Duh !! 

It amazing, two people who know better looked at the accounts policy and
did't notice it was checked. We never have set the " User must change
password at next login" box and the "User must logon in order to change
password" box at the same time before. Its strange they can both be set at
the same time.

Thanks for your help,

Allan

----------
> Hi Allan,
> 
> It sounds to me that you've checked the box "User must logon in order to
> change password" i the acount polices dialog in usermanager.
> 
> Hope this helps you!
> 
> /Jens
> 

Greetings
Try using FrontPage 97. That no longer needs basic authentication.
However you will have to upgrade all clients.


> -----Original Message-----
> From: Ylva Holm [SMTP:ylva.holm@hedbergska.sundsvall.se]
> Sent: Quarta-feira, 23 de Julho de 1997 19:41
> To: ntsecurity@iss.net
> Subject: [NTSEC] Basic authentication
> 
> Hi!
> I have an IIS-server with users connecting via FrontPage and it locks
> as if
> I have to turn on basic authentication for them to be able to connect
> and
> work with their webfiles. When I done this and users log in to the
> network
> to work is the passwords still encrypted or have I caused that all
> passwords are transmitted in clear text now even if it has nothing to
> do
> with the web at all?
> Worried! Ylva
Ah hem - See the following articles:

It clearly shows 120 bit RSA cracked on June of 93, and estimates 830
MIPS/Years. 129 at 5000mips/years but cracked three years ago on April
1994. RSA 128 would be 1 bit easier, therefore 2500MIPS/years (each
additional bit makes it twice as hard to crack) RSA 130 was broken April
of last year, which is four times harder than RSA 128, etc...

Also keep in mind Moore's law would have enhanced today's machine speeds
as compared to 1993 and 1994 significantly. Not twice, but significantly
since those dates.

While piddling easy is an understatement for a single machine, and you
might not be able to do it on your machines, nor I, but it's not for a
machine farm which any serious opponent will have available, or for
dedicated hardware designed to break a specific algorithm.

Further, when using a PK system you're actually using two cyphers, and
breaking either of them will break the message. (Analogy is that of a
chain, weakest link's strength is the strength of the whole.) 

It is naive that the bad guy wouldn't have these resources or couldn't
rent them or build them. All it takes is money and time to design them.

=====
See http://www.rsa.com/rsalabs/html/status.html
(excerpts thereof:)

Factoring Challenge
 Status





 number
 month
 MIPS-years

algorithm
 RSA-100
 April 1991
 7

quadratic sieve
 RSA-110
 April 1992
 75

quadratic sieve
 RSA-120
 June 1993
 830

quadratic sieve
 RSA-129
 April 1994
 5000

quadratic sieve
 RSA-130
 April 1996
 500

generalized number
 field
sieve



=====
Date: Tue, 24 Jun 1997 00:13:10 +0100
Message-Id: <199706232313.AAA00156@server.test.net>
From: Adam Back 
To: cypherpunks@cyberpass.net
Subject: Comparing Cryptographic Key Sizes


Below is a explanation of the meaning of cryptographic key sizes which
started as an explanation I wrote for a journalist friend of mine, on
being asked about how relatively secure a system using DES and RSA
(SET) was as compared to netscapes export version of SSL.

I've re-written it to make it more general in scope.

One of the most common errors I see in news stories about
cryptographic breaks is to (say) compare 1024 bit RSA keys with 56 bit
symmetric keys as if the two key sizes are directly comparable.

This new document is intended to be simple and understandable to give
people a handle on how to describe and compare cryptographic systems
strengths.

This document by design glosses over some details, where I think this
is reasonable.

It could use some criticism. If you are not that crypto aware, does
it make sense to you? If you are crypto aware, what do you think of
my off the cuff estimates of hardness?

I wrote it with journalists in mind. If you are a journalist and find
it useful, feel free to quote parts/all of it without attribution.

Adam


Comparing Cryptographic Key Sizes

There are two types of key sizes: public key (sometimes called
asymmetric key) and symmetric keys. Examples of public key algorithms
are RSA, and Diffie-Hellman. Examples of symmetric key algorithms are
RC4, DES, IDEA. You can not directly compare public key lengths (for
example RSA keys) with symmetric key lengths (DES, RC4). This is an
important point which confuses many people.

