'm aware.
 Users now spent 50% or more time then before "prettifing" documents
 that contain the same information, now matter how it's displayed or
 printed.

 - Have the systems become more secure? Well, leaving the security
 of the desktop (a much more expensive approach to the "end-user"
 organization then centralizing the security) in the hands of the
 user who does not have the time or inclination to spend most of
 their waking hours reading these lists, applying patches, hotfixes
 buying new updates, etc., has forced the security personnel in
 many organizations to present a choice to management. It's now
 not a question of grey areas. It's black and white. The cost
 of a corporate-wide catastrophe is greater then the benifit
 associated with the products use.

 - To all appearances, the vendors are taking a gamble that the end
 response, in the short-term, will be "So?, don't worry about it."
 The dice seems to have proven them right for the moment. As 
 security professionals, most of us may be at odds with that 
 approach, as it undermines any safety and securiy that we can 
 either supply, or encourage. 

 - Is there any chance that the "security policy" position, as it's
 currently implemented, can be either "redesigned to provide 
 actual security," or third-party products be invented to replace
 the current "security policy?" ISS is one product that has
 addressed this, but it's a reactive measure. Please consider that
 in the security business, proactive measures are always better
 solutions then reactive. (Using ISS products IS a proactive
 measure, however, the products that ISS tests need to be created
 with the "proactive" mind set enabled. Think of macro-virues in
 this instance. Instead of removing the capablity to do damage to
 the end user, within the programs that execute the macros, some 
 decision had been made that said "Lets not worry about it, we can 
 grow a new industry that will handle it. Removing the capability
 within the program of course, would have eliminated that industry").

 - Is there any possiblity that vendors will consider "not" placing
 security personnel into the position of a "use it and lose it"
 go-nogo recommendation on it's continued use?

 My apologies to the list. This strayed a bit. At this moment, this
 thread has enormous security content to me. It is affecting me and
 decisions I either make or recommend on a grand scale. This was not 
 intended to be a rant, rather, as an assist in the deduction of where 
 and what security is costing us, and whether security personnel even
 have a choice in the matter.

 To ISS, thank you for allowing me to discuss this. I realize that 
 it's technical content is less then what it should be for a list
 membership of this caliber. I am hoping that (since we discuss
 solutions and problems), some form of solution for the long _and_
 near term will fall out from this.

 For Microsoft, thank you for listening. It's my hope that the good
 sense you've shown in your products, and the programing creativity
 that your employees have shown in the past and present will begin
 to reflect itself in new and better ways for us to protect our 
 personal and corporate assets in the near and far future.

.with much respect
.jam

[ These are my own opinions. And within any forum, of this nature,
 they do not necessarily reflect on those that employ me, or seek
 my advise. As such, I am respondsible for them. Sad as that may be. ]
Please, post enclosed information in your mailing list.

Sincerely.
Nataly Shamsutdinova
Nataly.Shamsutdinova@csci.ca

Certified Web Site Program Comes to Canada

Ottawa-based CSCI Computer Security Canada Inc.has established
an exclusive partnership agreement with the National Computer 
Security Association to make the NCSA Web Certification Program 
available in Canada. This unique program reassures owners of 
external and internal Web sites, developers and users that security 
measures on their sites meet the independent and stringent standards 
of NCSA. NCSA's seal of approval would enable customers to trust 
the network communications channel whether providing their personal 
data to a government organization, to the corporate human resources 
database or making a purchase on Internet. 

CSCI will also make available the NCSA IS/Recon service which 
actively monitors the activities of Internet "hackers" over the world, 
informs subscribers of potential threats to their site security, and 
provides ways to correct their vulnerabilities. 

CSCI's principal objective is to become a security leader in Canada,
assisting Canadian public and private sector organizations in
protecting their positive corporate image, intellectual assets, privacy
of personal data entrusted to them by their clients and employees,
and investments in the electronic commerce solutions. 

For further information, please contact:
CSCI Computer Security Canada Inc.
Email: mailto:communications@csci.ca
URL: http://www.csci.ca/
Fax: (613)733-5691
Phone: (613)733-4135


On Sat, 30 Aug 1997, Russ wrote:

> .jam,
> 
> The scenario you're describing is identical to the one that befell
> PowerPoint recently. Namely its ability to execute an application from
> within a presentation became an issue when a PowerPoint viewer was used
> in IE.

 Well. Sort of. We are attempting to enforce a "no-ActiveX" policy.
 The problem is that, due to the design of the internal OS security 
 mechanisms, the users themselves have been given the responsibility 
 at the desktop to provide the enforcement. This is an unacceptable
 condition.

> IMO, the problem is in the Viewer, not the data. The Viewer should be
> able to support the exclusion of functionality which you deem risky in
> its configuration.

 The "exclusion of functionality" is a warning dialog to the user. This
 gives the user a choice. The user (in our humble opinions) is not
 conversant in what may be occuring "under the hood". At any rate, 
 even with millions of dollars spent in "educating them", turning all
 of the users into security professionals that know the code basis
 of ActiveX, or for that matter JAVA (please, no comparison here)
 is not our intent. It's not their area. They'd like to keep it that
 way.

> Of course there's another problem, which is that you stated that your
> company trusts the application, the viewer. If the viewer is incapable
> of giving you the necessary control to enable acceptable risk, then how
> can you say your company "trusts" it? Clearly your basis for trust is
> false??

 I may trust the application. I may trust the company that wrote it. 
 This does not say I trust any data that is "processed" by the 
 application. This is a different problem, and somewhat more complex.

 If I install a product which is signed (accepting the signature as
 valid) and use the product with data I create, then I have a 
 resonable expectation of "acceptable use." If this product must be
 used to process both data I create and trust, AND foreign data that 
 I don't trust, I now have a delima. (See earlier post to Paul for
 the description of that problem - it's a matter of scale).

 So I trust the product. If data has been produced that operates 
 outside the bounds of the vendors intentions, does liability fall
 to the vendor, or to the originator of the data which had been 
 processed? When the round of finger pointing stops, at whom does
 it point at? The vendor of the product that processes the data? The
 vendor of the product that makes or enables other products to operate
 outside the intentions of another vendors constraints? The end-user? 
 The author of the data being processed? Placing decisions that affect
 the outcome of these liability issues in the hands of every desktop 
 user doesn't seem like a problem or security risk? (Sorry Russ, I
 probably was not very clear in describing the problem).

 ...[snip of a good analisys f my day-job]...

 .jam
quit ntsecurity

Does anyone know of a ntuser.dat editor that I can use to ideally cut and paste entries from one users .dat file to another ?

TIA

Jas.
 Why are people sending nasty htmlized mail? Lusers who sned
htmlized e-mail need to be shot.


Siagian, Alvin S. boldly claimed:
> Why am I receiving a blank e-mail????
> 
> Alvin Siagian Loma Linda University Medical
> Center
> asiagian@ahs.llumc.edu 11175 Mt. View Ste. D
> 909.478.3265 Loma Linda, CA 92354
> 
> > -----Original Message-----
> > From: ntsecurity-digest [SMTP:ntsecurity@iss.net]
> > Sent: Thursday, August 28, 1997 11:00 PM
> > To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> > Subject: [NTSEC] ntsecurity-digest V2 #647
> > 
> > 

[text/html is unsupported, treating like TEXT/PLAIN]

> 
>
>
Why are people sending nasty htmlized mail? Lusers who sned
htmlized e-mail need to be shot.


Siagian, Alvin S. boldly claimed:
> Why am I receiving a blank e-mail????
> 
> Alvin Siagian Loma Linda University Medical
> Center
> asiagian@ahs.llumc.edu 11175 Mt. View Ste. D
> 909.478.3265 Loma Linda, CA 92354
> 
> > -----Original Message-----
> > From: ntsecurity-digest [SMTP:ntsecurity@iss.net]
> > Sent: Thursday, August 28, 1997 11:00 PM
> > To: ntsecurity-digest@iss.net; owner-ntsecurity-digest@iss.net
> > Subject: [NTSEC] ntsecurity-digest V2 #647
> > 
> > 

[text/html is unsupported, treating like TEXT/PLAIN]

> 
>
>
>...If you have NT, you can allow a little of it - you can
install just the ActiveX controls you deem acceptable, and set the
directory these are installed into to leave off the X bit - that will cause
newly downloaded controls not to execute without manual intervention.

Frankly, I've not seen any convincing reason why we ought to put up with them AT 
ALL. The **information** content, the stuff I want to get from the Web, doesn't 
require ANY of this crap. I don't need (or want) stupid animated GIFs, or 
JavaScript, or ActiveX bullshit, or any of this other nonsense. My personal 
situation is that I'm just SAYING "NO!" to all this crap. I'm using Spry Mosaic 
as my preferred browser... (yes, I've tried the other ones, of course...). Spry 
Mosaic is smaller, faster, has much better bookmark organization capabilities, 
and largely frees me from all these bullshit backgrounds, stupid font and 
typesize choices, animated GIF crap, Java nonsense, tables and frames, having to 
download ActiveX controls, annoying cookies, image map menus, addins, and all 
this other obnoxious stupidity.

JUST SAY NO! It's not as if there aren't plenty of other sites on the Web that 
we all can spend our time visiting instead. JUST DON'T GO to the sites whose 
Webmasters are more concerned with showcasing their supposed "skills" than they 
are with getting interesting CONTENT out to the greatest possible number of 
people!

>I'd note that we have the same problem with people going out and
downloading screen savers, various shareware/freeware apps, etc.

Sure, but on my own systems I only download and install the ones *I* want, and 
get them from sources that *I* deem appropriate.

There's more stuff on the Web than any of us could ever read in more lifetime 
than we have... and it's growing faster still. We do NOT have to put up with 
this crap. JUST SAY NO!

Gordon Peterson
http://www.computek.net/public/gep2/
Support the Anti-SPAM Amendment! Join at http://www.cauce.org/

On Sat, 30 Aug 1997 gep2@computek.net wrote:

> JUST SAY NO! It's not as if there aren't plenty of other sites on the
> Web that we all can spend our time visiting instead. JUST DON'T GO to
> the sites whose Webmasters are more concerned with showcasing their
> supposed "skills" than they are with getting interesting CONTENT out to
> the greatest possible number of people! 

 I totally agree. From a security standpoint, it's always good to reduce
things back to basics in a situation if at all possible, so you don't get
into "not seeing the forest for the trees" type situations. Technologies
like ActiveX etc may have the potential to do really great and nifty
things, but they are still too young and insecure to be worth the risk,
and the fact remains that you don't *need* them at all to use the
internet or intranets productively.

 And from a personal point of view, it's not hard to start sending out
that particular message to webmasters etc of sites like the ones mentioned
above. I recently decided to look at getting cable tv, and in my country
that comes down to a choice of basically two companies who each are
inextricably linked with the net as well. Went to one site... nothing on
the home page. Viewed source and as I suspected needed Javascript (which
I don't allow on my browser).

 Went to competitor. Same thing. This was getting a bit ridiculous.
Decided that I could "trust" this company and enabled Javascript for this
site. As it turns out, the site was visually stunning etc, but it was
incredibly hard to navigate, but I eventually found the prices etc I was
looking for.

 Then decided to be fair I should go back to the first site with
Javascript enabled. Was presented with a big page in flashing lights that
told me to browse their site I would also need to download Shockwave as
well. Yeah right! Shut down my browser and decided to go with their
competitor.

 As much as I'd like to see everyone do this so the message has the best
chance of getting across, I unfortunately don't think it's going to
happen. The Microsoft marketing machine has done a wonderful job of
convincing *all* users (not just M$ ones) that they *need* all these
wonderful things.

 *sigh* As days go by our jobs don't get any easier, do they? ;)

 Regards,
 Lee.

*-----------------------------*----------------------------------------*
| Lee Hamilton | Democracy: Three wolves and a |
| Systems Administrator | sheep deciding what's for dinner. |
| Prentice Centre | |
| University of Queensland | Em: lee@prentice.uq.edu.au |
| Australia | Ph: +61-7-3365 4328 |
*-----------------------------*----------------------------------------*


>> JUST SAY NO! It's not as if there aren't plenty of other sites on the
> Web that we all can spend our time visiting instead. JUST DON'T GO to
> the sites whose Webmasters are more concerned with showcasing their
> supposed "skills" than they are with getting interesting CONTENT out to
> the greatest possible number of people! 

> I totally agree. 

I'm glad to see at least some others feel the same way!

> From a security standpoint, it's always good to reduce
things back to basics in a situation if at all possible, so you don't get
into "not seeing the forest for the trees" type situations. 

It's not just that. It's also the issue of do you want to see ourselves as both 
an industry and a society dragged through the gauntlet of all this silly and 
harebrained faddish bullshit that anybody and their colleagues manage to dream 
up to complicate our lives? Just because somebody cooks up some new silly crap 
doesn't mean we all have to run out and embrace it with open arms.

Before I get lambasted as being a luddite, check out my Web page to see my 
background of working in R&D/Advanced Product Development, and some of my ideas 
for *meaningful* and still radical new future products. I'm hardly a person who 
dislikes genuine technical progress! But just because somebody comes out with 
something, doesn't automatically mean it's wonderful or that we all have to 
adopt it.

For example, when I get E-mail containing those bulky damned HTML codes, 
especially when it results in a DOUBLE copy of the mail text (one with, one 
without), I usually *send it back* asking the sender to please turn that option 
OFF in their mailer.

For one, I object to the assholes who make HTML browsers (what a coincidence!!) 
trying to "up the ante" for all other E-mail software companies.

For another, I already get more than enough E-mail bulk as it is. I've got over 
four hundred megs of E-mail in archives, and this HTML crap can multiply that 
storage bulk (as well as download times) by 2.5x... basically reducing a 
33.6kbps modem's throughput to about what we USED to enjoy with a 14.4kbps 
modem. I think that's a damned poor bargain.

Finally, the *content* of that mail is what matters to me, not the typeface it's 
presented in, or its color (which might look GREAT... on somebody ELSE's 
screen), or its point size, or whatever. I'm sick to death of people ASSUMING 
that the way *they* like to see something on THEIR system (running a 
17"-or-bigger monitor at high 1024x768-or-better resolution and 24-bit color 
depth) is the way EVERYONE wants to see it. The Web is not and SHOULD NOT BE 
treated (and attempted to be turned into) a WYSIWYG desktop-publishing system. 
And this is even MORE true for E-mail than it is for the Web.

It's simply not reasonable to blithely, Marie-Antoinette-style ("let them eat 
cake!") say "Download Netscape Now!" or "Download the Latest Internet 
Explorer!". These clods either don't realize, or just don't care, that E-mail 
is a **universal**, cross-platform mechanism which is supposed to allow 
*everyone* to communicate... and this includes people around the world who are 
running low-res Web TV, or E-mail-to-pager, E-mail-to-fax, 
E-mail-to-FIDOnet-BBS, E-mail-to-voice-reader (etc etc) gateways.

>Technologies like ActiveX etc may have the potential to do really great and 
nifty things, 

Nifty, maybe. I haven't seen any convincing cases where they did anything more 
than add silly "glitz" to a Web page. While I'm sure someone will someday come 
up with something like that, I believe that the purpose of the Web ought to be 
to be (at least for the Internet, as opposed to in-house Intranets running in a 
very specific, company-internal controlled environment) to make the company's 
information available to the GREATEST NUMBER of potential visitors and customers 
possible. Unless there's a DAMNED compelling reason, sites should not require 
all kinds of faddish glitzy bullshit that only succeeds in adding to server 
loading, lengthening download times, and limiting the number of visitors that 
are able to hear your company's message effectively.

I rank Webmasters that are all caught up with showing off these dubious "skills" 
(above the genuine best interests of their companies) right along with those 
pathetic dweebs who are so determined to show off their arcane knowledge (and 
thus supposedly earn the admiration of their equally-juvenile buddies) that they 
spend their lives trying to cook up the most fiendish and diabolical new 
computer viruses. The product is different, but the motivations and 
inappropriateness of the effort are the same.

>...but they are still too young and insecure to be worth the risk,
and the fact remains that you don't *need* them at all to use the
internet or intranets productively.

And that is the REAL point of the whole issue... in virtually NO case is any of 
this crap really NECESSARY. It's a "capability", yes. It's "new" and "latest", 
yes. But that does NOT mean that we all have to go chasing around and worrying 
about whether we're "ready" for it or not! For one, it may not even survive 
(plenty of other fads have come and gone). For two, it comes at a very high 
cost, both in terms of trying to support it (involving hardware requirements, 
people training and compatibility issues as well, so *more* than just keeping up 
to date with the latest plugins and other supporting software, which are 
themselves a very fast-moving target), and as the major security risks which 
seem endemic.

> And from a personal point of view, it's not hard to start sending out
that particular message to webmasters etc of sites like the ones mentioned
above. I recently decided to look at getting cable tv, and in my country
that comes down to a choice of basically two companies who each are
inextricably linked with the net as well. Went to one site... nothing on
the home page. Viewed source and as I suspected needed Javascript (which
I don't allow on my browser).

I don't allow Javascript on my browser either. For a whole host of what I 
consider *excellent* reasons, my primary browser of choice is Spry Mosaic. This 
browser doesn't even support frames (I *do* kinda wish it supported tables, but 
it doesn't... there ARE other ways to display such information on a Web page).

> Went to competitor. Same thing. This was getting a bit ridiculous.
Decided that I could "trust" this company and enabled Javascript for this
site. As it turns out, the site was visually stunning etc, but it was
incredibly hard to navigate, but I eventually found the prices etc I was
looking for.

I hope you complained to the Webmaster. Make them aware that you don't much 
care for their handiwork. But don't stop there... complain to their boss, or go 
directly to the head of the company involved and tell them that they're shooting 
themselves in the foot. Many of the execs paying for this stuff don't have the 
technical savvy to understand what's being done in the HTML code (and of course, 
it looks FINE to them when the guy who concocted it shows it off to the 
bigwigs). We have to make them aware of the issues involved, and explain how 
and why their Web site is turning away potential customers. (It's POSSIBLE that 
the Webmaster tried to explain this before, and was ordered to build it as they 
did regardless... in this case, we can help reinforce their protestations from 
outside the company).

> Then decided to be fair I should go back to the first site with
Javascript enabled. Was presented with a big page in flashing lights that
told me to browse their site I would also need to download Shockwave as
well. Yeah right! Shut down my browser and decided to go with their
competitor.

Personally, I said no to ALL cable and satellite TV. This is too bad in a way, 
since I do enjoy it in hotel rooms while travelling (etc). But when I'm at at 
home, I spend all my free time online in front of the computer ANYHOW... I can't 
imagine when I'd find time to watch TV... and I'm put off by the monopoly 
pricing policy of TCI and other cable companies (who also monopolize the DBS 
satellite programming companies, too... there's only the *facade* of competition 
there). A cable TV connection, even with just a tiny selection of premium movie 
channels, would cost more than twice what I pay for my Internet connection. In 
my case, I think there's far more already on the Internet than I could ever 
possibly have time to read. Do I need cable TV too? Clearly not.

There's far too many interesting magazines than I have time for. I let my BYTE 
subscription lapse, once I realized that I'd hardly even opened the last six or 
eight issues I'd gotten... the reading stacks just piled higher and higher. 
I've enjoyed many other eminently worthwhile magazines in the past... stereo and 
hi-fi mags, Consumer Reports, Business Week, and lots of others. I've 
discontinued nearly all of them, simply because there's not enough time in a 
lifetime to keep up.

And this is true with Web sites, too. There's far more of them than anyone 
could ever read, anyhow. So we shouldn't regret just simply _leaving_ sites 
which obnoxiously make demands on the software and hardware and bandwidth and 
patience and whatever else needed to visit them! Just say 'NO!'. And if it's a 
site you think you MIGHT want to visit in the future, you might want to (as I 
said before) drop a note to the Webmaster, and the CEO while you're at it, of 
the company involved to let them know precisely WHY you've "turned off" their 
company.

Sometimes this works, and sometimes it doesn't. Sometimes this renegade crap is 
being done by the Webmaster and the CEO hasn't a clue what's going on, and 
issues a company policy directive that fixes things. Sometimes the stupidity 
comes from the very top of the company and your letter won't change a thing 
(Novell's disastrously distracting fling with Unix, or Compuserve's incredibly 
stupid $100 million purchase of Spry coupled with their subsequent idiotic 
failure to FIX the shocking problems in their new division... Apple Computer's 
seeming determination to get nominated for the 1997 Darwin Award... once-huge 
Borland's incredibly arrogant and obnoxious attitude that turned off many of the 
developers they were critically dependent upon... IBM's unshakeable confidence 
that Micro-Channel or the incompatible Power PC microprocessor would 
revolutionize the PC marketplace (after IBM itself littered the ground in the 
1970's with the bodies of arguably-better-product-but-incompatible 
competitors)... there are a lot more...). Of course, spectacular corporate 
failures have never been limited to small companies (as Braniff International, 
Eastern Airlines, Pan Am and numerous other once-large-and-proud companies in 
other industries demonstrate all too clearly).

> As much as I'd like to see everyone do this so the message has the best
chance of getting across, I unfortunately don't think it's going to
happen. 

It is surprising how rarely companies put two and two together and actually see 
"four". Of course, the execs who make these bad decisions are loathe to blame 
themselves for their own lack of foresight that sends their companies down the 
tubes. Anybody with any sense of the computer business *knew* when Steve Jobs 
was deposed as the head of Apple Computer that it was the beginning of the end 
of that company. Seeing Novell pull the rug out from under the positions taken 
by their loyal CIO customer decision makers was a clear sign that Novell was 
going to be in *serious* trouble. Some of these corporate failures are still to 
come, but that doesn't make them any less inevitable. It is sad that some 
companies, with so much going for them, can be SO stupid. 

It is twenty years ago this year that Datapoint introduced the first 
commercially successful LAN (in the face of widespread contention that "big 
companies will NEVER give up their mainframes and run their companies on 
high-speed networks of little computers" :-) ). There is little good reason 
why Datapoint doesn't OWN that business today, other than the most outrageously 
bad corporate decisionmaking.

I think that some of these companies need to have the advice of much better 
consultants. :-)

> The Microsoft marketing machine has done a wonderful job of
convincing *all* users (not just M$ ones) that they *need* all these
wonderful things.

Eventually, SOMEBODY is going to stand up and point out that "BUT THE EMPORER IS 
NAKED!!!" In any case, I don't think it ultimately does anybody any good for us 
to all just sit back and silence while companies try to railroad this dumb stuff 
through. Hell, it's often not even truthfully in THEIR interest, and it's 
CERTAINLY not in ours.

> *sigh* As days go by our jobs don't get any easier, do they? ;)

We can help make them easier by simply ignoring some of the costly supposed 
"advances" that we don't really want, don't really need, and which mostly just 
derail us from moving in the directions that DO advance the interests of our 
(and our consulting client) companies. If we silently and obediently trundle 
along behind every ill-conceived bandwagon (usually accompanied with great 
fanfare) that comes along, we don't do any favors to the companies that count on 
our helping them to avoid making (sometimes VERY) expensive mistakes.

It may be premature, based solely on the recurrent but ominous security 
problems, to completely write off Active-X and Java. But those, coupled with 
the fact that the technologies are SO unnecessary, makes me convinced that only 
those customers with a real death wish would bet their company's Internet (and 
Intranet) presence on the continuing future (and ultimate market acceptance) of 
these latest-fad technologies. At least not unless and until they have a 
*damned* compelling reason they need to do so. And I, personally, haven't yet 
seen such a compelling reason.

Gordon Peterson
http://www.computek.net/public/gep2/
Support the Anti-SPAM Amendment! Join at http://www.cauce.org/

This is pathetic.

Gordon, you have your view, fine, you want to state it, that's fine too,
but do you have to swear so much? Its a public open forum here, common
courtesy should dictate you attempt to at least be civil. Personally I
find your swearing offensive, and find it detracts from my attempt to
understand your point (all I can understand is your hostility, which I
find baseless).

As for your opinion about the web, you seem too caught up in yourself to
realize that it is just that, your opinion. So far you're one of a very
few people who've I've seen upset with the state of the web today. You
don't like it, use Gopher.

If people were not enthusiastic about active content and Netscape
innovations then Lynx and Mosaic would be the most popular browser
around, they're* not, get with the program, the people are voting with
their ISP-minutes and downloading the latest versions all the time.
*MOST* people want more than what they have already, not less as you
suggest. People are not forced to download anything, and they're not the
idiots you would have us believe we all are. We are capable of voting
with our mice and not accepting a big web page full of junk, if that's
what we want. People don't do that, however, they instead want more,
they want Internet Phone, Internet Video, push technology and more.

Are you even bothering to look at the most popular sites on the 'net?
Look at sites with huge investments, MSNBC, CNET, etc... these sites all
deliver more not less. Do you think they're throwing their investment
dollars in the garbage?? Their demographics programs are more
sophisticated than your opinion, and based on far more people than
you've spoken to. If people wanted less, there would be less there,
believe me.

So you've stated your point, enough of the diatribe already, let's move
on.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security

At 07:08 PM 8/29/97 -0500, you wrote:
> This list needs some serious maintenance. 

Seconded great list just results in 40 odd mails back that are a pain
John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

> Are you even bothering to look at the most popular sites on the 'net?
> Look at sites with huge investments, MSNBC, CNET, etc... these sites all
> deliver more not less. Do you think they're throwing their investment
> dollars in the garbage?? 

Russ, I agree with most of what you've said, except the last line of the
above paragraph. They may deliver more, but they are indeed throwing
their dollars in the garbage. A recent news article indicated that
Pathfinder will lose some $10 million this coming year. With the
exception of engineers, developers (and all the folks that make the
Internet *work*), no one's making much money on the Internet. Oh,
certainly, those who sell connectivity, routers, software, etc....they
are making money. But the vast majority of corporate sites with
highly-charged content are losing 6 and 7 figures annually. 

Equally, your point is well taken. The masses love that stuff. However,
all that jazzy content is balderdash in the end analysis. Think about it
for a second: BUGTRAQ archives, for example...it is one of the most
valuable resources on the Internet for us folks. Wouldn't it irritate
you - even a little - if, while using that resource, you had to wait for
Java, graphics, sound and other media to load? (Especially if the ONLOAD
property was set to call these items, thereby preventing you from
manipulating the search's resulting data until the load were complete?)
Me, I spend at least 6 hours a day online. This represents cost. When I
want data, I want it fast. Have you ever used the US Census Bureau
resources? That is what I deem a practical and useful application of web
technologies. 

Within the next few months, I am going to be forced to put either 56K
Frame or T1 access in my home. The reason? Between connect charges (I
recently moved to a very small community and the repeaters are an
out-of-LATA call) and all the new junk pushed down the wire, it will
ultimately be cheaper for me to go 56K or T1. In my business, time is of
the essence and the more highly-charged content I encounter, the longer
it takes for me to get my work done. (And, even if they aren't using
ActiveX, Java, or place another favorite here), more and more sites are
now using tools like Fusion by Netobjects. Some of these WYSIWYG HTML
development environments generate MASSIVE table structures that a) make
even a text-only page in excess of 25K; and b) take longer to interpret.
Furthermore, your statement that no one is "forced" to download
materials is not entirely accurate. Some sites have now incorporated
scripting-language-based search engines - either partially or completely
- into their sites. That means that one must have a browser with a
decent implementation of that scripting language. If you don't possess
such a browser, the site will not "work" for you or operate properly.
D-HTML is the extreme example of this. So, one *must* download these
newer (and infinitely more bloated) browsers. Furthermore, this
situation is complicated by the lack of any real standards. W3 may as
well give up now, because each day, new protocols, new extensions and
new plugins are created. Lastly, there is a great divide between
implementations of the same language on diverse platforms. I can write
the very simplest JavaScript code (a mere pop-up window) that will
execute beautifully in Navigator and fail in MSIE. 

In the midst of all this, all I am trying to do is get some information.
At times, the climate can be very distrurbing and frustrating. Perhaps
that is the very reason that large, powerful and indispensable sites
like INTERNIC keep it simple. They, of all sites, have the technical
expertise at their disposal to create awe-inspiring web pages. However,
their basic function is to maintain one of the largest databases in the
world and distribute that data quickly and accurately. Compare their
model to enterprises that stack Java, ActiveX, JavaScript, JScript,
VBScript, D-HTML and/or any or all of the above technologies to a) make
things look nice; and b) tunnel the user's search terms to something
rooted in a CA Unicenter (Ingres), Informix or Oracle base. These
undertakings complicate the process (and increase needless cost). At the
end of the day, garden-variety HTML and PERL (with its incredible power
to manipulate both data and communications) are plenty enough for me and
I wish the majority of sites would stick with just that. Unfortunately,
this is unrealistic. Too bad.
On Sunday, August 31, 1997 5:29 PM, osiris@gnss.com wrote:

> want data, I want it fast. Have you ever used the US Census Bureau
> resources? That is what I deem a practical and useful application of web
> technologies. 

which btw contains, image maps, javascript, animation, etc.

this aside what about information that cannot be reduced to plain text
files? we're building intranet applications for local govs here that require
cheapo access (read that as browser access) to their spatial data like
land parcels, tax maps, sewers, etc. this stuff is damned expensive to
capture, so local government want this info spread around within their
municiplalities as much & as quickly as possible. slapping a browser
down on somebody's desktop is far simpler & cheaper than trying get
the bean counters to cough up $10,000+ per user for advanced spatial
s/w packages. we see activeX & java as real tools to leverage better
decisions out of costly information....


-----------------------------------------------------------------------------------------------------
Paul Hastings paul@tei.or.th Paul.H@pcd.go.th
Director Environmental Information Center
 Thailand Environment Institute
http://www.tei.or.th/eic---------------------------------------------------------------------


Paul Hastings wrote:
> 
> On Sunday, August 31, 1997 5:29 PM, osiris@gnss.com wrote:
> 
> > want data, I want it fast. Have you ever used the US Census Bureau
> > resources? That is what I deem a practical and useful application of web
> > technologies.
> 
> which btw contains, image maps, javascript, animation, etc.

Ah, but these components can be refused and the site still renders the
information quickly, accurately and painlessly. 

> this aside what about information that cannot be reduced to plain text
> files? 

The majority of these items can be delivered in PDF. Though, I will
readily admit that a) PDF in certain instances will not suffice; and b)
Java is excellent for the purposes you described. (I cannot say the same
about ActiveX, but then, I have a very biased opinion about that.)

But, here, you have introduced an example that is out of the ballpark.
You are talking intranets and these entail significantly greater speeds
than the average 28.8/56K modem. Speeds that can easily accomodate such
data. Moreover, you describe content that is designed for a specific
purpose; content that is of commercial and research value to a select
group of individuals. That being the case, such technologies are
warranted. Certainly, in corporate or government development
environments, Java is an excellent solution. (For government
environments, ActiveX is simply not practical because of security
considerations, and I do not see that changing.) However, most
publicly-oriented pages do not deliver such special and valuable
content. My point was that the network is now overrun with these
technologies, which are often used where there is no good reason to do
so.
On Sun, 31 Aug 1997, Russ wrote:

> Gordon, you have your view, fine, you want to state it, that's fine too,
> but do you have to swear so much? Its a public open forum here, common
> courtesy should dictate you attempt to at least be civil. Personally I
> find your swearing offensive, and find it detracts from my attempt to
> understand your point (all I can understand is your hostility, which I
> find baseless).

If you don't like active language content, then you shouldn't read it. If
people didn't want it, the words wouldn't exist. If it wasn't popular, 
newsfeeds wouldn't contain so much of it, and mailing lists wouldn't pass 
it. If nobody wanted to read it, e-mail software wouldn't display the 
naughty words.

Now that we've all seen that this is circular and pointless, can we 
please drift back to something more than 'people want it' and 'that 
doesn't make it good'. In the years we've been arguing that as a 
collective security community it hasn't been resolved yet. 
 
Public personal attacks based on language won't change that, and degrade the 
list as much as, if not more than a bunch of damn explicatives. 

Thanks,

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Anyone know of any commercial solutions for synchronizing passwords between Novell and NT?

______________________________________
Mark Curphey
Insight Consulting
Churchfield House
The Quintet
Churchfield Road
Walton on Thames
Surrey
KT12 2TZ

Tel 01932 - 241000
Fax 01932 - 244590
Mobile 0410 - 034066
E Mail MarkC@insight.co.uk
E Mail m.curphey@rhbnc.ac.uk
World Wide Web www.insight.co.uk
World Wide Web www.curphey.com

For that matter, does anyone know of any non-commercial solutions?

> -----Original Message-----
> From: Mark Curphey [SMTP:m.curphey@rhbnc.ac.uk]
> Sent: Sunday, August 31, 1997 2:28 PM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Synchronizing between Novell and NT
> 
> Anyone know of any commercial solutions for synchronizing passwords
> between Novell and NT?
> 
> 
At 14:35 31/08/97 -0400, you wrote:
>For that matter, does anyone know of any non-commercial solutions?
>
>> -----Original Message-----
>> From: Mark Curphey [SMTP:m.curphey@rhbnc.ac.uk]
>> Sent: Sunday, August 31, 1997 2:28 PM
>> To: 'ntsecurity@iss.net'
>> Subject: [NTSEC] Synchronizing between Novell and NT
>> 
>> Anyone know of any commercial solutions for synchronizing passwords
>> between Novell and NT?

Hi ya's check out the novell site they have a few options about..
commercial and non..

there is a novell specialist here in australia who was doing good business
doing this too ... had a package that was getting great write ups i'll see
if i can find there info and post it..

cheers



John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

> This list needs some serious maintenance. I been back on it for two
> days and have posted once. In that time frame I have received about 15
> empty messages or with garbage, and about another 10 to 15 bounces from
> dead accounts. May I also notice that this bounces are from account that
> where bouncing 3 months ago. David you are from ISS and obviously post to
> the list a lot. You must be getting the same messages. Cant you forward
> them to the list maintainer to have them handled? This is silly.

 Oh great! I've got scripts to deal with the bounce back to our
site. I totally forgot to deal with the brain damaged mail systems that
bounced messages back to the originator and didn't send US anything. Sorry.
This is a major oversight on my part. Expect some bounce test messages
shortly (if you haven't already seen them). DO NOT REPLY TO THEM! They
will be coming from a special address set up specifically to weed the
bounces out! Bouncing accounts and vacation programs are going to get toasted!

 I will be instituting a periodic message to test for these kinds
of problems in the near future. Just ignore them. I will attempt to keep
them to a minimum.

> Aleph One / aleph1@dfw.net
> http://underground.org/
> KeyID 1024/948FD6B5 
> Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

 Mike
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
 #### WARNING #### DO NOT REPLY TO THIS MESSAGE ####

 The return address on this message goes to a program which will
take the responding addresses from any list it is subscribed to at
iss.net! If you have a vacation program responding to your mail - YOU ARE
TOAST and will have to resubscribe.

 PLEASE! - DO read this message. Address comments, recommendations,
or compaints to me at mhw@iss.net. There are some particular warnings at
the bottom. Even if you skip the explanations in the middle, please read
the remarks about mail exploders and those about Microsoft Exchange at
the end! This message is somewhat longish so if you don't want to read
a bunch of administrative crap, just skip down to the line identifying
important remarks and ignore the rest. Future messages of this type will
be MUCH shorter! :-)

 From a recent message from aleph1@dfw.net its become apparent
that there is a whole class of mail failures I have not been checking
for and cleaning up. This message is round 1 to attempt to address
these problems. Rounds 2 and 3 are in the works and more announcements
will follow.

 My deepest thanks and appreciation to ALEPH1 for bringing this to
my attention. Somehow I just overlook this. This was my fault. I rarely
post to this list (and I'm sure that most of you hope I post as infrequently
as possible since it's almost always administrative). The bounces that I
had gotten back simply got lost in the noise of the hundreds of messages I
get each day.

 Problems are that different mail packages have been doing different
things when reporting an error. Most send errors back to the "Sender:"
which is typically the list owner (owner-ntsecurity in this case). Some
send them back to other addresses at this site. These I manage to catch
and in most cases I can clean up and torch the offending party. But, of
course, these are not the ones you, as subscribers ever see.

 Some mailers attempt to send errors back to the list where I have a
variety of filters in place to intercept and process those. There have been
some notable recent failures which have slipped by those filters and I've had
to modify the filters were possible. In a couple of recent cases I couldn't
filter them out. I had to block their site (what I refer to as a hostile site
list). These, you will occasionally see until I have a change to act
on the problem. This can take a day or two and messages in the queue may
take a couple of days to tickle out.

 The third category is something I had not thought of before and
what I am trying to address with this message. Some mailers are aparently
sending error messages back to the "From:" or "Reply-To:" address and
are not coming back here at all. The only way for me to detect and
eliminate these addresses is by a periodic posting to the list and
capturing the return messsages. This is the first, but will NOT be the
last of such messages. I will attempt to make them as infrequent and
unobtrusive as possible.

 This message is being posted from "bounce@iss.net" an address
specifically set up to catch bounce messages to this message. There is
certainly a potential for abuse of this address and I will be attempting
to watch it closely.

 ==== Important remarks from here down ==== Please read ====

 Messages coming into bounce@iss.net will result in the removal of
the offending address from all lists at iss.net!

 This is a LOT more complicated than it sounds. Not all mailers
properly identify the address that they are bouncing mail for. Most
particularly, Microsoft Exchange is probably the worst. E-Mail bouncing
back from Microsoft Exchange systems are almost unidentifiable. I am
going to be attempting to address those problems in rounds 2 and 3 where
individually addressed messages will be used.

 I also have the problem of mail exploders. At this time there appear
to be a couple of hundred mail exploders subscribed to the list. The mail
exploders account for well over half of the "I can't _unsubscribe_ from this
list" complaints. Reason is simple. They are not subscribed to this list.
They are subscribed to some other list that is remailing this list. One
person was loudly complaining on the list that majordomo was broken
and it kept saying he wasn't subscribed to the list. A simple examination
of one of the E-Mail messages he received showed that he was subscribed to
"hackers_lair" and that they were remailing. I sent him to deal with
them and after a letter of appreciation back from him, none of us have
heard from him since.

 Here is MY problem... If I get bounce messages back which identify
a Microsoft Exchange server or a mail exploder, what do I do? If I can NOT
identify the address which is failing, I can't make a deterministic choice
as to who to torch. Individually addressed messages will help somewhat.
In those cases where I can not determine the addressee that is failing,
I will attempt to warn all of the addresses at that site and then torch
all addresses in that domain, any subdomains, and (if a >=3rd level subdomain)
it's parent domain! Most of the unrecognizable bounces come from a system
in a subdomain of the actual E-Mail domain, so I will take out one level up
in parent domains as well (as long as it leaves me with something.com or such).
Imagine what will happen if an MS Exchange server at silly.microsoft.com
starts bouncing mail back here and I can't find anyone AT silly.microsoft.com
subscribed any of the lists... :-)

 Mail exploders are a real complication but in the end will be treated
the same way. If the exploder managers can not clean up their lists on their
own, I will torch them lock, stock, and barrel. I will send ONE warning
to the exploder and then torch it.

 I will make NO attempt to allow for or filter out vacation programs.
If you are going to use one, you better figure out how to use it right.
Set a filter rule to NOT respond to any messages with a "Sender:" of
"ntsecurity-owner@iss.net" and you will be safe. Don't and you are off
on first offense.

 These more darconian measures are intended for rounds 2 and 3 to come.
I'm holding off on that for comments and responses from the subscribers.
I'm also going to wait and see how effective this round is before implimenting
the next steps. The further I have to take this, the more likely that
innocent bystanders will be caught up as collateral damage or someone will
discover a way to subvert or abuse this.

 I will try to, when possible, send out a single notice to addresses
which I _unsubscribe_ from this list. But I make no guarentees of that
though...

 Thank you for your patience and forbearance.

 Regards,
 Mike
--
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
Companies have the ability to chose which technology to implement on
their site, their choices determine the amount of their investment in
that site. If their choosing high-volume technologies (i.e.
high-bandwidth-consuming), then its because they believe that will be
the best use of their investment dollars based on the market research
they've conducted. In this way they are not throwing their investment
dollars in the garbage in their minds. If customers stopped visiting
these sites or provided them with feedback that indicated they shouldn't
use the high-bandwidth-consuming methods, they'd alter their sites
accordingly. I've yet to see that happen. It may in the future, but its
not happening in the markets I'm aware of.

People/ISPs are opting for higher bandwidth, more compression,
pre-loaded or cached information. So far the market seems to be
satisfied with this approach to the problem. Granted, there is a lot of
garbage out there, but then there is a lot of graffiti painted on the
walls of highway abutments as well, isn't there...;-]

If any of you recently got the chance to read Reed Hundt's (FCC
Chairman) address about the Internet to the IEEE recently, you'll maybe
agree that the best way forward is not to restrict, but to facilitate.
We need more bandwidth at cheaper prices, not less content to save
money. Part of the beauty of the Internet is the fact that free speech
should be possible, and if part of that is expressing yourself with an
animated .GIF, or a Java Applet that makes a banner, or an ActiveX
object that makes menus, then this should be considered as much content
as any phrase you might publish. To say that all this stuff is
balderdash wasteful use of a valuable resource (bandwidth) is like
saying that all cars should be the size of Honda Civics, why do we need
to have cars that are any larger? Bigger cars use more gas, and
therefore shouldn't be allowed to drive our roads.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security

Russ wrote:

> To say that all this stuff is
> balderdash wasteful use of a valuable resource (bandwidth) is like
> saying that all cars should be the size of Honda Civics, why do we need
> to have cars that are any larger? Bigger cars use more gas, and
> therefore shouldn't be allowed to drive our roads.
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security

Oh, now don't get me wrong, Russ. In a perfect world, the entire Net
(and every machine connected to it) would be strong with SONET. That
would be absolutely wonderful. Unfortunately, however, the pricetag is
weighty indeed. I simply believe that many of these new technologies are
the equivalent of the "bloatedness" we have seen arise in desktop
applications. And, while microprocessor technology is moving quickly
enough to accomodate the resource demands these applications present, I
think that connectivity technologies for the mass populace have not kept
up in a similar, timely fashion. (For anyone with T1-T3-ATM access, this
is a moot point, of course. However, the average
individual-on-the-street is another matter.) 

Another thing that irritates me about it is the variance in
implementations. There was a point - no so very long ago - where HTML
implementations were sufficiently similar that anyone, with any suitable
browser, would see essentially the same thing as the next guy. Those
days are now gone, largely due to attempts by large corporations to
inject a viable, commercial market into a climate (the Internet) that
once was relatively "free" of such proprietary technologies. This, in a
way, defeats the original purpose of HTML. Today, we must install dozens
of different products to obtain "holistic and complete" access to
information that heretofore was easily accessed. Supposedly, the icing
on this cake is that we see more lively, more visualized content. But
somehow, I see it subjecting us to the same loss of productivity we see
when we migrate to complex desktop applications: upgrades, bugs,
problems with integration, the need for different tools for different
sites and so forth. Standing back from one's position as a user (and
believe me, I use or have used almost *every* operating system
available,) the scene looks just a little comical. Hundreds of thousands
of folks tinkering with this and upgrading that...I have personally
witnessed productivity in offices fall 2 and 300% for all of this
activity. Adding these complex applications to the Web just ensures that
these same problems have been into "CyberSpace" (Don't you hate that
word? :-)

But, agreed. If there were sufficient bandwidth available to all, these
new technologies would be wonderful. I admit that much without
reservation. For example, though I use Doze for many tasks, I am at
heart a UNIX enthusiast (and a security aware individual.) Even so, I
readily admit that ActieX technologies have produced some of the most
stunning, beautiful pages I have ever seen. Furthermore, these pages
have greatly increased functionality. I just get very frustrated with
compatibility issues (and of course, security.) So, perhaps my term
"balderdash" was a bit ill-considered. :-)
On Sun, 31 Aug 1997, Russ wrote:

> Companies have the ability to chose which technology to implement on
> their site, their choices determine the amount of their investment in
> that site. If their choosing high-volume technologies (i.e.
> high-bandwidth-consuming), then its because they believe that will be
> the best use of their investment dollars based on the market research
> they've conducted. In this way they are not throwing their investment
> dollars in the garbage in their minds. If customers stopped visiting
> these sites or provided them with feedback that indicated they shouldn't
> use the high-bandwidth-consuming methods, they'd alter their sites
> accordingly. I've yet to see that happen. It may in the future, but its
> not happening in the markets I'm aware of.

 This is so true.

 But the orginal point of this thread I think (and maybe we should get
back to it since this is starting to stray from *security* issues), was
along the lines of "What do we do with technologies like ActiveX etc that
represent a potentially significant security risk on our networks? How do
we convince managament and users to listen to us and not use them?" 

 The answer is all you can do is point out to them they don't *need* them
to do their work productively. I think we can all agree on this. If they
then opine "Oh but we do!", you're reduced to going, "Okay, here are the
reasons why you probably *don't* want to do this, and here are the reasons
why you can live without them again." The final decision, as always, is
with management. If they're not willing to listen to your advice (which
is what after all they are paying you for), you can't save them from
themselves. Perhaps they will only listen when they get burnt. My advice
is don't stress about it; you've done the best you could. ;)

 Regards,
 Lee.

*-----------------------------*----------------------------------------*
| Lee Hamilton | Democracy: Three wolves and a |
| Systems Administrator | sheep deciding what's for dinner. |
| Prentice Centre | |
| University of Queensland | Em: lee@prentice.uq.edu.au |
| Australia | Ph: +61-7-3365 4328 |
*-----------------------------*----------------------------------------*


On Sun, 31 Aug 1997, osiris@gnss.com wrote:

> up in a similar, timely fashion. (For anyone with T1-T3-ATM access, this
> is a moot point, of course. However, the average
> individual-on-the-street is another matter.) 

Some of us would argue that ATM isn't all it seems, especially if you've 
experienced the latency and lossiness that was UUNet's TCO facility a few 
months ago. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

QUIT
Possible resend, I didn't see this reach the list??
-----Original Message-----
From: Russ 
Sent: Saturday, August 30, 1997 3:36 AM
To: 'Aleph One'; Paul Leach
Cc: ntsecurity@iss.net
Subject: NT Security (was: ActiveX)

So I sat back and watched this thread take its course. ActiveX is a
topic that I really enjoy debating.

Q: What does ActiveX, Exchange, etc... have to do with NT Security??

A: It has everything to do with NT Security. NT Security serves no
purpose whatsoever if you're not using the OS for some purpose.
Obviously ActiveX, Exchange, etc... are all purposes for using an OS.
What many of these applications demonstrate is the need for an OS like
NT which is at least, in part, capable of addressing *some* of the
security requirements for such applications. If this point gets past you
then you're not appreciating what security means, NT or otherwise. More
importantly, since ActiveX is a core OS technology, NT Security must
address it more than it currently does, not IE or any individual
application which might make use of it.

What seems to be missed by many of you posters is the realities that are
the Internet, as well as what's happening on Intranets. In case you
hadn't noticed, we're in a revolution here, both externally and
internally. Portable code is nothing new, but the ability to easily plug
this code into your environment (via Japplets, plug-ins, or ActiveX) is
revolutionizing the way computing can be done.

The problem with some folks today is that they expect the revolution to
end today. They expect every offered innovation to be complete, 100%,
without faults. If its not, then they pick it apart until they're blue
in the face. To what end, I ask? To do this despite the potential
benefits of the technology means that possibly useful technology can get
swept under the table in favor of more debate.

A Sandbox is not a complete answer to portable code, nor is ActiveX.
Both offer the potential for better computing, and both offer
feature/functionality that's needed in the model we're creating. One
offers limited functionality with increased security, the other offers
increased security with limited security. But this is true only when
looked at from a Browser perspective. Instead, we should be considering
them from a technology perspective.

The Sandbox was designed to interoperate with a single server, much the
same way that a terminal interoperates with its CPU. This has incredible
potential for smart devices (e.g. Set-Top devices), but its hardly
enough to replace the feature/functionality we get out of PCs today.
What's being missed here is the fact that the Sandbox was, and is, not
the technology. Java was a portable code language, designed to write
applications. The Browser with its Sandbox was simply a neat
implementation that allowed mini-Java programs (Japplets) to be
demonstrated and make headlines. That was an effort to sell the
technology, not the concept of a Sandbox. If someone walked up to you
today and said "I'm going to remove your access to your hard disk,
sorry" I think you'd have something to say about it.

ActiveX was, and is, an attempt to allow existing code to be used in a
distributed fashion. The technology is not new, as someone else pointed
out, its simply OLE for networks with some tweaking. As a technology it
was/is as needed as Java was/is. Since OLE wasn't Sandboxed, and no
aspect of MS operating systems is Sandboxed, ActiveX wasn't constrained,
why should it be? As a technology it allows you to implement as much
security as you've always been able to implement (in fact much more than
was previously possible).

The issue has been the way ActiveX has been demonstrated. Instead of
demonstrating the technology for what it is, its been implemented in a
Browser similar to the way that Java was. The Web was seen as the right
place to show how neato wow ActiveX could be. One big problem, however,
was that too many people drew a comparison between ActiveX and the Java
Sandbox. There is *no comparison*, they're two entirely different
technologies with different feature/benefits.

Now both developers are burdened with trying to make their demonstration
products better, partly because the code-starved crowd on the Internet
won't leave them alone to continue developing the technologies (which is
what we should do). We don't need a better Sandbox, nor do we need
better Authenticode for ActiveX, what we need are better OS' capable of
supporting these technologies and giving us the ability to configure
security the way we want.

This is where NT Security comes in.

Do I really want to run an application in order to get security on my
interactions, or does it make more sense to get my security implemented
at the time I log onto the box I'm sitting in front of, regardless as to
whether that box happens to be a NetPC or a full-fledged PC??

My point is that the Browser needs to be the OS, not some application
sitting on top of the OS. What's the use of implementing controls in a
Browser that don't apply to every application I might run on my box, all
of which might be able to do what a Browser does??? Should I have to
configure my security preferences in each and every one of these
applications, or would it make more sense that my security is defined in
my system profile and loaded when I log on? Once loaded, it would apply
to anything doing anything to anyone, anywhere.

If NT was configurable to create a Sandbox, wouldn't we all be thrilled?
I know I would, it would give me the ability to run applications within
restricted environments to avoid some of the risks associated with
"doing stuff", whatever that might be. Of course the Sandbox should be
configurable, and I should be able to have as many different ones as I
want simultaneously on the same box, but I damn well don't want it every
single time I do everything, do I.

>From the same perspective, I want the ability to download code that can
fully interact with my environment. Of course it should be forced to
acknowledge the security profile I've established for each of my
environments where I might run it, but within those constraints it
should be able to do anything a properly console-installed application
can do, why not??

Authenticode, for those of you who don't realize it, was and is intended
for the sale and distribution of software via networks. Its not intended
to be a security sticker, or an anti-virus flag. But the whole concept
of trust is still in its infancy, and there are far too many voices
willing to jump up and cry "Foul" over all sorts of esoteric ethical
issues. Trust will evolve into something that will satisfy most, it just
takes time. The point is, software vendors want some way to sell and
deliver that software via networks. My experience is that most
corporations today trust their vendors to supply them their orders
without a great deal of verification. They place an order, its
delivered, it gets installed (and this bit about a paper trail is really
a side issue, a paper trail can exist regardless of how the software is
sold or delivered).

So where's the issue. Well, because of the Browser implementation of
ActiveX in IE it today is possible for anyone to do most anything they
want (and stuff they might not realize they're doing also). True, to an
extent. A tool does exist to control what users are able to do, I got
it, it works, others have complained about how difficult it is to get
(which doesn't alter the fact it is possible to get it and it does
work). Even without it, though, its possible to write Profiles which
limit much of this access also (and MS should make this easier and more
accessible), NT Tools recently announced a video series that includes a
segment on just this sort of thing.

To bottom-line it:

1. I want NT to provide my security, not Internet Explorer, Netscape, or
any other individual application. This security should be applied via
User Profiles.

2. I want to create a shortcut and then apply security policy to that
shortcut, such that I could have two different shortcuts to the same
application where one runs in a Sandbox and the other doesn't, or one
accepts ActiveX controls and the other doesn't. And I want to be able to
prevent access to the program other than through one (or more) of these
shortcuts.

3. I want to see more 3rd-party vendors, like McAfee, write personal
Firewall type products that can provide some, or all, of the desired
features above. But if they write them such that they cannot be part of
Profiles, their useless.

While we're waiting for the above:

4. I want the components in IE that permit ActiveX downloads/installs to
be componentized so that 3rd-parties can write a replacement for it (or
wrapper). IE should be configurable so its not possible to run without
the appropriate replacement/wrapper.

5. I want to be able to say which IP addresses (or ranges) I'll accept
ActiveX controls from in IE and I don't want it to prompt me to install
them from any site not on my approved list, and of course I want that
approved list to be password protected so my user can't change it.

6. I want a list of the currently installed ActiveX controls and an easy
mechanism to delete them.

7. I want an easy configuration option to turn off check boxes to accept
controls from such that my users don't even know they
could do that.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security





QUIT NTSECURITY


I am trying to demonstrate MS PPTP on a simple test network and can't get
it to work. I have read all the docs I could find, but can't work out what
the problem is.

I have two NT 4.0 workstations with Service Pack 3. To simplify, I am
starting with them on the same ip subnet. The machines connect and I hear
them both beep, but the authentication fails.

On the client, the dialupnetworking security tab is set to:
- Accept only MS encrypted authentication
 - Require data encryption
The server is setup to have encryption selected wherever possible.

The Connect Dialog looks as follows.

UserName: Administrator
Password: ******
Domain:

I have tried, with and without something in the domain: field, with blank,
wrong or correct passwords and get the following pattern of error messages.

If I have no domain, or enter the ip or NTTEST for domain:
 blank or incorrect password
 Verifying user name and password...
 Connect to PPTP Connection
 Your credentials have failed remote network authentication. 
 Enter a user name and password with access to the remote network domain
 correct password
 Error connecting to PPTP Connection
 Registering your computer on the network…
 Error 742: The remote server does not support encryption.
If I have \\NTTEST as the domain, even the correct password doesn't get me
anywhere, whereas generally the correct form for a workstation in these
sorts of dialogs is \\WORKSTATIONNAME.

When I turn off "Require data encryption" or change to "Accept only
encrypted communication" with the correct password, I get messages like
"The port was disconnected by the remote machine".

-Does anybody know what is wrong here?
-Does the server need to be an NT Server?
-Does it need to be a PDC or on a domain?

The guides say that they assume the server is an NT 4.0 Server for the sake
of their examples. They don't say that it has to be an NT Server. I thought
the only difference between Server and Workstation for this application is
that RAS can't serve more than one connection in Workstation.


Regards,

Nicholas Andonakis, Security Engineer nicka@softway.com.au
Softway Pty. Ltd. Tel:+61 2 9698 2322
http://www.softway.com.au Fax:+61 2 9699 9174


hi all,

i have the following problem: 

i must compute msv1.0 challenge responses for arbitrary users.

the only api known to me that computes challenge responses is the
LsaCallAuthenticationPackage() api. this api is designed to do its
duty for a logged on user, since it wants the LUID of a logged on user
as input for the computation.

so my question is: how do i 'pseudo' log on a user in a service
process, which is running under an account having all neccessary
privileges enabled, to get this luid ?

pointers to the api's to call are sufficient.

i know how the get the required information from the registry and how to
compute the challenge response, but this not the way i can go because
my code must work for domains as well and LsaCallAuthenticationPackage
takes care of all this domain communication.

tia

thomas vogler

-- 
+----------------------------------------------------------------------------+
| Thomas Vogler, @work: tvo@software-ag.de, http://pcool/~tvo/ |
| private: tvo@zaphod.swb.de, http://www.swb.de/personal/zaphod/ |
|----------------------------------------------------------------------------+
| Phone: [49]-(6151)-92-1732 FAX: [49]-(6151)-92-???? |
+----------------------------------------------------------------------------+
| Join the Army. Travel a lot. Meet nice people. Kill them all. |
+----------------------------------------------------------------------------+
| PGP fingerprint: A4 D4 2A 60 B5 48 0F 43 3F EB C5 AC 96 79 A8 D2 |
+----------------------------------------------------------------------------+
| statements in here are my own and not neccesarily those of my employer |
+----------------------------------------------------------------------------+
The problem is you're setting them up on the same subnet. Once the
client is connected, it then has two routes to the same host (the PPTP
server), one through the NIC of the client, and the other through the
pseudo-NIC that the PPTP tunnel establishes. If both NICs on the client
are on the same subnet, then it will try and send all data through the
physical NIC rather than through the pseudo-NIC.

Make the RAS Server serve up IP addresses from another subnet, and move
your client off the subnet of the RAS server (so it can't see the shared
resources of the RAS Server).

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security


I have heard rumour that IE 4.0 will send information from your PC to
Microsoft. This information include software installed on PC ( pirated
or official ). 

Is anybody out there know if this rumous is true ? 

if this is true, to what extend is the information on our PC send to
Microsoft.




--- On Mon, 1 Sep 1997 23:33:40 +0800 "SOO CHONG TIAN, ITID" wrote:
> 
> I have heard rumour that IE 4.0 will send information from your PC to
> Microsoft. This information include software installed on PC ( pirated
> or official ). 
> 
> Is anybody out there know if this rumous is true ? 
> 
> if this is true, to what extend is the information on our PC send to
> Microsoft.
> 
> 

---------------End of Original Message-----------------


Hi,
there is HTTP Managment information that is being sent from NetMeeting and 
it's browser component to uls.microsoft.com
I have not detected any other information that is being sent from IE 4.0 over 
the wire.
Ziv
 
 /AbirNet provides the next generation in Internet and Intranet Protection\
 | AbirNet provides Windows 95 & NT-based software that let's you know |
 | how your network is being used while protecting it from intrusions |
 | and abuse using no-network overhead, see-it-all filtering, blocking, |
 | alerting, logging, and scanning technologies. |
 | |
 \========== Get an EVALUATION COPY at ===========/

Hi
These and other dangerous problems with EVERYONE2USER were reported on May
14, 1997 and apparently, have not been fixed since that time.
More details at:
http://www.ntsecurity.com/redbutton/e2u.htm

At 01:53 AM 8/31/97 -0400, you wrote:
>> I downloaded the most recent copy of EVERYONE2USER by David LeBlanc
>> from
>> the NTBUGTRAQ web site and did a bit of testing on NT 4.0 SP3. After
>> doing an EVERYONE2USER SOFTWARE and de-installing and re-installing
>> some
>> software, the system became unusable for anyone who was not part of
>> the
>> administrators group. Some observations of what it seems to do based
>> on
>> some digging around with DUMPACL from the folks at Somarsoft.
>>
>> 1) The "inheritable" attributes are cleared. Before running
>> EVERYONE2USER, the keys (as dumped by DUMPACL) would show the same
>> permissions in both the "Own Key" and "Inheritable" columns. After
>> EVERYONE2USER was run, then the "Own Key" would show values, but the
>> "Inheritable" column would be blank. This has a very negative effect
>> as
>> any new keys which are created do not inherit the permissions of the
>> parent key, but rather get Administrators and SYSTEM with all access
>> as
>> the only permissions. This breaks just about any software installed
>> after EVERYONE2USER is run to which users (not administrators) require
>> access to registry keys.
>>
>> 2) The permissions from "Everyone" are not being copied to "Users",
>> rather "Users" are just assigned all permissions. This is highly
>> undesirable as it grants users far more rights than they effectively
>> had
>> as Everyone. If you go into the registry key with REGEDT32 you'll
>> notice
>> that Users is flagged as "Special Access", but when you double-click
>> the
>> entry it is actually set to "All". If you click the radio button from
>> "All" to "Other", then the access permissions which were formerly
>> assigned to Everyone are then correctly assigned to Users.
>>
>> I've tested it on 3 different NT 4.0/SP3 systems with similar results.
>> Can someone have a quick go at testing this, and if so David needs to
>> be
>> let know that this is happening and people warned against using it...
>>
>> Craig
>>
>> ____________________________________________
>>
>> Craig Baltzer - Anjura Technology Corp - Ottawa, Ontario
>> cbaltzer@anjura.com - (613) 727-1411
>> _____________________________________________
>>

---------------------------------------------------------------------------
 Ratmir Timashev
 MWC, Inc.
 http://www.NTsecurity.com/
 ratmir@box.omna.com
 


On Mon, 1 Sep 1997, . Ratmir Timashev wrote:

> Hi
> These and other dangerous problems with EVERYONE2USER were reported on May
> 14, 1997 and apparently, have not been fixed since that time.
> More details at:
> http://www.ntsecurity.com/redbutton/e2u.htm
> 

If my memory serves me correctly the 'EVERYONE2USER' program was written
by David Leblanc in his spare time and was distributed for free. In the
initial posts David made he stipulated the software was 'best effort' and
was meant to be *used at your own risk*. 

Having said this, it is important to note that upon the release of the
'everyone2user' utility there was no other free fix. As such I think it
was a pretty valuable contribution. 


/****************************************************************************
Alfred Huger http://www.secnet.com/ballista
Project Director ahuger@secnet.com
Secure Networks Inc. (SNI)
*****************************************************************************/


http://www.microsoft.com/support/downwiz/welcome.asp

How do they do that ? Registry ? Or they can read your HDD ? It works on IE3 ;)

On Tuesday, September 02, 1997 12:55 AM, Ziv Dascalu [SMTP:ziv@AbirNet.com] wrote:
> 
> --- On Mon, 1 Sep 1997 23:33:40 +0800 "SOO CHONG TIAN, ITID" wrote:
> > 
> > I have heard rumour that IE 4.0 will send information from your PC to
> > Microsoft. This information include software installed on PC ( pirated
> > or official ). 
> > 
> > Is anybody out there know if this rumous is true ? 
> > 
> > if this is true, to what extend is the information on our PC send to
> > Microsoft.
> Hi,
> there is HTTP Managment information that is being sent from NetMeeting and 
> it's browser component to uls.microsoft.com
> I have not detected any other information that is being sent from IE 4.0 over 
> the wire.
Regards,
*************** http://www.plexus.net/ ****************
Toh Chang Ying HICOM Teleservices Sdn Bhd
Network Operation Centre (323218-A)
Email: cytoh@plexus.net Suite 3.5, Wisma HICOM,
Tel: +60-3-202-8836 No 2 Jln Usahawan U1/8
Fax: +60-3-202-8899 40150 Shah Alam, Malaysia

Hi, I have been following the 
list for some time now to learn as much about the security implications 
surrounding NT as possible.

The reason for this post is that we 
have now finished the installation of our network and my manager has informed me 
that we are to do HACK attack on the system in various situations.
1. From a machine on the network 
without any prior passwords.
2. From being logged on as a 
normal user trying to access prohibited areas.
3. From outside the 
company trying to break through the firewall.
Any information or help people can 
provide will be greatly appreciated as we want to make this as good a test as 
possible.
System: ATM backbone, Win NT4.0 servers with service pack 3, Win 
NT4.0 Workstations.
Anyone wishing to help me please post privatly as i'm 
sure many of the list recepients have already heard most of this before 
:-)
Richard Woodward --Systems Administrator--
BNFL Sellafield. UK

On Fri, 29 Aug 1997 17:35:39 -0700, you wrote:

>Oh, were you talking about the *average* user? Funny, I missed seeing 
>where you stated that in your post.
Take a look at the original mail.

>
>You also stated flatly: "You are wrong." Perhaps if you would be so good 
>as to point out which of my statements *you* think are in error, we could 
>determine whether the disagreement concerns fact or opinion.
Hmm - I should have said, you do not see the point ;) Of course
one needs to first load a control that does somthing 'evil'
(reprogramming ie settings). But what I wanted to point out is
this difference is of very little value to the average user cause
she/he will normally have problems to understand the back-
ground. 

But enought of ax. (at least from my side)

regards, 

Dietz Proepper



-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
On first joining the domain the session key could be computed by
anyone listening in on the network as the machine password has
a well known value.
[EvZ]
My info is apparently not so deep as your but: ??? the session key is 
based on amongst others the users paswword...that one never travels in 
clear (never say never...basic authentication and such)...over the 
network..so how should an outsider guess the Session-key ?

None of the returned user info such as logon script, profile path
and SIDs *appear* to be protected by anything other than the TCP
checksum.

[EvZ] see remark above: session keys should be safe...
Brings me to another point:
- does anyone know exactly what data between NT-servers and DC's goes 
encrypted and/or signed ?

Gtings, ErikVZ

I for one agree with the principle of useful content preferred over
 "flash" ... 

alan

Russ wrote:
> 
> This is pathetic.
> 
> Gordon, you have your view, fine, you want to state it, that's fine too,
> but do you have to swear so much? Its a public open forum here, common
> courtesy should dictate you attempt to at least be civil. Personally I
> find your swearing offensive, and find it detracts from my attempt to
> understand your point (all I can understand is your hostility, which I
> find baseless).
> 
> As for your opinion about the web, you seem too caught up in yourself to
> realize that it is just that, your opinion. So far you're one of a very
> few people who've I've seen upset with the state of the web today. You
> don't like it, use Gopher.
> 
> If people were not enthusiastic about active content and Netscape
> innovations then Lynx and Mosaic would be the most popular browser
> around, they're* not, get with the program, the people are voting with
> their ISP-minutes and downloading the latest versions all the time.
> *MOST* people want more than what they have already, not less as you
> suggest. People are not forced to download anything, and they're not the
> idiots you would have us believe we all are. We are capable of voting
> with our mice and not accepting a big web page full of junk, if that's
> what we want. People don't do that, however, they instead want more,
> they want Internet Phone, Internet Video, push technology and more.
> 
> Are you even bothering to look at the most popular sites on the 'net?
> Look at sites with huge investments, MSNBC, CNET, etc... these sites all
> deliver more not less. Do you think they're throwing their investment
> dollars in the garbage?? Their demographics programs are more
> sophisticated than your opinion, and based on far more people than
> you've spoken to. If people wanted less, there would be less there,
> believe me.
> 
> So you've stated your point, enough of the diatribe already, let's move
> on.
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
At 12:00 02/09/97 +0200, Erik R. van Zuuren wrote:
>>On first joining the domain the session key could be computed by
>>anyone listening in on the network as the machine password has
>>a well known value.

>[EvZ]
>My info is apparently not so deep as your but: ??? the session key is 
>based on amongst others the users paswword...that one never travels in 
>clear (never say never...basic authentication and such)...over the 
>network..so how should an outsider guess the Session-key ?

No, there is a session key for the domain member to domain controller.
This occurs before a user logs in. Don't confuse SMB/CIFS authentication
with that of domain authentication.
I can compute the initial session key using a little program I wrote
on Unix that takes the unicode host name and two challenges from the
workstation and domain controller. It also allows me to decrypt the
RC4 encrypted LM and NT hashes.

>>None of the returned user info such as logon script, profile path
>>and SIDs *appear* to be protected by anything other than the TCP
>>checksum.

>[EvZ] see remark above: session keys should be safe...

The returned logon script is sent in the clear and none of the
authenticators include anything based on it, therefore it can
be replaced merely by changinging the packet and correcting the
TCP checksum. I'm sure Paul Leach will point out if I'm
mistaken in this.

>Brings me to another point:
>- does anyone know exactly what data between NT-servers and DC's goes 
>encrypted and/or signed ?

The NT and LM OWF hashes are encrypted with RC4. Nothing else appears
to be encrypted (this excludes PDC-BDC traffic).

Paul
How can I get off this list? I've sent mail to majordomo@iss.net, and to
ntsecurity-owner@iss.net. (I sent multiple requests, spread over a couple
weeks.) The only effect has been to get signed up for the digest also,
including all the bounce messages. 


Help would be appreciated.

Jim Hurd jeh@ohgua.lucent.com 402.691.3299 
Lucent Technologies
Omaha, NE 68137
Russ,

Long post but good point. Pretty well sums it up for me. Thanks.

David

-----Original Message-----
From: Russ [SMTP:Russ.Cooper@rc.on.ca]
Sent: Sunday, August 31, 1997 11:11 PM
To: 'Aleph One'; 'Paul Leach'
Cc: 'ntsecurity@iss.net'
Subject: [NTSEC] NT Security (was: ActiveX)

Possible resend, I didn't see this reach the list??
-----Original Message-----
From: Russ 
Sent: Saturday, August 30, 1997 3:36 AM
To: 'Aleph One'; Paul Leach
Cc: ntsecurity@iss.net
Subject: NT Security (was: ActiveX)

So I sat back and watched this thread take its course. ActiveX is a
topic that I really enjoy debating.

Q: What does ActiveX, Exchange, etc... have to do with NT Security??

A: It has everything to do with NT Security. NT Security serves no
purpose whatsoever if you're not using the OS for some purpose.
Obviously ActiveX, Exchange, etc... are all purposes for using an OS.
What many of these applications demonstrate is the need for an OS like
NT which is at least, in part, capable of addressing *some* of the
security requirements for such applications. If this point gets past you
then you're not appreciating what security means, NT or otherwise. More
importantly, since ActiveX is a core OS technology, NT Security must
address it more than it currently does, not IE or any individual
application which might make use of it.

What seems to be missed by many of you posters is the realities that are
the Internet, as well as what's happening on Intranets. In case you
hadn't noticed, we're in a revolution here, both externally and
internally. Portable code is nothing new, but the ability to easily plug
this code into your environment (via Japplets, plug-ins, or ActiveX) is
revolutionizing the way computing can be done.

The problem with some folks today is that they expect the revolution to
end today. They expect every offered innovation to be complete, 100%,
without faults. If its not, then they pick it apart until they're blue
in the face. To what end, I ask? To do this despite the potential
benefits of the technology means that possibly useful technology can get
swept under the table in favor of more debate.

A Sandbox is not a complete answer to portable code, nor is ActiveX.
Both offer the potential for better computing, and both offer
feature/functionality that's needed in the model we're creating. One
offers limited functionality with increased security, the other offers
increased security with limited security. But this is true only when
looked at from a Browser perspective. Instead, we should be considering
them from a technology perspective.

The Sandbox was designed to interoperate with a single server, much the
same way that a terminal interoperates with its CPU. This has incredible
potential for smart devices (e.g. Set-Top devices), but its hardly
enough to replace the feature/functionality we get out of PCs today.
What's being missed here is the fact that the Sandbox was, and is, not
the technology. Java was a portable code language, designed to write
applications. The Browser with its Sandbox was simply a neat
implementation that allowed mini-Java programs (Japplets) to be
demonstrated and make headlines. That was an effort to sell the
technology, not the concept of a Sandbox. If someone walked up to you
today and said "I'm going to remove your access to your hard disk,
sorry" I think you'd have something to say about it.

ActiveX was, and is, an attempt to allow existing code to be used in a
distributed fashion. The technology is not new, as someone else pointed
out, its simply OLE for networks with some tweaking. As a technology it
was/is as needed as Java was/is. Since OLE wasn't Sandboxed, and no
aspect of MS operating systems is Sandboxed, ActiveX wasn't constrained,
why should it be? As a technology it allows you to implement as much
security as you've always been able to implement (in fact much more than
was previously possible).

The issue has been the way ActiveX has been demonstrated. Instead of
demonstrating the technology for what it is, its been implemented in a
Browser similar to the way that Java was. The Web was seen as the right
place to show how neato wow ActiveX could be. One big problem, however,
was that too many people drew a comparison between ActiveX and the Java
Sandbox. There is *no comparison*, they're two entirely different
technologies with different feature/benefits.

Now both developers are burdened with trying to make their demonstration
products better, partly because the code-starved crowd on the Internet
won't leave them alone to continue developing the technologies (which is
what we should do). We don't need a better Sandbox, nor do we need
better Authenticode for ActiveX, what we need are better OS' capable of
supporting these technologies and giving us the ability to configure
security the way we want.

This is where NT Security comes in.

Do I really want to run an application in order to get security on my
interactions, or does it make more sense to get my security implemented
at the time I log onto the box I'm sitting in front of, regardless as to
whether that box happens to be a NetPC or a full-fledged PC??

My point is that the Browser needs to be the OS, not some application
sitting on top of the OS. What's the use of implementing controls in a
Browser that don't apply to every application I might run on my box, all
of which might be able to do what a Browser does??? Should I have to
configure my security preferences in each and every one of these
applications, or would it make more sense that my security is defined in
my system profile and loaded when I log on? Once loaded, it would apply
to anything doing anything to anyone, anywhere.

If NT was configurable to create a Sandbox, wouldn't we all be thrilled?
I know I would, it would give me the ability to run applications within
restricted environments to avoid some of the risks associated with
"doing stuff", whatever that might be. Of course the Sandbox should be
configurable, and I should be able to have as many different ones as I
want simultaneously on the same box, but I damn well don't want it every
single time I do everything, do I.

>From the same perspective, I want the ability to download code that can
fully interact with my environment. Of course it should be forced to
acknowledge the security profile I've established for each of my
environments where I might run it, but within those constraints it
should be able to do anything a properly console-installed application
can do, why not??

Authenticode, for those of you who don't realize it, was and is intended
for the sale and distribution of software via networks. Its not intended
to be a security sticker, or an anti-virus flag. But the whole concept
of trust is still in its infancy, and there are far too many voices
willing to jump up and cry "Foul" over all sorts of esoteric ethical
issues. Trust will evolve into something that will satisfy most, it just
takes time. The point is, software vendors want some way to sell and
deliver that software via networks. My experience is that most
corporations today trust their vendors to supply them their orders
without a great deal of verification. They place an order, its
delivered, it gets installed (and this bit about a paper trail is really
a side issue, a paper trail can exist regardless of how the software is
sold or delivered).

So where's the issue. Well, because of the Browser implementation of
ActiveX in IE it today is possible for anyone to do most anything they
want (and stuff they might not realize they're doing also). True, to an
extent. A tool does exist to control what users are able to do, I got
it, it works, others have complained about how difficult it is to get
(which doesn't alter the fact it is possible to get it and it does
work). Even without it, though, its possible to write Profiles which
limit much of this access also (and MS should make this easier and more
accessible), NT Tools recently announced a video series that includes a
segment on just this sort of thing.

To bottom-line it:

1. I want NT to provide my security, not Internet Explorer, Netscape, or
any other individual application. This security should be applied via
User Profiles.

2. I want to create a shortcut and then apply security policy to that
shortcut, such that I could have two different shortcuts to the same
application where one runs in a Sandbox and the other doesn't, or one
accepts ActiveX controls and the other doesn't. And I want to be able to
prevent access to the program other than through one (or more) of these
shortcuts.

3. I want to see more 3rd-party vendors, like McAfee, write personal
Firewall type products that can provide some, or all, of the desired
features above. But if they write them such that they cannot be part of
Profiles, their useless.

While we're waiting for the above:

4. I want the components in IE that permit ActiveX downloads/installs to
be componentized so that 3rd-parties can write a replacement for it (or
wrapper). IE should be configurable so its not possible to run without
the appropriate replacement/wrapper.

5. I want to be able to say which IP addresses (or ranges) I'll accept
ActiveX controls from in IE and I don't want it to prompt me to install
them from any site not on my approved list, and of course I want that
approved list to be password protected so my user can't change it.

6. I want a list of the currently installed ActiveX controls and an easy
mechanism to delete them.

7. I want an easy configuration option to turn off check boxes to accept
controls from such that my users don't even know they
could do that.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security

Novell makes a product called Novell Administrator for Windows NT. It 
consists of an NLM on a 4.x Novell Server, a Service for your domain 
controllers, a NDS schema modification and a snapin for NWAdmin. 
 Basically, it allows you to "import" a domain into your NDS tree, and 
create "hybrid" users whose basic NT properties (what you would see in User 
Manager) can be set through NDS. It also allows you to change passwords 
from a single point, or your users to change both at once. It is a 
relatively new product, and I've had pretty good luck with it. The only 
major problems I've had have come from loss of communications between the 
NT service and the NLM which in turn causes the service to stop.

"Rumor" has it that Novell has something big in the works, that will go way 
beyond this in domain administration and integration through NDS. I can't 
get a thing out of my contacts.

Regards,

Chris Rietmann
Network Engineer

these words and ideas are my own and must not be taken as those of my 
employers.

-----Original Message-----
From: Mark Curphey [SMTP:m.curphey@rhbnc.ac.uk]
Sent: Sunday, August 31, 1997 2:28 PM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] Synchronizing between Novell and NT

Anyone know of any commercial solutions for synchronizing passwords between 
Novell and NT?

______________________________________
Mark Curphey
Insight Consulting
Churchfield House
The Quintet
Churchfield Road
Walton on Thames
Surrey
KT12 2TZ

Tel 01932 - 241000
Fax 01932 - 244590
Mobile 0410 - 034066
E Mail MarkC@insight.co.uk
E Mail m.curphey@rhbnc.ac.uk
World Wide Web www.insight.co.uk
World Wide Web www.curphey.com

> How can I get off this list? I've sent mail to majordomo@iss.net, and to
> ntsecurity-owner@iss.net. (I sent multiple requests, spread over a couple
> weeks.) The only effect has been to get signed up for the digest also,
> including all the bounce messages. 

 Problem was that you were coming in from a different E-Mail address
than what you subscribed under (jhurd@lucent.com). You were bounced
from the list this weekend. You have never been on ntsecurity-digest
and I can only suppose that you were confusing some of the spillover
from the guy with the missconfigured gateway (who has contacted me and
did apologise but has not resubscribed yet).

> Help would be appreciated.

> Jim Hurd jeh@ohgua.lucent.com 402.691.3299 
> Lucent Technologies
> Omaha, NE 68137


 Mike
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt

 
 Here we have the same situation: new network with Win NT4.0
servers and workstations (with sp3), ATM backbone and 3 domains: WinNT,
MacOS and Unix.
 We are to do hack atack on the system like Richard has described.
 Any help will be apreciated.
 
TIA, 

------------------------------- 
Carlos Eduardo P. Guidugli
Institute of Computing
State University of Campinas
-------------------------------

On Tue, 2 Sep 1997, Richard Woodward wrote:

> Hi, I have been following the list for some time now to learn as much about the security implications surrounding NT as possible.
> 
> The reason for this post is that we have now finished the installation of our network and my manager has informed me that we are to do HACK attack on the system in various situations.
> 
> 1. From a machine on the network without any prior passwords.
> 
> 2. From being logged on as a normal user trying to access prohibited areas.
> 
> 3. From outside the company trying to break through the firewall.
> 
> Any information or help people can provide will be greatly appreciated as we want to make this as good a test as possible.
> 
> System: ATM backbone, Win NT4.0 servers with service pack 3, Win NT4.0 Workstations.
> 
> Anyone wishing to help me please post privatly as i'm sure many of the list recepients have already heard most of this before :-)
> 
> Richard Woodward --Systems Administrator--
> 
> BNFL Sellafield. UK
> 
> 

On Tue, 2 Sep 1997, Carlos Eduardo P. Guidugli wrote:
> Here we have the same situation: new network with Win NT4.0
> servers and workstations (with sp3), ATM backbone and 3 domains: WinNT,
> MacOS and Unix.
> We are to do hack atack on the system like Richard has described.
> Any help will be apreciated.

IMO, hackers get way too much publicity and attention at the expense
of considering many equally damaging scenarios. So: prioritise.
What do you really need (not want) from your network?
Confidentiality? Integrity? or Availability?

In an academic environment, I would consider confidentiality as close to
impossible to achieve anyway -- bored staff and/or students can and do
install packet-sniffers on their own (or public) machines. And should
you (miraculously) discover the perpetrator, you may find the disciplinary
committee unsympathetic to your cause (these things are still widely
regarded as "pranks"...)

Also bear in mind that the common-or-garden firewall provides a particularly
sophisticated hardware/software solution, presenting (in the commonest
configuration) Yet Another Highly Complex Single Point Of Failure (tm).

And now ask yourself which is more likely to get yourself shouted at by
the most people: losing a significant part of your network connectivity
for three days (the water engineers cut your fibre channel by accident),
or someone hacking root?

 -- Bob R.Tinsley@rhbnc.ac.uk

Thanks for the reply.

Do you know what application, service or device may be using this 
KSECDD logon process? Many security logs are registering these 
"logons" both between workstations to workstations, as well as 
workstations to servers.

....................................................................... 
....................................
Ronnie Bouchon, MCSE, CNE
Infrastructure Systems Engineer
SAS Institute, Infrastructure Support Team
919-677-8000 x4367 | snorjb@wnt.sas.com


-----Original Message-----
From: Paul Leach [SMTP:paulle@microsoft.com]
Sent: Tuesday, August 26, 1997 2:08 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] logon types...

> From ntsecapi.h, available in the security subdirectory on the 
Win32
> SDK CD:
>
> //
> // Used by a logon process to indicate what type of logon is being
> // requested.
> //
>
> typedef enum _SECURITY_LOGON_TYPE {
> Interactive = 2, // Interactively logged on (locally or
> remotely)
> Network, // Accessing system via network
> Batch, // Started via a batch queue
> Service, // Service started by service controller
> Proxy, // Proxy logon
> Unlock // Unlock workstation
> } SECURITY_LOGON_TYPE, *PSECURITY_LOGON_TYPE;
>
>
>

Jay Heiser wrote:
 
> One product manager replied back that
> you don't need an application, you can do a great mail merge using awk,
> m4 & sed! I'm sure he could, but 99.99% of the world would be better
> off with an 'application'. Not a person who should have been creating
> specs for products intended for use by mortals.

Jay! Good to see you out and about. Anyway...I agree with most of what
you said (and I had a good off-list discussion with R.C. about all this.
He made some excellent points. The technology is needed and that's that.
The people want it and as you say, it's up to us to sort out the
details) But about this sed and awk thingy...Hehehhehe. In good humor,
now...answer me this: how many points and clicks would it take to do the
following:

1. Open all files within a directory hierarchy that had the following
extensions:
 List: *.c, *.txt, *.pl, *.html, *.js, *.java and *.bat (And remember,
we are 
 doing a recursive run through many subdirectories)

2. Take the first 10 and last 10 lines of each file (head, tail, blah,
blah)

3. Merge these together in a single, running file (in memory, of course)

4. Scan (grep, if you like) each line for one or more words (and we are
talking 
 word boundaries here, so - like Wall and Schwartz said - no "camels"
wander in
 when we're looking for "came")

5. Sort these back into memory, alphabetically (and eliminating any
dupes, as in
 sort -u)

6. Break out those lines into fields (split/splice/join/whatever)

7. Capture the first, third and fifth fields of that list and add
labels, (e.g.
 "awk '{print Field1:$1,Field3:$3,Field5:$5}'"

7. Replace those fields with some sort of descriptor; and

8. Lastly, use the final result as input to another command.

On the M$ platform (without installing TCL or PERL), one could spend
hours doing that. (Maybe even days.) With PERL and shell, it's a snap.
Though, I do see your point. That 99.9% is what is driving that
wonderful market out there and they put food on my table, so hey...I
rejoice. But when I need to do something like that described above, I
switch off this Pentium and march over to the RS/6000 or the SPARC. No
sooner than the command line is issued, my work is done. (Although, I
have to admit that some really decent scripting utilities are now
available for NT and 95.) Anyway...

Just expressing a little support for the toolsmiths of the industry. :-)

O.
On Tue, 2 Sep 1997 sfernando@mwd.dst.ca.us wrote:

> Please include me in your NT Security Issues bulletin distribution list.
> My e-mail address is sfernando@mwd.dst.ca.us. Thanks!
> 


 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)




>> I downloaded the most recent copy of EVERYONE2USER by David LeBlanc
>> from
>> the NTBUGTRAQ web site and did a bit of testing on NT 4.0 SP3. After
>> doing an EVERYONE2USER SOFTWARE and de-installing and re-installing
>> some
>> software, the system became unusable for anyone who was not part of
>> the
>> administrators group. 

Obviously this is unacceptable for a workstation, but what about a server?
Do you really want users logging on and running software? 

Needless to say the second part of this finding (that the Users group is
granted to much access) is a big problem. 

I think 2 basic steps should be taken in conjunction with setting up a 
new, secure NT *Server* 4.x.

 1. Starting at the root share of each local drive assign the following 
 permissions:
 Administrators Full Control (All) (All)
 CREATOR OWNER Full Control (All) (All)
 SYSTEM Full Control (All) (All)
 Recurse subdirectories replacing permissions on all existing files.

 2. Starting at the root of HKLM assign the following permissions:
 Administrators Full Control (All) (All)
 SYSTEM Full Control (All) (All)
 Recurse subdirectories replacing permissions on all existing files.

This configuration will permit file and print sharing. Additional server 
software (db server, mail server, etc.) should be installed by a user in the
administrators group. If the server software installs a user account to run
certain of it's services in the context of (MS SQL, IIS), it will generally set
permissions for that account accordingly. 

The administrator will have to do a little more work assigning rights each 
time he/she creates a new share. The goal however is to create an environment
where the administrator has to do work to *ALLOW* access instead of
restricting it. Why? Because failing to give Untrusted User access to 
something is never as easy to detect or forgive as failing to restrict his 
access.

Any comments?


-bryan (flame shield at maximum)



>> But about this sed and awk thingy...Hehehhehe. In good humor,
>>now...answer me this: how many points and clicks would it take to do the
>>following:
>>
>>1. Open all files within a directory hierarchy that had the following
>>...

>>On the M$ platform (without installing TCL or PERL), one could spend
>>hours doing that. (Maybe even days.) With PERL and shell, it's a snap.

Or any programming language with competent programmer behind the
wheel.

>> But when I need to do something like that described above, I
>> switch off this Pentium and march over to the RS/6000 or the SPARC. No
>> sooner than the command line is issued, my work is done. 

If you weren't using awk and sed you probably wouldn't need an RS/6000 or 
SPARC. :)

Just having fun...


-bryan (don't become a dinosaur, evolve)
>... Technologies
>like ActiveX etc may have the potential to do really great and nifty
>things, but they are still too young and insecure to be worth the risk,
>and the fact remains that you don't *need* them at all to use the
>internet or intranets productively.
>

If you need to perform mutual athentication using X.509 certificates over
TLS when using MS IE then you are going to have to use ActiveX. Unlike
Netscape, with its keygen tag, MS IE uses an ActiveX control to install the
end user certificate.

"To enable Microsoft Ineternet Explorer users to request and install client
certificates, you need to download and install the Certificate Enrollment
ActiveX control.