For example 40 bit RC4 (a symmetric key cipher) can be broken in a few
hours with a few hundred workstations. 40 bit RSA (a public key
cipher) can be broken in a fraction of a second on one PC. RSA keys
need to be I'd guess around 350 bits to be equivalent in strength to
40 bit RC4.

56 bit DES is probably roughly similar to 512 bit RSA in hardness to
break.

Symmetric keys sizes are easy to reason with: one more bit in key
length is twice as hard to break, for the same algorithm. It is more
complicated estimating the hardness to break of public key (say RSA)
keys of varying sizes as they get harder more gradually than symmetric
keys. This is why public key systems have longer keys, you need more
bits to get the same security level.

Most systems use a mixture of public and symmetric key ciphers. This
is because public key ciphers are _slow_. Symmetric key ciphers are
fast, and so are used in combination with public key systems to speed
up the combined system. Public key systems are used because of the
advantages of public key management they make possible.

When considering the strength of a system using two ciphers one public
key and one symmetric key, the strength of the system is equal to the
strength of the weakest link.

For example: consider the export version of SSL, as shipped in the
export version of Netscape browsers and servers. It uses 512 bit RSA,
and 40 bit RC4. It is easier to crack 40 bit RC4 than it is to crack
512 bit RSA, so export SSL can be broken by breaking the 40 bit RC4
component. Ian Goldberg recently broke a 40 bit RC5 key himself with
Berkeley univ machines in 3.5 hours. 40 bit RC4 could be broken in a
similar amount of time.

512 bits RSA is not enough either, and you can rest assured that the
NSA, other governments' secret services, and any corporation or
organised crime group with sufficient funds can break it. 512 bits is
likely within reach of a distributed internet effort, of similar or
smaller scale than the recent DES breaking.

56 bit DES is harder to break than 40 bit RC4 (SSL), from the number
bits you might think it would be 65536 times harder, but it's less
than that because DES is faster than RC4. In software it's about 5
times faster, so that means breaking DES in software is about 10000
times harder than breaking 40 bit RC4 (as used in export SSL) in
software.

But, if the Russian Mafia, or a corporation involved in industrial
espionage wanted to break 56 bit DES they would not do it in software.
They would build a special purpose piece of hardware which was
designed only to break DES. DES was designed to be fast in hardware,
it is a relatively slow ciphers in software.

About 10 years ago now Michael Wiener made a design for such a DES
breaking machine. He estimated it would cost $10,000,000 to build a
machine which would break a 56 bit DES encrypted message a few hours.
His machine was scalable, pay more money, break the key faster, pay
less take longer. The estimate was that could build one with enough
DES key searching units to break it in a day for $1,000,000. That was
10 years ago. 10 years is a long time in the computer industry.
Nowadays you build the machine more cheaply as chip technology has
progressed, and computers are much faster per $. Estimates are around
$100,000 to build the machine (neglecting hardware engineers
consultancy fees).

Everyone expects that NSA, GCHQ, SCSSI have built such a machine for
$100,000+. This is obvious because the NSA and SCSSI allow export of
56 bit DES.

$100,000 is not much money for a secret service.

Algorithms using 40 bit keys aren't secure at all, past a very
superficial casual level of protection. Systems using DES, such as
SET are only secure against organisations who can't raise $100,000 and
can't find people who know lots about crypto and hardware design.
$100,000 is not much money for a secret service. It's not much for
the Rusian Mafia either.

END




====
On 24 Jul 1997, Ryan Russell/SYBASE wrote:

> Well, I'm a poor cryptographer, but I think
> you might be mistaken on a few points....
> 
> The french guy broke the 40 bit version
> of RSA. Only 1 trillion possibilities there,
> most folks could get together the few fast machine it
> would take to brute force that. The point was
> to demonstrate the fact the 40 bit stuff was usless.
> 
> The guys at berkeley broke the Netscape encryption
> because of a bad random number generator on
> Netscape's part. A bad implementation.
> 
> If RSA 128 is implemented properly, it is certainly not
> piddling easy to brute force.
> 
> I may be mistaken, but I don't think the other things 
> you mentioned are public-key ciphers. Diffie-Hellman
> is a secret sharing protocol, and elliptic curves are
> numbers with a certain set of characterisitics, and
> are intended to be useful for encryption using fewer
> bits.
> 



You know, RSA sells other ciphers besides PK. The 128 bit cipher in
question is RC4, for which the best known attack is brute force, and
what the French broke was 40 bit RC4.