The Certificate Enrollment control enables Microsoft Internet Explorer
users to generate a private-public key pair and a corresponding PKCS#10
certificate request. Once the Certificate Authority (CA) processes the
certificate request and sends the certificate back as a PKCS#7 object, the
Certificate Enrollment control enables Microsoft Internet Explorer users to
install the certificate."

Microsoft has put us in a difficult position if we want to support users of
IE. ActiveX presents us with many security problems, yet we need ActiveX to
provide some forms of security within the IE browser.

Paul
>[much stuff about how you need an ActiveX control to do various basic
> things, such as reading pdf files, with Internet Explorer]

It seems to me that getting and installing an ActiveX control is
similar to getting and installing a Netscape plug-in, and no more
risky. Allowing random websites to send you ActiveX controls is a
very different matter. We block ActiveX at the firewall, but if my
users need to do something that requires a particular control, I
believe I could obtain it and distribute it to the users, without
opening up the whole ActiveX security nightmare. Or am I missing
something?

Steve Gaarder Network and Systems Administrator
gaarder@cmold.com C-MOLD, Ithaca, N.Y., USA


> ----------
> From: Dick Dasterdly[SMTP:morrison@ladyred.rsoc.rockwell.com]
> Reply To: Dick Dasterdly
> Sent: Saturday, August 30, 1997 3:57 AM
> To: Russ
> Cc: Jan Nelson; nt
> Subject: RE: [NTSEC] Thank you
> 
> On Sat, 30 Aug 1997, Russ wrote:
> 
> > .jam,
> > 
> > The scenario you're describing is identical to the one that befell
> > PowerPoint recently. Namely its ability to execute an application
> from
> > within a presentation became an issue when a PowerPoint viewer was
> used
> > in IE.
> 
> Well. Sort of. We are attempting to enforce a "no-ActiveX" policy.
> The problem is that, due to the design of the internal OS security 
> mechanisms, the users themselves have been given the responsibility 
> at the desktop to provide the enforcement. 
> 
Not true. Get the IEAK (IE Admin Kit). This will enable you to make the
default "no-ActiveX" and to remove the ability to change that without
recourse to the registry. (Under NT, even that can be ACLd.)

Paul

test

At 01:53 8/31/97 -0400, you wrote:

>> 1) The "inheritable" attributes are cleared. Before running
>> EVERYONE2USER, the keys (as dumped by DUMPACL) would show the same
>> permissions in both the "Own Key" and "Inheritable" columns. After
>> EVERYONE2USER was run, then the "Own Key" would show values, but the
>> "Inheritable" column would be blank. This has a very negative effect
>> as
>> any new keys which are created do not inherit the permissions of the
>> parent key, but rather get Administrators and SYSTEM with all access
>> as
>> the only permissions. This breaks just about any software installed
>> after EVERYONE2USER is run to which users (not administrators) require
>> access to registry keys.

I've figured out what is doing this - seems one of the API calls I used has
an undesirable side-effect. I will post a new version with this fixed
within the next day or two. Sorry for any difficulties it may have caused.

The API I used is (IMHO) poorly written to clear the flags, and I'll have
to drop to a different call that allows me to set them explicitly.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

On Sun, 31 Aug 1997, Michael Warfield wrote:

> Oh great! I've got scripts to deal with the bounce back to our
> site. I totally forgot to deal with the brain damaged mail systems that
> bounced messages back to the originator and didn't send US anything. Sorry.
> This is a major oversight on my part. Expect some bounce test messages
> shortly (if you haven't already seen them). DO NOT REPLY TO THEM! They
> will be coming from a special address set up specifically to weed the
> bounces out! Bouncing accounts and vacation programs are going to get toasted!


Thank you! Thank you thank you!!!!! :)


=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

New technology is required and cannot be stopped. Active-X is a good MS-PC
technology, and a good marketing/technology tool for MS to leverage out
non-MS platforms from the internet.

However just as releasing genetically altered insects and plants into
nature, one should be careful about the effects of a successful (widely
adopted) release.

The 'Signing' technology used to secure Active-X applications, and users by
default dismissing the annoying alert messages is a flawed combination.
Users accessing applications that can do most anything on your computers (or
network) with only a quickly dismissed OK button protecting your corporation
is (in an extreme) a global worm trojan just waiting to happen. For
internal networks this may be an acceptable risk, but for public networks
this remains a serious exposure.

The security mechanism used to control Active-X applications needs to be
tightened. However IMNSHO, when developing a web site, apps and scripts
which run on _all_ platforms should be used, rather than to limit your
clients to MS-PCs only.

The previous sites with the DLLMainAttack exploit are down, I'll make the
DLL available for inspection again later (URL to be announced).

Bill Stout
___________________________________________________________________________
Think globally, act locally. Stop tyranny, stop 'Political Correctness'.

We are using a combination of 3 security features (mandatory profiles, 
policies and ACL) to lock down 100+ workstations in our lab environment.
Some how the users are still able to save shortcuts to the desktop and 
rename icons (My Computer). What additional variable is needing to be 
configured to lock the desktop.

Thanks for the help.
I've been staying out of the web security discussions so far, but I've just
had occasion to download the IIS 4.0 beta and came across the following
message on the Microsoft Web-Site:

> Hint: If an Authenticode dialog box appears you may check the check box that
> says "In the future do not show this message for software published by:
> Microsoft Corporation" so that the download may proceed uninterrupted.

Make of this what you will...

 -- Bob R.Tinsley@rhbnc.ac.uk



> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> Sent: Tuesday, September 02, 1997 12:09 PM
> To: Paul Leach
> Cc: nt
> Subject: RE: [NTSEC] Thank you
> 
> On Tue, 2 Sep 1997, Paul Leach wrote:
> 
> > Not true. Get the IEAK (IE Admin Kit). This will enable you to make
> the
> > default "no-ActiveX" and to remove the ability to change that
> without
> > recourse to the registry. (Under NT, even that can be ACLd.)
> 
> Does that still come with the license terms that specify that you
> _must_
> put IE specific content on your hompage, and a MSIE logo there? If
> so,
> are there alternate licensing terms available? 
> 
I've never heard of any such terms. See
"https://ieak.microsoft.com/release2/ie_site_lda.asp?Code=2" for the
IEAK license agreement -- all I know is what I just read there.

The agreement does _grant_ the _right_ to use the MSIE logo. There are
lots of restrictions there about what you can do _if_ you choose to put
the "Best viewed with IE" logo on your site, but _nothing_ that says you
have to use the logo, or use any IE specific content.

Also, there are no hidden Satanic messages in IE or IEAK :-) 

Paul
thanks

A number of people have commented about the Internet Explorer
Administration Kit (IEAK) in the past, regarding its licensing.

It should be pointed out that along with the actual administration tools
the IEAK also grants the user license to redistribute IE itself (if they
so choose), which means you could become an IE distribution site, or
distribute it internally within your organization. This is obviously
more than a simple license to use the administration tools alone, and
need not be obtained.

I believe this fact has led to some confusion as to Microsoft's motives
behind the IEAK.

If reading a contract, its important to read all the contract...;-]

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security

People _should_ be encouraged to be civil. If they expect replies,
anyway.

> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> To: Russ
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Re: Java and Active-X controls
> 

> 
> Public personal attacks based on language won't change that, and
> degrade the 
> list as much as, if not more than a bunch of damn explicatives. 
> 
Paul
quit



> ----------
> From: Paul Ashton[SMTP:paul@argo.demon.co.uk]
> Sent: Tuesday, September 02, 1997 3:59 AM
> 
 

> The returned logon script is sent in the clear and none of the
> authenticators include anything based on it, therefore it can
> be replaced merely by changinging the packet and correcting the
> TCP checksum. I'm sure Paul Leach will point out if I'm
> mistaken in this.
> 
The login script is read using CIFS, isn't it? (I don't know.) If so,
then turning on SMB signing will cause it to be integrity checked with
an keyed MD5 hash using a key derived from the user's password. If not,
then it could be attacked as Paul Ashton describes (absent some other
mechanism I'm unaware of.)

Paul


At 12:53 9/1/97 -0400, you wrote:
>Hi
>These and other dangerous problems with EVERYONE2USER were reported on May
>14, 1997 and apparently, have not been fixed since that time.
>More details at:
>http://www.ntsecurity.com/redbutton/e2u.htm

Let's make some things clear - 

#1 If your company had told Microsoft what the problem was when they called
you a month prior to the release of RedButton, everyone2user would have
never been written.

#2 The bugs in everyone2user which you reported were fixed within hours of
them being reported. Your web page is out of date and incorrect.

You claim:

1) everyone2user confuses CREATOR_OWNER (and probably some other built-in
groups) with Everyone.

This has been fixed for some time, but you say this in present tense. I'm
sure you're not very happy with me, and this must be the reason you
publicly post something you know is now false. Please amend this to say
that the first version had this problem, but has been fixed for several
months.

2) As the CREATOR_OWNER has Full Control to almost entire HKLM registry
hive the utility gives Users Full Control to the majority of registry keys
under HKLM, e.g. Software and almost all subkeys,
System\CurrentControlSet and almost all subkeys etc.
In other words after applying everyone2user Users have Full Control to the
registry which gives any user ability to modify registry. This is not what
an administrator wants for internal users to be able to do.

This is a consequence of the problem cited above, and again is no longer
true. It is currently an untruthful statement, and I ask you to please
correct it.

3) The utility creates several ACEs within the same ACL for the users group
(which I consider as incorrect permissions)

This statement isn't entirely accurate to begin with, but is also a
consequence of the fact that the first version didn't handle creator/owner
correctly. Again, we all know this has been fixed for some time (the
second fix was built on 5/7).

There was also another problem regarding access denied ACEs, but that was
also fixed in the version posted on 5/7.

You also state "There is no way to fix the problems and to restore
permissions to initial values after applying everyone2user. The only
solution is to restore HKLM hive from the backup." This is definately
incorrect.

Your fourth point is certainly a problem, and now that I have been advised
of it, it will be corrected - very likely within the hour. Please see to
it that the inaccurate statements on your page are corrected.

Once I do fix it, please amend the fourth point to note that it has been
fixed - after you of course test and verify that my newest version does
indeed fix it.

Perhaps you should review the remainder of your web site. I've noticed
that there are other areas which were outdated and no longer true the last
time I visited it.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |



> ----------
> From: Paul B. Hill[SMTP:pbh@MIT.EDU]
> Reply To: Paul B. Hill
> Sent: Tuesday, September 02, 1997 11:00 AM
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] Re: Java and Active-X controls
> 
> 
> "To enable Microsoft Ineternet Explorer users to request and install
> client
> certificates, you need to download and install the Certificate
> Enrollment
> ActiveX control.
> 
> The Certificate Enrollment control enables Microsoft Internet Explorer
> users to generate a private-public key pair and a corresponding
> PKCS#10
> certificate request. Once the Certificate Authority (CA) processes the
> certificate request and sends the certificate back as a PKCS#7 object,
> the
> Certificate Enrollment control enables Microsoft Internet Explorer
> users to
> install the certificate."
> 
> Microsoft has put us in a difficult position if we want to support
> users of
> IE. ActiveX presents us with many security problems, yet we need
> ActiveX to
> provide some forms of security within the IE browser.
> 
This is a misinterpretation. To use one particular ActiveX control, you
do not have to enable automatic downloading of ActiveX controls in
general -- you can manually download and install just that one control.

Paul
quit


Running NT4.0 with IIS

I went to create a new user with simple FTP access.

When I created the user first, indicating a home directory of USER on a D
drive, all was well, until I went to set up the FTP alias, at which point
I was told that I did not have rights to the directory ( Yes I was logged
in as admin with full rights, etc... )

So I dropped out of there, and tried to access the directory using other
methods ( winfile, etc... ) and they all had the same result... you do not
have rights.... as admin, I could not even remove the directory!

I logged in as the user, and had no problems, and removed the directory.

Logging back in as admin ...
Now, I blew everything away, and started over, except this time I created
the directory USER first, then made the account indicating the home
directory, and then made the FTP alias... no problems at all!!

There are no profiles in use.

Why is it that admin can be denied access to a users directory?


At 19:37 2/09/97 -0400, you wrote:

>Why is it that admin can be denied access to a users directory?

I don't know if you have a unix background and are thus assuming that
Administrator "is" the system as in UNIX.
This is a fundamental misconception of NT file level security - you need to
learn more about permissions on files/directories. I would suggest Windows
NT Security Guide by Sutton for this area.

In short:
If you create a file with specified permissions only for a user, admin will
not be able to access it. This is a feature. If you want admins to have
free access to user files, then add Administrators group to the permissions.

In the case of an emergency, Administrators can take ownership of any
files, and then grant themselves whatever permissions they like. However
they can't give ownership back to anybody, so the original owner would know
if an Administrator barged in and took ownership of their files.



Regards,

Nicholas Andonakis, Security Engineer nicka@softway.com.au
Softway Pty. Ltd. Tel:+61 2 9698 2322
http://www.softway.com.au Fax:+61 2 9699 9174


On Tuesday, September 02, 1997 8:35 PM, Nicholas Andonakis wrote:
> At 19:37 2/09/97 -0400, you wrote:
> 
> >Why is it that admin can be denied access to a users directory?
> 
> I don't know if you have a unix background and are thus assuming that
> Administrator "is" the system as in UNIX.
> This is a fundamental misconception of NT file level security - you
need to
> learn more about permissions on files/directories. I would suggest
Windows
> NT Security Guide by Sutton for this area.
> 
> In short:
> If you create a file with specified permissions only for a user, admin
will
> not be able to access it. This is a feature. If you want admins to
have
> free access to user files, then add Administrators group to the
permissions.
> 
> In the case of an emergency, Administrators can take ownership of any
> files, and then grant themselves whatever permissions they like.
However
> they can't give ownership back to anybody, so the original owner would
know
> if an Administrator barged in and took ownership of their files.

Two comments:

Administrators can take ownership of a file only if they have the user
right assigned that allows them to do this.

Anyone with the user right to restore files *can* give a file back to
the original owner. Administrator has this right by default. You might
need the backup right to get the original security descriptor, too.

Maybe the "Windows NT Security Guide by Sutton" doesn't cover this.

-Chris


Greetings

I know I am posting to the wrong list, but as I have no where to turned to,
so please help me.

I have a NT server with 2 IP addresses. First is 203.127.35.67/24, and next is 172.26.1.2/24.
I tried to DHCP a range of IP addresses of the second IP network. But the windows 95 client
does not seems to receive the dhcp information.

Has anyone have a solution to this problem?

PLEASE help me ...


On Tue, 2 Sep 1997, Russ wrote:

> A number of people have commented about the Internet Explorer
> Administration Kit (IEAK) in the past, regarding its licensing.
> 
> It should be pointed out that along with the actual administration tools
> the IEAK also grants the user license to redistribute IE itself (if they
> so choose), which means you could become an IE distribution site, or
> distribute it internally within your organization. This is obviously
> more than a simple license to use the administration tools alone, and
> need not be obtained.

It's not clear to me that you don't need the second license to use the 
first from the wording of the first license.

> I believe this fact has led to some confusion as to Microsoft's motives
> behind the IEAK.
> 
> If reading a contract, its important to read all the contract...;-]

Right, this is definitely confusing, because the second, distribution 
license seemed tied directly to the IEAK license. I read it four times 
the first day, and three the next, and still came up with the stated 
impression that both were terms for the license to use the IEAK, and that I 
was having to agree to both terms to use the combination of both IE and 
the IEAK together. I'm not a lawgeek, but we strongly audit software licenses,
and abide fully by the terms. That means that an overly restrictive license 
will get the software ignored unless we can negotiate a different license. My
(mis)understanding of the terms put me in a position to not move forward with 
the software even in a limited test mode.

I hadn't run it past our lawgeeks yet, and our strategic browser choice is
still pending. I've got a meeting with one of the lawgeeks next week, and 
I'll do it then if I can get someone from Microsoft to confirm what Russ is 
saying as true at least in intent. 

Thanks,

Paul 
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

On Wed, 3 Sep 1997, Nicholas Andonakis wrote:
> In the case of an emergency, Administrators can take ownership of any
> files, and then grant themselves whatever permissions they like. However
> they can't give ownership back to anybody, so the original owner would know
> if an Administrator barged in and took ownership of their files.

Presumably an administrator is denied access to the raw disk?

Cheers,

 -- Bob R.Tinsley@rhbnc.ac.uk

I should clarify my wording.

When I said "redistribute IE itself", I meant redistribute it outside of
your company, as an ISP would. Under these circumstances, the licensing
is somewhat different (and more like Paul R. stated).

If you are only distributing IE within your company, then logo
requirements and the like are not required. Logo requirements would
still apply to your Internet Site if you desired adding an IE logo to
it, but it not a mandatory component of the IEAK.

There are 5 different licenses for IEAK, hence some of the confusion. If
you use IE, however, its an invaluable tool in your security arsenal,
and I found the licensing quite easy to comply with. YMMV.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security

>Two comments:
>
>Administrators can take ownership of a file only if they have the user
>right assigned that allows them to do this.

Yes, though this right is set by default, and if it had been taken away the
Administrator could (again, in the default situation) grant themselves this
right. It depends on how deeply you want to get into the explanation.

>Anyone with the user right to restore files *can* give a file back to
>the original owner. Administrator has this right by default. You might
>need the backup right to get the original security descriptor, too.

I didn't realise this. Is there a mechanism in the interface to "give" a
file to somebody else, or does one need to use a 3rd party utility/program?

>Maybe the "Windows NT Security Guide by Sutton" doesn't cover this.

Sarcasm noted, and I can see why you thought this. I didn't mean to sound
condescending. 
However I believe in giving beginners a recommendation as to a good source
of information so that if they want to learn they know where to go, and
give them an alternative to posting to what I believe is an advanced email
list.

Rather than give a starving person a fish, give them a rod and show them
how to fish for themselves. :-)



Regards,

Nicholas Andonakis, Security Engineer nicka@softway.com.au
Softway Pty. Ltd. Tel:+61 2 9698 2322
http://www.softway.com.au Fax:+61 2 9699 9174



>I think 2 basic steps should be taken in conjunction with setting up a
>new, secure NT *Server* 4.x.
>
> 1. Starting at the root share of each local drive assign the following
> permissions:
> Administrators Full Control (All) (All)
> CREATOR OWNER Full Control (All) (All)
> SYSTEM Full Control (All) (All)
> Recurse subdirectories replacing permissions on all existing files.
>
> 2. Starting at the root of HKLM assign the following permissions:
> Administrators Full Control (All) (All)
> SYSTEM Full Control (All) (All)
> Recurse subdirectories replacing permissions on all existing files.
>

OK, as the self appointed keeper of what file permissions should look like
on NT, let me break my oath of silence and PREannounce (in grand Microsoft
fashion - gotta stifle all of my competition out there) the vastly
reworked, new and improved NT Configuration Guide for the Paranoid. Hosted
as always at ftp://gnpr.pae.osd.mil/pub/nt/securing_nt.html (yup I got
smart and went with a global standard) I hope it can answer the questions
once and for all. (well almost) PLEASE NOTE!! as of this writing 9/2/97
01:00 GMT this thing isn't even 1/3 written yet. About all that's done is
the intro piece (see above URL).

If you want the previous version that covered only v3.51 and IIS v1.0c take
a look at the IIS installation guide in RTF/Word/PostScript format in the
same directory.

But let me tantalize you with grand sweeping vistas of as yet unreleased
product...
* Full NT4 coverage
* How to run IIS, FastTrack, IBM ICS, NetDynamics, Oracle as 'normal' users
in a pseudo "sandbox"
* How to build a (hopefully) hardened Internet server on NT that can
survive without a firewall
* How to rationally build NT based workgroups on which users will want to
do real work.
* How to scrape the gunk microsoft leaves lying around all over the
filesystem and registry

There are a bunch of weak areas yet to cover though. I'm no guru with
regard to the registry and while Everyone2User is a good tool I shrink from
using such a large hammer especially as all consequences have yet to be
understood. I also am doing this from pure experimentation without the
benefit of all of those sage books on doing NT security (or for that matter
the ResKit). No doubt I'm missing stuff. I'll have a section strictly on
'what I don't know how to do' and ever so often I might bug you guys for an
answer.

All contributions will be happily credited and I hope the downloads of this
edition will far exceed those of the previous.

But before you gleefully launch into it, remember IT AIN'T EVEN HALF
WRITTEN YET. I will post to the list again when it's ready. This project
will probably be my most useful contribution to the NT community to date.
(gotta make a name for myself somehow. Did you know dogs were this smart?
Oops, you guys were supposed to continue thinking my human master was the
one actually typing this up - see Dilbert)

KeyID = E6A285A2 FingerPrint = 3B1ACE7A081E926C2B4B 8E745FC748ACE6A285A2

Windows95: noun. 32-bit extensions and a graphical shell for a 16-bit
 patch to an 8-bit operating system originally coded for a 4-bit
 microprocessor, written by a 2-bit company that can't stand 1 bit of
 competition. (author unknown)


>The challenge is to set up an Exchange server behind a proxy server and
>have both inbound and outbound SMTP mail delivered. In
>Proxy 1.0, this required an SMTP relay agent on the Proxy server. In
>Proxy 2.0, we no longer need the relay agent as the Proxy
>server will allow protected access to the Exchange Server.
>
As far as I can figure, the solution given simply exposes port 25 on the
internal Exchange server to the Internet. Since the whole point of a
firewall is to protect internal systems, how does this setup protect the
Exchange server from any SMTP attacks? (I'm asking in ignorance.)

PJDM
----
Peter Mayne
Digital Equipment Corporation (Australia),
Canberra, ACT
These are my opinions, not DEC's.
This was typed by an infinite number of monkeys.
>
At 15:23 02/09/97 -0700, Paul Leach wrote:
>> The returned logon script is sent in the clear and none of the
>> authenticators include anything based on it, therefore it can
>> be replaced merely by changinging the packet and correcting the
>> TCP checksum. I'm sure Paul Leach will point out if I'm
>> mistaken in this.
>> 
>The login script is read using CIFS, isn't it? (I don't know.) If so,
>then turning on SMB signing will cause it to be integrity checked with
>an keyed MD5 hash using a key derived from the user's password. If not,
>then it could be attacked as Paul Ashton describes (absent some other
>mechanism I'm unaware of.)

I knew this would be nisunderstood as soon as I sent it. I meant the
*name* of the login script as returned by netLogonSamLogon(), not
forgetting of course the SIDs etc. This return packet from the DC
is not protected.

Paul
Peter,

It doesn't provide any protection at the application layer. But that is
not always what people define in their security policy. This is very
similar functionality to the Cisco PIX firewall and others that do
circuit-level, packet-level, and dynamic-packet filtering (Proxy 2
calles itself a dynamic packet filter).

If you want to add protection at the SMTP layer, you still need a
secured SMTP relay. You could run this on the Proxy 2 server _instead
of_ setting up the server proxy if you wanted.

The solution does, however, protect all other ports on the Exchange
Server from access by external hosts, and protects all other hosts on
the internal network from any access by external hosts. I'd say it's a
far sight better than most folks security today. And likely within the
cost/risk equation for many folks too.

As to SMTP, most of the attacks have not been against the protocol
itself, but against systems through which priviledged access could be
exploited through the SMTP application. Sendmail was the most notorious
source of exploits, but other mailers have been hit too. The SMTP
service on Exchange removes many of the potential exploits by the nature
of its implementation (script execution by aliases, userid exposure via
VRFY for example). What remains to be seen - and is true for all SMTP
mailers whether inside a proxy or performing relay functions, is whether
their implementation prevents buffer overruns that can be exploited.

Recent history has shown that the Exchange SMTP service adheres much
more strictly (sometimes to its detriment) to the relevant RFC's than
many other mailers. Sendmail, for example, adheres more strongly to the
principal of "Be liberal in what you accept and conservative in what you
send" whereas Exchange is conservative in both.

The long and short is that I am less concerned about the method of
system protection, than I am with the actual implementation. The fact
that I have to install client software and config files on the Exchange
server to make it work with the Proxy server seems a bit off - a pain in
the neck actually.

regards
Andy

=======================================================
Andy Webb awebb@swinc.com www.swinc.com
Simpler-Webb, Inc. Austin, TX 
 "Mauve has more RAM" - Dilbert
=======================================================

> -----Original Message-----
> From: Peter Mayne [SMTP:Mayne@mail.dec.com]
> Sent: Wednesday, September 03, 1997 1:34 AM
> To: '[NTSEC]'
> Subject: RE: [NTSEC] MS Exchange and MS Proxy 2.0 Beta ?
> 
> >The challenge is to set up an Exchange server behind a proxy server
> and
> >have both inbound and outbound SMTP mail delivered. In
> >Proxy 1.0, this required an SMTP relay agent on the Proxy server. In
> >Proxy 2.0, we no longer need the relay agent as the Proxy
> >server will allow protected access to the Exchange Server.
> >
> As far as I can figure, the solution given simply exposes port 25 on
> the
> internal Exchange server to the Internet. Since the whole point of a
> firewall is to protect internal systems, how does this setup protect
> the
> Exchange server from any SMTP attacks? (I'm asking in ignorance.)
> 
> PJDM
> ----
> Peter Mayne
> Digital Equipment Corporation (Australia),
> Canberra, ACT
> These are my opinions, not DEC's.
> This was typed by an infinite number of monkeys.
> >
 This message is just to appologise for the previous post.
I have recently installed IE4 Preview2 and i'm now using Outlook Express.
Since the message was the first i'd sent i hadn't realised that Outlook had
changed my previous mail settings to use HTML.
Hopefully all should now be ok.

finally I'd like to thank all the people who have replied with help


Hi all,

According to MS document "Securing Windows NT Installation"
(http://www.microsoft.com/ntserver/info/secure_NTinstall.htm),
recently updated (mid august), there is a key
Winlogon/CachedLogonsCount that when set to DWORD 0, is supposed to
prevent any caching of user credentials on the machine you're sitting
on. 

Did a quick test but as far as i can see, that key doesn't change
the caching behaviour. Test was:

1. created and set the CachedLogonsCount to 0 on a NTWS (NT4, SP3)
2. rebooted the computer (just in case...)
3. logged in as an admin
4. created a new user in the domain and logged out of the admin
account 
5. logged in as the new user and logged out
6. unplugged the networking cable
7. logged in as the new user again
8. got the "a domain ctrler for your domain could not be contacted,
you have been logged on using cached account info" dialog after a
couple of timeout values of time and was logged in as the new user

Now, that shouldn't have succeeded if there were no cached creds,
right? Or, am i misunderstanding something here?

--linus


------------------------------------------------------------------
Linus Nordberg | Email: linus@incolumitas.se
Incolumitas AB | Phone: +46-8-656 24 40
Warfvinges väg 16 | GSM: +46-706-75 74 72
S-112 51 STOCKHOLM, Sweden | PGP Bits/KeyID: 1024/F854DAB9
------------------------------------------------------------------
PGP fingerprint: 6A CC 4A 59 7A 49 D5 02 38 35 43 09 5F C0 84 F7
------------------------------------------------------------------


Hello, 

 Is there a way to reduce the memory alocated to file cache ?
Thanx. 


 Regards,
 Stef
We've tested V-One and MS Exchange. I'll describe you the situation
below.

The machines:

1. Exchange 5.0 Server SP1, NT 4.0 SP3 with all hotfixes
2. SmartGate Server, NT 4.0 SP3 with all hotfixes
3. SmartGate Client, Windows 95 SP1 and Exchange Client 4.0

The machines are physically connected in one network and have the
following IP addresses:

1. 10.0.0.3 255.255.255.0 (named support-2)
2. 10.0.0.140 255.255.255.0 (named support-1)
10.0.2.4 255.255.255.0
3. 10.0.2.3 255.255.255.0 (named dummy)

The explanation of these IP addresses is:

1 en 2 are able to communicate directly with each other so are 2 en 3.
The machines 1 and 3 can't connect directly. In all cases the SmartGate
server must be used to get a connection between 1 and 3.

I've defined three secure paths on the SmartGate server and client:

Host/IP Address Protocol Server Client Destination

Dummy TELNET 2021 1024 1024
Dummy TELNET 2022 1026 1026
Dummy TELNET 2023 135 135

I've also tried it with

Dummy TELNET 2023 1024 1024
Dummy TELNET 2023 1026 1026
Dummy TELNET 2023 135 135


On the Exchange server I've defined 2 tcp-ports (1024 and 1026). The
Exchange Server has to use these within client-connections. This is
described in MS Knowledge Base on
http://www.microsoft.com/kb/articles/q155/8/31.htm 

Then I've configured the Exchange client to connect to another Exchange
Server (10.0.2.5) correctly. After that i've changed the profile to
connect to the localhost (The SmatGate client).

When I start the Exchange client I can see my SmartGate client
connecting to the SmartGate server three times successfully. The
Exchange client then gives me an error like can't connect, network
problems etc...

To be sure everything between the SmartGate Server and the Exchange
server worked fine, I've installed an MS Outlook client on the SmartGate
server (support-1). In this situation I was able to connect to the
Exchange Server. Then I've configured (within NT) the machine where
SmartGate Server runs on to use only the following TCP ports 135,
138,139,1024,1026. Now when I tried to connect to the Exchange Server
(bypassing the SmartGate services), I got the same error as on my Win 95
machine using the SmartGate Server.

I figured that Exchange Server and client use more then 3 tcp ports to
communicate, so I've used the Network Monitoring utility of NT to
monitor the use of tcp ports while connecting with MS Outlook (on
support-1) to the Exchange Server (on dummy). I was right, Exchange and
Outlook did use some random TCP-ports between 1024 and 1600. I can't
explain that. I checked the registry of the Exchange server again, the
parameters are right (1024 and 1026) and I can't find anything about
this in MS Knowledge bases.

I hope someone can help us with this problem.
Remco Bakker
-- 
 Een veilig net met PointNet Security Systems bv
 http://www.pointnet.nl/pss
 Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
 PointNet Security Systems maakt deel uit van de PointGroup
 te Alphen a/d Rijn
Remco,

Download a copy of the MS document MS Exchange Server and Firewalls.
That will provide you more information on what is going on.

In essence, the Exchange client does setup and then chooses an higher
port to communicate over. If you need to "lock-down" the client, that
above mentioned document will describe how to limit the server. However
you will limit performance in doing so.
------------------------------------
Wesley.Peace@ncons.com
Microsoft Exchange/BackOffice MVP

"When things look dark, hold your head high so it can rain up your
nose.." -- anon.


> -----Original Message-----
> From: Remco Bakker [SMTP:rbakker@pointnet.nl]
> Sent: Wednesday, September 03, 1997 8:57 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Does exchange use random ports?
> 
> We've tested V-One and MS Exchange. I'll describe you the situation
> below.
> 
> The machines:
> 
> 1. Exchange 5.0 Server SP1, NT 4.0 SP3 with all hotfixes
> 2. SmartGate Server, NT 4.0 SP3 with all hotfixes
> 3. SmartGate Client, Windows 95 SP1 and Exchange Client 4.0
> 
> The machines are physically connected in one network and have the
> following IP addresses:
> 
> 1. 10.0.0.3 255.255.255.0 (named support-2)
> 2. 10.0.0.140 255.255.255.0 (named support-1)
> 10.0.2.4 255.255.255.0
> 3. 10.0.2.3 255.255.255.0 (named dummy)
> 
> The explanation of these IP addresses is:
> 
> 1 en 2 are able to communicate directly with each other so are 2 en 3.
> The machines 1 and 3 can't connect directly. In all cases the
> SmartGate
> server must be used to get a connection between 1 and 3.
> 
> I've defined three secure paths on the SmartGate server and client:
> 
> Host/IP Address Protocol Server Client Destination
> 
> Dummy TELNET 2021 1024 1024
> Dummy TELNET 2022 1026 1026
> Dummy TELNET 2023 135 135
> 
> I've also tried it with
> 
> Dummy TELNET 2023 1024 1024
> Dummy TELNET 2023 1026 1026
> Dummy TELNET 2023 135 135
> 
> 
> On the Exchange server I've defined 2 tcp-ports (1024 and 1026). The
> Exchange Server has to use these within client-connections. This is
> described in MS Knowledge Base on
> http://www.microsoft.com/kb/articles/q155/8/31.htm 
> 
> Then I've configured the Exchange client to connect to another
> Exchange
> Server (10.0.2.5) correctly. After that i've changed the profile to
> connect to the localhost (The SmatGate client).
> 
> When I start the Exchange client I can see my SmartGate client
> connecting to the SmartGate server three times successfully. The
> Exchange client then gives me an error like can't connect, network
> problems etc...
> 
> To be sure everything between the SmartGate Server and the Exchange
> server worked fine, I've installed an MS Outlook client on the
> SmartGate
> server (support-1). In this situation I was able to connect to the
> Exchange Server. Then I've configured (within NT) the machine where
> SmartGate Server runs on to use only the following TCP ports 135,
> 138,139,1024,1026. Now when I tried to connect to the Exchange Server
> (bypassing the SmartGate services), I got the same error as on my Win
> 95
> machine using the SmartGate Server.
> 
> I figured that Exchange Server and client use more then 3 tcp ports to
> communicate, so I've used the Network Monitoring utility of NT to
> monitor the use of tcp ports while connecting with MS Outlook (on
> support-1) to the Exchange Server (on dummy). I was right, Exchange
> and
> Outlook did use some random TCP-ports between 1024 and 1600. I can't
> explain that. I checked the registry of the Exchange server again, the
> parameters are right (1024 and 1026) and I can't find anything about
> this in MS Knowledge bases.
> 
> I hope someone can help us with this problem.
> Remco Bakker
> -- 
> Een veilig net met PointNet Security Systems bv
> http://www.pointnet.nl/pss
> Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
> PointNet Security Systems maakt deel uit van de PointGroup
> te Alphen a/d Rijn
Hi Paul

You say in your message that you have a Unix program that will compute the
initial session key for the domain member to domain controller that also
allows the RC4 encrypted LM and NT hashes to be computed.

Is this program (source?) available anywhere on the net? Can you post me a
copy.

Thanks

John Taylor
john@carrhouse.force9.net

----------
> From: Paul Ashton 
> To: e.v.zuuren@aranea.nl
> Cc: ntbugtraq@ntadvice.com; ntsecurity@iss.net
> Subject: RE: [NTSEC] NT domain member to domain controllerauthentication
protocol
> Date: 02 September 1997 11:59
> 
> At 12:00 02/09/97 +0200, Erik R. van Zuuren wrote:
> >>On first joining the domain the session key could be computed by
> >>anyone listening in on the network as the machine password has
> >>a well known value.
> 
> >[EvZ]
> >My info is apparently not so deep as your but: ??? the session key is 
> >based on amongst others the users paswword...that one never travels in 
> >clear (never say never...basic authentication and such)...over the 
> >network..so how should an outsider guess the Session-key ?
> 
> No, there is a session key for the domain member to domain controller.
> This occurs before a user logs in. Don't confuse SMB/CIFS authentication
> with that of domain authentication.
> I can compute the initial session key using a little program I wrote
> on Unix that takes the unicode host name and two challenges from the
> workstation and domain controller. It also allows me to decrypt the
> RC4 encrypted LM and NT hashes.
> 
> >>None of the returned user info such as logon script, profile path
> >>and SIDs *appear* to be protected by anything other than the TCP
> >>checksum.
> 
> >[EvZ] see remark above: session keys should be safe...
> 
> The returned logon script is sent in the clear and none of the
> authenticators include anything based on it, therefore it can
> be replaced merely by changinging the packet and correcting the
> TCP checksum. I'm sure Paul Leach will point out if I'm
> mistaken in this.
> 
> >Brings me to another point:
> >- does anyone know exactly what data between NT-servers and DC's goes 
> >encrypted and/or signed ?
> 
> The NT and LM OWF hashes are encrypted with RC4. Nothing else appears
> to be encrypted (this excludes PDC-BDC traffic).
> 
> Paul
And I'd be interested an' all ...

>----------
>From: John Taylor[SMTP:john@carrhouse.force9.net]
>Sent: 03 September 1997 10:54
>To: Paul Ashton
>Cc: ntsecurity@iss.net
>Subject: Re: [NTSEC] NT domain member to domain controllerauthentication
>protocol
>
>Hi Paul
>
>You say in your message that you have a Unix program that will compute the
>initial session key for the domain member to domain controller that also
>allows the RC4 encrypted LM and NT hashes to be computed.
>
>Is this program (source?) available anywhere on the net? Can you post me a
>copy.
>
>Thanks
>
>John Taylor
>john@carrhouse.force9.net
>
>----------
>> From: Paul Ashton 
>> To: e.v.zuuren@aranea.nl
>> Cc: ntbugtraq@ntadvice.com; ntsecurity@iss.net
>> Subject: RE: [NTSEC] NT domain member to domain controllerauthentication
>protocol
>> Date: 02 September 1997 11:59
>> 
>> At 12:00 02/09/97 +0200, Erik R. van Zuuren wrote:
>> >>On first joining the domain the session key could be computed by
>> >>anyone listening in on the network as the machine password has
>> >>a well known value.
>> 
>> >[EvZ]
>> >My info is apparently not so deep as your but: ??? the session key is 
>> >based on amongst others the users paswword...that one never travels in 
>> >clear (never say never...basic authentication and such)...over the 
>> >network..so how should an outsider guess the Session-key ?
>> 
>> No, there is a session key for the domain member to domain controller.
>> This occurs before a user logs in. Don't confuse SMB/CIFS authentication
>> with that of domain authentication.
>> I can compute the initial session key using a little program I wrote
>> on Unix that takes the unicode host name and two challenges from the
>> workstation and domain controller. It also allows me to decrypt the
>> RC4 encrypted LM and NT hashes.
>> 
>> >>None of the returned user info such as logon script, profile path
>> >>and SIDs *appear* to be protected by anything other than the TCP
>> >>checksum.
>> 
>> >[EvZ] see remark above: session keys should be safe...
>> 
>> The returned logon script is sent in the clear and none of the
>> authenticators include anything based on it, therefore it can
>> be replaced merely by changinging the packet and correcting the
>> TCP checksum. I'm sure Paul Leach will point out if I'm
>> mistaken in this.
>> 
>> >Brings me to another point:
>> >- does anyone know exactly what data between NT-servers and DC's goes 
>> >encrypted and/or signed ?
>> 
>> The NT and LM OWF hashes are encrypted with RC4. Nothing else appears
>> to be encrypted (this excludes PDC-BDC traffic).
>> 
>> Paul
>
I don't know if this was already discussed if it was could somebody
point me to the "discussion".

Systems: NT Workstation 4.0 + SP3 and NT Server 4.0 + SP3

1- A normal user (no admin privileges) request the presence of an 
administrator and ask him to check some logon problems with is login 
(or something alike, that needs admin privileges).
2- The user is already logged-in, the administrator executes the 
command \\server\c$ at the user workstation and a window asking 
for the login name and password is displayed.
3- The administrator types "administrator" and the correct password 
(I use this technique to avoid logout and login to gain admin privileges).
4- The window view to \\server\c$ is displayed and now the administrator 
can use the usual GUI admin utilities (User Manager, Server Manager, etc). 
The administrator doesn't find any problem and the user is asked to 
recheck and report if any problem occurs.
5- The administrator closes all admin applications and the window 
to \\server\c$ and leaves.
6- The user has a User Manager application (domain version) installed 
and executes it. Because NT Workstation has the admin privileges cache 
the user can change anything (e.g. administrator password) as administrator.

The security implications are obvious. If you use this technique to gain 
quickly admin permissions you must logout the user after.

In my point of view the cached information should be cleaned after 
the last privileged connection is closed.

Any comments?

Victor Fernandes (victor.dias-fernandes@dg12.cec.be)
Under NTFS, the only thing that makes the administrator special (with 
regard to file permissions) is that users in the administrators group have 
the ability to take ownership of objects. That's it! And, as a matter of 
fact, that right can be revoked! 

To recreate your problem below try this:
 
 1. Create a directory on an NTFS partition c:\ACLTest

 2. In explorer or winfile select the directory in the left pane.

 3. In explorer, select File/Properties from the menu, click on the 
 Security tab, and press the Permissions button. Or in winfile
 select Security/Permissions from the menu

 4. In the resulting dialog, click on the line that says 
 Everyone Full Control (All) (All)

 5. Click remove. 

 6. Click Add. In the resulting dialog select an individual user (Show 
 Users button) other than the user you are logged in as and give
 that user Full Control.

 7. Click Ok. 

You are now no longer able to access that directory or the files in it. 
To regain access (without logging in as the user) repeat steps 1-3 above
and change the permissions to include Administrators with full control. 

Note that the reason you are allowed you to change permissions at this
point is because you are the CREATOR/OWNER of the object To my 
knowledge, this behavior is not revocable (maybe Russ knows better). 
Full Control includes the Take Ownership (O) permission. If the user 
you gave exclusive rights logs in and takes ownership of the directory
you will have to invoke your administrator takes ownership spell (user 
manager - user rights) before you can change the permissions back.

-bryan
 



-----Original Message-----
From: The entropy Technician [SMTP:delchi@dorsai.org]
Sent: Tuesday, September 02, 1997 4:38 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Weird scenes inside the file mine



Running NT4.0 with IIS

I went to create a new user with simple FTP access.

When I created the user first, indicating a home directory of USER on a D
drive, all was well, until I went to set up the FTP alias, at which point
I was told that I did not have rights to the directory ( Yes I was logged
in as admin with full rights, etc... )

So I dropped out of there, and tried to access the directory using other
methods ( winfile, etc... ) and they all had the same result... you do not
have rights.... as admin, I could not even remove the directory!

I logged in as the user, and had no problems, and removed the directory.

Logging back in as admin ...
Now, I blew everything away, and started over, except this time I created
the directory USER first, then made the account indicating the home
directory, and then made the FTP alias... no problems at all!!

There are no profiles in use.

Why is it that admin can be denied access to a users directory?


At 10:54 03/09/97 +0100, John Taylor wrote:
>You say in your message that you have a Unix program that will compute the
>initial session key for the domain member to domain controller that also
>allows the RC4 encrypted LM and NT hashes to be computed.
>
>Is this program (source?) available anywhere on the net? Can you post me a
>copy.

No, but anyone should be able to reproduce it from the spec I wrote.
To be able to compute all the values in the NT authentication protocol
requires a DES library (libdes-4.01), RC4 (arcfour.c from SSH-1.2.20)
and MD4 (samba-1.9.17) and a 100 or so lines of code. My program
has other stuff in it and so I don't want to release it. It would
be good if someone else were to write it and confirm my specification
(I'd be glad to assist with any clarifications).

To grab the machine password you can use lsadump from:-
http://ntbugtraq.rc.on.ca/SCRIPTS/WA.EXE?A2=ind9708&L=ntbugtraq&O=T&P=1230
Usage: lsadump $machine.acc

Cheers,
Paul
Victor Fernandes wrote:

>>5- The administrator closes all admin applications and the window 
>>to \\server\c$ and leaves.

Just closing the window won't do it. You need to disconnect from that 
share. NET USE Z: /DELETE *or* Tools/Disconnect Network Drive *or* 
Disk/Disconnect Network Drive.

I don't think client side caching applies here.

-bryan
The name of the "My Computer" icon is stored under

HKLM\Software\Classes\CLSID\20D04FE0-3AEA-1069-08002B30309D.

By default users can change this registry setting. You will need
to change the permisson for this key on each of the workstations.

> From satterl@ksu.edu Tue Sep 2 14:24:56 1997
> 
> We are using a combination of 3 security features (mandatory profiles, 
> policies and ACL) to lock down 100+ workstations in our lab environment.
> Some how the users are still able to save shortcuts to the desktop and 
> rename icons (My Computer). What additional variable is needing to be 
> configured to lock the desktop.
> 
> Thanks for the help.
> 
One solution may be to hide all the desktop items. In this case you
would provide access to the applications only through the start menu.
You can use systems policies to implement this solution.

There may be a better solution but this is the only one I know.

You can also improve your policies by using the templates that come with
ZAK.

Jorge.
(This is not an official answer from Microsoft. It's just me trying to
help)

> -----Original Message-----
> From: Janet Dueck [SMTP:janet@cs.sfu.ca]
> Sent: Wednesday, September 03, 1997 8:09 PM
> To: ntsecurity@iss.net
> Cc: satterl@ksu.edu
> Subject: Re: [NTSEC] Locking the desktop
> 
> The name of the "My Computer" icon is stored under
> 
> HKLM\Software\Classes\CLSID\20D04FE0-3AEA-1069-08002B30309D.
> 
> By default users can change this registry setting. You will need
> to change the permisson for this key on each of the workstations.
> 
> > From satterl@ksu.edu Tue Sep 2 14:24:56 1997
> > 
> > We are using a combination of 3 security features (mandatory
> profiles, 
> > policies and ACL) to lock down 100+ workstations in our lab
> environment.
> > Some how the users are still able to save shortcuts to the desktop
> and 
> > rename icons (My Computer). What additional variable is needing to
> be 
> > configured to lock the desktop.
> > 
> > Thanks for the help.
> > 

>OK, as the self appointed keeper of what file permissions should look like
>on NT, let me break my oath of silence and PREannounce (in grand Microsoft
>fashion - gotta stifle all of my competition out there) the vastly
>reworked, new and improved NT Configuration Guide for the Paranoid. Hosted
>as always at ftp://gnpr.pae.osd.mil/pub/nt/securing_nt.html (yup I got
>smart and went with a global standard) I hope it can answer the questions
>once and for all. (well almost) PLEASE NOTE!! as of this writing 9/2/97
>01:00 GMT this thing isn't even 1/3 written yet. About all that's done is
>the intro piece (see above URL).

I checked out the doc referenced above. You really should consider the 
impact on readability that your constant Microsoft ranting tangents have.
I'm not real certain that I would trust your professional opinion given such
an unprofessional context. 

You should also give explanation as to why file permissions should be set 
the way you suggest. Excluding the administrators from certain trees is 
worthless given that they can take ownership and give themselves permission.

BTW: the changes that you reference for turning Workstation into Server no 
longer works under 4.0 (it won't allow you to change the Product Type). I
realize that it violates your sense of fairness that Microsoft, a business, would
want to make money with it's server products on a per client basis (much in the 
same way Sybase, Oracle, and Novell have for years).


-bryan (don't be a dinosaur, evolve)

How do I change the default TTL for NT? Our servers stick out like a
sore thumb, and firewalls/proxies are not an option...

Cheers,

 -- Bob R.Tinsley@rhbnc.ac.uk

>In my point of view the cached information should be cleaned after 
>the last privileged connection is closed.

You want to tell me what you consider "closed"? Even if I disconnect
from the network share, I've already been given credentials which are
valid for my RPC sessions with the Server as Administrator, so until
they time out (i.e. the Server times out the client), those credentials
will remain valid. Unless of course you log out...

>3- The administrator types "administrator" and the correct password 
>(I use this technique to avoid logout and login to gain admin
privileges).

Here's your problem right here, its your security policy that's
ineffective, not the caching of your credentials.

Your use of this "technique" violates good security policy. The user
could be running a program to capture keyboard input (that's one reason
why the ctrl-alt-del is required to log in), for example. Obviously
logging off as the current user, then logging on as your administrative
user (not administrator, and with network profiles enabled and local
caching of profiles disabled) makes the issue go away, quite simply.

If cached credentials are done away with, then network traffic increases
(potentially dramatically) and performance takes a hit also. It may be
what you want, just to avoid having to log off and on again as an
administrative user, but I personally wouldn't want to see such a change
in NT.

I'd suggest you change your technique then look for similar
vulnerabilities, you'll probably find your issue resolved.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security

This morning when I come to office, I found out that one of my server 
pop out a Doctor Watson message, saying that he can't find 
drwtsn32.log file and asking me to create a directory for it. I 
suspect that this cause by the drwtsn32.log is too big already. I am 
not sure that whether I can delete drwtsn32.log file or not. Will NT 
generate this file again after I delete it?

regards,
gek po

I found out that my server memory.dmp and user.dmp file is above 
50MB. Can I delete it? This two file are generated automaticaly by 
NT, right?

regards,
gek po


>I checked out the doc referenced above. You really should consider the 
>impact on readability that your constant Microsoft ranting tangents have.
>I'm not real certain that I would trust your professional opinion given such
>an unprofessional context. 
Matthew like myself and many others I am sure are 'ranting' when it
comes
to Microsoft products for a very good reason. It is crap.
When you are sentenced to use proprietary, untested, bugridden,
overblown
products on a consistant basis, you are bound to develop just a tad of
psychosis.
Ive been doing it for over 10 years and I positively despise what
Microsoft makes me do.

Case in point. IIS 3.0 install. It took me 2 days to set up Apache WWW
server
(including the learning curve) on a UNIX box. It took us 3 weeks to set
up
IIS correcty with all the f*cking around we had to go through to get it
going right.

Its gotten so bad in South Australia that the government will not buy
anything
but Microsoft even where better products are available 
(eg:Lotus notes cant be had).

In fact I would see "Microsoft ranting" as a sign of a seasoned
professional
as anyone else is either too new to the field or does little but change
tapes.

> I realize that it violates your sense of fairness that Microsoft, a
>business, would
>want to make money with it's server products on a per client basis (much in
>the 
>same way Sybase, Oracle, and Novell have for years).
Do they really need to "make money" more than they used to?
Do we need another MSN? Microsoft TV? Microsoft Democracy?
>
>
>
I think that the problem here is based on the fact that the mechanism that
you are using for gaining administrative privelages is not being used in
the way that it was intended.

The normal login process (using the dialog obtained only after startup or
ctrl-alt-del) (sometimes called "primary logon") is used by NT as something
of a trusted path. If you want to have administrative privelages on a
machine, you are supposed to login using an account with such privelages.
If you are a normal user and need to something as an administrator, then
you are supposed to logout and login again.

The method you are using (sometimes called "secondary logon") of connecting
to administrative shares was designed so that an administrator could obtain
adminstrator access to REMOTE computers.

It is important that you raised this practice as obviously this method
could be used as a social engineering attack on unrealising administrators.
This is all the more reason that the general principle should be followed
by adminstrators that they don't give administrative password to anything
that asks for it, but only to the mechanisms NT intended them to.

Unix accomplishes what you are trying to do with the su command, which has
a discrete login and logout. The Resource Kit contains an NT version, and I
think I've seen 3rd party versions too.

I am not sure if this will work the way it should, but with remote
connections this is how you do it:
If you do a "net use" you will probably see a connection to the hidden ipc$
share. You need to remote that connection.
net use \\server\ipc$ /delete will do it if the connection hasn't got
anything open. Note!!! This will say that it succeeded but won't if you
still have windows using the connection open in the GUI (and probably other
situations.)



At 16:47 3/09/97 +0200, you wrote:
>I don't know if this was already discussed if it was could somebody
>point me to the "discussion".
>
>Systems: NT Workstation 4.0 + SP3 and NT Server 4.0 + SP3
>
>1- A normal user (no admin privileges) request the presence of an 
>administrator and ask him to check some logon problems with is login 
>(or something alike, that needs admin privileges).
>2- The user is already logged-in, the administrator executes the 
>command \\server\c$ at the user workstation and a window asking 
>for the login name and password is displayed.
>3- The administrator types "administrator" and the correct password 
>(I use this technique to avoid logout and login to gain admin privileges).
>4- The window view to \\server\c$ is displayed and now the administrator 
>can use the usual GUI admin utilities (User Manager, Server Manager, etc). 
>The administrator doesn't find any problem and the user is asked to 
>recheck and report if any problem occurs.
>5- The administrator closes all admin applications and the window 
>to \\server\c$ and leaves.
>6- The user has a User Manager application (domain version) installed 
>and executes it. Because NT Workstation has the admin privileges cache 
>the user can change anything (e.g. administrator password) as administrator.
>
>The security implications are obvious. If you use this technique to gain 
>quickly admin permissions you must logout the user after.
>
>In my point of view the cached information should be cleaned after 
>the last privileged connection is closed.
>
>Any comments?
>
>Victor Fernandes (victor.dias-fernandes@dg12.cec.be)
>

Regards,

Nicholas Andonakis, Security Engineer nicka@softway.com.au
Softway Pty. Ltd. Tel:+61 2 9698 2322
http://www.softway.com.au Fax:+61 2 9699 9174


ohh !£$% just realised my error, please ignore the last message !!

Pete

----------
From: Pete Vickers
Sent: 04 September 1997 09:07
To: 'bryanw@reston.ans.net'
Cc: 'ntsecurity-digest@iss.net'
Subject: congrats

Bryan,
.....
Pete
Adtranz (Signal) Ltd.


Bryan,

just had a quick look at ftp://gnpr.pae.osd.mil/pub/nt/securing_nt.html 
... very good, a lot of common sense stuff,
but info on file perms is something I just never got
around to. Glad to see someone, who instead of just
bitching about M$, actually does something constructive
about it, keep up the good work.

Pete
Adtranz (Signal) Ltd.

Right people,

Firstly the document I downloaded from Microsoft, mentioned in Linus Norberg's email, is incorrect. It is not a REG_DWORD it is a REG_SZ.

Secondly it does work but it is very very untidy. I'll explain:

1) Deleted the old key and created the new one as a REG_SZ
2) Rebooted the machine (Needed)
3) Logged on as an end-user and the logged off.
4) Pulled the network cable
5) Logged back in.
6) The end-user is HIT with the question "A slow network connection has been detected. Do you wish to download or use the local profile."
7) I chose Download.
8) The next message displayed was "A domain controller for your domain couldn't be located" Bla bla bla. You will be logged on using cached information"
9) The user is simply logged off. No messages nothing.

If you answer Use Local in Number 7 above then its even better. My machine after going to the toilet, making a drink and writing this e-mail is still sitting there with the blue screen. Reminds me of the 3.51 problem when loggong off 

Give it a try chaps and let me know the outcome.

I've informed Microsoft that its very very untidy. Lets see what happens.

Thanks

Jas.
Hello,

Exchange use, in fact random port, the situation also occurs when you 
use Exchange Administrator to administer remote servers...
I found a article in TechNet confirming this (the Admin random port 
stuff) but I don't find reference again...
You can use netstat -a to show used port on your client.
Actually, I just checked 2 clients machines (connected to the same MSX 
server) and indeed they use random ports (one 1026 and 1028, the other 
1029 and 1030).

Good luck

Stephane Mabille
DEC Exchange support.

-----Original Message-----
From: Remco Bakker [SMTP:rbakker@pointnet.nl]
Sent: Wednesday, September 03, 1997 2:57 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Does exchange use random ports?

We've tested V-One and MS Exchange. I'll describe you the situation
below.

The machines:

1. Exchange 5.0 Server SP1, NT 4.0 SP3 with all hotfixes
2. SmartGate Server, NT 4.0 SP3 with all hotfixes
3. SmartGate Client, Windows 95 SP1 and Exchange Client 4.0

The machines are physically connected in one network and have the
following IP addresses:

1. 10.0.0.3 255.255.255.0 (named support-2)
2. 10.0.0.140 255.255.255.0 (named support-1)
10.0.2.4 255.255.255.0
3. 10.0.2.3 255.255.255.0 (named dummy)

The explanation of these IP addresses is:

1 en 2 are able to communicate directly with each other so are 2 en 
3.
The machines 1 and 3 can't connect directly. In all cases the 
SmartGate
server must be used to get a connection between 1 and 3.

I've defined three secure paths on the SmartGate server and client:

Host/IP Address Protocol Server Client Destination

Dummy TELNET 2021 1024 1024
Dummy TELNET 2022 1026 1026
Dummy TELNET 2023 135 135

I've also tried it with

Dummy TELNET 2023 1024 1024
Dummy TELNET 2023 1026 1026
Dummy TELNET 2023 135 135


On the Exchange server I've defined 2 tcp-ports (1024 and 1026). The
Exchange Server has to use these within client-connections. This is
described in MS Knowledge Base on
http://www.microsoft.com/kb/articles/q155/8/31.htm

Then I've configured the Exchange client to connect to another 
Exchange
Server (10.0.2.5) correctly. After that i've changed the profile to
connect to the localhost (The SmatGate client).

When I start the Exchange client I can see my SmartGate client
connecting to the SmartGate server three times successfully. The
Exchange client then gives me an error like can't connect, network
problems etc...

To be sure everything between the SmartGate Server and the Exchange
server worked fine, I've installed an MS Outlook client on the 
SmartGate
server (support-1). In this situation I was able to connect to the
Exchange Server. Then I've configured (within NT) the machine where
SmartGate Server runs on to use only the following TCP ports 135,
138,139,1024,1026. Now when I tried to connect to the Exchange Server
(bypassing the SmartGate services), I got the same error as on my Win 
95
machine using the SmartGate Server.

I figured that Exchange Server and client use more then 3 tcp ports 
to
communicate, so I've used the Network Monitoring utility of NT to
monitor the use of tcp ports while connecting with MS Outlook (on
support-1) to the Exchange Server (on dummy). I was right, Exchange 
and
Outlook did use some random TCP-ports between 1024 and 1600. I can't
explain that. I checked the registry of the Exchange server again, 
the
parameters are right (1024 and 1026) and I can't find anything about
this in MS Knowledge bases.

I hope someone can help us with this problem.
Remco Bakker
--
 Een veilig net met PointNet Security Systems bv
 http://www.pointnet.nl/pss
 Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
 PointNet Security Systems maakt deel uit van de PointGroup
 te Alphen a/d Rijn

I want to be able to detect it when someone is probing an NT (and to a
lesser extent, Win95) box. I don't just want to deny access, if someone is
probing me I want to know about it. 

If there isn't an inbuilt way to do it, recommendations as to 3rd party
software - preferably low cost :-) are welcome. I've heard the term
"personal firewall" but I don't believe they actually do what I would think
this term meant (e.g. virus scanners.) Anybody know of such a beast?

TCP/IP Ports
--------------
Your "classic" port scan is scanning tcp/udp ports for servers. I know in
the TCP/IP Advanced Options..Security one can permit/deny traffic. 
-Can I log attempts to connect to denied ports? If the answer is no, then I
suppose an interesting work-around is a server that listens on a port and
logs incoming traffic?
-Generally with NT and TCP/IP ports, does "netstat -an" definitely show all
listening ports or is there a way for an application to avoid detection here?
-I think this has been asked, but why does my SP3 machine have a connection
to itself around the 1025 area?

SMB Based Networking
--------------------
NT's default configuration is to have Netbios over tcp/ip enabled - windows
networking over tcp/ip. It seems to me that this is designed for a LAN
behind a firewall, and pretty scary if you are connected to the Internet
via PPP.
Assuming that you want to keep it enabled though, how can I get immediate
notification/alert when someone has connected to my machine?

Solutions that have occured to me are writing a script that runs netstat
and examines it periodically, or have performance monitor running and
looking for a connected users counter or something. Is there anything more
elegant than this?

I think I once saw a perl script that would run a large number of secondary
logon attempts on one's machine in a short space of time. Does anybody have
something like this?



Regards,

Nicholas Andonakis, Security Engineer nicka@softway.com.au
Softway Pty. Ltd. Tel:+61 2 9698 2322
http://www.softway.com.au Fax:+61 2 9699 9174


Our setup is such that we have a local user who is automatically logged on
for each workstation. Students are then connected to their Netware home
directory at login by the Novell IntraNetware client. We use system policies
and a mandatory profile for the local (automatic) user which is used by each
student. They cannot update the profile (fudged mechanism applied to ensure
this).

To ensure students cannot change "My Computer" to anything else (rude or
otherwise!) we make its registry key (see path below) Read only for the local
(automatic login) user and user INTERACTIVE. If we only changed the rights
for the local user (i.e. ignored INTERACTIVE), students could still change
the icon's name.

To stop students creating shortcuts on the desktop, we make the Desktop
folder in the local (automatic) user's Profiles folder read only (NTFS
permissions).

Tip: use only NTFS parititons and tie the permissions down as tightly as 
possible!

HTH,
Adrian.

> > -----Original Message-----
> > From: Janet Dueck [SMTP:janet@cs.sfu.ca]
> > Sent: Wednesday, September 03, 1997 8:09 PM
> > To: ntsecurity@iss.net
> > Cc: satterl@ksu.edu
> > Subject: Re: [NTSEC] Locking the desktop
> > 
> > The name of the "My Computer" icon is stored under
> > 
> > HKLM\Software\Classes\CLSID\20D04FE0-3AEA-1069-08002B30309D.
> > 
> > By default users can change this registry setting. You will need
> > to change the permisson for this key on each of the workstations.
> > 
> > > From satterl@ksu.edu Tue Sep 2 14:24:56 1997
> > > 
> > > We are using a combination of 3 security features (mandatory
> > profiles, 
> > > policies and ACL) to lock down 100+ workstations in our lab
> > environment.
> > > Some how the users are still able to save shortcuts to the desktop
> > and 
> > > rename icons (My Computer). What additional variable is needing to
> > be 
> > > configured to lock the desktop.
> > > 
> > > Thanks for the help.
> > > 
> 

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Adrian Rich, University Computing Service, University of Leeds,
 Leeds LS2 9JT UK
Tel: (+44) (0)113 233 5687 Fax: (+44) (0)113 233 5411
Email: A.N.Rich@leeds.ac.uk
++++++++++ http://www.leeds.ac.uk/ucs/people/ANRich +++++++++++
Jason Jarvis wrote:
>Right people,
>
>Firstly the document I downloaded from Microsoft, mentioned in Linus Norberg's
> email, is incorrect. It is not a REG_DWORD it is a REG_SZ.

Great. Trial and error?


>Secondly it does work but it is very very untidy. I'll explain:
>
>1) Deleted the old key and created the new one as a REG_SZ
>2) Rebooted the machine (Needed)
>3) Logged on as an end-user and the logged off.
>4) Pulled the network cable
>5) Logged back in.

Here, after a while, I get (NTWS 4, SP3, no HotFixes) a dialog
entitled "Logon Message" saying "The system cannot log you on now
because the domain DOMAIN is not available." Then I'm back to the
logon dialog. NT version dependant?

--linus
------------------------------------------------------------------
Linus Nordberg | Email: linus@incolumitas.se
Incolumitas AB | Phone: +46-8-656 24 40
Warfvinges väg 16 | GSM: +46-706-75 74 72
S-112 51 STOCKHOLM, Sweden | PGP Bits/KeyID: 1024/F854DAB9
------------------------------------------------------------------
PGP fingerprint: 6A CC 4A 59 7A 49 D5 02 38 35 43 09 5F C0 84 F7
------------------------------------------------------------------


Stephane,Wesley et al,
thanks for the advise. All answers like"
http://www.microsoft.com/exchange/deployment/techsupport/exchsec.htm.
The latter part of the document should provide you the information you
need." 
tell me how to configure Exchange to use specified ports, we did this
and Exchange doesn't use the ports we prescribed as mentioned in the
earlier posting. Any ideas?
Remco
-- 
 Een veilig net met PointNet Security Systems bv
 http://www.pointnet.nl/pss
 Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
 PointNet Security Systems maakt deel uit van de PointGroup
 te Alphen a/d Rijn
hi all,

i read mirosoft recommendations about registry permissions in the paper
"securing windows nt installions", but how will i do what automatically in
an unattended setup.
any experience with this guide?

does everyone know a command line utility, or a workaround to do something
like this?
i found regini in the resourcekit but it can`t set special rights.

i am not familar with perl-programming, but is it possible to do something
like this with perl?

thank you for your help
holger gelhausen
Subject: 
Proxy Server 2.0 features & market positioning by Microsoft Program
Manager
 
Date: 
Wed, 03 Sep 1997 19:57:14 -0700

From: 
Kerry 

Organization: 
Microsoft

Newsgroups: 
microsoft.public.proxybeta




This message is in response to a posting by Itai Dor-on on this
newsgroup
about Proxy Server version 2.0 Beta. Itai had several questions about
Proxy
Server 2.0 features, security, and market positioning.

I am a Program Manager for Microsoft Proxy Server. I would like to
clarify
the feature-set and market positioning of Proxy Server v2.0, and respond
to
some specific comments in Itai's posting.

Proxy Server version 2.0 is currently in 'Beta' status, with the final
retail release scheduled for later this calendar year. I would like to
apologize for lack of complete product documentation & marketing
information at this time. We are working on improved documentation on
the
product, to be available before or at product final release. In order to
give many people access to our beta versions for evaluation and feedback
purposes, we made the decision to put these pre-release versions on the
web. We did this, knowing that the final complete set of documentation
and
marketing information was under development and ask beta customers to be
patient while we finish this up and make it available as soon as
possible.

First, a bit of history: Microsoft Proxy Server version 1.0, released
last
October, was positioned as an extensible (via ISAPI) security &
performance
product for connecting private networks to the Internet. The product
includes an application-layer proxy service (Web Proxy) for http, ftp &
gopher, and a circuit-layer (Windows Sockets API layer) proxy service
(WinSock Proxy) for support of all Internet protocols by transparently
remoting client TCP/UDP requests. The version 1.0 product offers the
following features:
- Performance & Management
 - Passive Caching
 - Active Caching
 - Tight Integration with Windows NT & IIS
 - Easy GUI setup & admin tools
 - Dial-on-Demand
 - Support for IPX/SPX or TCP/IP on private network

- Security
 - Runs on dual-homed machine with IP routing disabled
 - Built on top of the Windows NT secure networking O/S
 - IP address aggregation (hides internal addresses)
 - Uses a Local Address Table (LAT) to identify internal/external
addresses
& block external requests
 - Access control by user, protocol, domain (both proxy services)
 - Transaction logging to file or database
 
We do not refer to Proxy version 1.0 as a firewall, because it does not
have the complete set of security features and functionality we consider
necessary to position the product as a firewall. However, we do say that
Proxy version 1.0 has 'firewall class securty' because all of our
testing
indicates that when configured properly, the Windows NT 4.0 and Proxy
Server 1.0 combination offer a very high level of security. In fact, in
an
independent security evaluation of Proxy Server v1.0 by Coopers &
Lybrand,
they did not find any security risks associated with the product (please
download the Coopers & Lybrand whitepaper from
http://www.microsoft.com/proxy/).

Proxy v2.0: Microsoft Proxy Server version 2.0 Final Beta was made
available on the web this week. Proxy Server version 2.0 is "An
extensible
firewall and content cache server, providing Internet security while
improving network response-time and efficiency". The most significant
features added to the version 2.0 product are:
- Performance & Management
 - Hierarchical Caching
 - Distributing Caching
 - Administration of multiple proxies
 - Product-wide performance improvements
- Security
 - Dynamic Packet Filtering
 - Logging of dropped packets
 - Real-time alerting
 - Reverse Proxy/Virtual Hosting
 - Server Proxy (support for internal servers)

In addition, we've added a SOCKS version 4.3 service to improve our
support
of non-Windows clients. We also continue to support extensibility via
the
ISAPI Filter APIs for compatibility with Proxy Server add-ons developed
by
independent software vendors for Proxy Server versions 1.0 and 2.0.

Proxy Server version 2.0 offers security at three layers. We offer
application-layer proxies for http, ftp, gopher (Web Proxy) and
circuit/API-layer proxies (WinSock Proxy & SOCKS Proxy). We also add
security at the IP packet layer with our dynamic packet filtering
feature.
The kernel-mode packet filtering is integrated with the proxy services:
ports are 'opened' as necessary, resulting in packets being allowed up
the
stack for the minimum duration necessary and only on ports being used.
We
only filter external interfaces, and the default state of received
packets
for all TCP/IP protocols and TCP/UDP ports is 'drop'. Packets are
dropped
for the following reasons:
- TCP/IP protocol or port number unexpected
- IP Spoof attempt
- Badly formed fragment
- Fragments not supported (config. option)
- Log disk full

In addition, our packet filtering supports:
- Configuration of static filters for services running on the Proxy
server
machine
- Internal servers (email, WWW, etc.) communicating with external
servers/clients
- DMZ networks containing IPs routable on the Internet
- Logging of all dropped packets
- Real-time alerting based on thresholds via NT event log and/or email

The added security features and functionality in Proxy Server version
2.0
does make this product an excellent firewall solution, and our
positioning
statement (above, in quotes) indeed refers to the product as a firewall.
Some customers will use Proxy Server v2.0 as their only Internet
security
device, while other customers will want the combined feature-set of
multiple products or desire multiple layers of security and will
therefore
use our product in conjunction with other security products. It is much
more likely that a site would have multiple kinds/layers of security
devices, than they would have multiple kinds/layers of mail servers.
This
is why we differentiate between sites that currently have firewall
products
and those that do not.

Comments on some of the other issues Itai raises in the posting:

>You don't understand our Reverse Proxy feature<
Reverse Proxy allows the Proxy Server to forward external client
requests
to internal web servers in a controlled, secure way. The proxy appears
to
the clients as a single or multiple web servers (client requests are NOT
proxy requests), and the routing of requests by the proxy is transparent
to
the clients. The proxy administrator creates a mapping table associating
Internet domain names (with or without paths) to internal domain names
(with or without paths). Internal machines not listed in the mapping
table
will never receive requests from the proxy. By using DNS names (via the
http HOST header) and/or URI paths, the proxy can impersonate multiple
web
servers simultaneously with the advantage of offering security, logging,
&
caching for these web sites.

>You believe that Proxy Server is for outbound access only<
Microsoft Proxy Server version 1.0 supports internal clients accessing
external servers. In Proxy Server version 2.0, we have added support for
internal servers and inbound access. Again, these features are
configurable
by the administrator to avoid unnecessary security risks. The new
features
to support internal servers are:
- Reverse Proxy (This supports internal Web servers - see above for more
information)
- Server Proxy (This supports any TCP/UDP server running on an internal
Windows/Windows NT machine)

This is a new feature of the WinSock Proxy. It is set up by installing
the
WinSock Proxy client on the internal server machine, and the WinSock
Proxy
will remote the internal server's Winsock listen() and other
APIs. For
security, the WinSock Proxy will authenticate a user account on the
internal server machine.

- DMZ networks (This supports any TCP/IP-based internal server on a
machine
with an IP address that can be routed on the Internet)

This is a feature of our packet filtering and can be used for internal
non-Windows server machines such as UNIX mail servers. Security is done
by
IP address.

>You mention that firewalls are either "Application Gateways" or "Filtering
Gateways"<
With three layers of security, Proxy Server v2.0 is both.
- Application-layer security via the Web Proxy.
- Circuit/API-layer security via the WinSock Proxy and SOCKS Proxy.
- IP-layer security with dynamic packet filtering.

>You ask about our support for SMTP<
We do not include an application-layer proxy for SMTP. Our product
supports
SMTP clients and servers via circuit-layer proxies and packet filtering,
however we do not verify the integrity of the structure of SMTP packets.
Most concerns about the structure of SMTP packets are due to serious
security bugs that have been found in UNIX-based SENDMAIL servers.
Microsoft Exchange Server does not have any known SENDMAIL-like security
bugs. In addition, if a mail server is placed on a DMZ network, our
packet
filtering can be used to protect other internal machines and other
machines
on the DMZ network.

>You seem to be confused about what's included in Proxy Server vs. what
ISVs add with ISAPI extensions<
Everything described in this message is built into the Proxy Server
product
(version 1.0 or 2.0, as specified). ISVs have written Proxy Server
extensions using the ISAPI Filter interface for such functionality as
virus-scanning, content-filtering, and application/script blocking. For
a
list of add-on products to Proxy Server version 1.0, click on the
'Partners
Showcase' button at http://www.microsoft.com/proxy/.

I hope this clarifies the feature-set and positioning of Microsoft Proxy
Server. We will continuously update the information on our web site,
develop more detailed marketing literature, and improve product
documentation for the final retail release.
Here is the contents of a short TTL.REG file that I use to set the TTL on our servers:

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\TCPIP\Parameters]
"DefaultTTL"=dword:000000xx

Change xx to the hex value of the TTL you want.

----------
From: Bob Tinsley [R.Tinsley@rhbnc.ac.uk]
Sent: Wednesday, September 03, 1997 6:59 PM
To: ntsecurity@iss.net
Subject: [NTSEC] time to live

How do I change the default TTL for NT? Our servers stick out like a
sore thumb, and firewalls/proxies are not an option...

Cheers,

 -- Bob R.Tinsley@rhbnc.ac.uk
Mega$Nets!!! Whether You Are Already In Business For Yourself Or Not, This 
Exciting New Business, Is By Far, The Easiest One You'll Ever Do!! Mega$Nets
is a easy-to-use, yet sophisticated software program to help the average person
get in on the fabulous profits being made in the computer networking age!

Visit The Ultimate Home Business site--Mega$Nets--http://www.power-agents.com/~eclark1

Mega$Nets is a software program that makes you nothing but money. In Mega$Nets
YOU are the owner of your own company...YOU are in charge of the MONEY! Once
you own it, you always own it, and you can sell as much as you please. Look at it
NOW before your closest friend shows it you, because they will be showing it to
you!!! I GUARANTEE you have never seen anything as powerful... and filled 
with more benefits. To get more details about this exciting opportunity, contact us
immediately. You'll be glad you did.

Start your own business today!!






If you just want some sort of tripwire you can use netcat for NT/95 and
set it to listen at some port that you know someone will be scanning.

You run netcat in a dos shell with a command like:
nc -v -l -p 135

If someone tries to connect to port 135 on your machine you will see their
IP address and the data they send to the port. You could write a batch
file which would concatenate this to a file and restart netcat to listen
again. 

Netcat for NT is available at www.l0pht.com/~weld/netcat/


 Weld Pond - weld@l0pht.com - http://www.l0pht.com/~weld
 L 0 p h t H e a v y I n d u s t r i e s 
 Technical archives for the people - Bio/Electro/Crypto/Radio

On Thu, 4 Sep 1997, Nicholas Andonakis wrote:

> I want to be able to detect it when someone is probing an NT (and to a
> lesser extent, Win95) box. I don't just want to deny access, if someone is
> probing me I want to know about it. 
> 
> If there isn't an inbuilt way to do it, recommendations as to 3rd party
> software - preferably low cost :-) are welcome. I've heard the term
> "personal firewall" but I don't believe they actually do what I would think
> this term meant (e.g. virus scanners.) Anybody know of such a beast?
> 
> TCP/IP Ports
> --------------
> Your "classic" port scan is scanning tcp/udp ports for servers. I know in
> the TCP/IP Advanced Options..Security one can permit/deny traffic. 
> -Can I log attempts to connect to denied ports? If the answer is no, then I
> suppose an interesting work-around is a server that listens on a port and
> logs incoming traffic?
> -Generally with NT and TCP/IP ports, does "netstat -an" definitely show all
> listening ports or is there a way for an application to avoid detection here?
> -I think this has been asked, but why does my SP3 machine have a connection
> to itself around the 1025 area?
> 
> SMB Based Networking
> --------------------
> NT's default configuration is to have Netbios over tcp/ip enabled - windows
> networking over tcp/ip. It seems to me that this is designed for a LAN
> behind a firewall, and pretty scary if you are connected to the Internet
> via PPP.
> Assuming that you want to keep it enabled though, how can I get immediate
> notification/alert when someone has connected to my machine?
> 
> Solutions that have occured to me are writing a script that runs netstat
> and examines it periodically, or have performance monitor running and
> looking for a connected users counter or something. Is there anything more
> elegant than this?
> 
> I think I once saw a perl script that would run a large number of secondary
> logon attempts on one's machine in a short space of time. Does anybody have
> something like this?
> 
> 
> 
> Regards,
> 
> Nicholas Andonakis, Security Engineer nicka@softway.com.au
> Softway Pty. Ltd. Tel:+61 2 9698 2322
> http://www.softway.com.au Fax:+61 2 9699 9174
> 
> 

Weld Pond wrote:
> If you just want some sort of tripwire you can use netcat for NT/95 and
> set it to listen at some port that you know someone will be scanning.
> 
> You run netcat in a dos shell with a command like:
> nc -v -l -p 135

UNIX netcat won't detect a half-scan, or any of the variants,
and a quick glance at the source doesn't seem to indicate that
the NT port will either?

In addition, the original request was for something which wouldn't
actually deny access -- by implication, there is already an
application bound to the port in question.

OTOH, binding to port 136 would probably catch a few careless attackers.

> If someone tries to connect to port 135 on your machine you will see
> their IP address and the data they send to the port. You could write
> a batch file which would concatenate this to a file and restart netcat
> to listen again.

... but watch out for a potential DoS ...

> Netcat for NT is available at www.l0pht.com/~weld/netcat/

And an *excellent* tool it is too. But probably not here.

Me? I'd be looking for a low-overhead packet sniffer which allows
the building up of complex rule-sets to filter out the junk.

 -- Bob
I have asked this question before but was unable to interpret a straight
answer from the replies..

Network browsing via NT RAService can be specifically limited to the RAS
'server' or the 'entire network'. Is there a specific registry key (for
Windows NT Server 4.0) that an administer can read remotely to
conclusively decide which option is set for the RAS server.

Thanx in advance. 
>comments about the rants duly noted. I've been excising them or toning them
>down as I review the work but I'm letting off some steam while composing.
>There is a reason why it's not 'done' yet. The earlier round was also
>rather inflamatory as I recall.

That's cool. It just gets in the way of what would otherwise be all useful
stuff.

>The registry tricks still work I believe though at this juncture I haven't
>confirmed it. I think some of the service packs introduce checking code to
>foil the attempts.

You will see what I'm talking about if you go to regedt32, select HKLM
and adjust the permissions recursing subkeys. You will get a couple 
messages from the system process indicating a License Violation.

>>Excluding the administrators from certain trees is
>>worthless given that they can take ownership and give 
>>themselves permission.

>ahh, but you summarily yank their priviledge to do just that as well as
>reown the filesystem to the substitue administrator. 

ahh, but as an NT hacker, I would know that if an object won't allow me 
to take ownership of it while logged in as admistrator, it means that
you have yanked my Take Ownership permission. Knowing this and 
the fact that there is nothing that can stop me from granting myself 
that permission, you have delayed me, at most, 2 minutes.


>I'm hardly alone in
>blasting them for their attempt to make INTERNET tcpip requests contingent
>upon client LANMAN connection limits. When the bruhaha errupted with
>workstation some months back there were all sorts of industry pundits,
>users etc who called M$ rationale a farce and completely irrational. I also
>happen to agree with them. 

I agree with you and the rest and I think M$ would also agree with you now.
This is America, however, and if MS hadn't done a 180 Bill would be 
scratching his head wondering why everyone was running Linux servers.
If you guys on the crusade out there really want to see Microsoft fold,
vote with your money and not your keyboard. I personally have been a
consumer of MS products for 12 years. They've had some good (NT, IIS, 
VC 4+), bad (Win31, VC 1, VB) & downright stupid (Bob) products 
in that time. I am generally happy with their progress. This progress
is in part due to critics like yourself. So I thank you.

-bryan 
 





At 15:46 9/4/97 +0100, you wrote:

>Me? I'd be looking for a low-overhead packet sniffer which allows
>the building up of complex rule-sets to filter out the junk.

The problem here is that low-overhead and complex rule sets are somewhat
mutually exclusive. If all you want to do is examine your own traffic,
that might not be too bad. If you add cheap into your requirements, your
solution set becomes very limited.

There is a sample driver in the DDK that is a good place to start, though.
Our RealSecure product does a nice job of recognizing attacks, and you
might want to download an eval. I wouldn't categorize it as low-overhead,
though.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Try taking a look at http://www.axent.com/swat/swat.htm

> -----Original Message-----
> From: Bryan Wilkerson [SMTP:bryanw@reston.ans.net]
> Sent: Friday, August 29, 1997 12:39 AM
> To: 'Megan Reinhardt'; 'NT Security List'
> Subject: RE: [NTSEC] Bug/Hack listing
> 
> A few of my personal favorites:
> 
> http://www.ilinks.net/~486578/hack_NT/hacknt.html
> 
> http://blkbox.com/~renegade/nt/
> 
> http://www.securityserver.com/cgi-local/ssis.pl/home2.htm
> 
> http://www.iss.net/
> 
> http://ntbugtraq.rc.on.ca/ntexploits.htm
> 
> http://www.fastlane.net/homepages/thegnome/faqs/nt/index.html
> 
> http://www.microsoft.com/ntserver/info/cooperswp_con2.htm#a25
> 
> 
> -bryan
> 
> -----Original Message-----
> From: Megan Reinhardt [SMTP:meganr@wagged.com]
> Sent: Thursday, August 28, 1997 9:19 AM
> To: 'NT Security List'
> Subject: [NTSEC] Bug/Hack listing
> 
> Does anyone know of a list, document or Web site that describes the
> different bugs and holes found in NTServer?
> 
> Thanks, Megan
> 
>I have asked this question before but was unable to interpret a straight
>answer from the replies..
>
>Network browsing via NT RAService can be specifically limited to the RAS
>'server' or the 'entire network'. Is there a specific registry key (for
>Windows NT Server 4.0) that an administer can read remotely to
>conclusively decide which option is set for the RAS server.
>
>Thanx in advance. 

It's actually stored in 3 separate locations in the Registry (1 for each transport
protocol).

For NetBEUI the value is:
 HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\NBF\\NetbiosGatewayEnabled 
 
For TCP/IP the value is 
 HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IP\\AllowNetworkAccess

For IPX the value is 
 HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IPX\\AllowNetworkAccess

In all 3 cases the value meanings are:

 0x0 = This computer only
 0x1 = Entire network


-bryan
David LeBlanc wrote:
> 
> At 15:46 9/4/97 +0100, you wrote:
> 
> >Me? I'd be looking for a low-overhead packet sniffer which allows
> >the building up of complex rule-sets to filter out the junk.
> 
> The problem here is that low-overhead and complex rule sets are somewhat
> mutually exclusive. If all you want to do is examine your own traffic,
> that might not be too bad. If you add cheap into your requirements, your
> solution set becomes very limited.
> 
> There is a sample driver in the DDK that is a good place to start, though.
> Our RealSecure product does a nice job of recognizing attacks, and you
> might want to download an eval. I wouldn't categorize it as low-overhead,
> though.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |


So...

There is indeed software that will monitor probing on an NT box, it just
isn't cheap or low overhead?

What vendors offer software that does this type of monitoring
commercially? How does the UNIX\MAINFRAME world accomplish port
monitoring?

Pardon the naivete of my questions, but it seems like an awful important
subject with a heretofore limited discussion.

Ryan Ferris
ryan25@hooked.net
Hello , somebody Know about a bug in the inetinfo.exe File. The IIS
stopped with access violation message and the file is inetinfo.exe.
Thanks in advanced for your help
Luis Alberto Barraza del C. Infosel S.A. de C.V.
Network Security Dirección de Redes y Telecomunicaciones
lbarraza@Infosel.com.mx http://www.infosel.com.mx
voz 52(8)318-8751 Clz. San Pedro #507Nte, Col. Fuentes
del Valle
fax 52(8)318-8995 Monterrey NL, Mexico CP 66220
 "La vida se vive momento a momento, no por periodos"

 -----Original Message-----
 From: Bryan Wilkerson [SMTP:bryanw@reston.ans.net]
 Sent: Thursday, September 04, 1997 12:05 PM
 To: 'Vanek, Jim'; 'ntsecurity@iss.net'
 Subject: RE: [NTSEC] RAS security

 >I have asked this question before but was unable to interpret a
straight
 >answer from the replies..
 >
 >Network browsing via NT RAService can be specifically limited
to the RAS
 >'server' or the 'entire network'. Is there a specific registry
key (for
 >Windows NT Server 4.0) that an administer can read remotely to
 >conclusively decide which option is set for the RAS server.
 >
 >Thanx in advance. 

 It's actually stored in 3 separate locations in the Registry (1
for each transport
 protocol).

 For NetBEUI the value is:

HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\NBF\\NetbiosGatewayEnabled 
 
 For TCP/IP the value is 

HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IP\\AllowNetworkAccess

 For IPX the value is 

HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IPX\\AllowNetworkAccess

 In all 3 cases the value meanings are:

 0x0 = This computer only
 0x1 = Entire network


 -bryan
This site might be of interest to anyone involved with firewall or proxy
server implementation:

http://firebox.denversys.com
> -----Original Message-----
> From: Luis Alberto Barraza del Castillo [SMTP:lbarraza@infosel.com.mx]
> Sent: Thursday, September 04, 1997 11:13 AM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Problems with IIS
> 
> Hello , somebody Know about a bug in the inetinfo.exe File. The IIS
> stopped with access violation message and the file is inetinfo.exe.
> Thanks in advanced for your help
> Luis Alberto Barraza del C. Infosel S.A. de C.V.
> Network Security Dirección de Redes y
> Telecomunicaciones
> lbarraza@Infosel.com.mx http://www.infosel.com.mx
> voz 52(8)318-8751 Clz. San Pedro #507Nte, Col. Fuentes
> del Valle
> fax 52(8)318-8995 Monterrey NL, Mexico CP 66220
> "La vida se vive momento a momento, no por periodos"
> 
> -----Original Message-----
> From: Bryan Wilkerson [SMTP:bryanw@reston.ans.net]
> Sent: Thursday, September 04, 1997 12:05 PM
> To: 'Vanek, Jim'; 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] RAS security
> 
> >I have asked this question before but was unable to interpret a
> straight
> >answer from the replies..
> >
> >Network browsing via NT RAService can be specifically limited
> to the RAS
> >'server' or the 'entire network'. Is there a specific registry
> key (for
> >Windows NT Server 4.0) that an administer can read remotely to
> >conclusively decide which option is set for the RAS server.
> >
> >Thanx in advance. 
> 
> It's actually stored in 3 separate locations in the Registry (1
> for each transport
> protocol).
> 
> For NetBEUI the value is:
> 
> HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\NBF\\NetbiosGatewayEnabled 
> 
> For TCP/IP the value is 
> 
> HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IP\\AllowNetworkAccess
> 
> For IPX the value is 
> 
> HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IPX\\AllowNetworkAccess
> 
> In all 3 cases the value meanings are:
> 
> 0x0 = This computer only
> 0x1 = Entire network
> 
> 
> -bryan
On Thu, 4 Sep 1997, Ryan Matthew Ferris wrote:
> What vendors offer software that does this type of monitoring commercially?

Funny you should say that -- as David has already pointed out,
ISS's own RealSecure does this, and according to www.iss.net,
there's now an NT port.

> How does the UNIX\MAINFRAME world accomplish port monitoring?