In my reply, I said "millions of machines and billions of cracks per
second" -- that's about 1000 time more machines and 1000 times faster
than was employed in the recent DES challenge, so I don't think that I
was ignoring Moore's law. Not only that, but the crack time was 10**16
years -- so there's a little slack to permit machines to get even faster
:-)

Based on these numbers, I'd say that 128 bit RC4 would be good for about
the next 50 years, if not cryptanalyzed first.

> ----------
> From: Ray Arachelian[SMTP:sunder@brainlink.com]
> Reply To: Ray Arachelian
> Sent: Thursday, July 24, 1997 11:21 AM
> To: Ryan Russell/SYBASE
> Cc: Paul Leach; ntsecurity
> Subject: RE: [NTSEC] Win95 sec
> 
> Ah hem - See the following articles:
> 
> It clearly shows 120 bit RSA cracked on June of 93, and estimates 830
> MIPS/Years. 129 at 5000mips/years but cracked three years ago on
> April
> 1994. RSA 128 would be 1 bit easier, therefore 2500MIPS/years (each
> additional bit makes it twice as hard to crack) RSA 130 was broken
> April
> of last year, which is four times harder than RSA 128, etc...
> 
> Also keep in mind Moore's law would have enhanced today's machine
> speeds
> as compared to 1993 and 1994 significantly. Not twice, but
> significantly
> since those dates.
> 
> While piddling easy is an understatement for a single machine, and you
> might not be able to do it on your machines, nor I, but it's not for a
> machine farm which any serious opponent will have available, or for
> dedicated hardware designed to break a specific algorithm.
> 
> Further, when using a PK system you're actually using two cyphers, and
> breaking either of them will break the message. (Analogy is that of a
> chain, weakest link's strength is the strength of the whole.) 
> 
> It is naive that the bad guy wouldn't have these resources or couldn't
> rent them or build them. All it takes is money and time to design
> them.
> 
> =====
> See http://www.rsa.com/rsalabs/html/status.html
> (excerpts thereof:)
> 
> Factoring Challenge
> Status
> 
> 
> 
> 
> 
> number
> month
> MIPS-years
> 
> algorithm
> RSA-100
> April 1991
> 7
> 
> quadratic sieve
> RSA-110
> April 1992
> 75
> 
> quadratic sieve
> RSA-120
> June 1993
> 830
> 
> quadratic sieve
> RSA-129
> April 1994
> 5000
> 
> quadratic sieve
> RSA-130
> April 1996
> 500
> 
> generalized number
> 
> field
> sieve
> 
> 
> 
> =====
> Date: Tue, 24 Jun 1997 00:13:10 +0100
> Message-Id: <199706232313.AAA00156@server.test.net>
> From: Adam Back 
> To: cypherpunks@cyberpass.net
> Subject: Comparing Cryptographic Key Sizes
> 
> 
> Below is a explanation of the meaning of cryptographic key sizes which
> started as an explanation I wrote for a journalist friend of mine, on
> being asked about how relatively secure a system using DES and RSA
> (SET) was as compared to netscapes export version of SSL.
> 
> I've re-written it to make it more general in scope.
> 
> One of the most common errors I see in news stories about
> cryptographic breaks is to (say) compare 1024 bit RSA keys with 56 bit
> symmetric keys as if the two key sizes are directly comparable.
> 
> This new document is intended to be simple and understandable to give
> people a handle on how to describe and compare cryptographic systems
> strengths.
> 
> This document by design glosses over some details, where I think this
> is reasonable.
> 
> It could use some criticism. If you are not that crypto aware, does
> it make sense to you? If you are crypto aware, what do you think of
> my off the cuff estimates of hardness?
> 
> I wrote it with journalists in mind. If you are a journalist and find
> it useful, feel free to quote parts/all of it without attribution.
> 
> Adam
> 
> 
> Comparing Cryptographic Key Sizes
> 
> There are two types of key sizes: public key (sometimes called
> asymmetric key) and symmetric keys. Examples of public key algorithms
> are RSA, and Diffie-Hellman. Examples of symmetric key algorithms are
> RC4, DES, IDEA. You can not directly compare public key lengths (for
> example RSA keys) with symmetric key lengths (DES, RC4). This is an
> important point which confuses many people.
> 
> For example 40 bit RC4 (a symmetric key cipher) can be broken in a few
> hours with a few hundred workstations. 40 bit RSA (a public key
> cipher) can be broken in a fraction of a second on one PC. RSA keys
> need to be I'd guess around 350 bits to be equivalent in strength to
> 40 bit RC4.
> 
> 56 bit DES is probably roughly similar to 512 bit RSA in hardness to
> break.
> 
> Symmetric keys sizes are easy to reason with: one more bit in key