UNIX? Us poor people use tcpdump (ftp.ee.lbl.gov). On a reasonable LAN,
detecting the basics, such as an OOB attack, oversized pings, or attempts
to connect to certain (mail, web, ...) services on machines not hosting
them is simple enough. If you're not happy reading raw log-files, though,
you're going to have to find a perl back-end (or roll your own ;-)

 -- Bob R.Tinsley@rhbnc.ac.uk

Actually, the correct URL is http://www.sealabs.com They're the ones who 
produce the firebox. We are also distributors of the WatchGuard Firebox.

Christopher Schroeder Email: cds@nvt.net
System Administrator Work: (316) 651-1239
NetVision Technologies, Inc. http://www.nvt.net/

On Thursday, September 04, 1997 1:30 PM, Stephen Greenwalt 
[SMTP:StephenG@DENVERSYS.COM] wrote:
> This site might be of interest to anyone involved with firewall or proxy
> server implementation:
>
> http://firebox.denversys.com
> > -----Original Message-----
> > From: Luis Alberto Barraza del Castillo [SMTP:lbarraza@infosel.com.mx]
> > Sent: Thursday, September 04, 1997 11:13 AM
> > To: 'ntsecurity@iss.net'
> > Subject: [NTSEC] Problems with IIS
> >
> > Hello , somebody Know about a bug in the inetinfo.exe File. The IIS
> > stopped with access violation message and the file is inetinfo.exe.
> > Thanks in advanced for your help
> > Luis Alberto Barraza del C. Infosel S.A. de C.V.
> > Network Security Direccion de Redes y
> > Telecomunicaciones
> > lbarraza@Infosel.com.mx http://www.infosel.com.mx
> > voz 52(8)318-8751 Clz. San Pedro #507Nte, Col. Fuentes
> > del Valle
> > fax 52(8)318-8995 Monterrey NL, Mexico CP 66220
> > "La vida se vive momento a momento, no por periodos"
> >
> > -----Original Message-----
> > From: Bryan Wilkerson [SMTP:bryanw@reston.ans.net]
> > Sent: Thursday, September 04, 1997 12:05 PM
> > To: 'Vanek, Jim'; 'ntsecurity@iss.net'
> > Subject: RE: [NTSEC] RAS security
> >
> > >I have asked this question before but was unable to interpret a
> > straight
> > >answer from the replies..
> > >
> > >Network browsing via NT RAService can be specifically limited
> > to the RAS
> > >'server' or the 'entire network'. Is there a specific registry
> > key (for
> > >Windows NT Server 4.0) that an administer can read remotely to
> > >conclusively decide which option is set for the RAS server.
> > >
> > >Thanx in advance.
> >
> > It's actually stored in 3 separate locations in the Registry (1
> > for each transport
> > protocol).
> >
> > For NetBEUI the value is:
> >
> > HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\NBF\\NetbiosGatewayEnabled
> > 
> > For TCP/IP the value is
> >
> > HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IP\\AllowNetworkAccess
> >
> > For IPX the value is
> >
> > HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IPX\\AllowNetworkAccess
> >
> > In all 3 cases the value meanings are:
> >
> > 0x0 = This computer only
> > 0x1 = Entire network
> >
> >
> > -bryan
Woops. Make that http://www.watchguard.com/ (they changed their url very 
recently)

Christopher Schroeder Email: cds@nvt.net
System Administrator Work: (316) 651-1239
NetVision Technologies, Inc. http://www.nvt.net/

On Thursday, September 04, 1997 2:03 PM, Christopher Schroeder 
[SMTP:cds@nvt.net] wrote:
> Actually, the correct URL is http://www.sealabs.com They're the ones who
> produce the firebox. We are also distributors of the WatchGuard Firebox.
>
> Christopher Schroeder Email: cds@nvt.net
> System Administrator Work: (316) 651-1239
> NetVision Technologies, Inc. http://www.nvt.net/
>
> On Thursday, September 04, 1997 1:30 PM, Stephen Greenwalt
> [SMTP:StephenG@DENVERSYS.COM] wrote:
> > This site might be of interest to anyone involved with firewall or proxy
> > server implementation:
> >
> > http://firebox.denversys.com
> > > -----Original Message-----
> > > From: Luis Alberto Barraza del Castillo [SMTP:lbarraza@infosel.com.mx]
> > > Sent: Thursday, September 04, 1997 11:13 AM
> > > To: 'ntsecurity@iss.net'
> > > Subject: [NTSEC] Problems with IIS
> > >
> > > Hello , somebody Know about a bug in the inetinfo.exe File. The IIS
> > > stopped with access violation message and the file is inetinfo.exe.
> > > Thanks in advanced for your help
> > > Luis Alberto Barraza del C. Infosel S.A. de C.V.
> > > Network Security Direccion de Redes y
> > > Telecomunicaciones
> > > lbarraza@Infosel.com.mx http://www.infosel.com.mx
> > > voz 52(8)318-8751 Clz. San Pedro #507Nte, Col. Fuentes
> > > del Valle
> > > fax 52(8)318-8995 Monterrey NL, Mexico CP 66220
> > > "La vida se vive momento a momento, no por periodos"
> > >
> > > -----Original Message-----
> > > From: Bryan Wilkerson [SMTP:bryanw@reston.ans.net]
> > > Sent: Thursday, September 04, 1997 12:05 PM
> > > To: 'Vanek, Jim'; 'ntsecurity@iss.net'
> > > Subject: RE: [NTSEC] RAS security
> > >
> > > >I have asked this question before but was unable to interpret a
> > > straight
> > > >answer from the replies..
> > > >
> > > >Network browsing via NT RAService can be specifically limited
> > > to the RAS
> > > >'server' or the 'entire network'. Is there a specific registry
> > > key (for
> > > >Windows NT Server 4.0) that an administer can read remotely to
> > > >conclusively decide which option is set for the RAS server.
> > > >
> > > >Thanx in advance.
> > >
> > > It's actually stored in 3 separate locations in the Registry (1
> > > for each transport
> > > protocol).
> > >
> > > For NetBEUI the value is:
> > >
> > > HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\NBF\\NetbiosGatewayEnabled
> > > 
> > > For TCP/IP the value is
> > >
> > > HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IP\\AllowNetworkAccess
> > >
> > > For IPX the value is
> > >
> > > HKLM\SOFTWARE\MICROSOFT\RAS\PROTOCOLS\IPX\\AllowNetworkAccess
> > >
> > > In all 3 cases the value meanings are:
> > >
> > > 0x0 = This computer only
> > > 0x1 = Entire network
> > >
> > >
> > > -bryan
 Are both of the network cards on the same physical segment, or are
 both addresses on the same card? If so, that may be the problem. You
 can test this by removing one of the addresses.
 Duston Suits
 LAN Administrator
 State of Illinois, Department of Insurance



______________________________ Reply Separator _________________________________
Subject: [NTSEC] DHCP using NT
Author: PT (INTERNET.PT) at INSSNAPI
Date: 9/2/97 7:51 PM


Received: from NEWMAN.STATE.IL.US by CMSSOFT.STATE.IL.US
 (Soft*Switch Central V4L40P1A);
 02 Sep 1997 19:51:12 GMT
Received: from phoenix.iss.net by newman.state.il.us (AIX 3.2/UCB 5.64/4.03)
 id AA08088; Tue, 2 Sep 1997 19:55:28 -0500
Received: (qmail 27790 invoked by alias); 3 Sep 1997 00:46:23 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 27783 invoked by alias); 3 Sep 1997 00:46:22 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 27758 invoked by uid 15); 3 Sep 1997 00:46:21 -0000
Received: (qmail 27708 invoked from network); 3 Sep 1997 00:46:17 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 3 Sep 1997 00:46:17 -0000
Received: from cemtecasia.com.sg (ptmail.pt.com.sg [202.42.237.2]) by
arden.iss.net (8.8.7/8.7.3) with ESMTP id UAA25648 for ;
Tue, 2 Sep 1997 20:48:26 -0400 Received: from Nobody ([128.1.5.252]) by
ssy.cemtecasia.com.sg with SMTP id <11655>; Wed, 3 Sep 1997 08:50:01 +0800
Message-Id: To:
ntsecurity@iss.net Mime-Version: 1.0 From: Albert 
Subject: [NTSEC] DHCP using NT Date: Wed, 3 Sep 1997 13:01:13 +0800
Content-Type: text/plain; charset=US-ASCII; X-MAPIextension=".TXT"
Content-Transfer-Encoding: quoted-printable Sender: owner-ntsecurity@iss.net
Precedence: bulk Reply-To: Albert X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net

Greetings

I know I am posting to the wrong list, but as I have no where to turned =
to,
so please help me.

I have a NT server with 2 IP addresses. First is 203.127.35.67/24, and =
next is 172.26.1.2/24.
I tried to DHCP a range of IP addresses of the second IP network. But the=
 windows 95 client
does not seems to receive the dhcp information.

Has anyone have a solution to this problem?

PLEASE help me ...
Before everyone rushes off to Allan's offered link to
http://www.axent.com/swat/swat.htm, let me point out something in the
Legal Agreement you have to accept before getting any useful
information;
If you do find something of value in their site, you cannot use this
information as advice to a third party. This is covered under "You agree
not to use Software provided in this site for malicious or illegal
purposes, or use it on or against any third party." They explain that
the term "Software" refers to "software programs and information
(collectively referred to as "Software")".
So if they had a valuable tidbit of information, and I thought to use
this information on one of my customer's systems, I would be prohibited
by virtue of the fact I read it at Axent's web site.
You also may not learn the information contained there unless you are a
"qualified personnel trained in its use", according to their wording.
Their attempt to limit their liability for the information that is
contained in their website results in them actually limiting your
freedom of speech as a result of viewing their information. Unless you
could prove prior knowledge (something extremely difficult to do some
times), anything they might have in there that you've actually
previously known would also be subjected to the same restrictions, by
virtue of you accepting their Legal Agreement.
Decide for yourselves, but licensing agreements pertaining to
information they've presumably gathered from the net seems like an
infringement on the original author's Intellectual Property.
I'll steer clear of Axent's web site and their products for fear I'm
jeopardizing my ability to speak about what I already know...;-]
Cheers,
Russ

If you don't want to be bound by any legal "I accept" agreements just
enter the site at:

http://www.axent.com/swat/control.htm

 Weld Pond - weld@l0pht.com - http://www.l0pht.com/~weld
 L 0 p h t H e a v y I n d u s t r i e s 
 Technical archives for the people - Bio/Electro/Crypto/Radio

On Thu, 4 Sep 1997, Russ wrote:

> Before everyone rushes off to Allan's offered link to
> http://www.axent.com/swat/swat.htm, let me point out something in the
> Legal Agreement you have to accept before getting any useful
> information;
> If you do find something of value in their site, you cannot use this
> information as advice to a third party. This is covered under "You agree
> not to use Software provided in this site for malicious or illegal
> purposes, or use it on or against any third party." They explain that
> the term "Software" refers to "software programs and information
> (collectively referred to as "Software")".
> So if they had a valuable tidbit of information, and I thought to use
> this information on one of my customer's systems, I would be prohibited
> by virtue of the fact I read it at Axent's web site.
> You also may not learn the information contained there unless you are a
> "qualified personnel trained in its use", according to their wording.
> Their attempt to limit their liability for the information that is
> contained in their website results in them actually limiting your
> freedom of speech as a result of viewing their information. Unless you
> could prove prior knowledge (something extremely difficult to do some
> times), anything they might have in there that you've actually
> previously known would also be subjected to the same restrictions, by
> virtue of you accepting their Legal Agreement.
> Decide for yourselves, but licensing agreements pertaining to
> information they've presumably gathered from the net seems like an
> infringement on the original author's Intellectual Property.
> I'll steer clear of Axent's web site and their products for fear I'm
> jeopardizing my ability to speak about what I already know...;-]
> Cheers,
> Russ
> 

I hope you will forgive me, but what does Firebox have to do with
Windows NT Security?? The fact that your GUI happens to run on W95, NT,
or Linux, does not make your product an NT Security product in my mind.

The web page you offer doesn't have any detailed information on how
Firebox works, it merely has a ton of useless GIFs of the console, the
box itself (oohh, pretty red box), and marketing descriptions of the
various wonderful things you can do with this thing.

When you click on the "Find out why" link, you're asked a gazillion
questions (I just put the letter A into a field, then click the bottom
button, it'll prompt you for some other missing field, put A in it, and
so on until you get through their marketing stuff), only to get to the
very uninformative pages on the product.

THERE IS NOWHERE ON THE WEB SITE THAT EXPLAINS HOW THE PRODUCT PROVIDES
SECURITY.

Boy, I do seem to be in a bad mood on the list lately don't
I...;-]...honestly, its not me...;-]...let me go and try and catch a
fish...;-]

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
BAN ALL OFF-TOPIC SPAMMERS!!!

Weld Pond wrote:

> If you don't want to be bound by any legal "I accept" agreements just
> enter the site at:
>
> http://www.axent.com/****/*******.html

1.) I think you violated the spirit of the license agreement by passing
on the above information

2.) Axent can't possibly prove whether or not any individual actually
visited their web site and viewed that info, so they must believe that
all the information behind the license agreement is Axent intellectual
property. Obviously, any appearance of this info in any other form
could only have been stolen from this web server.

3) If anybody anywhere in the universe gets hacked using techniques
mentioned on Axent's web page, every lawyer in the world will be able to
sue you.

What does 'SWAT' stand for anyway, 'Sealed With A Threat?'


>
>
> Weld Pond - weld@l0pht.com - http://www.l0pht.com/~weld
> L 0 p h t H e a v y I n d u s t r i e s
> Technical archives for the people - Bio/Electro/Crypto/Radio

Check the KB on this, article ID Q153066. The article states that this was 
corrected for NT 4, but I was been able to reproduce it quite easily a 
while ago (SP2 days). The issue deals with IPC$ remaining open (using 
Admin credentials) until it is disconnected by the server due to inactivity 
(default is 15 minutes). I spoke with MS about this and after about 2 
weeks, their 'official' stance was that this [the IPC$ share remaining 
open] could happen any time an application is run that would use the IPC$. 
 One wouldn't expect a MS product on top of a MS operating system to act in 
this manner, but...

I agree with Russ in that it is a bad security practice to perform a 
'connect as' using admin (or any other) credentials. If this needs to 
occur, a possible work around is to set the autodisconnect to a low value 
thereby closing these completed but exploitable connections.

Peter Prusko
MCPS
Windows NT Workstation 3.51, 4.0
Windows NT 4.0 Server, 4.0 Server Enterprise

pprusko@vanstar.com


I don't get it. Isn't this like saying that on UNIX, an admin used SU to
become admin on some user's workstation, and then left the shell open?

On UNIX the solution is to close the shell. On NT, isn't the solution to
do a "NET USE \\foo\IPC$ /d"

> ----------
> From: Prusko, Peter T. (Vanstar at
> Alcoa)[SMTP:Peter.Prusko@alcoa.com]
> Reply To: Prusko, Peter T. (Vanstar at Alcoa)
> Sent: Thursday, September 04, 1997 2:08 PM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] RE: Giving admin privileges without knowing
> 
> Check the KB on this, article ID Q153066. The article states that
> this was 
> corrected for NT 4, but I was been able to reproduce it quite easily a
> 
> while ago (SP2 days). The issue deals with IPC$ remaining open (using
> 
> Admin credentials) until it is disconnected by the server due to
> inactivity 
> (default is 15 minutes). I spoke with MS about this and after about 2
> 
> weeks, their 'official' stance was that this [the IPC$ share remaining
> 
> open] could happen any time an application is run that would use the
> IPC$. 
> One wouldn't expect a MS product on top of a MS operating system to
> act in 
> this manner, but...
> 
> I agree with Russ in that it is a bad security practice to perform a 
> 'connect as' using admin (or any other) credentials. If this needs to
> 
> occur, a possible work around is to set the autodisconnect to a low
> value 
> thereby closing these completed but exploitable connections.
> 
> Peter Prusko
> MCPS
> Windows NT Workstation 3.51, 4.0
> Windows NT 4.0 Server, 4.0 Server Enterprise
> 
> pprusko@vanstar.com
> 
> 
Before we rant too long on the spoofed/stolen signature issue, are there any
historical cases of signature stealing?

Any revoked signatures because of suspected signature theft?

If so, we can rant on. If not, ranting may induce embarrassment.

Reviewing signatures at Verisign for Microsoft (search for 'Microsoft' at
http://digitalid.verisign.com/query.htm), I verified the following serial
numbers(http://digitalid.verisign.com/status.htm):

7b89238cde823a102b95059f7bf82b63 Valid 'till 1/98
6fe41896fa0edeb03e339a881a00f156 Not found (Expires 9/97)
0343758089deb2b13962356ae8037e95 Expired 7/97
51b5ca9b461455b3d26b615e72bee09c Expired 7/97
15887aca6d9b611e6dcee499a8e85490 Not found (Expired 7/96)

At http://www.verisign.com/repository/rpa.html, Verisign waves all
responsibility for the authenticity of an object signed with a verisign
signature, and states 'you' responsible for determining safety of the
object. It also notifies 'you' of the possibility of stolen or compromised
keys.

Nothing at the site lists stolen or compromised keys though.

Bill Stout

You should do a little research on exactly what a firewall is. The web site 
explains the features of this particular firewall, but not exactly what a 
firewall is. A firewall, by nature protects a network against all traffic 
(malicious and otherwise) that is not specifically allowed. This applies to 
many types of Windows bugs, including the infamous OOB (WinNuke) bug. Do some 
reading on firewalls in general to find out what a firewall is and how it 
works, then go back to the web site and read up on the specific capabilities of 
THIS firewall to see if it can help you in protecting your network.

Christopher Schroeder Email: cds@nvt.net
System Administrator Work: (316) 651-1239
NetVision Technologies, Inc. http://www.nvt.net/


On Thursday, September 04, 1997 3:57 PM, Russ [SMTP:Russ.Cooper@rc.on.ca] 
wrote:
> I hope you will forgive me, but what does Firebox have to do with
> Windows NT Security?? The fact that your GUI happens to run on W95, NT,
> or Linux, does not make your product an NT Security product in my mind.

> The web page you offer doesn't have any detailed information on how
> Firebox works, it merely has a ton of useless GIFs of the console, the
> box itself (oohh, pretty red box), and marketing descriptions of the
> various wonderful things you can do with this thing.

> When you click on the "Find out why" link, you're asked a gazillion
> questions (I just put the letter A into a field, then click the bottom
> button, it'll prompt you for some other missing field, put A in it, and
> so on until you get through their marketing stuff), only to get to the
> very uninformative pages on the product.

> THERE IS NOWHERE ON THE WEB SITE THAT EXPLAINS HOW THE PRODUCT PROVIDES
> SECURITY.

> Boy, I do seem to be in a bad mood on the list lately don't
> I...;-]...honestly, its not me...;-]...let me go and try and catch a
> fish...;-]
>
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> BAN ALL OFF-TOPIC SPAMMERS!!!

On Thu, 4 Sep 1997, Jay Heiser wrote:

> Weld Pond wrote:
> 1.) I think you violated the spirit of the license agreement by passing
> on the above information

I don't see anywhere in the agreement that forbids the publishing of links
directly to the information.
 
> 3) If anybody anywhere in the universe gets hacked using techniques
> mentioned on Axent's web page, every lawyer in the world will be able to
> sue you.

But every lawyer in the world can already sue me. Winning a suit is a
different story. 


-weld

At 01:12 PM 9/4/97 -0500, you wrote:
>Hello , somebody Know about a bug in the inetinfo.exe File. The IIS
>stopped with access violation message and the file is inetinfo.exe.

Could be a couple of things. Maybe malicious (experimenting user).

1. GET ..\.. bug (Fixed v4sp2?) kills inetsrv.exe w/ Dr Watson 
2. A URL of 4K or 8K sent to your server (v4sp3 hotfix) kills 
 inetsrv.exe w/ Dr Watson (Q143484).
3. I had a couple of other things too somewhere (I forget what else...)

Apply the latest service packs and hotfixes. Then apply face paint, and
shake little bag of bones, dried herbs and chicken feathers above system,
wave hand down, then left to right and press reset button. That should hold
it for a while. ;)

Bill
______________________________________________________________________
Sometimes I crack me up.

Has anyone corrected this problem:

For an IIS system with an \images directory, the directory needs 'everyone'
to have 'full access' to get reasonable image (gif/jpg) performance. Of
course the image files themselves are read-only, but that's useless since
directory permissions(full control) override file permissions (read-only).
Therefore image files on IIS servers are vulnerable to overwrite/delete.

Did I miss a fix somewhere?

Bill Stout

At 06:32 PM 9/4/97 -0400, you wrote:
>
>On Thu, 4 Sep 1997, Jay Heiser wrote:
>
>> Weld Pond wrote:
>> 1.) I think you violated the spirit of the license agreement by passing
>> on the above information
>
>I don't see anywhere in the agreement that forbids the publishing of links
>directly to the information.
> 
>> 3) If anybody anywhere in the universe gets hacked using techniques
>> mentioned on Axent's web page, every lawyer in the world will be able to
>> sue you.
>
>But every lawyer in the world can already sue me. Winning a suit is a
>different story. 
>
>
>-weld
>
>

hey folks has anyone here thought how many exploits have been described on
this list??

heaps

if this information is illegal or wrong then why is all the other stuff about??
www.ntinternals.com iis.net etc they all supply info or tools that could be
used wrongly .. ok i give in ban matches to anyone under 30 and totally
ban paint cause someone sprayed the bustop here again.. common .. please!!!

if axent posted something bad then tell them you think so and see there reply..

i think its a very handy site and have and will contuinue to send my clients
to it so they know whats about what it looks like so they can KNOW what is
going on.. security by guess is not that effective...

just my 2 cents

cheers

John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

Hi-
 I'm fairly new to the CA & SSL world. Are there any programs that can
generate unsigned or in-house SSL certificates? I'm simply looking to
enable SSL between my server & my remote browser for light admin duties. I
don't care to pay US$350 so that my server can tell me with confidence that
it belongs to me -- I only want to enable the secure link. For the kind of
cash Verisign wants, I can buy another copy of NT/IIS...

Eric Fagan
mailserve@pdqnet.net

## Reply Start ##

Quite apart from its length, I think this oversteps the mark
into blatant advertising. It would have been quite sufficient 
to have supplied a URL.

>This message is in response to a posting by Itai Dor-on on this newsgroup
>about Proxy Server version 2.0 Beta. Itai had several questions about
>Proxy Server 2.0 features, security, and market positioning.
>
>I am a Program Manager for Microsoft Proxy Server. I would like to clarify
>the feature-set and market positioning of Proxy Server v2.0, and respond
>to some specific comments in Itai's posting.

That's what I mean. 
If we want to know the 'market positioning' we can look it up from a URL.
This was an excessive post considering the question.

/anton

## Reply End ##
--------------------------------------------------------------------------
Anton J Aylward | "Quality refers to the extent to which 
The Strahn & Strachan Group Inc | processes, products, services, and 
Information Security Consultants | relationships are free from defects, 
Voice: (416) 494-8661 | constraints and items which do not add
 Fax: (416) 494-8803 | value." - Dr. Mildred G Pryor, 1995 
Not precisely (in my opinion).
On UNIX when you close the privileged shell the permissions are 
automatically removed, on NT you must close explicitly the hidden 
(not directly visible) privileged connection. And because it is a 
non-directly visible shell the administrator can easily forget to do it.

I can think on a solution like a counter for admin connections that 
are incremented for each application executed that uses the 
connection and decrements when the applications exists. When the 
counter reaches zero the privileged connection is automatically 
closed. Cloud this be possible?

Victor Fernandes



> I don't get it. Isn't this like saying that on UNIX, an admin used SU to
> become admin on some user's workstation, and then left the shell open?
> 
> On UNIX the solution is to close the shell. On NT, isn't the solution to
> do a "NET USE \\foo\IPC$ /d"
> 
> > ----------
> > From: Prusko, Peter T. (Vanstar at
> > Alcoa)[SMTP:Peter.Prusko@alcoa.com]
> > Reply To: Prusko, Peter T. (Vanstar at Alcoa)
> > Sent: Thursday, September 04, 1997 2:08 PM
> > To: 'ntsecurity@iss.net'
> > Subject: [NTSEC] RE: Giving admin privileges without knowing
> > 
> > Check the KB on this, article ID Q153066. The article states that
> > this was 
> > corrected for NT 4, but I was been able to reproduce it quite easily a
> > 
> > while ago (SP2 days). The issue deals with IPC$ remaining open (using
> > 
> > Admin credentials) until it is disconnected by the server due to
> > inactivity 
> > (default is 15 minutes). I spoke with MS about this and after about 2
> > 
> > weeks, their 'official' stance was that this [the IPC$ share remaining
> > 
> > open] could happen any time an application is run that would use the
> > IPC$. 
> > One wouldn't expect a MS product on top of a MS operating system to
> > act in 
> > this manner, but...
> > 
> > I agree with Russ in that it is a bad security practice to perform a 
> > 'connect as' using admin (or any other) credentials. If this needs to
> > 
> > occur, a possible work around is to set the autodisconnect to a low
> > value 
> > thereby closing these completed but exploitable connections.
> > 
> > Peter Prusko
> > MCPS
> > Windows NT Workstation 3.51, 4.0
> > Windows NT 4.0 Server, 4.0 Server Enterprise
> > 
> > pprusko@vanstar.com
> > 
> > 
On Thu, 4 Sep 1997 16:12:56 -0400, you wrote:

>Before everyone rushes off to Allan's offered link to
>http://www.axent.com/swat/swat.htm, let me point out something in the
>Legal Agreement you have to accept before getting any useful
>information;

At least in Germany, agreements normally are made valid by signature -

not by clicking on a nice button.
Dunno how that's at your location...

regards, Dietz

-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
I think you (and possibly others) may be a bit vendorphobic.
The message that you're complaining about is clearly stated
as "Proxy Server 2.0 features & marketing positioning..."
in the subject line. You can easily choose to delete it
without reading it if you choose. The message from Microsoft's
Program Manager was posted in response to another message
so it wasn't unsolicited advertising. Also, Microsoft does
not have a history of doing this on this list so it's not
abuse.

I prefer that vendors are allowed to participate in this list
and contribute bits of information that we may not otherwise
find on their Web site. As an author, I know that my preconceived
notion of product features and design philosophy is sometimes
wrong and I need feedback from the vendor to see the product
in the light that the vendor intended.

I'm not comfortable with your interpretation of "blatant advertising".
In summary, I do not need the protection that you're trying to
provide for me.

Ed Sawicki - author of several ALC Press books.
http://www.alcpress.com

----------
> From: Anton J Aylward 
> To: silicom@netvision.net.il; firewalls@GreatCircle.COM;
ntsecurity@iss.net
> Subject: Re: Proxy Server 2.0 features & market positioning byMicrosoft
Program Manager
> Date: Thursday, September 04, 1997 7:12 PM
> 
> ## Reply Start ##
> 
> Quite apart from its length, I think this oversteps the mark
> into blatant advertising. It would have been quite sufficient 
> to have supplied a URL.
> 
> >This message is in response to a posting by Itai Dor-on on this
newsgroup
> >about Proxy Server version 2.0 Beta. Itai had several questions about
> >Proxy Server 2.0 features, security, and market positioning.
> >
> >I am a Program Manager for Microsoft Proxy Server. I would like to
clarify
> >the feature-set and market positioning of Proxy Server v2.0, and respond
> >to some specific comments in Itai's posting.
> 
> That's what I mean. 
> If we want to know the 'market positioning' we can look it up from a URL.
> This was an excessive post considering the question.
> 
> /anton
> 
> ## Reply End ##
>
--------------------------------------------------------------------------
> Anton J Aylward | "Quality refers to the extent to which

> The Strahn & Strachan Group Inc | processes, products, services, and 
> Information Security Consultants | relationships are free from defects, 
> Voice: (416) 494-8661 | constraints and items which do not add
> Fax: (416) 494-8803 | value." - Dr. Mildred G Pryor, 1995 
All,

I found Microsoft's statements interesting. I considered it appropriate for
the NT Security list. 

 Conrad

----------
> From: Anton J Aylward 
> To: silicom@netvision.net.il; firewalls@GreatCircle.COM;
ntsecurity@iss.net
> Subject: [NTSEC] Re: Proxy Server 2.0 features & market positioning
byMicrosoft Program Manager
> Date: Thursday, September 04, 1997 10:12 PM
> 
> ## Reply Start ##
> 
> Quite apart from its length, I think this oversteps the mark
> into blatant advertising. It would have been quite sufficient 
> to have supplied a URL.
> 
> >This message is in response to a posting by Itai Dor-on on this
newsgroup
> >about Proxy Server version 2.0 Beta. Itai had several questions about
> >Proxy Server 2.0 features, security, and market positioning.
> >
> >I am a Program Manager for Microsoft Proxy Server. I would like to
clarify
> >the feature-set and market positioning of Proxy Server v2.0, and respond
> >to some specific comments in Itai's posting.
> 
> That's what I mean. 
> If we want to know the 'market positioning' we can look it up from a URL.
> This was an excessive post considering the question.
> 
> /anton
> 
> ## Reply End ##
>
--------------------------------------------------------------------------
> Anton J Aylward | "Quality refers to the extent to which

> The Strahn & Strachan Group Inc | processes, products, services, and 
> Information Security Consultants | relationships are free from defects, 
> Voice: (416) 494-8661 | constraints and items which do not add
> Fax: (416) 494-8803 | value." - Dr. Mildred G Pryor, 1995 
Eric@operations writes:

> I'm fairly new to the CA & SSL world. Are there any programs that can
> generate unsigned or in-house SSL certificates? I'm simply looking to
> enable SSL between my server & my remote browser for light admin duties. I
> don't care to pay US$350 so that my server can tell me with confidence that
> it belongs to me -- I only want to enable the secure link. For the kind of
> cash Verisign wants, I can buy another copy of NT/IIS...

You can create your own CA with the SSLeay package, see this URL
for info:
 http://psych.psy.uq.oz.au/~ftp/Crypto/

(Especially if you're in the US, you'll need to make your own 
decision about the legality of using this stuff without a license
from RSADSI.)

Or, you can apparently just get a zero-assurance certificate directly
from the creator of the above FAQ at:
 http://www.cryptsoft.com/~tjh/usercert.cgi


-- Jeff
At 04:38 AM 05/09/97 -0700, Ed Sawicki wrote:

## Reply Start ##


>I think you (and possibly others) may be a bit vendorphobic.


No, I deal with a lot of vendors and have good relationships with them.


>The message that you're complaining about is clearly stated

>as "Proxy Server 2.0 features & marketing positioning..."

>in the subject line. You can easily choose to delete it

>without reading it if you choose. 


This is the argument spammers make.

Sorry, I don't consider it valid.


>The message from Microsoft's

>Program Manager was posted in response to another message

>so it wasn't unsolicited advertising. 


I didn't use the world "unsolicited". 

Please don't put words in my mouth.


>Also, Microsoft does

>not have a history of doing this on this list so it's not

>abuse.


Oh, OK, so the first rape is allowed because the guy doesn't 

have a history or doing it, so its not abuse. Fine, I'll tell

Alan Dershowitz that and he can use it in the next issue of

his book "The Abuse Excuse".


>I prefer that vendors are allowed to participate in this list

>and contribute bits of information that we may not otherwise

>find on their Web site. 


I think that's a laudatory position.

it perfectly reflects my attitude that the posting we 

are referring to was excessive, because it was cut&paste from

MS published information. Since I have Proxy Server docs

and marketing literature on my desk I can happily assert to that.


>As an author, I know that my preconceived

>notion of product features and design philosophy is sometimes

>wrong and I need feedback from the vendor to see the product

>in the light that the vendor intended.


I'm not arguing YOUR needs. I'm arguing this instance.

The positing was excessive and far beyond what even vendors

supply. We have regular contributions from people, for example,

at Cisco, along such lines. They are not as voluminous or as

marketing oriented. This is a technology & support list.

I know from my own experience, in the role of an author or reviewer,

marketing treats one differently from being an end user.


>In summary, I do not need the protection that you're trying to

>provide for me.


That could be taken as an invitation to be spammed. Do you 

need the protection your ISP is providing, that firewalls 

are providing? That's what this groups is about.



Lets get back to basics:


 1. Was the positing significantly longer than most on this list?

 2. Did it supply information which could have been obtained from a 

 web page or other marketing documents?


Q1 makes it excessive.

Q2 deals with my point about a URL being sufficient.


I think we're experienced enough to recognize the mailto: on most

web pages and most vendors have a link to obtain more information.


And yes, I do work proactively to suppress spamming and other abuses.


You might also see the .sig line on my earlier posting which said..


left"Quality refers to the extent to which 

processes, products, services, and 

relationships are free from defects, 

constraints and items which do not add

value." - Dr. Mildred G Pryor, 1995 



I would assert that the long positing did not add value and

so decreases the quality of the list. I firmly believe that this

list has a reputation based on it NOT being a sounding board

for vendors to tout their wares.


/anton


## Reply End ##

--------------------------------------------------------------------------

Anton J Aylward | "Quality refers to the extent to which 

The Strahn & Strachan Group Inc | processes, products, services, and 

Information Security Consultants | relationships are free from defects, 

Voice: (416) 494-8661 | constraints and items which do not add

 Fax: (416) 494-8803 | value." - Dr. Mildred G Pryor, 1995 

I believe that since it was in response to another participant's
request for information it was entirely appropriate. Chill.
--
chris


> ## Reply Start ##
> 
> Quite apart from its length, I think this oversteps the mark
> into blatant advertising. It would have been quite sufficient 
> to have supplied a URL.
> 
> >This message is in response to a posting by Itai Dor-on on this
newsgroup
> >about Proxy Server version 2.0 Beta. Itai had several questions about
> >Proxy Server 2.0 features, security, and market positioning.
> >
> >I am a Program Manager for Microsoft Proxy Server. I would like to
clarify
> >the feature-set and market positioning of Proxy Server v2.0, and respond
> >to some specific comments in Itai's posting.
> 
> That's what I mean. 
> If we want to know the 'market positioning' we can look it up from a URL.
> This was an excessive post considering the question.
> 
> /anton
> 
> ## Reply End ##
>
--------------------------------------------------------------------------
> Anton J Aylward | "Quality refers to the extent to which

> The Strahn & Strachan Group Inc | processes, products, services, and 
> Information Security Consultants | relationships are free from defects, 
> Voice: (416) 494-8661 | constraints and items which do not add
> Fax: (416) 494-8803 | value." - Dr. Mildred G Pryor, 1995 
Hi all,

I have problems with users here. A lot of them uses two accounts at the
same time. Is there a way to deny user access at the same time in NT 4.0
server?

Thanks,

========================================
Allan Christian Brandt - allan@netland.com.br
Sysop - Administrador da Rede
Netland Internet Providers
http://www.netland.com.br
Minas Gerais - Brazil - Phone: 0055 31 281-6434
======================================== 
> I think you (and possibly others) may be a bit vendorphobic.
> The message that you're complaining about is clearly stated
> as "Proxy Server 2.0 features & marketing positioning..."
> in the subject line.

That doesn't tell me it's marketing fluff. I might well post a message
with that title pointing out how their marketing position is inconsistent
with their features. Even a message from a Microsoft address might contain
useful information under that title. And in any case I tend to give messages
from Firewalls a higher priority, and it's useful that I be able to do so,
simply because they are so rarely contain marketing noise.

So it's *not* possible to just skip a message like that without reading
it. And I wouldn't want to discourage people at Microsoft from commenting
from the trenches by making them think their messages would simply be
discarded just because of where they're posting from, which is what you
seem to be proposing.

No, it's not classical spam. It's not unsolicited marketing email. But I
think that we need to draw the line on this list against vendors sending
apparently solicited responses to the list as a whole: we've had periods
in the past where single vendors have pushed a significant amount of such
fluff down the pipe.

With more and more vendors getting into it, especially companies like
Microsoft who have been pushing the ragged edge of acceptable behaviour in
marketing material in the past (yes, I've had bulk mail from them that
it's a stretch to consider solicited), if we don't draw that line here
it's just going to get worse. I hope in the future that they send lengthy
web-formatted low-content pieces to just the person who requested it.

On Fri, 5 Sep 1997 10:04:41 -0300, you wrote:

>Hi all,
>
>I have problems with users here. A lot of them uses two accounts at the
>same time. Is there a way to deny user access at the same time in NT 4.0
>server?
>
As far as i know not - but you could write a login script that checks
for another session & logs out the user if true.

regards, Dietz


-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.
> > I think you (and possibly others) may be a bit vendorphobic.
> > The message that you're complaining about is clearly stated
> > as "Proxy Server 2.0 features & marketing positioning..."
> > in the subject line.
> 
> That doesn't tell me it's marketing fluff. I might well post a message
> with that title pointing out how their marketing position is inconsistent
> with their features. Even a message from a Microsoft address might
contain
> useful information under that title. And in any case I tend to give
messages
> from Firewalls a higher priority, and it's useful that I be able to do
so,
> simply because they are so rarely contain marketing noise.
> 
> So it's *not* possible to just skip a message like that without reading
> it. And I wouldn't want to discourage people at Microsoft from commenting
> from the trenches by making them think their messages would simply be
> discarded just because of where they're posting from, which is what you
> seem to be proposing.
> 
> No, it's not classical spam. It's not unsolicited marketing email. But I
> think that we need to draw the line on this list against vendors sending
> apparently solicited responses to the list as a whole: we've had periods
> in the past where single vendors have pushed a significant amount of such
> fluff down the pipe.

Ah, here's a point. It wasn't sent by M$. M$ sent a private response to
Itai
and then he reposted it to the list. I assume Itai thought he was just
doing a good deed since he had posted his questions to the list earlier. I
didn't notice this myself earlier.

> 
> With more and more vendors getting into it, especially companies like
> Microsoft who have been pushing the ragged edge of acceptable behaviour
in
> marketing material in the past (yes, I've had bulk mail from them that
> it's a stretch to consider solicited), if we don't draw that line here
> it's just going to get worse. I hope in the future that they send lengthy
> web-formatted low-content pieces to just the person who requested it.
 "I hope in the future that they send lengthy
> web-formatted low-content pieces to just the person who requested it."
> 
> 
Well, Peter, I hope that in the future YOU send your opinion to only
those who care!

I just joined this list (NTSECURITY) a few days ago and am astounded at
how childish and juvenile and ill-mannered many posters seem to be. 

When responding to something is it really necessary to direct this to
the ENTIRE list? Also, the vast majority of the posts to this group
really seem minor and irrelevant, to the point that I'm not sure it's
worth sorting through 50+ junk e-mails a day to find something of worth.

Is not this group suffering from its own self-generating spam?

I'll stick around for another week and see if things get any better. If
not, I'm gone -- I am gainfully employed and definitely have better
things to do with my time than weed through garbage.

Ryan Sokolowski, MCSE, CNA
Consultant 
GE Capital Consulting
Ryan.Sokolowski@gectms.ge.com

> ----------
> From: Peter da Silva[SMTP:peter@grendel.nmti.com]
> Reply To: Peter da Silva
> Sent: Friday, September 05, 1997 8:08 AM
> To: ed@alcpress.com
> Cc: silicom@netvision.net.il; firewalls@GreatCircle.COM;
> ntsecurity@iss.net; anton@Toronto.com
> Subject: [NTSEC] Re: Proxy Server 2.0 features & market
> positioning byMicrosoft Program Manager
> 
> > I think you (and possibly others) may be a bit vendorphobic.
> > The message that you're complaining about is clearly stated
> > as "Proxy Server 2.0 features & marketing positioning..."
> > in the subject line.
> 
> That doesn't tell me it's marketing fluff. I might well post a message
> with that title pointing out how their marketing position is
> inconsistent
> with their features. Even a message from a Microsoft address might
> contain
> useful information under that title. And in any case I tend to give
> messages
> from Firewalls a higher priority, and it's useful that I be able to do
> so,
> simply because they are so rarely contain marketing noise.
> 
> So it's *not* possible to just skip a message like that without
> reading
> it. And I wouldn't want to discourage people at Microsoft from
> commenting
> from the trenches by making them think their messages would simply be
> discarded just because of where they're posting from, which is what
> you
> seem to be proposing.
> 
> No, it's not classical spam. It's not unsolicited marketing email. But
> I
> think that we need to draw the line on this list against vendors
> sending
> apparently solicited responses to the list as a whole: we've had
> periods
> in the past where single vendors have pushed a significant amount of
> such
> fluff down the pipe.
> 
> With more and more vendors getting into it, especially companies like
> Microsoft who have been pushing the ragged edge of acceptable
> behaviour in
> marketing material in the past (yes, I've had bulk mail from them that
> it's a stretch to consider solicited), if we don't draw that line here
> it's just going to get worse. I hope in the future that they send
> lengthy
> web-formatted low-content pieces to just the person who requested it.
> 
On Thursday, September 04, 1997 4:13 PM, Russ
[SMTP:Russ.Cooper@rc.on.ca] wrote:
> Before everyone rushes off to Allan's offered link to
> http://www.axent.com/swat/swat.htm, let me point out something in the
> Legal Agreement you have to accept before getting any useful
> information;
> If you do find something of value in their site, you cannot use this
> information as advice to a third party. This is covered under "You
agree
> not to use Software provided in this site for malicious or illegal
> purposes, or use it on or against any third party." They explain that
> the term "Software" refers to "software programs and information
> (collectively referred to as "Software")".
> So if they had a valuable tidbit of information, and I thought to use
> this information on one of my customer's systems, I would be
prohibited
> by virtue of the fact I read it at Axent's web site.
> You also may not learn the information contained there unless you are
a
> "qualified personnel trained in its use", according to their wording.
> Their attempt to limit their liability for the information that is
> contained in their website results in them actually limiting your
> freedom of speech as a result of viewing their information. Unless you
> could prove prior knowledge (something extremely difficult to do some
> times), anything they might have in there that you've actually
> previously known would also be subjected to the same restrictions, by
> virtue of you accepting their Legal Agreement.
> Decide for yourselves, but licensing agreements pertaining to
> information they've presumably gathered from the net seems like an
> infringement on the original author's Intellectual Property.
> I'll steer clear of Axent's web site and their products for fear I'm
> jeopardizing my ability to speak about what I already know...;-]

While I'm largely legally ignorant, I don' t know what kind of "license"
they claim here. Copyright would prevent me from reproducing or
republishing the information in its current form. A patent might
eliminate my right to use the information, but you can only patent
processes, not information. Trade secret status would make it illegal
for me to use the information, but publishing it removes that
protection.

Maybe you could argue that it is actually a contract, but I don't know
that it would be defensible. I could ask a 12 year old to go read it,
and explain the content to me, and the "contract" would not be valid
since 12 year olds are unable to enter into binding contractual
agreements.

I thought intellectual property rights existed as copyright, patents,
and trade secrets. I don't know which of these their "license" would
fall into. It was also my impression that there is no (at least in the
US) protection for actual knowledge excepting trade secrets (and
publishing it removes take that out of consideration, so does not
developing or owning the agent that developed the material yourself, I
believe): only for processes (through patents) or a representation of
knowledge (through copyright).

Disclaimer: I still won't go and look, because I wouldn't want to be a
test case. You should not use my "wild legal speculation" above to
justify anything you do.

-Chris


>From the workstation, this connection isn't visible and can easily be 
ignored / forgotten by the sys admin. It's been a while since I've played 
with this, so I don't recall exactly how the IPC$'s are opened (one per 
share or one per app executed). Therefore, I don't know if a counter of 
sorts would suffice, but it would be a start.

On NT, you can use a 'NET USE \\foo\ipc$ /d' command, but you shouldn't 
have to. When I spoke with MS support, they agreed with me that IPC$ stays 
open, but they said that it shouldn't have credentials, it should only 
reference the workstation name. If a simple copy is performed, this works 
as expected, but if an application is executed (not all apps do this), IPC$ 
will remain open with the user's (admin's) credentials associated with it 
allowing the original (non-admin) user to reconnect to that share w/o 
supplying credentials and with admin rights.

-----Original Message-----
From: Victor.DIAS-FERNANDES@dg12.cec.be 
[SMTP:Victor.DIAS-FERNANDES@dg12.cec.be]
Sent: Friday, September 05, 1997 6:06 AM
To: paulle@microsoft.com
Cc: Prusko, Peter T. (Vanstar at Alcoa); ntsecurity@iss.net
Subject: Re(2): [NTSEC] RE: Giving admin privileges without knowing

Not precisely (in my opinion).
On UNIX when you close the privileged shell the permissions are
automatically removed, on NT you must close explicitly the hidden
(not directly visible) privileged connection. And because it is a
non-directly visible shell the administrator can easily forget to do it.

I can think on a solution like a counter for admin connections that
are incremented for each application executed that uses the
connection and decrements when the applications exists. When the
counter reaches zero the privileged connection is automatically
closed. Cloud this be possible?

Victor Fernandes



> I don't get it. Isn't this like saying that on UNIX, an admin used SU to
> become admin on some user's workstation, and then left the shell open?
>
> On UNIX the solution is to close the shell. On NT, isn't the solution to
> do a "NET USE \\foo\IPC$ /d"
>
> > ----------
> > From: Prusko, Peter T. (Vanstar at
> > Alcoa)[SMTP:Peter.Prusko@alcoa.com]
> > Reply To: Prusko, Peter T. (Vanstar at Alcoa)
> > Sent: Thursday, September 04, 1997 2:08 PM
> > To: 'ntsecurity@iss.net'
> > Subject: [NTSEC] RE: Giving admin privileges without knowing
> >
> > Check the KB on this, article ID Q153066. The article states that
> > this was
> > corrected for NT 4, but I was been able to reproduce it quite easily a
> >
> > while ago (SP2 days). The issue deals with IPC$ remaining open (using
> >
> > Admin credentials) until it is disconnected by the server due to
> > inactivity
> > (default is 15 minutes). I spoke with MS about this and after about 2
> >
> > weeks, their 'official' stance was that this [the IPC$ share remaining
> >
> > open] could happen any time an application is run that would use the
> > IPC$.
> > One wouldn't expect a MS product on top of a MS operating system to
> > act in
> > this manner, but...
> >
> > I agree with Russ in that it is a bad security practice to perform a
> > 'connect as' using admin (or any other) credentials. If this needs to
> >
> > occur, a possible work around is to set the autodisconnect to a low
> > value
> > thereby closing these completed but exploitable connections.
> >
> > Peter Prusko
> > MCPS
> > Windows NT Workstation 3.51, 4.0
> > Windows NT 4.0 Server, 4.0 Server Enterprise
> >
> > pprusko@vanstar.com
> >
> >

> Ah, here's a point. It wasn't sent by M$. M$ sent a private response to
> Itai
> and then he reposted it to the list. I assume Itai thought he was just
> doing a good deed since he had posted his questions to the list earlier. I
> didn't notice this myself earlier.

Ah! I missed that too. Apologies to Microsoft.
At 10:10 9/5/97 -0400, you wrote:
>>From the workstation, this connection isn't visible and can easily be 
>ignored / forgotten by the sys admin. It's been a while since I've played 
>with this, so I don't recall exactly how the IPC$'s are opened (one per 
>share or one per app executed). Therefore, I don't know if a counter of 
>sorts would suffice, but it would be a start.
>
>On NT, you can use a 'NET USE \\foo\ipc$ /d' command, but you shouldn't 
>have to. 

Unfortunately, what you or I think should or shouldn't happen won't help us
much unless MS agrees to change it. The best thing we can all do is to
make a habit of accessing the share by:

net use \\server\ipc$ /user:domain\whoever

now go and do whatever you need to on that machine under that user context

then - 

net use \\server\ipc$ /d

A useful trick that can work if the user already has a connection (NT 4.0
only) is to:

net use \\123.123.123.123\ipc$

That will establish a second session under a different user context - if
you then access it that way (by IP addr, not NetBIOS name), you can do
anything you like.

IMHO, MS ought to provide us a *supported* tool to pop up a new desktop
under a different user context so that I can log in, do what I need to do,
and not disturb the user's work. I personally tend to never log out until
my password expires, and currently have an uptime of close to 60 days. If
one of the tools in the resource kit were polished a bit, it should suit
this need.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

RPC connections are visible from a NT workstation.

qp
<_


> -----Original Message-----
> From: David LeBlanc [SMTP:dleblanc@iss.net]
> Sent: Friday, September 05, 1997 11:23 AM
> To: Prusko, Peter T. (Vanstar at Alcoa)
> Cc: ntsecurity@iss.net
> Subject: RE: Re(2): [NTSEC] RE: Giving admin privileges without
> knowing
> 
> At 10:10 9/5/97 -0400, you wrote:
> >>From the workstation, this connection isn't visible and can easily
> be 
> >ignored / forgotten by the sys admin. It's been a while since I've
> played 
> >with this, so I don't recall exactly how the IPC$'s are opened (one
> per 
> >share or one per app executed). Therefore, I don't know if a counter
> of 
> >sorts would suffice, but it would be a start.
> >
> >On NT, you can use a 'NET USE \\foo\ipc$ /d' command, but you
> shouldn't 
> >have to. 
> 
> Unfortunately, what you or I think should or shouldn't happen won't
> help us
> much unless MS agrees to change it. The best thing we can all do is
> to
> make a habit of accessing the share by:
> 
> net use \\server\ipc$ /user:domain\whoever
> 
> now go and do whatever you need to on that machine under that user
> context
> 
> then - 
> 
> net use \\server\ipc$ /d
> 
> A useful trick that can work if the user already has a connection (NT
> 4.0
> only) is to:
> 
> net use \\123.123.123.123\ipc$
> 
> That will establish a second session under a different user context -
> if
> you then access it that way (by IP addr, not NetBIOS name), you can do
> anything you like.
> 
> IMHO, MS ought to provide us a *supported* tool to pop up a new
> desktop
> under a different user context so that I can log in, do what I need to
> do,
> and not disturb the user's work. I personally tend to never log out
> until
> my password expires, and currently have an uptime of close to 60 days.
> If
> one of the tools in the resource kit were polished a bit, it should
> suit
> this need.
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |


> ----------
> From:
> Victor.DIAS-FERNANDES@dg12.cec.be[SMTP:Victor.DIAS-FERNANDES@dg12.cec.
> be]
> Sent: Friday, September 05, 1997 3:05 AM
> To: Paul Leach
> Cc: ntsecurity@iss.net; Peter.Prusko@alcoa.com
> Subject: Re(2): [NTSEC] RE: Giving admin privileges without
> knowing
> 
> Not precisely (in my opinion).
> 
No disagreement. I meant "like" as in "similar". Yes, the connection is
not visible, and hence more easily forgotten.

In the near term, how about a bath file call "doadmin"
 net use \\%1\ipc$ /user:domain\admin *
 cmd
 net use \\%1\ipc$ /d

which when invoked in a command window with "doadmin server" will let
you run commands, and then delete the session when you close the shell.

> On UNIX when you close the privileged shell the permissions are 
> automatically removed, on NT you must close explicitly the hidden 
> (not directly visible) privileged connection. And because it is a 
> non-directly visible shell the administrator can easily forget to do
> it.
> 
Paul
Peter,

I am part of a team with Inside Sales for Symantec Corporation handling
site licensing in Michigan, Indiana, and Ohio.

One of the software solutions we offer is YEO--Your Eyes Only. This
data security software provides access control and file/directory
encryption.

Please feel free to contact me if you would like further information or
evaluation CD's.

Thank you,

Dan Werner
800-388-3858 ext 6547
How about remembering that Itai Dor-on posted it to the list, not the MS
PM. And that Itai's first posting that prompted the reply explicitly
questioned the legitimacy of _positioning_ MS PRoxy 2.0 as a firewall.

> ----------
> From: Peter da Silva[SMTP:peter@grendel.nmti.com]
> Reply To: Peter da Silva
> Sent: Friday, September 05, 1997 6:08 AM
> To: ed@alcpress.com
> Cc: silicom@netvision.net.il; firewalls@GreatCircle.COM;
> ntsecurity@iss.net; anton@Toronto.com
> Subject: [NTSEC] Re: Proxy Server 2.0 features & market
> positioning byMicrosoft Program Manager
> 
> > I think you (and possibly others) may be a bit vendorphobic.
> > The message that you're complaining about is clearly stated
> > as "Proxy Server 2.0 features & marketing positioning..."
> > in the subject line.
> 
> That doesn't tell me it's marketing fluff. I might well post a message
> with that title pointing out how their marketing position is
> inconsistent
> with their features. Even a message from a Microsoft address might
> contain
> useful information under that title. And in any case I tend to give
> messages
> from Firewalls a higher priority, and it's useful that I be able to do
> so,
> simply because they are so rarely contain marketing noise.
> 
> 
jware@rfwklaw.com has been changed to rpetersen@rfwklaw.com
I am wondering if anyone has used the passfilt.dll or have any comments 
about it. I have just tried it and discovered what appears to be two 
annoying things.

1) If does not apply for Adminstrators using User Manager. I have the 
filter applied on the domain controllers for my test account domain. When 
I connect from a machine in the test resource domain as Administrator and 
change the password, I can change it without any password checking.

2) When I try to change the password from a client workstation, I get a 
message saying that my password is not at least six characters long or has 
been used as one of the past six passwords. This message is incorrect. Is 
there any way to change this message?

- Aldon Hynes
ahynes@ny.ubs.com


In aneMail from 08/30/1997 12:36:48 MEZ, you wrote:

<< 
 Is policy editor a solution, or do they just use their own version of policy

 
 editor to unlock the pc? ...
 >>

You can use policy editor as well as any other registry editing tool to
remove 
the right to edit the registry for Users (easyest with policy editor) 

you might as well have a look at microsofts Zero Administration Kit
(available at www.microsoft.com) 

The resource-kit tool FloppyLocker might as well come handy for you.
(A service which puts a DACL at the Floppy drive, blocking access from Users
while Powerusers and Administrators are still able tho access the floppy).

hope this helps


Bye

Christian Sting
C/S Consulting
I have tried using it, but not in a domain setting. I have written a
passfilt.dll, installed it on my local standalone NT server and it works
great. I did not run into any problems with the Administrator account
being able to change passwords when others could not. It restricted the
Administrator accounts just as it did everyone else. But like I said, I
have not done it in a domain setting yet. That was going to be my next
step until I realized another problem with the whole concept of password
filtering.

My problem is the fact that the majority of my clients are Windows 95
clients. I have not verified this, but everyone I talk to seems to
agree, that if a Windows 95 client goes to change their domain password,
it will change it on the Windows 95 client, whether or not it is
rejected by the NT Server. Thus leaving the end user with passwords
that are now out of synch.

In regards to your second point. That really sounds like a domain
policy rejection. Check the Account Policy in User Manager for that
domain to check and see if those options are set for the domain.

Greg...
---
Gregory S. Bradley
gsbrad@exchange.monsanto.com

> -----Original Message-----
> From: ahynes@ny.ubs.com [SMTP:ahynes@ny.ubs.com]
> Sent: Friday, September 05, 1997 2:20 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] passfilt.dll
> 
> I am wondering if anyone has used the passfilt.dll or have any
> comments 
> about it. I have just tried it and discovered what appears to be two 
> annoying things.
> 
> 1) If does not apply for Adminstrators using User Manager. I have the
> 
> filter applied on the domain controllers for my test account domain.
> When 
> I connect from a machine in the test resource domain as Administrator
> and 
> change the password, I can change it without any password checking.
> 
> 2) When I try to change the password from a client workstation, I get
> a 
> message saying that my password is not at least six characters long or
> has 
> been used as one of the past six passwords. This message is
> incorrect. Is 
> there any way to change this message?
> 
> - Aldon Hynes
> ahynes@ny.ubs.com
> 
 Does anyone know if there is an SSH product that will port between NT
and unix available yet?


-------------------
Mark Fearer
mfearer@securid.com
voice 617 687 7361
page 888 274 4139
http://pages.prodigy.com/NH/tollbooth/tollbooth.html
I thought I'd de-lurk for a second and point out that the email Itai
forwarded to this list was:

* posted on a Microsoft support newsgroup for Proxy Server
* sent to Itai as personal email in response to his questions on
NTSecurity & firewalls@greatcircle.com

---> Microsoft did NOT post that email to this newsgroup as part of any
marketing activity.

Itai Dor-On (who is NOT a Microsoft employee) forwarded that personal
email to the newsgroup b/c there have been many questions on this group
about the Proxy Server product.

> -----Original Message-----
> From: Peter da Silva [SMTP:peter@grendel.nmti.com]
> Sent: Friday, September 05, 1997 6:09 AM
> To: ed@alcpress.com
> Cc: silicom@netvision.net.il; firewalls@GreatCircle.COM;
> ntsecurity@iss.net; anton@Toronto.com
> Subject: Re: Proxy Server 2.0 features & market positioning
> byMicrosoft Program Manager
> 
> > I think you (and possibly others) may be a bit vendorphobic.
> > The message that you're complaining about is clearly stated
> > as "Proxy Server 2.0 features & marketing positioning..."
> > in the subject line.
> 
> That doesn't tell me it's marketing fluff. I might well post a message
> with that title pointing out how their marketing position is
> inconsistent
> with their features. Even a message from a Microsoft address might
> contain
> useful information under that title. And in any case I tend to give
> messages
> from Firewalls a higher priority, and it's useful that I be able to do
> so,
> simply because they are so rarely contain marketing noise.
> 
> So it's *not* possible to just skip a message like that without
> reading
> it. And I wouldn't want to discourage people at Microsoft from
> commenting
> from the trenches by making them think their messages would simply be
> discarded just because of where they're posting from, which is what
> you
> seem to be proposing.
> 
> No, it's not classical spam. It's not unsolicited marketing email. But
> I
> think that we need to draw the line on this list against vendors
> sending
> apparently solicited responses to the list as a whole: we've had
> periods
> in the past where single vendors have pushed a significant amount of
> such
> fluff down the pipe.
> 
> With more and more vendors getting into it, especially companies like
> Microsoft who have been pushing the ragged edge of acceptable
> behaviour in
> marketing material in the past (yes, I've had bulk mail from them that
> it's a stretch to consider solicited), if we don't draw that line here
> it's just going to get worse. I hope in the future that they send
> lengthy
> web-formatted low-content pieces to just the person who requested it.
About a four days ago I posted a message by the name of “Proxy server
2.0 beta -
is it a true firewall?” that questioned some security features of
Microsoft Proxy
Server 2.0 (beta).

In that message I mentioned that I questioned Microsoft on the matter
presented
by sending a message to the proxy beta NEWS GROUP at msnews.

I also wrote that I was willing to post the response to the mailing
list.

Kerry Schwartz, who is PROGRAM MANAGER for MS Proxy Server, was kind
enough to respond to my post with a very detail explanation that is
TECHNICAL despite
the subject title (personally I was flattered).

Even thought the response questions my knowledge, I decided to put all
of this aside
and post it to the list with no modification so I can contribute to the
security community.

The content of the post is VERY important to any security
expert/consultant that is
involved with firewall tech.

How Microsoft positions Microsoft proxy server 2.0 is relatively
important as any technical
question. and I won’t bother to explain why, it is obvious.

I was shocked to see that certain subscribers started to SPAM the list
with stupid arguments
against the post.

If one would like to comment he should send the reply directly to me not
to all the subscribers.

Another thing that amazed me is how long did it take for some people to
realize that I sent the
post NOT Microsoft. I suspect that they didn’t even read the post just
saw the word Microsoft
and started burning!

And why do they reply with “RE:” + “original subject” leaving others to
suspect it is a serious
technical comment regarding the original post. They could respond with a
modified subject line so
people can distinguish and decided if they would like to read it or not

I couldn’t post a URL because it was on the msnew NEWSGROUP and I
thought it would be much
more convenient for other subscribers to read it.

I think certain people have to much spare time so instead of wasting it
by sending
messages that contain arguments and analogies with no benefit (rape?!)
I am willing to buy a LOT of time If anyone is selling, name the price!

One thing I learned is to never send anymore ‘interesting’ responses
that I get
from vendors.

That’s all.

Itai Dor-on



P.S

Yes I like Microsoft.


Hello everyone!

I am new to your group. I located you last week and have been watching with
great interest. I have printed a lot of your information and have decided to
take a chance and post this message. 

I am new to the world of NT. A couple of months ago I accepted a position as
Computer Lab Manager at an Art Institute that teaches many art and design
courses, with a strong emphasis on Graphic Design, Multimedia, and Animation.

I have two labs, one PC and the other MAC. The PC lab is running Windows TN
4.0 with many applications such as 3D Sudio MAX, AutoCAD14, Fractal Painter 5
etc etc..... the MACs have been delivered and I am going to start loading
software Monday.

I have a very strong background in UNIX and VOS. and am teaching myself NT.
 But could use some help with the security issues involved with seting up
school lab security. I've got a really good grasp of the basics, but I'm just
having a little problem with setting up theusers NT profiles...

I currently have 25 machines running NT. They were config as FAT before I
came on board and I am converting them to NTFS. My Dean of Education wants
everyone to be able to use specific applications and save ONLY write to the
JAZ drives... no hard access drive at all. I understand that if every
student saved to the system we would have no space, but am having a little
trouble setting up the security.. Are there any school lab managers out
there that can help me? 

Any help is welcome and will be appreciated... It's hell being new, Hope
you'all can remember back to when you were new and can help a fellow
flounder.

Yvonne

luebemsy@aii.edu



---------------------
Forwarded message:
From: Postmaster@naakka.tmt.tele.fi
Date: 97-09-05 23:08:33 EDT

----- Transcript of session follows -----
From:fiabb085@fitra.mail.abb.com
550 fiabb085@fitra.mail.abb.com .... Lotus Notes delivery error.

----- Unsent message follows -----
Item Subject: Lotus Notes Message Text

Received: from tiira.tmt.tele.fi (tiira.tmt.tele.fi [193.210.21.46]) by naa
kka.tmt.tele.fi with SMTP (8.7.6/8.7.3) id GAA25372 for ; Sat, 6 Sep 1997 06:07:44 +0300 (EETDST)
Received: from iss.net (actually host ns.iss.net) by tiira.tmt.tele.fi
 with SMTP Public (MMTA); Sat, 6 Sep 1997 06:07:07 +0300
Received: (qmail 16509 invoked by alias); 6 Sep 1997 03:01:30 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 16503 invoked by alias); 6 Sep 1997 03:01:29 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 16498 invoked by uid 15); 6 Sep 1997 03:01:29 -0000
Received: (qmail 16493 invoked from network); 6 Sep 1997 03:01:27 -0000
Received: from arden.iss.net (root@208.21.0.8) by phoenix.iss.net with SMT
P;
 6 Sep 1997 03:01:27 -0000
Received: from emout11.mail.aol.com (emout11.mx.aol.com [198.81.11.26])
 by arden.iss.net (8.8.7/8.7.3) with ESMTP id XAA31005
 for ; Fri, 5 Sep 1997 23:04:04 -0400
From: YvonneL455@aol.com
Received: (from root@localhost)
 by emout11.mail.aol.com (8.7.6/8.7.3/AOL-2.0.0) id XAA23807;
 Fri, 5 Sep 1997 23:03:24 -0400 (EDT)
Date: Fri, 5 Sep 1997 23:03:24 -0400 (EDT)
Message-ID: <970905230255_1026949030@emout11.mail.aol.com>
To: ntsecurity@iss.net
cc: luebesmy@aii.edu
Subject: [NTSEC] Greetings from a Novice
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: YvonneL455@aol.com
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.
net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net



___________________________________________________


Hello everyone!

I am new to your group. I located you last week and have been watching
with
great interest. I have printed a lot of your information and have decided
to
take a chance and post this message.

I am new to the world of NT. A couple of months ago I accepted a position
as
Computer Lab Manager at an Art Institute that teaches many art and design
courses, with a strong emphasis on Graphic Design, Multimedia, and
Animation.

I have two labs, one PC and the other MAC. The PC lab is running Windows
TN
4.0 with many applications such as 3D Sudio MAX, AutoCAD14, Fractal Painter
5
etc etc..... the MACs have been delivered and I am going to start loading
software Monday.

I have a very strong background in UNIX and VOS. and am teaching myself NT.
 But could use some help with the security issues involved with seting up
school lab security. I've got a really good grasp of the basics, but I'm
just
having a little problem with setting up theusers NT profiles...

I currently have 25 machines running NT. They were config as FAT before I
came on board and I am converting them to NTFS. My Dean of Education
wants
everyone to be able to use specific applications and save ONLY write to the
JAZ drives... no hard access drive at all. I understand that if every
student saved to the system we would have no space, but am having a little
trouble setting up the security.. Are there any school lab managers out
there that can help me?

Any help is welcome and will be appreciated... It's hell being new, Hope
you'all can remember back to when you were new and can help a fellow
flounder.

Yvonne

luebemsy@aii.edu




---------------------
Forwarded message:
From: msdos=AIG/EXCHANGE/POSTMASTER%wtmp01@wtgw.aig.com
To: YvonneL455@aol.com
Date: 97-09-06 00:26:21 EDT

[002] Mail was received that was addressed to unknown addresses. 
Mail item was not delivered to: 
AIG/EXCHANGE/MPREZIOSI

------------------------------------------------------------------------------
 
Worldtalk 400 Gateway IPM.Microsoft Mail.Note
From: YvonneL455@aol.com-@-INETGW
To: ntsecurity@iss.net-@-INETGW
Cc: YvonneL455@aol.com-@-INETGW
Subject: [NTSEC] Fwd: Returned Mail: Message Coul
Date: 1997-09-05 23:49
Priority: 3

------------------------------------------------------------------------------

---------------------
Forwarded message:
From: Postmaster@naakka.tmt.tele.fi
Date: 97-09-05 23:08:33 EDT

----- Transcript of session follows -----
From:fiabb085@fitra.mail.abb.com
550 fiabb085@fitra.mail.abb.com .... Lotus Notes delivery error.

----- Unsent message follows -----
Item Subject: Lotus Notes Message Text

Received: from tiira.tmt.tele.fi (tiira.tmt.tele.fi [193.210.21.46]) by naa
kka.tmt.tele.fi with SMTP (8.7.6/8.7.3) id GAA25372 for ; Sat, 6 Sep 1997 06:07:44 +0300 (EETDST)
Received: from iss.net (actually host ns.iss.net) by tiira.tmt.tele.fi
 with SMTP Public (MMTA); Sat, 6 Sep 1997 06:07:07 +0300
Received: (qmail 16509 invoked by alias); 6 Sep 1997 03:01:30 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 16503 invoked by alias); 6 Sep 1997 03:01:29 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 16498 invoked by uid 15); 6 Sep 1997 03:01:29 -0000
Received: (qmail 16493 invoked from network); 6 Sep 1997 03:01:27 -0000
Received: from arden.iss.net (root@208.21.0.8) by phoenix.iss.net with SMT
P;
 6 Sep 1997 03:01:27 -0000
Received: from emout11.mail.aol.com (emout11.mx.aol.com [198.81.11.26])
 by arden.iss.net (8.8.7/8.7.3) with ESMTP id XAA31005
 for ; Fri, 5 Sep 1997 23:04:04 -0400
From: YvonneL455@aol.com
Received: (from root@localhost)
 by emout11.mail.aol.com (8.7.6/8.7.3/AOL-2.0.0) id XAA23807;
 Fri, 5 Sep 1997 23:03:24 -0400 (EDT)
Date: Fri, 5 Sep 1997 23:03:24 -0400 (EDT)
Message-ID: <970905230255_1026949030@emout11.mail.aol.com>
To: ntsecurity@iss.net
cc: luebesmy@aii.edu
Subject: [NTSEC] Greetings from a Novice
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: YvonneL455@aol.com
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.
net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net



___________________________________________________


Hello everyone!

I am new to your group. I located you last week and have been watching
with
great interest. I have printed a lot of your information and have decided
to
take a chance and post this message.

I am new to the world of NT. A couple of months ago I accepted a position
as
Computer Lab Manager at an Art Institute that teaches many art and design
courses, with a strong emphasis on Graphic Design, Multimedia, and
Animation.

I have two labs, one PC and the other MAC. The PC lab is running Windows
TN
4.0 with many applications such as 3D Sudio MAX, AutoCAD14, Fractal Painter
5
etc etc..... the MACs have been delivered and I am going to start loading
software Monday.

I have a very strong background in UNIX and VOS. and am teaching myself NT.
 But could use some help with the security issues involved with seting up
school lab security. I've got a really good grasp of the basics, but I'm
just
having a little problem with setting up theusers NT profiles...

I currently have 25 machines running NT. They were config as FAT before I
came on board and I am converting them to NTFS. My Dean of Education
wants
everyone to be able to use specific applications and save ONLY write to the
JAZ drives... no hard access drive at all. I understand that if every
student saved to the system we would have no space, but am having a little
trouble setting up the security.. Are there any school lab managers out
there that can help me?

Any help is welcome and will be appreciated... It's hell being new, Hope
you'all can remember back to when you were new and can help a fellow
flounder.

Yvonne

luebemsy@aii.edu




I'm looking for an identd deamon that will open requested ports when 
a user makes a request.. i am currently using one that has to be 
configured manually... it's a major pain when more then one process 
dies and logs on ident'd wrong.. i have to close it down, restart it 
and change the current identd deamon..any helpers?

Thanks!

Matthew Katona


***************
The chicken wore a polyester smile
***************
http://www.polyester.net
root@polyester.net
***************

Hi,
 Could someone please give me a solution to a problem I have encounted. I was trying to access resources on a WinNT 4.0 Workstation via a Windows 95 Box. However, to do this I have had to supply my WinNT username and password before logging into Win95 to be able to access WinNT resources. 

As most people know, Win 95 does not encrypt passwords on its machine. Therefore, anyone who gets access to the Win 95 box gets access to WinNT resources also. Can I access WinNT resources any other way other then supplying my username and password to Win 95. I have made the resources on NT available to EVERYONE.

Any help would be greatly appreciated..

Thanks

Ace 
 I started using Proxy 2.0 b2 and found it quite interesting... my Internet
Access configuration relies on a modem to dialup to an ISP... but I'm
surprised to discover that it won't enable me to do a packet filtering
because it cannot find any external interfaces... What ?!?
How can I make a interface an external one ?? Can I configure it with a
modem ?? Ok Ok, I know that packets won't be routed, because it is a RAS
interface, but I want to enable Proxy to alert me when someone try to send a
ICMP packet, for example.

Is there any way to do that ???

Romulo Moacyr Cholewa, MCSE, MCT. ICQ UIN: 832755
WWWPager: http://wwp.mirabilis.com/832755
Personal E-Mail: RCholewa@Elogica.com.br
Corporate E-Mail: RomuloC@MSConecta.com.br
----------------------------------------------------------------------------
-


1st. Define a dial-up record for you ISP in NT 'dial-up networking' manager.

2nd. Enable 'Auto Dial' by checking the option in the auto dial configuration
manager manger
for Proxy2b and select the dial-up record.

3rd. After you have done that you HAVE TO stop and restart the www service in
Internet service manager.

If you don't follow these steps in the specific order PRXY2B
won't recognize the dial-up adapter as a pipe to the internet thus
won't allow you to use DPF.

Any way I suggest you go to msnews.microsoft.com server
microsoft.public.proxybeta section there you will find valuable information on
specific configuration settings and an extensible FAQ that was prepared by a
wonderful man at Microsoft named of Cral calvello

Hope this help.

Itai Dor-on,MCSE


Romulo Moacyr Cholewa wrote:

> I started using Proxy 2.0 b2 and found it quite interesting... my Internet
> Access configuration relies on a modem to dialup to an ISP... but I'm
> surprised to discover that it won't enable me to do a packet filtering
> because it cannot find any external interfaces... What ?!?
> How can I make a interface an external one ?? Can I configure it with a
> modem ?? Ok Ok, I know that packets won't be routed, because it is a RAS
> interface, but I want to enable Proxy to alert me when someone try to send a
> ICMP packet, for example.
>
> Is there any way to do that ???
>
> Romulo Moacyr Cholewa, MCSE, MCT. ICQ UIN: 832755
> WWWPager: http://wwp.mirabilis.com/832755
> Personal E-Mail: RCholewa@Elogica.com.br
> Corporate E-Mail: RomuloC@MSConecta.com.br
> ----------------------------------------------------------------------------
> -



What about hummingbird software? check it out at www.hummingbird.com 


-----Original Message-----
From: administrator@polyester.net 
To: ntsecurity@iss.net 
Date: Friday, September 05, 1997 11:41 PM
Subject: [NTSEC] ident process



I'm looking for an identd deamon that will open requested ports when 
a user makes a request.. i am currently using one that has to be 
configured manually... it's a major pain when more then one process 
dies and logs on ident'd wrong.. i have to close it down, restart it 
and change the current identd deamon..any helpers?

Thanks!

Matthew Katona


***************
The chicken wore a polyester smile
***************
http://www.polyester.net
root@polyester.net
***************



Doesn't Novell 4.0 and up take care of the synchronizing password scheme -
instead of having to do it manually? 

 ! __ __ __ __ 
 o /\ \ /\ \ /\ "-./ \ Using no way as way | blanka of lusty 
 /V\ _\_\ \\ \ \\ \ \-./\ \ Having no limitation | baraka of viking 
 A /\_____\\ \_\\ \_\ \ \_\ as limitation | 
 / \ \/_____/ \/_/ \/_/ \/_/ -B.L. | jqy4680@is2.nyu.edu 

 Korean Pop Home Page you say ??? http://pages.nyu.edu/~jqy4680

I was sent the following letter--> I run SP3.. anyone have any 
suggestions on what happened? I have a log showing he attempted to 
access /iisadmin on my webserver as well..

[---letter is as follows---]

On saturday, 9-6-97 1:00pm,

Currently logged on user: administrator
machine name: freaky
Web Server: MS IIS

I had a logon prompt for your shared LAN resources and the name of a
currently logged on user, all that's needed to begin a dictionary attack. 
I'll tell you how to secure your site from this sort of attack if you tell
me how you keep TCP, UDP secure.

-Nate
nfitzge@pop3.utoledo.edu

I have screen shots that I can show you that tell you how and what info was
obtained. 

screen1: show's your machine in my name table
screen2: your machine's name table, including the currently logged on user
screen3: a windows login prompt to freaky. Obtained after about 3 minutes
work.


***************
The chicken wore a polyester smile
***************
http://www.polyester.net
root@polyester.net
***************

Aldon Hynes notes:

 I am wondering if anyone has used the passfilt.dll 

We do.

 1) If does not apply for Adminstrators using User Manager. I have the 
 filter applied on the domain controllers for my test account domain...

I think if you want to apply to the local Administrator account,
you'll have to install it on the workstations as well as on the domain
controller. 

 2) [The message lies about problematic passwords] ...
 Is there any way to change this message?

Apparently not - unless Microsoft fixes it, or you write your own DLL.

-- James E. Leinweber
Information Systems - State Laboratory of Hygiene - University of Wisconsin
 465 Henry Mall, Madison WI 53706-1578 USA +1 608 262 0736
On Fri, 5 Sep 1997, Paul Leach wrote:

> No disagreement. I meant "like" as in "similar". Yes, the connection is
> not visible, and hence more easily forgotten.
> 
> In the near term, how about a bath file call "doadmin"
> net use \\%1\ipc$ /user:domain\admin *
> cmd
> net use \\%1\ipc$ /d

I have a few questions about this that maybe Paul can clear up.

1. Is there a race condition during the execution of cmd, before the 
connection is closed which could allow the user to execute other commands 
with admin privs or is the security context of the batch file seperate 
from the user?

2. What if I set the PATH such that I had another command called "net" 
someplace else. How does NT handle the PATH in these situations. 
Obviously you should give an absolute path.

3. Could I cause the "net use ... /d" command to fail in anyway thus 
stopping it fro dropping perms?

4. Is that the password there in the first "net use" command? Sorry I 
don't have a Win32 to check the net use arg formats. If so, would you 
really want it on disk someplace, and could you not specify a trojan 
domain in a such a way to send the password to a non-trusted host? Even 
if it is not the password there, could I not still do the forced connection 
toa trojaned domain. You could utilize several problems with SMB to 
collect a password that way.

It would seem that something akin to sudo could be whipped up a little 
easier, and possibly a bit more secure than this batch file.

Craig Brozefsky craig@onshore.com
onShore Inc. http://www.onshore.com/~craig
Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)
I hear my inside, the mechanized hum of another world - Steely Dan

> From: Bryan Wilkerson 
> To: ntsecurity@iss.net
> Subject: [NTSEC] Basic permissions
> Date: Tuesday, September 02, 1997 3:54 PM
>
> I think 2 basic steps should be taken in conjunction with setting up a 
> new, secure NT *Server* 4.x.
> 
> 1. Starting at the root share of each local drive assign the
following 
> permissions:
> Administrators Full Control (All) (All)
> CREATOR OWNER Full Control (All) (All)
> SYSTEM Full Control (All) (All)
> Recurse subdirectories replacing permissions on all existing
files.

Correct me if I am wrong, but wouldn't it be safer to take this a step
further with permissions and set them to:

Change (RWXD) (RWXD)

With Full Control, any file that has been changed to have no permissions
(for some obscure reason) can be taken over by anyone.
With Change, only the Administrator would be able to reset the permissions
for the file.

I believe this is the only difference between Full Control and Change, and
was done only for POSIX compatability.

> From: Toh Chang Ying 
> To: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] IE 4.0 sending information on PC to Microsoft 
> Date: Monday, September 01, 1997 9:51 PM
> 
> http://www.microsoft.com/support/downwiz/welcome.asp
> 
> How do they do that ? Registry ? Or they can read your HDD ? It works on
IE3 ;)

It's a simple Active-X control. Security wise, I'd avoid it... It appears
to be able to read and write files locally (and who knows what else).

If you want more detailed information on Active-X and security, reply
privately (or read the mostly off-topic thread Java and Active-X Controls).

Actually I don't know but I think NT acts AS IF... I guess the ALC nor the file
descriptor (but for the name) are untouched.

 ---
 Jean-Claude Berger
 Systems and RDBMS consultant (MCSE), Lyon, France
 E-mail : jcberger@imaginet.fr, Compuserve : 100305,2436


-----Original Message-----
From: Ray Arachelian [SMTP:sunder@brainlink.com]
Sent: Tuesday, August 26, 1997 5:07 PM
To: Jean-Claude Berger
Cc: 'gpng@mol.com.my'; 'ntsecurity@iss.net'
Subject: RE: [NTSEC] can't rename directory

On Tue, 26 Aug 1997, Jean-Claude Berger wrote:

> When you rename a file or a directory NT acts as if it deleted the file and then 
> recreated it. So you need the right to delete your directory (D) on the left list of

Erm, does this mean that the file's or directory's ACL's & Audit info's
are zapped and new ones are inherited from the parent? That would be bad.


Paul,

Maybe be you should try it. With the Explorer, create a directory with
(RWX)(RX) permissions and into it create a directory with (RX)(RX) 
permissions. You can't rename this last one.

Always on the internal directory, change permissions to (RWX)(RX) and you can
rename it.

I did not say that NT WAS recreating a directory but that it was
acting AS IF...Now, you are in good place to know if the Explorer 
uses MoveFile or not.

 ---
 Jean-Claude Berger
 Systems and RDBMS consultant (MCSE), Lyon, France
 E-mail : jcberger@imaginet.fr, Compuserve : 100305,2436


-----Original Message-----
From: Paul Leach [SMTP:paulle@microsoft.com]
Sent: Tuesday, August 26, 1997 9:59 PM
To: Jean-Claude Berger; 'Ray Arachelian'
Cc: 'gpng@mol.com.my'; 'ntsecurity@iss.net'
Subject: RE: [NTSEC] can't rename directory



> ----------
> From: Ray Arachelian[SMTP:sunder@brainlink.com]
> Reply To: Ray Arachelian
> Sent: Tuesday, August 26, 1997 9:06 AM
> To: Jean-Claude Berger
> Cc: 'gpng@mol.com.my'; 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] can't rename directory
> 
> On Tue, 26 Aug 1997, Jean-Claude Berger wrote:
> 
> > When you rename a file or a directory NT acts as if it deleted the
> file and then 
> > recreated it. So you need the right to delete your directory (D) on
> the left list of
> > permissions of the directory itself OR full control on the container
> directory 
> > AND at least the RWX on the container directory (repectively for
> deleting and
> > adding).
> 
The above statement is not true. Changing the name (with MoveFile)
merely requires (W) access to the directory. Some applications (e.g.
Word) will implement operations like "save" by creating a new file,
deleting the old one, and renaming the new one to the old name, which
will cause the behavior you saw above. 

> Erm, does this mean that the file's or directory's ACL's & Audit
> info's
> are zapped and new ones are inherited from the parent? That would be
> bad.
> 
If the app creates a new file and deletes the old one, and renames the
new one the same as the old name, without copying across the security
descriptor, that's the behavior you get. It's an app problem, not an OS
one.

Paul

Folks,

Open WINLOGON.EXE using Notepad (or friendly binary editor) and scroll through 
it (Word Wrap helps in Notepad). You'll notice what appears to be a script 
that calls adduser.exe (RESKIT tool) and NET LOCALGROUP to create accounts and 
add them to the Administrators group. My only thought is this is a security 
feature for creating an Administrator account when you are completely locked 
out of a machine (or maybe used at installation time). Any ideas (or how to 
activate it?).

Also, doing the same thing to MSGINA.DLL reveals code that appears to handle 
situations such as Security Log full and CrashOnAuditFail - but I've never 
seen it working. Anyone with a code license care to comment?

Cheers, john...

Guaranteed lowest prices and largest selection! Factory Direct!
We have millions of inventory from over 3,000 makers worldwide.
For FULL details, e-mail us a blank message to:
mailto:music@powernethk.com?subject=INFO.

Since I have subscribed to this list my POP3 box has become the welcome mat
for large volumes of advertising SPAM. Since I have only been lurking here
for a week and not posted yet, I can only assume that the mailing list has
been SOLD to electronic advertising firms. Is this true? Are other list
members experiencing the same kind of annoying garbage? The LAST advertiser
was so bold as to actually place [NTSEC] in the subject line!

Bewildered,

Very Respectfully,

Michael E. Cummins
webmaster@i-magery.com

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

"Argue for your limitations, and they shall be yours!"
 - R. Bach (paraphrased)
"Every man is my superior in that I may learn from him"
 -S. Clemmons







| Does anyone know if there is an SSH product that will port between NT
| and unix available yet?
Check out:
http://www.datafellows.com/f-secure/
http://www.europe.datafellows.com/f-secure/

It does not yet include secure ftp, I heard that this was bount to be 
released in there next release this autumn. The SSH package works fine for
me, though I think it's a bit slow.

Groetjes, Micha"el
---------------------------------------------------------------------
 Micha"el Smeding | Michael.Smeding@cwi.nl | www.cwi.nl/~mis
---------------------------------------------------------------------
 System Administrator / Helpdesk-engineer
 Dept. ComputerSystems & Telematics (CST)
 Centre for Mathematics and Computer Sciences (CWI)
 Kruislaan 413, 1098 SJ Amsterdam, Holland
 +31 20 5924129
Michael,
 I am getting the same thing too, I just received the e-mail you spoke of.
 How can we fix this problem?


At 04:57 PM 9/8/97 +1000, you wrote:
>Since I have subscribed to this list my POP3 box has become the welcome mat
>for large volumes of advertising SPAM. Since I have only been lurking here
>for a week and not posted yet, I can only assume that the mailing list has
>been SOLD to electronic advertising firms. Is this true? Are other list
>members experiencing the same kind of annoying garbage? The LAST advertiser
>was so bold as to actually place [NTSEC] in the subject line!
>
>Bewildered,
>
>Very Respectfully,
>
>Michael E. Cummins
>webmaster@i-magery.com
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
>MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
>PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
>I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>"Argue for your limitations, and they shall be yours!"
> - R. Bach (paraphrased)
>"Every man is my superior in that I may learn from him"
> -S. Clemmons
>
>
>
>
>
>
>
>
Jim Raykowski
San Diego, CA
jimrski@cts.com
I recently resubscribed to the list.
The first message I received was advertising spam.
SMPnet

Michael E. Cummins wrote:
> 
> Since I have subscribed to this list my POP3 box has become the welcome mat
> for large volumes of advertising SPAM. Since I have only been lurking here
> for a week and not posted yet, I can only assume that the mailing list has
> been SOLD to electronic advertising firms. Is this true? Are other list
> members experiencing the same kind of annoying garbage? The LAST advertiser
> was so bold as to actually place [NTSEC] in the subject line!
> 
> Bewildered,
> 
> Very Respectfully,
> 
> Michael E. Cummins
> webmaster@i-magery.com
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
> MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
> PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
> I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> "Argue for your limitations, and they shall be yours!"
> - R. Bach (paraphrased)
> "Every man is my superior in that I may learn from him"
> -S. Clemmons
[ntsecurity-owner@iss.net cc'ed]

What could very easily be happening is that spammers either mail to the
list, or spammers list the members off the ISS listserver. Neither of
which constitutes selling the list to adverts.

On Mon, 8 Sep 1997, SMPnet wrote:

> I recently resubscribed to the list.
> The first message I received was advertising spam.
> SMPnet
> 
> Michael E. Cummins wrote:
> > 
> > Since I have subscribed to this list my POP3 box has become the welcome mat
> > for large volumes of advertising SPAM. Since I have only been lurking here
> > for a week and not posted yet, I can only assume that the mailing list has
> > been SOLD to electronic advertising firms. Is this true? Are other list
> > members experiencing the same kind of annoying garbage? The LAST advertiser
> > was so bold as to actually place [NTSEC] in the subject line!
> > 
> > Bewildered,
> > 
> > Very Respectfully,
> > 
> > Michael E. Cummins
> > webmaster@i-magery.com
> > 
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
> > MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
> > PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
> > I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > 
> > "Argue for your limitations, and they shall be yours!"
> > - R. Bach (paraphrased)
> > "Every man is my superior in that I may learn from him"
> > -S. Clemmons
> 

--
"If it fails, then we know we are making progress!"
-- John E. Jasen // DNRC Ambassador to Earth \\ jjasen1@umbc.edu --
-- My views are those of the DNRC only. Prepare to be domesticated --


I have a requirement to significantly tighten down several hundred NT
4.0 workstations. I want to build a batch file that will do the
following:

1) Add/Change registry key values
2) Modify registry key permissions
3) Modify file permissions
4) Turning on most of the options in the c2config utility
5) Increasing the registry size
6) Turn on specific registry key and system auditing
7) Modify log settings
8) Modify user rights

I know there are some resource kit utilities to help with these items. 
I'm just not sure the best way to approach the above problems. 
Recommendations will be greatly appreciated.

thanks,...rt
-- 
+------------------------------------------+
|Randy Taylor |
|Inter-National Research Institute, Inc. |
|System Support Engineer, MCSE |
|757-764-6652, Pager 757-931-4266 |
+------------------------------------------+
Try PERL.