> length is twice as hard to break, for the same algorithm. It is more
> complicated estimating the hardness to break of public key (say RSA)
> keys of varying sizes as they get harder more gradually than symmetric
> keys. This is why public key systems have longer keys, you need more
> bits to get the same security level.
> 
> Most systems use a mixture of public and symmetric key ciphers. This
> is because public key ciphers are _slow_. Symmetric key ciphers are
> fast, and so are used in combination with public key systems to speed
> up the combined system. Public key systems are used because of the
> advantages of public key management they make possible.
> 
> When considering the strength of a system using two ciphers one public
> key and one symmetric key, the strength of the system is equal to the
> strength of the weakest link.
> 
> For example: consider the export version of SSL, as shipped in the
> export version of Netscape browsers and servers. It uses 512 bit RSA,
> and 40 bit RC4. It is easier to crack 40 bit RC4 than it is to crack
> 512 bit RSA, so export SSL can be broken by breaking the 40 bit RC4
> component. Ian Goldberg recently broke a 40 bit RC5 key himself with
> Berkeley univ machines in 3.5 hours. 40 bit RC4 could be broken in a
> similar amount of time.
> 
> 512 bits RSA is not enough either, and you can rest assured that the
> NSA, other governments' secret services, and any corporation or
> organised crime group with sufficient funds can break it. 512 bits is
> likely within reach of a distributed internet effort, of similar or
> smaller scale than the recent DES breaking.
> 
> 56 bit DES is harder to break than 40 bit RC4 (SSL), from the number
> bits you might think it would be 65536 times harder, but it's less
> than that because DES is faster than RC4. In software it's about 5
> times faster, so that means breaking DES in software is about 10000
> times harder than breaking 40 bit RC4 (as used in export SSL) in
> software.
> 
> But, if the Russian Mafia, or a corporation involved in industrial
> espionage wanted to break 56 bit DES they would not do it in software.
> They would build a special purpose piece of hardware which was
> designed only to break DES. DES was designed to be fast in hardware,
> it is a relatively slow ciphers in software.
> 
> About 10 years ago now Michael Wiener made a design for such a DES
> breaking machine. He estimated it would cost $10,000,000 to build a
> machine which would break a 56 bit DES encrypted message a few hours.
> His machine was scalable, pay more money, break the key faster, pay
> less take longer. The estimate was that could build one with enough
> DES key searching units to break it in a day for $1,000,000. That was
> 10 years ago. 10 years is a long time in the computer industry.
> Nowadays you build the machine more cheaply as chip technology has
> progressed, and computers are much faster per $. Estimates are around
> $100,000 to build the machine (neglecting hardware engineers
> consultancy fees).
> 
> Everyone expects that NSA, GCHQ, SCSSI have built such a machine for
> $100,000+. This is obvious because the NSA and SCSSI allow export of
> 56 bit DES.
> 
> $100,000 is not much money for a secret service.
> 
> Algorithms using 40 bit keys aren't secure at all, past a very
> superficial casual level of protection. Systems using DES, such as
> SET are only secure against organisations who can't raise $100,000 and
> can't find people who know lots about crypto and hardware design.
> $100,000 is not much money for a secret service. It's not much for
> the Rusian Mafia either.
> 
> END
> 
> 
> 
> 
> ====
> On 24 Jul 1997, Ryan Russell/SYBASE wrote:
> 
> > Well, I'm a poor cryptographer, but I think
> > you might be mistaken on a few points....
> > 
> > The french guy broke the 40 bit version
> > of RSA. Only 1 trillion possibilities there,
> > most folks could get together the few fast machine it
> > would take to brute force that. The point was
> > to demonstrate the fact the 40 bit stuff was usless.
> > 
> > The guys at berkeley broke the Netscape encryption
> > because of a bad random number generator on
> > Netscape's part. A bad implementation.
> > 
> > If RSA 128 is implemented properly, it is certainly not
> > piddling easy to brute force.
> > 
> > I may be mistaken, but I don't think the other things 
> > you mentioned are public-key ciphers. Diffie-Hellman
> > is a secret sharing protocol, and elliptic curves are
> > numbers with a certain set of characterisitics, and
> > are intended to be useful for encryption using fewer
> > bits.
> > 
> 
> 
> 
On 24 Jul 1997, Ryan Russell/SYBASE wrote:

> I may be mistaken, but I don't think the other things 
> you mentioned are public-key ciphers. Diffie-Hellman
> is a secret sharing protocol, and elliptic curves are
> numbers with a certain set of characterisitics, and
> are intended to be useful for encryption using fewer
> bits.

A yep. DH is a secret sharing protocol, yes. It's used to share a session
key with the person/device you're trying to communicate with, and thus
acts as a PK system for all purposes. You do the same with RSA any way as
it's too time expenisve to send all your messages encyphered in RSA.
Instead you use RSA to send a session key - same with elliptic curve
cyphers. (FYI: NeXT Inc - now Apple Inc. had a few patents on those...)

Yes, Elliptic Curves do require less digits, and there are PK systems
based on them. 

See the other message I sent about comparing key sizes and what's been
broken. Also, look at RSA's home page for the challenges - you'll have to
send email to challenge-rsa-list@rsa.com to receive the list of the
current and already broken challenges (I think's it honorroll-list or
something... but beware, you'll get bunches of 40-50K messages.) 

It's naive to think that 128 bits is enough for RSA. Possibly ok for
symmetric/private key cyphers, but.... I'd rather use 2048bit RSA and 128
bit session IDEA for everything. If you encrypt everything strongly all
the time - even email to your mother, then someone watching you can't use
traffic analysis to figgure out which messages they should try to crack
and which are crap.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================


On Wed, 23 Jul 1997, Paul Leach wrote:

> > > Also worthy of note: with $10,000,000 it would take about a year to
> > > break one password (assumes the PC costs ~$1750). Not much use if
> > > passwords are changed every 45-90 days (a typical figure). So to
> > break
> > > it in time to use it, it would take $40-80,000,000.
> > The problem is, that this cost is the same to break 1 or 10000
> > passwords.
> > (Assuming you've collected your data from a rogue server, that
> > requests
> > the same salt everytime.)

Well, I think the time figure accounts for Intel hardware, and it's
already been demonstrated that "spare cycles" and free will can take the
costs down to 0 for the aggressor.

 > > 
> So what -- it still takes a year, and if all of the passwords have
> already changed, now you know a lot of out-of-date passwords.
> 
> > Assuming 10-20% weak passwords you're in quite faster than your
> > quotes.
> > (And I'm not sure that 10-20 is the upper bound of weak passwords with
> > usual users, probably it's more like the lower bound :((( )
> > 
> Since it is possible to install a DLL that checks whether passwords are
> strong enough, any site that cares enough about security will have 0%
> weak passwords, so your assumption is invalid.

Unfortunately, this reduces the keyspace, all the brute force timings
assume any possible value, but if you go for non-dictionary passwords
you've just limited the keyspace, reducing the time necessary for a brute
force attack, and since most of those "strong passwords" require non-alpha
characters, even non-dictionary possibilities are automatically eliminated
from the attack sequence.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Until there is a demonstrated demand for better security on Windows 95
that can't be best met by Windows NT, then it's that simple.