> -----Original Message-----
> From: Randal S. Taylor [SMTP:rtaylor@inri.com]
> Sent: Monday, September 08, 1997 8:55 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Scripting tools
> 
> I have a requirement to significantly tighten down several hundred NT
> 4.0 workstations. I want to build a batch file that will do the
> following:
> 
> 1) Add/Change registry key values
> 2) Modify registry key permissions
> 3) Modify file permissions
> 4) Turning on most of the options in the c2config utility
> 5) Increasing the registry size
> 6) Turn on specific registry key and system auditing
> 7) Modify log settings
> 8) Modify user rights
> 
> I know there are some resource kit utilities to help with these items.
> 
> I'm just not sure the best way to approach the above problems. 
> Recommendations will be greatly appreciated.
> 
> thanks,...rt
> -- 
> +------------------------------------------+
> |Randy Taylor |
> |Inter-National Research Institute, Inc. |
> |System Support Engineer, MCSE |
> |757-764-6652, Pager 757-931-4266 |
> +------------------------------------------+

> What could very easily be happening is that spammers either mail to the
> list, or spammers list the members off the ISS listserver. Neither of
> which constitutes selling the list to adverts.

Folks:

Not trying to be snotty or anything, but isn't it a little embarrasing 
for this group's listserv to be so unguarded? For shame...

My 2 cents...

Pete
--
=======================================================================
 Peter M Deuel "Assembly of Japanese bicycle
 NPD Electronic Marketing Programs Mgr require great peace of mind."
 ICG/Central Marcom Services -Pirsig, ZMM
 Intel Corporation
 email: Peter_M_Deuel@ccm.jf.intel.com MIME: pmdeuel@ibeam.intel.com
 This message is not intended to represent the views of Intel Corp.
=======================================================================
On Mon, 8 Sep 1997, Pete M DeUel wrote:
> Folks:
> 
> Not trying to be snotty or anything, but isn't it a little embarrasing 
> for this group's listserv to be so unguarded? For shame...

Actually, I just checked, and the who command has been disabled..

--
"If it fails, then we know we are making progress!"
-- John E. Jasen // DNRC Ambassador to Earth \\ jjasen1@umbc.edu --
-- My views are those of the DNRC only. Prepare to be domesticated --


Hello...

> Since I have subscribed to this list my POP3 box has become the welcome mat
> for large volumes of advertising SPAM. Since I have only been lurking here
> for a week and not posted yet, I can only assume that the mailing list has
> been SOLD to electronic advertising firms. Is this true? Are other list
> members experiencing the same kind of annoying garbage? The LAST advertiser
> was so bold as to actually place [NTSEC] in the subject line!

 NO! Under NO circumstances would we sell any subscriber list
to any group what so ever! I will even go so far as to state that we
will never use any of our mailing list subscribers lists for any purpose
outside of the subscribed-to list. In other words - our own marketing and
sales have no access to our subscriber lists and never will.

 For the same reason, we have inhibited several majordomo commands
which can be used to obtain subscriber lists or membership. On occasion,
addresses from some known spammer havens have tried to subscribe to the
list and troll for E-Mail addresses. When spotted, they are blocked or
removed from the list. I recently had one chump attempted to subscribe
a "hotmail.com" address to every list we have, including BOTH ntsecurity
and ntsecurity-digest. You betcha he didn't get past the "approval".
Anyone reported to me for spamming abuse will be terminated and prohibited
from resubscribing. If anyone is aware of such individuals, I would ask
them to report them to me.

 From time to time, some of these slime manage to post messages
to the list. As fast as I can spot them, I add their domains to my
hostile site list and they are blocked from any future mail. When I
can lookup responsible parties for their domains, I will publish that
information on the list so the list lurkers can take appropriate actions.
I've had two incidents in the last couple of weeks where someone has snuck
one in on us. We've had about a half a dozen over the last year. That
would be your "The LAST advertiser was so bold as to actually place [NTSEC]
in the subject line!". If you had inspected the message and looked at
the headers you would have discovered that this slimeball had sent it to the
mailing list and my filters did not catch it.

 Some people are under the mistaken impression that this list is
moderated or that someone inspects each message before it goes to the list.
It is not and nobody does. We depend on a series of filters to attempt
to weed out the more obvious problems but even that has problems. Anyone
noticing that their posting of a message containing the word XremoveX anywhere
in the body didn't show up, just ran across the filter with the most number
of legitimate stops but also the highest collarteral damage (innocent messages
removed by mistake). Same thing applies to a large number of variations,
permutations, and mispellings on the word(s) _(un)subscribe_.

 We have also had at least one occasion where an individual has
forged spam from our site, making it look as though we had sent the spam
when, in fact, it had never even been near our site. We suspect someone
thrown off for past abuses.

 Another point on the curve... I personally have another E-Mail
address, in a totally different domain, which I use only for testing the
list management (subscribes and unsubscribes) monitoring traffic (digest
and otherwise) and just generally keep an independent eye on all of our
lists. This address has never been used to send any E-Mail to anything
other than majordomo but does receive all of our lists. I've never received
any independent SPAM at that address. I have received SPAM when someone
has snuck one onto the list, and that's generally where I spot it first.

> Bewildered,

> Very Respectfully,

> Michael E. Cummins
> webmaster@i-magery.com

> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
> MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
> PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
> I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

> "Argue for your limitations, and they shall be yours!"
> - R. Bach (paraphrased)
> "Every man is my superior in that I may learn from him"
> -S. Clemmons

 Regards,
 Mike
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
At 07:23 AM 9/8/97 -0700, you wrote:
>
>> What could very easily be happening is that spammers either mail to the
>> list, or spammers list the members off the ISS listserver. Neither of
>> which constitutes selling the list to adverts.
>
>Folks:
>
>Not trying to be snotty or anything, but isn't it a little embarrasing 
>for this group's listserv to be so unguarded? For shame...
>
>My 2 cents...
>
>Pete
>--

hmm actually there are no security restrictions on anyone sending to this
group.. how can there be?? it is like this if i want to spam someone i
contact the spammers .. they pay folks to look for lists (its easier to
send to a list than a few hundred folks) and so it goes if you have a
hassle please xcomplain to the folks who's ads get on this list buy immoral
and uninvited means and let them know you will not use there products and
will post against the use of there products .. they stop the list very
smartly indeed next contact them in context to finding who was there
spammer and contact them and let them know you dont appreciate it.. next..
well we are all security experts do i really have to explain it??

cheers folks 

OH there is a anti spamming organisation being set up if you really hate
spam join and have your say..

cheers again (my apologuise to the list... back to security please)
John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

Hi,

Try Perl for Win32 () or the native port to
win32 (). For docs on how to use perl to tweak the
registry, check out .

Regards
Philippe Le Berre
SSG - CSBU R&D
Advance Technology Lab, Europe
----------------------------------------------------------------
! Not speaking for Hewlett-Packard !
----------------------------------------------------------------
Hewlett-Packard 
5 av Raymond Chanas Tel : 33 4 76 14 66 05
38053 Grenoble Cedex 9, France Fax : 33 4 76 14 14 65
Does any-one out there know of a good NT admin/general purpose list?

Please reply to me directly.

Thanks in advance

---
The usual disclaimer:
These views are mine, not the company's. And no-one else can have them,
so there!

"No, we in IT don't have a sense of humour that we're aware of"
mis-quote, MiB

Amanda Appleton, network admin, hassled.

uh... huh huh... uh.... 

Here try this on an NTFS partition. 

 1. Create a directory under your temp dir
 2. Copy 4-5 files (from temp) into the new dir
 3. Select the new directory and change perms on it
 to everyone RWX. Make sure that "replace permissions
 on files" is selected
 4. Select one of the files in the new directory and replace
 perms on it to everyone RX.
 5. Rename the file from step 4
 6. Examine the permissions on the renamed file. Results?
 7. Examine the permissions on the dir. Results?

The end result is that changing the name of a file does NOT affect 
the file's ACL.

-bryan (don't guess, test)

 

-----Original Message-----
From: Jean-Claude Berger [SMTP:jcberger@imaginet.fr]
Sent: Sunday, September 07, 1997 5:39 AM
To: 'sunder@brainlink.com'
Cc: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] can't rename directory

Actually I don't know but I think NT acts AS IF... I guess the ALC nor the file
descriptor (but for the name) are untouched.

 ---
 Jean-Claude Berger
 Systems and RDBMS consultant (MCSE), Lyon, France
 E-mail : jcberger@imaginet.fr, Compuserve : 100305,2436


-----Original Message-----
From: Ray Arachelian [SMTP:sunder@brainlink.com]
Sent: Tuesday, August 26, 1997 5:07 PM
To: Jean-Claude Berger
Cc: 'gpng@mol.com.my'; 'ntsecurity@iss.net'
Subject: RE: [NTSEC] can't rename directory

On Tue, 26 Aug 1997, Jean-Claude Berger wrote:

> When you rename a file or a directory NT acts as if it deleted the file and then 
> recreated it. So you need the right to delete your directory (D) on the left list of

Erm, does this mean that the file's or directory's ACL's & Audit info's
are zapped and new ones are inherited from the parent? That would be bad.


Hi,
 Based upon your recent submission to ntbugtraq, "NT domain
member to domain controller authentication protocol
", I am asking for your help in a matter that seems to be quite
baffling. We have a Master Domain that spans on a Global Scale. We are
seeing that many of our clients are getting authenticated by a remote
Master DC as opposed to a local one. Initially we thought that the
client's local resource DC was setting up a secure channel with a remote
master DC and that that was the reason the clients were headed the wrong
way for their lengthy SMS based login scripts. We brought this to
Microsoft's attention and they provided us with a new Netlogon file
(WINNT 3.51 and WINNT 4.0) that had code which responded to a utility
called setprefdc.exe. The utility was also coupled with a souped-up
version of nltest.exe that provided us with more options than the RESKIT
version. At any rate, the utilities allow us to force the local
resource dc to create an SC with the local Master DC. We schedule the
setprefdc.exe to run every 10 minutes on the Resource DC. However, we
are still seeing problems with clients authenticating to the wrong
master DC and not being able to run their scripts in full. Apparently
the SMS script is very speed sensitive and if it is executed from a WAN
that is too slow then it would barf. We find that the clients that are
exhibiting this problem are coupling with a foreign resource DC that is
in a SC with a different Master DC than the local Master DC. 

My question is:

Given that all the scripts are replicating (all have OK under "manage"
using srvmgr/replication manager) and the WINS servers are pulling and
pushing properly, what is the algorithm on the client side that allows
it to select it's ultimate resource controller for the passthrough
authentication? I know that it asks for a <1C> from WINS and gets ip
addresses for all of them. It then asks all of them for help to get
passthrough authenticated and they all reply back. I do not know what
criteria in the algorithm is used to select it's mate. Is it the one is
first to answer or is it the one that is closest or is it a
crapshoot???? Does it sort all of the ip addresses that reply and then
determines the closest one and then establishes the channel (probably
not or I wouldn't be writing this note) I want it to answer in an order
that has the local bdc as number one priority and if it is not available
then go on to the nearest neighbor. One note, we are using 3 protocol
stacks on the servers (IPX/TCPIP/NetBEUI) and I wonder, since all three
go through the process of the authentication cycle, if one of these
protocols is favoring or biasing a certain server that is remote to us
because it is "better installed or prepped"??? I did try forcing the
local BDC by specifying the local BDC's IP address in the local lmhosts
file of the client:

xxx.xxx.xxx.xxx "MASTERDOM \0x1b" #PRE
#MASTERDOM PDC (foreign address)
xxx.xxx.xxx.xxx PDC #PRE #DOM:MASTERDOM
#MASTERDOM PDC (foreign address)
xxx.xxx.xxx.xxx BDC #PRE
#DOM:MASTERDOM #MASTERDOM PDC (local master bdc)
xxx.xxx.xxx.xxx "RESOURCE \0x1b" #PRE
#RESOURCE PDC (foreign address)
xxx.xxx.xxx.xxx PDC #PRE #DOM:MASTERDOM
#MASTERDOM PDC (foreign address for resource PDC)
xxx.xxx.xxx.xxx BDC #PRE
#DOM:MASTERDOM #MASTERDOM PDC (local address of Resource BDC)

I was hoping we can avoid going through the WINS cycle by loading this
stuff in the netbios cache but it doesn't help. It still goes through
WINS and selects a foreign address. Remember this happens to about 30%
of the workstation (NT 4.0SP3 with 11 hotfixes) population. All the
servers are NT 3.51 in this situation. I know this problem is rampant
through other resource domain but no one has complained from those
groups so we have not addressed them. This group is very vocal when SMS
logon script windows don't appear on the workstation :*) BTW, we do not
check off "Use DNS for WINDOWS resolution on the DC's or workstations
even though we define three DNS servers per server and per workstation.
I tried a test with this option enable on my NTWS 4.0 and it still does
not help.

What do you suggest?

Chance.

p.s. We have done SNIFFS and we can't explain the behavior (going to
wrong RES DC).


I have two questions concerning my initial setup of an NT Server. Is it
recommended to install service packs 1, 2, and 3, or is it sufficient to
install just 3? Also, I have read that it is wise to leave the Administrator
on the system, but to give it minimum permissions after creating a new user
that will serve as the Administrator. Are there any problems that arise from
doing this?

Thanks,
 eric
-- 
Information Consultant | email: careers4@d.umn.edu 
Career Services | WWW: http://www.d.umn.edu/careers
University of Minnesota Duluth | phone: (218) 726-8963
Campus Center 21 | fax: (218) 726-6394
 MS Service packs are comprehensive, so sp3 is enough, however, you do want
to have your system setup with all drivers and stuff. If you ever change
your configuration, you then have to re-install sp3 (or whatever is the
latest sp)

I like the idea of lowering Admin priv. It hasn't caused (and shouldn't)
cause any problems.


-----Original Message-----
From: Career Services IC 
To: ntsecurity@iss.net 
Date: Monday, September 08, 1997 11:07 AM
Subject: [NTSEC] Administrators and Service Packs




Time to bring this up again...

Rather than logging off properly, our users are posting their passwords to
prevent the password-protected screen saver from causing them problems.

Sigh.

Does anyone know of a package that will safely log out idle users?

Thanks.

-------------------------------------------------------------------------
 John Hardin KA7OHZ jhardin@gonzo.wolfenet.com
 PGP fingerprint: A3 0C 5B C2 EF 0D 2C E5 E9 BF C8 33 A7 A9 CE 76 
 finger for PGP key Linux: the choice of a Gnu generation
-------------------------------------------------------------------------
 3 days until Mars Global Surveyor reaches Mars orbit



> ----------
> From: Craig Brozefsky[SMTP:craig@onshore.com]
> Sent: Saturday, September 06, 1997 11:39 PM
> To: Paul Leach
> Cc: ntsecurity@iss.net
> Subject: RE: Re(2): [NTSEC] RE: Giving admin privileges without
> knowing
> 
> On Fri, 5 Sep 1997, Paul Leach wrote:
> 
> > No disagreement. I meant "like" as in "similar". Yes, the connection
> is
> > not visible, and hence more easily forgotten.
> > 
> > In the near term, how about a bath file call "doadmin"
> > net use \\%1\ipc$ /user:domain\admin *
> > cmd
> > net use \\%1\ipc$ /d
> 
> I have a few questions about this that maybe Paul can clear up.
> 
> 1. Is there a race condition during the execution of cmd, before the 
> connection is closed which could allow the user to execute other
> commands 
> with admin privs or is the security context of the batch file seperate
> 
> from the user?
> 
No.

Some context -- the admin is typing in to the command window created by
"cmd". When the type "exit" to leave that incarnation of CMD, it will
execute the net use /d. Thus, the admin will be there the whole time to
prevent the user from entering commands.

Obviously, if the admin walks away leave the command window open,
they've blown it. This is exactly like alking away after doing an SU.

> 2. What if I set the PATH such that I had another command called "net"
> 
> someplace else. How does NT handle the PATH in these situations. 
> Obviously you should give an absolute path.
> 
Sure. I don't claim that what I wrote is bug free -- it's never even
been tested. It was a suggestion of a direction that might prove
fruitful.

> 3. Could I cause the "net use ... /d" command to fail in anyway thus 
> stopping it fro dropping perms?
> 
Possibly. I don't know of any ways.

> 4. Is that the password there in the first "net use" command?
> 
No. "*" means to prompt for the password.

> Sorry I 
> don't have a Win32 to check the net use arg formats. If so, would you
> 
> really want it on disk someplace, and could you not specify a trojan 
> domain in a such a way to send the password to a non-trusted host?
> Even 
> if it is not the password there, could I not still do the forced
> connection 
> toa trojaned domain. You could utilize several problems with SMB to 
> collect a password that way.
> 
If the user has admin rights to the machine, or enough unmonitored
physical access, then anything an admin does could be trojaned.

> It would seem that something akin to sudo could be whipped up a little
> 
> easier, and possibly a bit more secure than this batch file.
> 
Not easier, for sure -- it took 2 minutes to do the batch script. And no
safer against trojans.

The only thing I want to even try to claim is that the script is less
error prone than doing it by hand.

Paul


At 11:18 9/8/97 -0700, Paul Leach wrote:

>> From: Craig Brozefsky[SMTP:craig@onshore.com]

>> 2. What if I set the PATH such that I had another command called "net"
 
>> someplace else. How does NT handle the PATH in these situations. 
>> Obviously you should give an absolute path.
 
>Sure. I don't claim that what I wrote is bug free -- it's never even
>been tested. It was a suggestion of a direction that might prove
>fruitful.

You could prepend %systemroot\system32\ to the net command, thus ensuring
it will at least grab the one in the system32 directory. This isn't
failsafe, but better.

>> 3. Could I cause the "net use ... /d" command to fail in anyway thus 
>> stopping it fro dropping perms?
 
>Possibly. I don't know of any ways.
 
Yes. Open another app that needs the connection then forget to close it.
If you start regedt32 from the command line, then close the command line,
the app will keep the connection alive. There is even a weird condition
along the same lines that causes the API that underlies net use /d to
return success, but the session isn't closed.

>The only thing I want to even try to claim is that the script is less
>error prone than doing it by hand.

I think that's a safe claim.

If we had a good way to start a new user session on a new desktop without
logging out the old one, we would have fewer hassles with this. Perhaps NT
5.0 could have such a feature.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

On Monday, September 08, 1997 3:18 PM, David LeBlanc
[SMTP:dleblanc@iss.net] wrote:
[...]
> If we had a good way to start a new user session on a new desktop
without
> logging out the old one, we would have fewer hassles with this.
Perhaps NT
> 5.0 could have such a feature.

Why can't you just reset the desktop permissions so the administrator
(or whoever) can access it, impersonate the user, and open a command
shell as administrator. Doesn't this have that effect? I know I did
this on 3.51 with success, though at that time, security issue wasn't
what I was working around.

-Chris

Hi, i've been reading the list for some time and found it very
usefull; 
now i have a (big?) problem and i hope someone can help me because i'm 
trying to solve it since a week ago...

Windows NT 4.0 SP3
IIS 3.0
MsProxy 1.0
Exchange 5.0
NT postSP3 hotfixes

Some time ago (when i started the job) they have installed and working 
Exchange Active PAges that allow people to access to their mailboxes 
using Internet Explorer 3.0x

Well, now the problem is that we only can access the mailboxes from
the 
console, when we type the username at the logon box on
 http://www.mysite.com/exchange
we get this message:
 Access Denied

We had a strong security policy, we do not have a firewall (just MS 
Proxy) and we have secured the directory tree just how the docs at M$ 
and other sites says.

aaah, the message appears only if we try to access the mailbox, but we 
can enter to the public folders and use them right.

Sorry for the (semi) offtopic, but i'm really SICK of this!
And also... sorry for my horrible English

 
OmY





_____________________________________________________________________
Sent by RocketMail. Get your free e-mail at http://www.rocketmail.com

Nothing that is stated in the letter indicates that he actually
succeeded in getting in, however, he was clearly able to connect to your
machine's TCP139 port. You should block access, via your router to port
139.

There are other things you could do also, but it depends on what other
roles that server is playing (i.e. acting as a file server for your
internal network, etc...). If you want to prevent logons from the
Internet, just block 139.

Cheers,
Russ

On Monday, September 08, 1997 11:55 PM, Randal S. Taylor
[SMTP:rtaylor@inri.com] wrote:
> I have a requirement to significantly tighten down several hundred NT
> 4.0 workstations. I want to build a batch file that will do the
> following:
> 
> 1) Add/Change registry key values
> 2) Modify registry key permissions

regini works very well for doing these two.
The scripts are pretty easy to set up and you don't have to spend the
time to learn a whole new programming language ... like Pearl ;-)
The doco that comes with the resource kit explains the use of regini
very well.
It can modify permissions, and add keys
Unsure (as in never tried) if it can remove keys...

> 3) Modify file permissions

xcacls will give you the granularity you reguire here - like cacls but
better

> 4) Turning on most of the options in the c2config utility

These are mostly just registry settings - it's just a matter of finding
them... :-)

> 5) Increasing the registry size

Unsure how to do this one.

> 6) Turn on specific registry key and system auditing
> 7) Modify log settings

I suspect registry settings again - but haven't tried and hence unsure.

> 8) Modify user rights

Are you really sure you want to modify user rights?
Wouldn't it possibly be better to create groups - modify the rights they
have and place the appropraite users into those groups?
I personnally find this a far easier way to manage things.

> I know there are some resource kit utilities to help with these items. 
> I'm just not sure the best way to approach the above problems. 
> Recommendations will be greatly appreciated.


Hope this has helped somewhat...

Steve
---------
Steve McInerney
(Stephen.McInerney@dsb.defence.gov.au)
"Why stop now just when I'm hating it?"
 - Marvin the Paranoid Android

Hi everybody,

Does anybody know of a utility which allows to transfer (not take)
ownership of files to an arbitrary account ? In my application I need to
create a file as administrator and then assign the ownership of that
file to another, non administrative account on the machine.

Thanks in advance for any help.

Martin Verhein
Ace wrote:

> ... Can I access WinNT resources any other way other then
> supplying my username and password to Win 95. I have made the
> resources =
> on NT available to EVERYONE. ...

1) Place the Win95 box in an WinNT domain trusted by the domain the NT
box belongs to.

2) Use the guest or other restricted account to connect to the WinNT
box.


I do not understand what all of the hullaballo is about. No mailing list can
be guarded. In the last year, I have received over 500 megs of email from
various security lists. And, while only the list owners can confirm the
actual number of subscribed individuals that post, I would say it is fairly
high. If I were to take that 500 megs of data now, extract the addresses and
sort them for unique names, I am quite certain I would have several thousand
names. (If not over 10,000). This is especially a problem with lists that
are archived (e.g., firewalls@greatcircle.com). Searchable archives can even
assist in automating the process of recovering those email addresses. For
anyone that subscribes to a list, it should be a given that their email
address will be accessible. I am not going to go way out of my way to
demonstrate this point, but I will say this: the previous poster was easily
available, showing a total of 32 hits on the Firewalls list.

John "E.R." Jasen wrote:

> On Mon, 8 Sep 1997, Pete M DeUel wrote:
> > Folks:
> >
> > Not trying to be snotty or anything, but isn't it a little embarrasing
> > for this group's listserv to be so unguarded? For shame...
>
> Actually, I just checked, and the who command has been disabled..
>
> --
> "If it fails, then we know we are making progress!"
> -- John E. Jasen // DNRC Ambassador to Earth \\ jjasen1@umbc.edu --
> -- My views are those of the DNRC only. Prepare to be domesticated --



Good point, I stand corrected. Sorry I added fuel to the fire. That's
what I get for a sending a morning pre-coffee email. My apologies.



Pete
PS Just for the heck of it, I did make cursory tries to expn and vrfy my
way to the list, but to no avail. All the simple public methods for
extracting a list (short of subscribing to it) seem to have been
blocked.
-- 
=======================================================================
 Peter M Deuel "Assembly of Japanese bicycle
 NPD Electronic Marketing Programs Mgr require great peace of mind."
 ICG/Central Marcom Services -Pirsig, ZMM
 Intel Corporation
 (503) 264-7471
 email: Peter_M_Deuel@ccm.jf.intel.com MIME: pmdeuel@ibeam.intel.com
 This message is not intended to represent the views of Intel Corp.
=======================================================================

osiris@gnss.com wrote:
> 
> I do not understand what all of the hullaballo is about. No mailing list can
> be guarded. In the last year, I have received over 500 megs of email from
[snip] ...
> I will say this: the previous poster was easily
> available, showing a total of 32 hits on the Firewalls list.
> John "E.R." Jasen wrote:
> > On Mon, 8 Sep 1997, Pete M DeUel wrote:
> > > Folks:
> > > Not trying to be snotty or anything, but isn't it a little embarrasing
> > > for this group's listserv to be so unguarded? For shame...

> > Actually, I just checked, and the who command has been disabled..
We're using WindowWare from Wilson Software. For non-Unix people, it's very
easy to learn, has excellent help-files, can be compiled to give it to
costumers ...

http://www.windowware.com

regards from Austria


+-----------------------------------------------------------------+
| Krackowizer Christian mailto:kra1@technodat.co.at |
| TECHNODAT Phone: ++43-(0)662-454944-0 |
| CAD/CAM - Systeme fuer Moebel GmbH FAX: ++43-(0)662-454944-9 |
| Jakob-Haringer-Strasse 6 http://www.technodat.co.at/ |
| A-5020 Salzburg / Austria |
+-----------------------------------------------------------------+

On Tuesday, September 09, 1997 12:35 AM, Verhein, Martin
[SMTP:MVerhein@nibupls1.telstra.com.au] wrote:
> Does anybody know of a utility which allows to transfer (not take)
> ownership of files to an arbitrary account ? In my application I need
to
> create a file as administrator and then assign the ownership of that
> file to another, non administrative account on the machine.

Transfering ownership is not possible for security reasons!

You have to log in (one way or the other) and take ownership
of a file. You application have to impersonate, i.e., get
username and password from the user you want to give the file.

Why not just give the specific user full rights to the file
but still let the administrator keep ownership?

Microsoft made it this way so administrators couldn't take
ownership of files to access it and then give ownership back
so the original owner wouldn't notice that somebody else was
messing with his/her files!

Andrew
-- 
* Dansk Gospel Kalender: http://www.Kristuskirken.dk/sog/dgk.html NEW! *
*** The opinions expressed are not necessarily those of my employer. ***
* Software Engineer * Leif Andrew Rump * BLIK og ROERarbejderforbundet *
* AAlholmvej 55 * 2500 Valby * Tlf: +45 3871 3022 * Fax: +45 3871 2599 *
mailto:Andrew@unidhp.uni-c.dk http://www.GeoCities.com/SunsetStrip/1093/
** No response? Try: http://www.NetBy.NerdScan.dk/Centrum/Nordre/Andrew/

Hi,

It has been draw to my attention that there is a potential security risk
with using Internet Explorer for NT 4 Workstation. If you visit the
following url:

Hi,

It has been draw to my attention that there is a potential security risk
with using Internet Explorer for NT 4 Workstation. If you visit the
following url:

http://www.securenetworks.net

they have a webpage that will display you Windows NT password.

Does any one know if you can stop the system from sending out you
password to the Internet (if that is what it is doing) or able to
explain how it does it?

Thanks,

Andy Pitt

Systems Administrator
Infobank International Holdings plc.
EMail: shakey@infobank.co.uk


Has anyone tried to run the command line version of LC1.5 on NT ? It
never seems to terminate, and doesn't crack as many passwords as the
graphical version.

I ask this because I would like to save the list of users whose
passwords were cracked so I can notify them. Graphical LC1.5 seems to
have a bug -- it doesn't write all the names to file (linked list
problems perhaps), so I'm wondering if anyone else has run into this
problem. Presently, I pore through the list manually and write down
usernames. 

Also wondering if anyone has added automatic email notification to LC.
Or if anyone has ported it to UNIX (backwords and all that).

FYI, I'm running with a dictionary of approximately 175MB. Replies to me
directly will be appreciated.

--Robin
A client of mine is implementing this. I had some reservations about the
message which users receive when they try a new password which does not
meet the criteria. I discussed it with some of the guys in product
management and it seems that there are no plans to change it. There is
some justification for not giving out too much information to a would-be
assailant but I think that it is debatable in this case. Originally I
think a previous filter (similar to passfilt.dll) was provided as an
example to be used as a basis for writing your own gina. 

Yes, passfilt.dll applies only to changes to the local SAM database, so
if you want to affect a whole domain, use it on the DC. If you want to
affect local accounts as well then you need to install it on all systems
as well (which is what I would recommend).

Incidentally, I think that you can bypass it by using the NET command
but this is not something which should be freely available to end-users.

* Julian Bates
 "Purely my own personal view"
 Enterprise Programme Manager
 Microsoft Consulting

 -----Original Message-----
 From: James E. Leinweber [SMTP:jiml@slh.wisc.edu]
 Sent: Sunday, September 07, 1997 3:24 AM
 To: ahynes@ny.ubs.com
 Cc: ntsecurity@iss.net
 Subject: [NTSEC] passfilt.dll

 Aldon Hynes notes:

 I am wondering if anyone has used the passfilt.dll 

 We do.

 1) If does not apply for Adminstrators using User Manager. I
have the 
 filter applied on the domain controllers for my test account
domain...

 I think if you want to apply to the local Administrator account,
 you'll have to install it on the workstations as well as on the
domain
 controller. 

 2) [The message lies about problematic passwords] ...
 Is there any way to change this message?

 Apparently not - unless Microsoft fixes it, or you write your
own DLL.

 -- James E. Leinweber
 Information Systems - State Laboratory of Hygiene -
University of Wisconsin
 465 Henry Mall, Madison WI 53706-1578 USA
+1 608 262 0736

Grab the source from the same place you grabbed the binaries.

It already compiles just fine on Unix (in fact, with the optimization
flags and a native V8+ compiler the Ultra-Sparc is the crypto-hackers best
friend it seems).

We are aware of the bug in the GUI.

We are aware of a speed bug in the CLI version.

We are aware that we make the source code available.

We are aware that, unlike the unix world, most people in the NT world
don't seems to care about source code availability.

sigh,

.mudge

On Tue, 9 Sep 1997 sundaram@austin.asc.slb.com wrote:

> Has anyone tried to run the command line version of LC1.5 on NT ? It
> never seems to terminate, and doesn't crack as many passwords as the
> graphical version.
> 
> I ask this because I would like to save the list of users whose
> passwords were cracked so I can notify them. Graphical LC1.5 seems to
> have a bug -- it doesn't write all the names to file (linked list
> problems perhaps), so I'm wondering if anyone else has run into this
> problem. Presently, I pore through the list manually and write down
> usernames. 
> 
> Also wondering if anyone has added automatic email notification to LC.
> Or if anyone has ported it to UNIX (backwords and all that).
> 
> FYI, I'm running with a dictionary of approximately 175MB. Replies to me
> directly will be appreciated.
> 
> --Robin
> 

I understand that the original intent of MS was to cause NTFS to behave
the way described below. However, there is a really cute package called
"NT Security Manager" that allows you to do this and much more.

You can check it out at:

http://home.t-online.de/home/wispro/secumgr.htm

I've found it very useful for managing security on NT files.

L8R!

David R. Bivens
Ash Grove Systems & Technologies, Atlanta, Georgia, USA

"Very funny, Scotty! Now beam down my clothes!"



-----Original Message-----
From: Leif Andrew Rump [SMTP:andrew@unidhp.uni-c.dk]
Sent: Tuesday, September 9, 1997 06:13
To: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Granting file ownership

On Tuesday, September 09, 1997 12:35 AM, Verhein, Martin
[SMTP:MVerhein@nibupls1.telstra.com.au] wrote:
> Does anybody know of a utility which allows to transfer (not take)
> ownership of files to an arbitrary account ? In my application I need
to
> create a file as administrator and then assign the ownership of that
> file to another, non administrative account on the machine.

Transfering ownership is not possible for security reasons!

You have to log in (one way or the other) and take ownership
of a file. You application have to impersonate, i.e., get
username and password from the user you want to give the file.

Why not just give the specific user full rights to the file
but still let the administrator keep ownership?

Microsoft made it this way so administrators couldn't take
ownership of files to access it and then give ownership back
so the original owner wouldn't notice that somebody else was
messing with his/her files!

Andrew
-- 
* Dansk Gospel Kalender: http://www.Kristuskirken.dk/sog/dgk.html NEW! *
*** The opinions expressed are not necessarily those of my employer. ***
* Software Engineer * Leif Andrew Rump * BLIK og ROERarbejderforbundet *
* AAlholmvej 55 * 2500 Valby * Tlf: +45 3871 3022 * Fax: +45 3871 2599 *
mailto:Andrew@unidhp.uni-c.dk http://www.GeoCities.com/SunsetStrip/1093/
** No response? Try: http://www.NetBy.NerdScan.dk/Centrum/Nordre/Andrew/

Just wanted to add... since I've been getting bizarre requests from people
running L0phtcrack... obviously in commercial organizations and on
commercial audits.

L0phtcrack is shareware.

If you are using it in a non-commercial environment for educational
purposes or in a non-profit organization then you don't have to register
it.

If you are using it in a commercial setting (ie you are in an IT group and
auditing you r NT machines for your company) then you need to register it.
The registration fee is $50. And no, govt. orginizations don't qualify as
non-profit ;-)

It's all in the agreement that comes with the software. That you agree to
by running the software and/or keeping the software on your computer.

Just figured I'd take this opportunity to point out that everyone claims
that hackers are 'evil' - while I still stand by the belief that it's
large corporations instead :-)

.mudge


Hi mudge

On Tue, 9 Sep 1997 09:53:56 -0400 (EDT), you wrote:

[...]

>
>We are aware that we make the source code available.
That's as it should be imho :) 
>
>We are aware that, unlike the unix world, most people in the NT world
>don't seems to care about source code availability.
How do you get to this impression? Especially for tools like
l0phtcrack it's vital for me to have the source available :)
[BTW - I also learned to rtfm - thx mudge]

cheers

Dietz

>
>On Tue, 9 Sep 1997 sundaram@austin.asc.slb.com wrote:
>
>> Has anyone tried to run the command line version of LC1.5 on NT ? It
>> never seems to terminate, and doesn't crack as many passwords as the
>> graphical version.
>> 
>> I ask this because I would like to save the list of users whose
>> passwords were cracked so I can notify them. Graphical LC1.5 seems to
>> have a bug -- it doesn't write all the names to file (linked list
>> problems perhaps), so I'm wondering if anyone else has run into this
>> problem. Presently, I pore through the list manually and write down
>> usernames. 
>> 
>> Also wondering if anyone has added automatic email notification to LC.
>> Or if anyone has ported it to UNIX (backwords and all that).
>> 
>> FYI, I'm running with a dictionary of approximately 175MB. Replies to me
>> directly will be appreciated.
>> 
>> --Robin
>> 
>
>

-- 

 dietz proepper, [software|web] designer, S.E.P.P. MED
 aka tik on irc, bladerunner on netrek
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. S.E.P.P. MED GmbH shall not be made 
+ responsible.

Mudge:

 Hopefully you will continue posting the source for your work -- please
don't think it's not appreciated! Guess what you're observing is too many
NT users stuck in VB!

Mark
----------
> From: Insert shell-code here 
> To: ntsecurity@iss.net
> Subject: [NTSEC] Re: l0phtcrack 1.5
> Date: Tuesday, September 09, 1997 7:05 AM
> 
> 
> Just wanted to add... since I've been getting bizarre requests from
people
> running L0phtcrack... obviously in commercial organizations and on
> commercial audits.
> 
> L0phtcrack is shareware.
> 
> If you are using it in a non-commercial environment for educational
> purposes or in a non-profit organization then you don't have to register
> it.
> 
> If you are using it in a commercial setting (ie you are in an IT group
and
> auditing you r NT machines for your company) then you need to register
it.
> The registration fee is $50. And no, govt. orginizations don't qualify as
> non-profit ;-)
> 
> It's all in the agreement that comes with the software. That you agree to
> by running the software and/or keeping the software on your computer.
> 
> Just figured I'd take this opportunity to point out that everyone claims
> that hackers are 'evil' - while I still stand by the belief that it's
> large corporations instead :-)
> 
> .mudge
> 
> 
We are a government organization and would like to know if we can pay in 
some other form other than check for the l0pht program. We would like to 
use our government credit card.


-----Original Message-----
From: Insert shell-code here [SMTP:mudge@l0pht.com]
Sent: Tuesday, September 09, 1997 10:06 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Re: l0phtcrack 1.5


Just wanted to add... since I've been getting bizarre requests from people
running L0phtcrack... obviously in commercial organizations and on
commercial audits.

L0phtcrack is shareware.

If you are using it in a non-commercial environment for educational
purposes or in a non-profit organization then you don't have to register
it.

If you are using it in a commercial setting (ie you are in an IT group and
auditing you r NT machines for your company) then you need to register it.
The registration fee is $50. And no, govt. orginizations don't qualify as
non-profit ;-)

It's all in the agreement that comes with the software. That you agree to
by running the software and/or keeping the software on your computer.

Just figured I'd take this opportunity to point out that everyone claims
that hackers are 'evil' - while I still stand by the belief that it's
large corporations instead :-)

.mudge



First, I just want to say that I think l0pht provides an excellent service
to the IT community as a whole. 

If you are using l0phtcrack in a commercial environment, send them the $50
and give them more incentive to continue what they do best (I know Mudge
would do it anyway, but its worth the cash). You'll spend more than $50 to
get someone with working security knowledge in house for an hour.

At 09:53 AM 9/9/97 -0400, Insert shell-code here wrote:
>
>Grab the source from the same place you grabbed the binaries.
>
>It already compiles just fine on Unix (in fact, with the optimization
>flags and a native V8+ compiler the Ultra-Sparc is the crypto-hackers best
>friend it seems).
>
>We are aware of the bug in the GUI.
>
>We are aware of a speed bug in the CLI version.
>
>We are aware that we make the source code available.
>
>We are aware that, unlike the unix world, most people in the NT world
>don't seems to care about source code availability.
>
>sigh,
>
>.mudge
>
>On Tue, 9 Sep 1997 sundaram@austin.asc.slb.com wrote:
>
>> Has anyone tried to run the command line version of LC1.5 on NT ? It
>> never seems to terminate, and doesn't crack as many passwords as the
>> graphical version.
>> 
>> I ask this because I would like to save the list of users whose
>> passwords were cracked so I can notify them. Graphical LC1.5 seems to
>> have a bug -- it doesn't write all the names to file (linked list
>> problems perhaps), so I'm wondering if anyone else has run into this
>> problem. Presently, I pore through the list manually and write down
>> usernames. 
>> 
>> Also wondering if anyone has added automatic email notification to LC.
>> Or if anyone has ported it to UNIX (backwords and all that).
>> 
>> FYI, I'm running with a dictionary of approximately 175MB. Replies to me
>> directly will be appreciated.
>> 
>> --Robin
>> 
>
>
>
On Tue, 9 Sep 1997 sundaram@austin.asc.slb.com wrote:
> Also wondering if anyone has added automatic email notification to LC.
> Or if anyone has ported it to UNIX (backwords and all that).

l0phtcrack is available in source form, and compiles fine for unix out
of the box.

> FYI, I'm running with a dictionary of approximately 175MB. Replies to me
> directly will be appreciated.

Weld -- any chance we can have a rules filter a` la` (unix) crack?
Dictionaries are all well and good, but if they don't include something
like "hello1", then you can either:
 1. generate it from "hello", or
 2. brute-force the key-space.
I know which I'd rather do...

Regards,

 -- Bob R.Tinsley@rhbnc.ac.uk

Hi, this is a bit of the subject so pls don't linch me..

I am looking for a method of monitoring NT services running on our
machines. So far I have not found any tool that will do this for all
services.
MSExchange has a monitoring tool of this sort but it means installing
exchange on all servers :(
I need something that sets off alarms preferably SNMP traps for events
such as WWW service has stopped .. etc.
I have tried setting process auditing and all sorts of other tricks on
www stopped etc. - nothing seems to generate an event when services stop


Any help appreciated. Cheers.
 look for a product called webxray or netxray. I've previewed both, but I
don't remember the company that publishes the software. I also don't
remember which product does specifically what you are talking about... I'm
guessing it's WebXRay.

I'll look for the web site.

-----Original Message-----
From: Petr Havlik 
To: ntsecurity@iss.net 
Date: Tuesday, September 09, 1997 10:36 AM
Subject: [NTSEC] SNMP / monitoring NT services



Hi, this is a bit of the subject so pls don't linch me..

I am looking for a method of monitoring NT services running on our
machines. So far I have not found any tool that will do this for all
services.
MSExchange has a monitoring tool of this sort but it means installing
exchange on all servers :(
I need something that sets off alarms preferably SNMP traps for events
such as WWW service has stopped .. etc.
I have tried setting process auditing and all sorts of other tricks on
www stopped etc. - nothing seems to generate an event when services stop


Any help appreciated. Cheers.



Ace wrote:
> ... Can I access WinNT resources any other way other then
> supplying my username and password to Win 95. I have made the
> resources =
> on NT available to EVERYONE. ...
1) Place the Win95 box in an WinNT domain trusted by the domain the NT
box belongs to.
2) Use the guest or other restricted account to connect to the WinNT
box.




Ace wrote:
> ... Can I access WinNT resources any other way other then
> supplying my username and password to Win 95. I have made the
> resources =
> on NT available to EVERYONE. ...
1) Place the Win95 box in an WinNT domain trusted by the domain the NT
box belongs to.
2) Use the guest or other restricted account to connect to the WinNT
box.



 The URL for WebXRay and NetXRay is www.cinco.com
-Brent

-----Original Message-----
From: Petr Havlik 
To: ntsecurity@iss.net 
Date: Tuesday, September 09, 1997 10:36 AM
Subject: [NTSEC] SNMP / monitoring NT services



Hi, this is a bit of the subject so pls don't linch me..

I am looking for a method of monitoring NT services running on our
machines. So far I have not found any tool that will do this for all
services.
MSExchange has a monitoring tool of this sort but it means installing
exchange on all servers :(
I need something that sets off alarms preferably SNMP traps for events
such as WWW service has stopped .. etc.
I have tried setting process auditing and all sorts of other tricks on
www stopped etc. - nothing seems to generate an event when services stop


Any help appreciated. Cheers.


Hi Petr,
 We use srvmon from the NT 4.0 resource kit utilities (Supplement
II). Here is the description for the utility from MS:

"This tool monitors services on local and remote computers for changes
in state (starting or stopping). To detect these changes, Service
Monitor implements a polling scheme. When a monitored service stops or
starts, Service Monitor notifies you by sending e-mail or paging you via
Microsoft Exchange.