Especially if, as Dave Leblanc noted on this list recently, when cost of
ownership is factored in, Windows NT is actually cheaper.

> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Thursday, July 24, 1997 8:03 AM
> To: Paul Leach
> Cc: ntsecurity; NTBUGTRAQ
> Subject: RE: Windows NT rantings from the l0pht
> 
> Oh, come on. You aren't going to pretend that
> the issue is that simple, are you?
> 
> I realize these things aren't your personnal 
> choices, but it would appear that you've 
> been declared de-facto MS spokesperson here...
> 
> My personal opinion is that any OS ought to
> be securable on the network, even if it has
> no security when you sit down in front of it.
> Not using the network is not much of a choice.
> As the only supplier of the SMB stuff between
> 95 and NT, I would hope that MS has plans 
> to dump the unsecure LM dialect entirely.
> I'd prefer to see a hotfix for 95 soon, but I 
> could even live with it being fixed in Memphis.
> 
> Are you able to comment on any of the above?
> 
> Ryan
> 
> ---------- Previous Message ----------
> To: ntsecurity, NTBUGTRAQ, mudge
> cc: Ryan.Russell
> From: paulle@microsoft.com (Paul Leach) @ smtp
> Date: 07/24/97 10:42:01 AM
> Subject: RE: Windows NT rantings from the l0pht
> 
> It's amazing how hard it is for some people to get the idea that MS
> says
> "if security is a major concern, buy Windows NT". We've always said
> that. Maybe the 65% of all systems that run with no security at all
> (see
> the IDC report that Russ cites in his recent message) are happy to run
> Windows 95 even though it isn't as secure as Windows NT. Maybe thats
> why
> we concentrate our efforts on enhancing security in Windows NT.
> 
> For people who claim security is so important, why won't they admit
> that
> it's worth more money for a system that implements it?
> 
> > ----------
> > From: Who cares what the hell goes into a Gecos field
> > anyway![SMTP:mudge@l0pht.com]
> > Sent: Thursday, July 24, 1997 7:20 AM
> > To: ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca
> > Cc: Paul Leach; Ryan.Russell@sybase.com
> > Subject: Windows NT rantings from the l0pht
> > 
> > 
> > I didn't ask to be cc'd into the rantings of the MS Borg Marketing 
> > Juggernaut but since I'm here...
> > 
> > I find this hillarious. The people at MS should know better.
> > 
> > I haven't been following this thread tremendously but I've seen
> > bit's and pieces. Recently there was an attrocious article in
> > WindowsNT 
> > magazine, where they stated it would take 5000 or so years to break
> > the 
> > passwords; thus put policy in place to have users change their
> > passwords 
> > every 2500 years. HELLO? I think these people aren't getting it.
> > 
> > Let's shed some light on things shall we?
> > 
> > 1. Thank you very little MS for dropping any reference to the l0pht,
> > hobbit, or myself in reference to your recent LM-Hash fix. If this
> > is how you "correspond" with people who point out problems to you
> it's
> > no wonder that people prefer to release things to the public instead
> > of your "proper" channels. 
> > 
> > 2. MS agrees that the LM hash is a horrible implementation from a 
> > security standpoint. They respond with: "well we didn't write the 
> > protocol that was IBM".
> > 
> > 3. When MS had the chance to do things a different way (ie Network
> > challenge/response obfuscation on NT boxes) they implemented it
> based
> > upon LM techniques to break up components (see #2).
> > 
> > 4. The LM-hash fix works great if you don't have anything but NT
> > machines
> > on your network. If you want to continue being "productive" with
> your
> > win95 machines it is my understanding that you "do it insecurely" or
> > you are S.O.L.
> > 
> > 5. Few places are running "nothing but NT" (ie just about everyone 
> > has 95 or WfW boxes if MS has already gotten their foot in the
> door).
> > (see #4)
> > 
> > 6. MS can't swallow their pride enough to say "oops", even in 
> > technical circles where they don't have to worry about the general
> > public
> > mis-interpreting things.
> > 