Overview of Windows NT Resource Kit Tools version 4.00.03 © Microsoft
Corporation 1985 - 1997

Here is some more install/desc. Info.

To install and configure Service Monitor:

1. Manually copy SRVMON.EXE from the folder where the Resource Kit
installation has installed it (for example, C:\NTRESKIT\) to your
computer's %SYSTEMROOT%\SYSTEM32 folder.
2 Run the Service Monitor Configuration wizard:

Click the Start button, point to Programs, then NT Resource Kit 4.0,
then Diagnostics, and then click Service Monitor Configuration.

Or, at the command prompt, type:

smconfig

Wizard page 1

The first page of the Service Monitor Configuration wizard provides a
brief overview of the utility. Click Next to proceed with installation
or configuration.

Wizard page 2

The second page helps you to set up Exchange information. Typically the
default Domain, User Name and Profile given are adequate. You must enter
a password: if you are on a Windows NT network, use your Domain\UserName
password. To complete the Exchange information, add the e-mail names of
any other people that should be notified when the selected services
change state.

Wizard page 3

On the third and final page, you select the services to be monitored.
The computer name defaults to the local computer. To monitor services on
another computer, enter the computer name and press the TAB key. From
the services list, select a service to monitor. Next, modify the polling
interval if necessary. The polling interval specifies in seconds how
frequently the service should be polled for a state change.

After selecting a computer, service and polling interval, click the Add
Service button to add the service to the list of services to be
monitored. Continue adding services until all of the services that you
wish to monitor have been added to the list. Service Monitor supports a
maximum of 99 services.

After adding all of the services to be monitored to the list, click the
Finish button to complete the installation or re-configuration of
Service Monitor.

Notes

To stop a service, use the Services option in Control Panel.
 To remove a stopped service, use the Resource Kit's
SRVINSTW.EXE: Service Installation Wizard.

Overview of Windows NT Resource Kit Tools version 4.00.03 © Microsoft
Corporation 1985 - 1997



Chance.


* Chance H. Neale 
* Morgan Stanley, Dean Witter, Discover
* IT / Engineering / Distributed Systems / PC




-----Original Message-----
From: Petr Havlik [SMTP:phavlik@gia.co.za]
Sent: Tuesday, September 09, 1997 1:27 PM
To: ntsecurity@iss.net
Subject: [NTSEC] SNMP / monitoring NT services

Hi, this is a bit of the subject so pls don't linch me..

I am looking for a method of monitoring NT services running on our
machines. So far I have not found any tool that will do this for all
services.
MSExchange has a monitoring tool of this sort but it means installing
exchange on all servers :(
I need something that sets off alarms preferably SNMP traps for events
such as WWW service has stopped .. etc.
I have tried setting process auditing and all sorts of other tricks on
www stopped etc. - nothing seems to generate an event when services stop


Any help appreciated. Cheers.
At 19:26 9/9/97 +0200, you wrote:
>Hi, this is a bit of the subject so pls don't linch me..
>
>I am looking for a method of monitoring NT services running on our
>machines. So far I have not found any tool that will do this for all
>services.
>MSExchange has a monitoring tool of this sort but it means installing
>exchange on all servers :(
>I need something that sets off alarms preferably SNMP traps for events
>such as WWW service has stopped .. etc.
>I have tried setting process auditing and all sorts of other tricks on
>www stopped etc. - nothing seems to generate an event when services stop

There is an app in the resource kit, as well as with SQL Server, that can
start and stop services. I'm fairly sure that it will report service
status. You could wrap that in a perl script and stick it in an "at" job.

I'm not aware of a non-polling solution to this right now. One approach
might be to modify the security descriptor on the service to enable
auditing on service stops and starts - that should get you clean stops and
starts, but not flat-out crashes.

Unfortunately, there isn't a user interface to setting either the DACL or
the SACL on services.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

"Hinders, James D." thus spake unto me:
> We are a government organization and would like to know if we can pay in 
> some other form other than check for the l0pht program. We would like to 
> use our government credit card.

Sure, just reply with your card number...

Yet another example of our tax dollars at work...

-paul

------

On the whole, we are hostile to puns. - Wolcott Gibbs

MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e


Paul,

> Yet another example of our tax dollars at work...

At least they know of the existence of LC. I'm not impressed at all by
this kind of expenses (50 $), for this kind of software.
What about upgrading some thousands of machines to NT ? Sure, at
winsite.com you can read that NT is 1/3 the price of unix. Do you have one
for me at 33$ ? That's 1/3 of Caldera OL.

If security would only cost 50$ per machine...

kr=

 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)



We have had great success using the CA Unicenter TNG NT OS Agent. The
agent instruments 100+ objects on the OS. The NTOS agent, in addition
to MS Eventrap (SMS) and Compaq Insight Manager (on Compaq servers)
allows us to monitor our NT systems end to end. 

> -----Original Message-----
> From: Petr Havlik 
> Sent: Tuesday, September 09, 1997 1:27 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] SNMP / monitoring NT services
> 
> Hi, this is a bit of the subject so pls don't linch me..
> 
> I am looking for a method of monitoring NT services running on our
> machines. So far I have not found any tool that will do this for all
> services.
> MSExchange has a monitoring tool of this sort but it means installing
> exchange on all servers :(
> I need something that sets off alarms preferably SNMP traps for events
> such as WWW service has stopped .. etc.
> I have tried setting process auditing and all sorts of other tricks on
> www stopped etc. - nothing seems to generate an event when services
> stop
> 
> 
> Any help appreciated. Cheers.
Question for those of you running Octopus, or have tested Octopus 3.0
with NT 4.0 and IIS 3.0

Do you set up everything as a virtual root to avoid conflicts with
default roots?

Background:
Octopus can mirror data, but cannot mirror registry information (at
least its not recommended that you do so). This means that information
about IIS, which is stored in the services registry key w3svc and below
will not be mirrored. For a web site, that means that all information
about its virtual roots is not mirrored. So before a failover can occur,
your target machine (the machine that will assume the identity of the
failed machine) must know about these virtual roots lest it be rendered
useless as a failover. Now this assumes a situation where both the
primary and secondary boxes are being used simultaneously as web servers
and what you want is for one to fail to the other but leave both sites
available.

You also have to have multiple wwwroot directories and using things like
FrontPage has to be given careful consideration to avoid duplicate
virtual root names or directory names.

Anyone running Octopus out there using services that have issues such as
this? I'd appreciate any feedback and further discussion (privately if
you prefer).

The security implications are that content might be mirrored into a
directory on the target machine which has one set of permissions (or
visibility) while the other machine might have restrictions on that
content.

Cheers,
Russ

I manage a mixed environment of 
NT 4.0 servers & workstations, along with a good number of users using both 
UNIX and NT.  My UNIX users tend to log on and off of their machines much 
more frequently than NT only users and some with long names are complying about 
their long user names.   We have standardized on first initial with 
last name, for all user/login names, NT and UNIX.  Does anyone know if it 
is possible in NT or if there is a utility that will allow me to alias a NT 
username.  For example, I have a user whose username is mkirkpatrick, but I 
would like for him to be able to login as say "mikek", but still keep 
his "real" user name for security purposes, group memberships, 
etc.

Thanks in advance.

I would have to agreeand second the motion.
 

At 04:57 PM 9/8/97 +1000, Michael E. Cummins wrote:
>Since I have subscribed to this list my POP3 box has become the welcome mat
>for large volumes of advertising SPAM. Since I have only been lurking here
>for a week and not posted yet, I can only assume that the mailing list has
>been SOLD to electronic advertising firms. Is this true? Are other list
>members experiencing the same kind of annoying garbage? The LAST advertiser
>was so bold as to actually place [NTSEC] in the subject line!
>
>Bewildered,
>
>Very Respectfully,
>
>Michael E. Cummins
>webmaster@i-magery.com
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
>MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
>PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
>I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
>"Argue for your limitations, and they shall be yours!"
> - R. Bach (paraphrased)
>"Every man is my superior in that I may learn from him"
> -S. Clemmons
>
>
>
>
>
>
>

I have posted to the list before, but I must say that my spam mail increased 
dramatically shortly after subscribing to the NTSEC list - before I had posted 
originally. I cannot rule out the possibilty of coincidence, however.

Christopher Schroeder Email: cds@nvt.net
System Administrator Work: (316) 651-1239
NetVision Technologies, Inc. http://www.nvt.net/

On Tuesday, September 09, 1997 6:59 PM, dreamwvr [SMTP:dreamwvr@nucleus.com] 
wrote:
> I would have to agreeand second the motion.
>
>
> At 04:57 PM 9/8/97 +1000, Michael E. Cummins wrote:
> >Since I have subscribed to this list my POP3 box has become the welcome mat
> >for large volumes of advertising SPAM. Since I have only been lurking here
> >for a week and not posted yet, I can only assume that the mailing list has
> >been SOLD to electronic advertising firms. Is this true? Are other list
> >members experiencing the same kind of annoying garbage? The LAST advertiser
> >was so bold as to actually place [NTSEC] in the subject line!
> >
> >Bewildered,
> >
> >Very Respectfully,
> >
> >Michael E. Cummins
> >webmaster@i-magery.com
> >
> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
> >MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
> >PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
> >I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >
> >"Argue for your limitations, and they shall be yours!"
> > - R. Bach (paraphrased)
> >"Every man is my superior in that I may learn from him"
> > -S. Clemmons
> >
> >
> >
> >
> >
> >
> >

i have received more posts complaining about spam mail than spam mail.
please stop.

I have an NT 3.51 Server which has RAS running in a domain called D1. 
 I can give users dial-in rights if they belong to D1.

The problem is my server trusts a domain called D2 and I can't seem to 
give users from D2 dial-in access. Is this possible, or can RAS 
security only work in it's own domain?

Thanks and Regards, Antony



 
 
 I've a couple of my users that are travelling a lot, and want to be 
 able to be connected to our network where ever they are.
 
 I'm not able at the moment to install DHCP services all over the 
 world, so i've think to a solution that allow the user to change is 
 own IP Address without going to the control Panel.
 
 Using a menu, he selects is location, and i modify the correct key in 
 the registry (using su & regini).
 
 The problem is, that this modification is not available in the 
 memory... it would be necessary to "reload" the registry...
 
 Does anyone know the API that can do so ? (or another way without 
 rebooting)
 
 Regards,
 
 Patrick.



I just installed the diskette installation of Novell Netware Client 
for Windows NT on a Win NT Workstation 4.0 but after that my 
machine won't synchronize w/ the time of our Netware 4.01 server and 
i cant change the time of my PC manually. Before the client 
instalation the time was ok. TIA
Try using NetSwitcher at www.bysnet.com. Does the job of maintaining multiple 
network settings from configuration files user selects. Unless totally 
necessary by OS design, reboot not required. I use it on my laptop as I 
travel from client to client. It's meant for W95 but halfway works for NTWS. 
Kinda, sorta NT Security related.

----------
From: owner-ntsecurity@iss.net on behalf of Patrick EVRARD
Sent: Wednesday, September 10, 1997 1:18 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Changing WorkStation IP Address


 
 
 I've a couple of my users that are travelling a lot, and want to be 
 able to be connected to our network where ever they are......

At 07:18 AM 9/10/97 +0100, you wrote:
>
> 
> 
> I've a couple of my users that are travelling a lot, and want to be 
> able to be connected to our network where ever they are. etc...
> 
> 
> Patrick.
>
>
>
>

G'day ok there are a number of ways they can do this..

1 is to get something like a IBM Global internet account (there are others
too its just what we use) just get one that does everywhere you may want to
go..either all of US or just the state and some tunneling and authentican
program there are a few (some freeware) or MS included and some firewalls
have this as a option (sometimes free..) as well

with digital cirtifacates being something you can do yourself this is the
main authentication the machine has this as a id who is there .. the rest
is to authenticate YOU to the machine 

you can pay or do yourself but our little team enjoy this method (ie ease
of use once set up) it cost us $700 AUD total and 11 hours work ($520 US) +
the internet accounts ($30 a month x 5 folks) but spec'd out off the shelf
answers at from $ 399 a seat to $800 a seat + access 

two of our staff go international regularly and this is excellent for them
they pop to our FW and are authenticated and home.. no problem..

John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

I think, there is a special Version of Crystal-Reports from Segeate 
Software for making reports out of eventlog. There are some nice tools for 
analyze the audit logs: rcswww.urz.tu-dresden.de/~fh/nt/eventlog/. 
Another comercial product for a complete analye is Logcaster NT from 
www.logcaster.com.

Greetings ...

 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 
Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
+49 355 69 2752 fsch@informatik.tu-cottbus.de
http://www-rnks.informatik.tu-cottbus.de/~fsch
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

 administer all NT services in the domain:
 Service Manager NT 1.0

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/


On Thu, 28 Aug 1997, MJ Stromberg wrote:

> Hello all,
> 
> I have question about NT Auditing. Given that a decently busy NT Server
> can generate large logs per day (if file auditing or other such things are
> enabled), and also given that Event viewer, while it is good for browsing,
> does not have any abilities to create reports or anything along that line,
> what tools (if any) do people use to moniter NT's logs? I have seen maybe
> one or two tools (the DumpEvt utility from Somarsoft) and have looked at a
> few unix based ones as well (swatch) to see if they could be converted
> easily. But, I haven't run across any tools that enable you to easily
> process large logs and discard uninteresting events or produce usage
> reports without going thru a lot of work in the process.
> 
> So, does anyone have any comments on available tools or ways or dealing
> with large logs?
> 
> MJ Stromberg
> mjstrom@itisolutions.com
> 
> 
> 
test

It worked !!


Bart Hermus 
E-mail: Barth@wcc.nl 

WCC Services B.V
Eekholt 54; 1112 XH Diemen-Zuid
Tel: +31 (0)20-4160266 ; Fax: +31 (0)20-4160267

 ----------
 From: Arturo Ellis [SMTP:arturo@intac.com]
 Sent: Wednesday, September 10, 1997 10:55 AM
 To: Ntsecurity (E-mail)
 Subject: [NTSEC] test

 test
Is there a list of "To Do's" when first setting up a secured NT server?
If so, where is it?

Such as:

Rename the "administrator" account.
Create a new account with no access whatsoever called "administrator."
Rename the "guest" account.
Block access to unused Telnet ports, i.e. FTP, etc.

>Lots of.... Just a few seconds after install in SP3 on 2 machines, both
Hello All;

 I am having a trouble with my stations...
 Just a few seconds after install in SP3, some of the stations cannot logon any more.
 The message says that the pass cannot be validate or is incorrect...

 Some one have the same problem?

Tks in advance...


 _/_/ _/_/ _/_/_/ _/_/ _/_/ ///// TBA Informatica \\\\\ 
 _/ _/ _/ _/ _/ _/ _/ _/ //// Florianopolis - SC - Brasil \\\\
 _/ _/ _/ _/_/ _/ _/ /// Microsoft Certified Professional \\\
_/ _/ _/_/_/ _/ _/ // mailto:magnoj@tbacuritiba.com.br \\


On Wed, 10 Sep 1997, Jung, Steve wrote:

> Is there a list of "To Do's" when first setting up a secured NT server?
> If so, where is it?
> 
> Such as:
> 
> Rename the "administrator" account.
> Create a new account with no access whatsoever called "administrator."
> Rename the "guest" account.
> Block access to unused Telnet ports, i.e. FTP, etc.

One place to start is: 
http://www.microsoft.com/ntserver/info/secure_NTinstall.htm

Happy hunting!

--
"If it fails, then we know we are making progress!"
-- John E. Jasen // DNRC Ambassador to Earth \\ jjasen1@umbc.edu --
-- My views are those of the DNRC only. Prepare to be domesticated --


I have been trying desparately to get off this list!!
 (I know I am trapped and can't ever leave!!)
I love the insight and new hot topics that are discussd but I hate the 
accumulation. Also I am back at school and only work part time, and this 
mailling list goes to my work account - I hate trying to catch up on it 
after being away for a few days

My email address which is on the list is greg@ycs.net

when I try to mail you from ycs.net - everything comes back to me = 
I can't even post to the mailing list from that address, so I am trying 
it from another address

PLEASE GET ME OFF THE LIST!!

again - PLEASE remove greg@ycs.net from the ntsecurity mailinglist!!

THANX

-----------------------------------------------------------------------------
GREGORY A EISENBERG
tele@cs.mcgill.ca Computer Science Student / Music Freak
 http://www.cs.mcgill.ca/~tele
 President of DynaCom -> Dynamic Computer Solutions
 
There were in this country two very large monopolies. The larger of
the two had the following record: the Vietnam War, Watergate, double-
digit inflation, fuel and energy shortages, bankrupt airlines, and the
8-cent postcard. The second was responsible for such things as the
transistor, the solar cell, lasers, synthetic crystals, high fidelity
stereo recording, sound motion pictures, radio astronomy, negative
feedback, magnetic tape, magnetic "bubbles", electronic switching
systems, microwave radio and TV relay systems, information theory, the
first electrical digital computer, and the first communications
satellite. Guess which one got to tell the other how to run the
telephone business?
Wed Sep 10 09:55:10 EDT 1997

I have created a tool that has helped me in creating accounts and
administrating my network.
 
The tool:

1. Allows quick account creating setting profiles, creating and
sharing home directories etc...
2. Scanning of log files created by MS Proxy Server.
3. Quick reset of passwords and unlocking accounts.
4. Querying of drive space usage.

I will be adding many more features to the program as I go along.

The program is written entirely in C++ using Borland C++ and OWL.

If anyone is interested in trying it I will email it to you.

Paul Potter
Software Engineer/Network Administrator.
SAIC has developed an audit reduction and analyis tool called Computer Misuse
Detection System or CMDS for short. Check out the following:
http://www.saic.com/it/cmds.html

------------------------------
Date: 9/10/97 3:20 AM
To: Von Lehmden, Bob
From: Falk Schmal

I think, there is a special Version of Crystal-Reports from Segeate 
Software for making reports out of eventlog. There are some nice tools for 
analyze the audit logs: rcswww.urz.tu-dresden.de/~fh/nt/eventlog/. 
Another comercial product for a complete analye is Logcaster NT from 
www.logcaster.com.

Greetings ...


_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
+49 355 69 2752 fsch@informatik.tu-cottbus.de
http://www-rnks.informatik.tu-cottbus.de/~fsch

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/

 administer all NT services in the domain:
 Service Manager NT 1.0

_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/


On Thu, 28 Aug 1997, MJ Stromberg wrote:

> Hello all,
> 
> I have question about NT Auditing. Given that a decently busy NT Server
> can generate large logs per day (if file auditing or other such things are
> enabled), and also given that Event viewer, while it is good for browsing,
> does not have any abilities to create reports or anything along that line,
> what tools (if any) do people use to moniter NT's logs? I have seen maybe
> one or two tools (the DumpEvt utility from Somarsoft) and have looked at a
> few unix based ones as well (swatch) to see if they could be converted
> easily. But, I haven't run across any tools that enable you to easily
> process large logs and discard uninteresting events or produce usage
> reports without going thru a lot of work in the process.
> 
> So, does anyone have any comments on available tools or ways or dealing
> with large logs?
> 
> MJ Stromberg
> mjstrom@itisolutions.com
> 
> 
> 

------------------ RFC822 Header Follows ------------------
Received: by cpqm.saic.com with ADMIN;10 Sep 1997 03:15:24 -0800
Return-Path: 
Received: from phoenix.iss.net by cpmx.mail.saic.com; Wed, 10 Sep 97 03:15:00
-0700
Received: (qmail 31519 invoked by alias); 10 Sep 1997 10:05:28 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 31514 invoked by alias); 10 Sep 1997 10:05:28 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 31509 invoked by uid 15); 10 Sep 1997 10:05:27 -0000
Received: (qmail 31502 invoked from network); 10 Sep 1997 10:05:26 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 10 Sep 1997 10:05:26 -0000
Received: from portia.Informatik.TU-Cottbus.DE
(portia.Informatik.TU-Cottbus.DE [141.43.3.129]) by arden.iss.net
(8.8.7/8.7.3) with ESMTP id GAA02383 for ; Wed, 10 Sep
1997 06:08:39 -0400
Received: by portia.Informatik.TU-Cottbus.DE id MAA24175; Wed, 10 Sep 1997
12:05:07 +0200 (MET DST)
Received: by malcolm.Informatik.TU-Cottbus.DE id MAA00774; Wed, 10 Sep 1997
12:08:06 +0200 (MET DST)
 Date: Wed, 10 Sep 1997 12:08:05 +0200 (MET DST)
From: Falk Schmal 
To: MJ Stromberg 
cc: ntsecurity@iss.net
Subject: Re: [NTSEC] Auditing
In-Reply-To: <3.0.2.32.19970828115031.0070e6cc@223.128.100.16>
Message-ID: 
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Falk Schmal 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net




I've recently been the victem of some violent smurf attacks..

I dont want to filter class 8 echo (icmp) at the router, but rather 
stop them at the ip where they are attacking ( polyester.net -- NT4.0 
Server -- all the latest patches/hotfixes) Any suggestions as to the 
software i should install?

Thanks in adavance!

Matthew Katona
(*)+(*)=(* *)
jar@polyester.net
(*)-(*)==(  )
Polyester toast after a polyester butter

At 10:34 AM 9/10/97 -0300, you wrote:
>>Lots of.... Just a few seconds after install in SP3 on 2 machines, both
>Hello All;
>
> I am having a trouble with my stations...
> Just a few seconds after install in SP3, some of the stations cannot >
logon any more.

Microsoft Certified Professional \\\

ok try the hotfix for this at your certified professional site

:)

 
 MWC - NTsecurity.com has released a new product: EventAdmin (TM) beta
for Microsoft Windows NT(R). EventAdmin Kit includes two utilities:
EventAdmin- the Enterprise Event Logs Manager and AuditSet -the Enterprise
Audit Policy Manager.

 EventAdmin gives Windows NT administrators a central point for
collecting, storing and analyzing the information contained in event logs.
AuditSet is a part of EventAdmin kit, allows administrators to establish
and maintain enterprise-wide security logs auditing policy.

Full description can be found at:
 http://www.ntsecurity.com/Products/EventAdmin/index.htm

EventAdmin beta can be downloaded at:
 http://www.ntsecurity.com/Products/License/DemoAgreement.html

Beta testers are welcome. Please send questions and suggestions to
support@box.omna.com

 Thank you for your feedback.

EventAdmin is scheduled to be released on September 25.

Contact:
MWC, Inc.
(614) 336-9223
e-mail Products@ntsecurity.com
http://www.NTsecurity.com

At 09:20 AM 9/10/97 -0800, you wrote:
>SAIC has developed an audit reduction and analyis tool called Computer Misuse
>Detection System or CMDS for short. Check out the following:
>http://www.saic.com/it/cmds.html
>
>------------------------------
>Date: 9/10/97 3:20 AM
>To: Von Lehmden, Bob
>From: Falk Schmal
>
>I think, there is a special Version of Crystal-Reports from Segeate 
>Software for making reports out of eventlog. There are some nice tools for 
>analyze the audit logs: rcswww.urz.tu-dresden.de/~fh/nt/eventlog/. 
>Another comercial product for a complete analye is Logcaster NT from 
>www.logcaster.com.
>
>Greetings ...
>
>
>_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
>
>Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
>+49 355 69 2752 fsch@informatik.tu-cottbus.de
>http://www-rnks.informatik.tu-cottbus.de/~fsch
>
>_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
>
> administer all NT services in the domain:
> Service Manager NT 1.0
>
>_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
>
>
>On Thu, 28 Aug 1997, MJ Stromberg wrote:
>
>> Hello all,
>> 
>> I have question about NT Auditing. Given that a decently busy NT Server
>> can generate large logs per day (if file auditing or other such things are
>> enabled), and also given that Event viewer, while it is good for browsing,
>> does not have any abilities to create reports or anything along that line,
>> what tools (if any) do people use to moniter NT's logs? I have seen maybe
>> one or two tools (the DumpEvt utility from Somarsoft) and have looked at a
>> few unix based ones as well (swatch) to see if they could be converted
>> easily. But, I haven't run across any tools that enable you to easily
>> process large logs and discard uninteresting events or produce usage
>> reports without going thru a lot of work in the process.
>> 
>> So, does anyone have any comments on available tools or ways or dealing
>> with large logs?
>> 
>> MJ Stromberg
>> mjstrom@itisolutions.com
>> 
>> 
>> 
>
>------------------ RFC822 Header Follows ------------------
>Received: by cpqm.saic.com with ADMIN;10 Sep 1997 03:15:24 -0800
>Return-Path: 
>Received: from phoenix.iss.net by cpmx.mail.saic.com; Wed, 10 Sep 97 03:15:00
>-0700
>Received: (qmail 31519 invoked by alias); 10 Sep 1997 10:05:28 -0000
>Delivered-To: nt-out-link@iss.net
>Received: (qmail 31514 invoked by alias); 10 Sep 1997 10:05:28 -0000
>Delivered-To: nt-out@iss.net
>Received: (qmail 31509 invoked by uid 15); 10 Sep 1997 10:05:27 -0000
>Received: (qmail 31502 invoked from network); 10 Sep 1997 10:05:26 -0000
>Received: from arden.iss.net (root@208.21.0.8)
> by phoenix.iss.net with SMTP; 10 Sep 1997 10:05:26 -0000
>Received: from portia.Informatik.TU-Cottbus.DE
>(portia.Informatik.TU-Cottbus.DE [141.43.3.129]) by arden.iss.net
>(8.8.7/8.7.3) with ESMTP id GAA02383 for ; Wed, 10 Sep
>1997 06:08:39 -0400
>Received: by portia.Informatik.TU-Cottbus.DE id MAA24175; Wed, 10 Sep 1997
>12:05:07 +0200 (MET DST)
>Received: by malcolm.Informatik.TU-Cottbus.DE id MAA00774; Wed, 10 Sep 1997
>12:08:06 +0200 (MET DST)
> Date: Wed, 10 Sep 1997 12:08:05 +0200 (MET DST)
>From: Falk Schmal 
>To: MJ Stromberg 
>cc: ntsecurity@iss.net
>Subject: Re: [NTSEC] Auditing
>In-Reply-To: <3.0.2.32.19970828115031.0070e6cc@223.128.100.16>
>Message-ID: 
>MIME-Version: 1.0
>Content-Type: TEXT/PLAIN; charset=US-ASCII
>Sender: owner-ntsecurity@iss.net
>Precedence: bulk
>Reply-To: Falk Schmal 
>X-Loop: ntsecurity
>X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to
majordomo@iss.net
>X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
>
>
>
>
>
Hi,

How to block one or more ports in WindowsNT 4.0?? May I use the registry??
Thanks,

Wagner

Check http://www.texas.net/~mrbill/smurf.html this will give you much 
more info on how to protect yourself and how not to be part of the 
attacking clan.

Joel Lafleur
Technical Support Team Leader
Golden Triangle On Line
1-519-576-1713

On Wed, 10 Sep 1997, Rodrigo Simon Coutinho wrote:

> Whats a smurf attack!?!?
> 
> Pazuzu
> http://www.inf.ufpr.br/~rsc89
> 
> 
> ----- Mensagem original -----
> De: jar@polyester.net [SMTP:jar@polyester.net]
> Enviada em: Wednesday, September 10, 1997 8:26 AM
> Para: ntsecurity@iss.net
> Assunto: [NTSEC] Smurf Attacks
> 
> I've recently been the victem of some violent smurf attacks..
> 
> I dont want to filter class 8 echo (icmp) at the router, but rather
> stop them at the ip where they are attacking ( polyester.net -- NT4.0
> Server -- all the latest patches/hotfixes) Any suggestions as to the
> software i should install?
> 
> Thanks in adavance!
> 
> Matthew Katona
> (*)+(*)=(* *)
> jar@polyester.net
> (*)-(*)==( )
> Polyester toast after a polyester butter
> 
> 
Anyone stupid enough to Spam a mailing list of Network professionals is
a candidate for a Darwin award. Anyone stupid enough for Spam a mailing
list that discusses network security and internet security is a Darwin
award.

> -----Original Message-----
> From: dreamwvr [SMTP:dreamwvr@nucleus.com]
> Sent: Tuesday, September 09, 1997 6:59 PM
> To: Michael E. Cummins; NT Security Mailing List
> Subject: Re: [NTSEC] Is the subscriber's list parceled out to
> advertisers?
> 
> I would have to agreeand second the motion.
> 
> 
> At 04:57 PM 9/8/97 +1000, Michael E. Cummins wrote:
> >Since I have subscribed to this list my POP3 box has become the
> welcome mat
> >for large volumes of advertising SPAM. Since I have only been
> lurking here
> >for a week and not posted yet, I can only assume that the mailing
> list has
> >been SOLD to electronic advertising firms. Is this true? Are other
> list
> >members experiencing the same kind of annoying garbage? The LAST
> advertiser
> >was so bold as to actually place [NTSEC] in the subject line!
> >
> >Bewildered,
> >
> >Very Respectfully,
> >
> >Michael E. Cummins
> >webmaster@i-magery.com
> >
> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
> >MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
> >PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
> >I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >
> >"Argue for your limitations, and they shall be yours!"
> > - R. Bach (paraphrased)
> >"Every man is my superior in that I may learn from him"
> > -S. Clemmons
> >
> >
> >
> >
> >
> >
> >
I've been getting alot of SPAM over the last fews days, with NT Security
Software sales guys. I've been doing computer security since 1986 and this
is the first week that I have been getting unsolicited mail on this
subject, after all of these years in the biz.

At 01:20 PM 9/10/97 -0500, Stephen Wiles wrote:
>Anyone stupid enough to Spam a mailing list of Network professionals is
>a candidate for a Darwin award. Anyone stupid enough for Spam a mailing
>list that discusses network security and internet security is a Darwin
>award.
>
>> -----Original Message-----
>> From: dreamwvr [SMTP:dreamwvr@nucleus.com]
>> Sent: Tuesday, September 09, 1997 6:59 PM
>> To: Michael E. Cummins; NT Security Mailing List
>> Subject: Re: [NTSEC] Is the subscriber's list parceled out to
>> advertisers?
>> 
>> I would have to agreeand second the motion.
>> 
>> 
>> At 04:57 PM 9/8/97 +1000, Michael E. Cummins wrote:
>> >Since I have subscribed to this list my POP3 box has become the
>> welcome mat
>> >for large volumes of advertising SPAM. Since I have only been
>> lurking here
>> >for a week and not posted yet, I can only assume that the mailing
>> list has
>> >been SOLD to electronic advertising firms. Is this true? Are other
>> list
>> >members experiencing the same kind of annoying garbage? The LAST
>> advertiser
>> >was so bold as to actually place [NTSEC] in the subject line!
>> >
>> >Bewildered,
>> >
>> >Very Respectfully,
>> >
>> >Michael E. Cummins
>> >webmaster@i-magery.com
>> >
>> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> >ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
>> >MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
>> >PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
>> >I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
>> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> >
>> >"Argue for your limitations, and they shall be yours!"
>> > - R. Bach (paraphrased)
>> >"Every man is my superior in that I may learn from him"
>> > -S. Clemmons
>> >
>> >
>> >
>> >
>> >
>> >
>> >
>
>

Have you looked at Security Expolrer for managing the file and directory
permissions?
If not take a look
http://www.smallwonders.com

> -----Original Message-----
> From: Bryan Wilkerson [SMTP:bryanw@reston.ans.net]
> Sent: Tuesday, September 02, 1997 12:55 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Basic permissions
> 
> 
> >> I downloaded the most recent copy of EVERYONE2USER by David LeBlanc
> >> from
> >> the NTBUGTRAQ web site and did a bit of testing on NT 4.0 SP3.
> After
> >> doing an EVERYONE2USER SOFTWARE and de-installing and re-installing
> >> some
> >> software, the system became unusable for anyone who was not part of
> >> the
> >> administrators group. 
> 
> Obviously this is unacceptable for a workstation, but what about a
> server?
> Do you really want users logging on and running software? 
> 
> Needless to say the second part of this finding (that the Users group
> is
> granted to much access) is a big problem. 
> 
> I think 2 basic steps should be taken in conjunction with setting up a
> 
> new, secure NT *Server* 4.x.
> 
> 1. Starting at the root share of each local drive assign the
> following 
> permissions:
> Administrators Full Control (All) (All)
> CREATOR OWNER Full Control (All) (All)
> SYSTEM Full Control (All) (All)
> Recurse subdirectories replacing permissions on all existing
> files.
> 
> 2. Starting at the root of HKLM assign the following
> permissions:
> Administrators Full Control (All) (All)
> SYSTEM Full Control (All) (All)
> Recurse subdirectories replacing permissions on all existing
> files.
> 
> This configuration will permit file and print sharing. Additional
> server 
> software (db server, mail server, etc.) should be installed by a user
> in the
> administrators group. If the server software installs a user account
> to run
> certain of it's services in the context of (MS SQL, IIS), it will
> generally set
> permissions for that account accordingly. 
> 
> The administrator will have to do a little more work assigning rights
> each 
> time he/she creates a new share. The goal however is to create an
> environment
> where the administrator has to do work to *ALLOW* access instead of
> restricting it. Why? Because failing to give Untrusted User access
> to 
> something is never as easy to detect or forgive as failing to restrict
> his 
> access.
> 
> Any comments?
> 
> 
> -bryan (flame shield at maximum)
> 
Are you implying that stupid spammers are rare? On the contrary! 

Christopher Schroeder NetVision Technologies, Inc.
Wichita, Kansas USA System Adminstrator
316-651-1239 http://www.nvt.net/


On Wednesday, September 10, 1997 1:21 PM, Stephen Wiles 
[SMTP:swiles@empower.com] wrote:
> Anyone stupid enough to Spam a mailing list of Network professionals is
> a candidate for a Darwin award. Anyone stupid enough for Spam a mailing
> list that discusses network security and internet security is a Darwin
> award.
>
> > -----Original Message-----
> > From: dreamwvr [SMTP:dreamwvr@nucleus.com]
> > Sent: Tuesday, September 09, 1997 6:59 PM
> > To: Michael E. Cummins; NT Security Mailing List
> > Subject: Re: [NTSEC] Is the subscriber's list parceled out to
> > advertisers?
> >
> > I would have to agreeand second the motion.
> >
> >
> > At 04:57 PM 9/8/97 +1000, Michael E. Cummins wrote:
> > >Since I have subscribed to this list my POP3 box has become the
> > welcome mat
> > >for large volumes of advertising SPAM. Since I have only been
> > lurking here
> > >for a week and not posted yet, I can only assume that the mailing
> > list has
> > >been SOLD to electronic advertising firms. Is this true? Are other
> > list
> > >members experiencing the same kind of annoying garbage? The LAST
> > advertiser
> > >was so bold as to actually place [NTSEC] in the subject line!
> > >
> > >Bewildered,
> > >
> > >Very Respectfully,
> > >
> > >Michael E. Cummins
> > >webmaster@i-magery.com
> > >
> > >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > >ICQ UIN: 1410138 | A+ CERTIFIED MICROCOMPUTER REPAIR
> > >MEMBER HTML WRITER's GUILD, MICROSOFT SITE BUILDER's NETWORK
> > >PGP PUBLIC KEY AVAILABLE - http://www.i-magery.com/pgp.txt
> > >I-MAGERY WEB PUBLISHING - http://www.i-magery.com/
> > >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > >
> > >"Argue for your limitations, and they shall be yours!"
> > > - R. Bach (paraphrased)
> > >"Every man is my superior in that I may learn from him"
> > > -S. Clemmons
> > >
> > >
> > >
> > >
> > >
> > >
> > >

 We have Domain consists of 1500 users having NT 4.0 Workstations. Some of them have local Printers.
 I need to give access to helpdesk people , in order them to add local printers on the workstations. Is there 
 any way to give help desk people to give permissions to add printers locally without making them domain Admins
 
I would not want them to log on locally as administrators, If they do, they cannot access printer drives files which are on the domain. 

Any suggestions appreciated

Thanks in Advance

Jagadish Chnadran


>From: "Samuel Kam" 
>To: 
>Subject: Re: Spam from "music@powernethk.com"
>Date: Thu, 11 Sep 1997 15:31:43 +0800
>X-MSMail-Priority: Normal
>
>Dear Sir,
>
>To let you know, we cut our user "music" the next day after he joined our
>services, after realising he had several computers using our network to
>spam. We already deleted all his mail and records and have blacklisted him.
>
>Regards,
>Samuel Kam
>Manager
>PowerNet Internet Group
>


see it does work these guys like "music" just dont care they hit and run ..
it was just this lists "turn" and lets be honest what can anyone of us do
besides monitor the list... and does anyone want to chip in??

cheers

John Johnson WWW http://www.novatech.net.au 
Tactical Director email novatech@novatech.net.au (business) 
NovaTech Internet Security knytmare@nectar.com.au (private)
Australias Leading Dedicated Internet and Network Security Consultants

Hi, 

I'm looking for a tool that permits to compare the Registry before and 
after doing an operation.

Any idea ????'
Best Regards
Is this possible?
Various Microsoft Knowledge Base articles (Q157361 in particular) 
describe this for a domain a/c. 

Leaving out the DefaultDomainName does'nt work.

 Regards
 Patrick
---------------------------------------------------------------------------
Patrick (JC) Townsend | H.H. Wills Physics Laboratory
WFWG, WinNT, Mac & Network support | University of Bristol.
Tel: 0117-928-9000 x8936 | Tyndall Avenue,
email: patrick.townsend@bris.ac.uk | Bristol. BS8 1TL
web: http://vishnu.phy.bris.ac.uk/phynet/ | United Kingdom

-----Original Message-----
From: 
ppowell <ppowell@tse.com>
To: request-ntsecurity@iss.net 
<request-ntsecurity@iss.net>
Date: Thursday, September 11, 1997 
9:07 AM
Subject: Subscribe ntsecurity

Subscribe NT 
security

Pat Powell
The Toronto 
Stock Exchange
Sr. Networks Software 
analyst
MCSE

I've found a pretty good way to do this.

1) Export your registry to a text file using REGEDIT.EXE
2) Perform your system changes
3) Export your registry again to another text file using REGEDIT.EXE
4) Use WINDIFF.EXE to compare the two text files.

WINDIFF.EXE comes with the VC++ compiler or the WINNT Resource Kit.

> -----Original Message-----
> From: Juan Evangelista David [SMTP:jevang@cc.upv.es]
> Sent: Thursday, September 11, 1997 9:52 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Registry Tool
> 
> Hi, 
> 
> I'm looking for a tool that permits to compare the Registry before and
> 
> after doing an operation.
> 
> Any idea ????'
> Best Regards
A quick little hint for folks that have been bitten by the LC1.5 GUI bug
that doesn't write out all the data to a file...

1) Append to your dictionary a list of already checked words (say 3% or
so)
2) Start up LC and let it run
3) When it reaches 97%, you know that all the actual checking is done,
so save the results then to a file (I used save as, but I suppose save
will work fine as well)

Presto, the list of cracked passwords is available for you to send email
to them or something.

Of course, you might just want to wait for mudge and weld to fix that
:-)

--Robin

Hello fellow security specialists,

I heard from our local Microsoft Office here in the Netherlands that
The release date for MS Proxy 2.0 (not the Beta but the official)
Is set for 8 september in the US.

For Europe it will be 4 till 6 weeks later !!

My question is, is there somebody in the US who already has this
version.
So is this all true, is the final version already released.


Bart Hermus 
E-mail: Barth@wcc.nl 

WCC Services B.V
Eekholt 54; 1112 XH Diemen-Zuid
Tel: +31 (0)20-4160266 ; Fax: +31 (0)20-4160267
On Thu, 11 Sep 1997, Juan Evangelista David wrote:

> I'm looking for a tool that permits to compare the Registry before and 
> after doing an operation.

 The most simple yet almost the most powerful: sysdiff from NT
resource kit. Just don't forget to put an [ExcludeDrives] section
in your sysdiff.inf file if you don't want to monitor disk
changes.

 See sysdiff.hlp (in reskit) for details.

 Hope this helps,
VZ

There is this Technet article that may help you. Hopefully it helps.

Q170517

Chance.

* Chance H. Neale 
* Morgan Stanley, Dean Witter, Discover
* IT / Engineering / Distributed Systems / PC




-----Original Message-----
From: mario.magno@omninet.com.br [SMTP:mario.magno@omninet.com.br]
Sent: Wednesday, September 10, 1997 9:35 AM
To: 'NTBUGTRAQ@NTADVICE.COM'
Cc: 'ntsecurity@iss.net'
Subject: [NTSEC] Windows 3.11 and windows 95 stations cannot
logon

>Lots of.... Just a few seconds after install in SP3 on 2 machines, both
Hello All;

 I am having a trouble with my stations...
 Just a few seconds after install in SP3, some of the stations
cannot logon any more.
 The message says that the pass cannot be validate or is
incorrect...

 Some one have the same problem?

Tks in advance...


 _/_/ _/_/ _/_/_/ _/_/ _/_/ ///// TBA
Informatica \\\\\ 
 _/ _/ _/ _/ _/ _/ _/ _/ //// Florianopolis
- SC - Brasil \\\\
 _/ _/ _/ _/_/ _/ _/ /// Microsoft
Certified Professional \\\
_/ _/ _/_/_/ _/ _/ //
mailto:magnoj@tbacuritiba.com.br \\

Please note that this user, vbenvenu@unifi.com, is no longer here,
please adjust your listing.

System Administrator @unifi.com


Sorry for this off-topic post, but the post from Pat Powell illustrates
perfectly a problem I have with MSIM.

ppowell wrote:
>
>-----Original Message-----
>From: ppowell 
>To: request-ntsecurity@iss.net 
>Date: Thursday, September 11, 1997 9:07 AM
>Subject: Subscribe ntsecurity
>
>
>
> Subscribe NT security
>
>Pat Powell
>The Toronto Stock Exchange
>Sr. Networks Software analyst
>MCSE 

For me, the forwarding header has mixed bold/normal Arial text. The last
bit appeared in a small italic CYAN Fixedsys (difficult to read on a
white background). Examining the message shows it has two MIME parts, one
text/plain and one text/html.

I don't want HTMLized version in my email unless I ask for them, I want
plain black-on-white 11-point Lucida Console throughout. Is there *any*
way I can turn this 'feature' off. (A way to unconditionally save
attachments to disk would be nice too...)

ObSecurity: I assume it wouldn't be stupid enough to run any active
content within the HTML? Good Times...

John
-- 
remember i was always true; remember that i always tried 
remember i loved only you; remember me and smile... 
for it's better to forget than to remember me and cry
:-p

People keep asking here about general NT admin lists - I ran across one
this morning - see http://www.ntsoftdist.com/scripts/lyris.pl

I have _no_ idea what the S/N is, or anything else - I haven't subscribed.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

"configsafe" from imaginlan in nashua, new hampshire. does exactly what
you wish. we use it on test system to evaluate products. you can
automate periodic checks on the registry or do before and after
installation checks.

http://www.imagine-lan.com/csprice.htm

typically, we've confirmed what we knew with most products, as a result of
configsafe

 install does not equal -(uninstall)

boris

Juan Evangelista David wrote:

> Hi,
>
> I'm looking for a tool that permits to compare the Registry before and
> after doing an operation.
>
> Any idea ????'
> Best Regards