> > 7. For the LM hash you only have to break 7 characters, not 14!
> > 
> > 8. MS keeps talking about the NT hash being so secure while refusing
> > to
> > talk
> > about how weak the LM hash is. Guess what, you probably won't be
> able
> > to use the "added security" of the NT hash on your network. Why keep
> 
> > talking about something people can't use?
> > 
> > 9. Even though the NT hash spec says you can have up to 128 char
> > passwords,
> > I'd really like someone to show me how they can type more than 14
> > characters
> > into UserManager before it starts Beep-Beep'ing at them.
> > 
> > 10. We demonstrate up front with proof of concept code in L0phtcrack
> > v1.0,
> > and L0phtcrack v1.5 that the following is indeed the case.
> > 
> > For those that don't know, L0phtcrack v1.5 will attack the challenge
> > response done over the network. The reason we came out with this was
> > that
> > the SYSKEY "fix" that MS came out with only managed to emasculate
> the
> > ADMINISTRATOR and not address the actuall problem. Can we say "save
> > face"? I knew we could.
> > 
> > L0phtcrack v1.5 is available for FREE from http://www.L0pht.com
> > (that's
> > a ZERO after the 'L', not an 'o') . It comes with source so you can
> > build 
> > it on just about any platform. It is proof-of concept code and thus
> > could be sped up tremendously.
> > 
> > Now, let's rip apart why it is so trivial to go through the LM hash
> on
> > the
> > network. And then talk about why the NT hash doesn't matter.
> > 
> > -------------------------- -----------------------------
> > | 16byte LM hash | | 16byte NT hash (md4) |
> > -------------------------- -----------------------------
> > 
> > We already know that you only have to go through 7 characters to
> > retrieve
> > passwords (up to 14 chars in length) in the LM hash, and that since
> > there
> > is
> > no salting being done, constants show up all over the place giving
> > away
> > too much information and speeding up attacks tremendously.
> > 
> > -------------------------------------------------
> > | 1st 8bytes of LMhash | second 8bytes of LMhash |
> > -------------------------------------------------
> > 
> > 1st 8 bytes are derived from the first seven characters of the
> > password
> > and
> > the second 8 bytes are derived from the 8th through 14th characters
> of
> > the password. If the password is less than 7 characters then the
> > second
> > half will always be: 0xAAD3B435B51404EE.
> > 
> > Let's assume for this example that the users password has a LM hash
> of
> > 0xC23413A8A1E7665fAAD3B435B51404EE (which I'll save everyone the
> > nanosecond 
> > it would have taken for them to plug this into L0phtcrack and have
> it
> > tell them the password is "WELCOME").
> > 
> > Here's what happens to this hash on the network:
> > 
> > -------- --------
> > | A | <______________| B |
> > | | | |
> > -------- --------
> > 
> > B sends an 8 byte challenge to A. (assume 0x0001020304050607)
> > 
> > Machine A takes the hash of 0xC23413A8A1E7665fAAD3B435B51404EE
> > and adds 5 nulls to it, thus becoming 
> > 0xC23413A8A1E7665fAAD3B435B51404EE0000000000.
> > 
> > The string 0xC23413A8A1E7665fAAD3B435B51404EE0000000000 is broken
> into
> > three groups of 7:
> > 
> > C23413A8A1E766 5fAAD3B435B514 04EE0000000000
> > 
> > The 7 byte strings are str_to_key'd (if you will) into 8 byte odd
> > parity
> > des keys.
> > 
> > Now we have :
> > 
> > | 8byteDeskey1 | | 8byteDeskey2 | | 8 byteDeskey3 |
> > 
> > 8byteDeskey1 is used to encrypt the challenge 0x0001020304050607.
> > Let's
> > assume the result is 0xAAAAAAAAAAAAAAAA.
> > 
> > 8byteDeskey2 is used to encrypt the challenge 0x0001020304050607.
> > Let's
> > assume the result is 0xBBBBBBBBBBBBBBBB.
> > 
> > 8byteDeskey3 is used to encrypt the challenge 0x0001020304050607.
> > Let's
> > assume the result is 0xCCCCCCCCCCCCCCCC.
> > 
> > The three 8byte values are concatenated (!dumb!), and the 24 byte
> > response
> > of 0xAAAAAAAABBBBBBBBCCCCCCCC is returned to the server. The server
> > does
> > the same thing to the hash on it's end and compares the result to
> the
> > 24 byte response. If they match, it was the correct original hash.
> > 
> > Why this is boneheaded:
> > ----------------------
> > 
> > 7 char or less passwords.
> > 
> > -------------------- --------------------
> --------------------
> > 
> > | C23413A8A1E766 || 5fAAD3B435B514 || 04EE0000000000
> |
> > -------------------- --------------------
> --------------------
> > 
> > The first thing we check is to see if the users password is less
> than
> > 8 characters in length. We do this by taking the 7 byte value of 
> > 0x04EE0000000000, turning it into an 8 byte odd parity DES key, 
> > and encrypting it against the 8 byte challenge of
> 0x0001020304050607.
> > If we get the result of 0xCCCCCCCCCCCCCCCC then we are pretty sure
> > it's < 8 chars in length. 
> > 
> > In order to be sure we can run through 0x??AAD3B435B514 (ie 256
> > possible
> > combinations) to see that 5f shows us the result is
> > 0xBBBBBBBBBBBBBBBB,
> > proving that the password is less than 7 characters and also giving
> us
> > the last byte of the first half of the LM hash.
> > 
> > From this point, even assuming we're just joyriding and not worried
> > about
> > optimizing the way this is done (believe me, there are much more
> > effective ways to do this that reduce the amount of time needed even
> > further... this whole this is just showing that even a simplistic
> > attack works against this implementation), it's no different than
> > how a tool like L0phtcrack attacks the hashes in the registry.
> > 
> > 8 char or greater passwords.
> > 
> > -------------------- --------------------
> --------------------
> > | C23413A8A1E766 || AC435F2DD90417 || CCD60000000000
> |
> > -------------------- --------------------
> --------------------
> > 
> > The first thing to check is whether the password is less than 8
> > characters
> > in length. Deriving the 8 byte odd parity des key from
> > 0x04EE0000000000 
> > and encrypting against 0x0001020304050607 does not, in this case,
> give
> > us 0xCCCCCCCCCCCCCCCC, so we know that the password is 8 characters
> or
> > greater. 
> > 
> > It takes us, in a worst case scenario, 65535 checks to figure out
> that
> > the 2bytes that are used in the last third are 0xCCD6. Even
> > approaching
> > this in a completely brain-dead fashion (hey, turn-about is fair
> > play),
> > you can go through your 7 digit combinations of characters for the
> > first third the same way you would the LM hash from the registry.
> This
> > will yield not only the first third of the response, but also the 
> > first byte of the second third. Keep in mind that you already have
> the
> > last two bytes that made up the third third. 
> > 
> > You could approach the middle third in the same fashion.
> > 
> > (note: this whole method that MS is doing screams for a precompute
> > table lookup attack - which given the small enough potential values
> > is not impossible by any means)
> > 
> > Thus, the challenge response is completely brute-forcable for the
> > LM-hash.
> > 
> > MS made the "oversight" of still sending the LM-hash response along
> > with 
> > the NT response even when SP3 was installed. Thus it was a moot
> point 
> > as to how tough or well done the NT hash might or might not be.
> > 
> > Since installing the LM-fix precludes continued use of windows 95
> > machines
> > in regards to talking to NT machines, it is still a moot point as to
> > how tough or well done the NT hash might or might not be.
> > 
> > The LM hash is incredibly weak and your more secure NT hash is
> brought
> > down to the lowest common denominator.
> > 
> > (note: this whole method that MS is doing screams for a precompute
> > table lookup attack - which given the small enough potential values
> > is not impossible by any means)
> > 
> > Thus, the challenge response is completely brute-forcable for the
> > LM-hash.
> > 
> > MS made the "oversight" of still sending the LM-hash response along
> > with 
> > the NT response even when SP3 was installed. Thus it was a moot
> point 
> > as to how tough or well done the NT hash might or might not be.
> > 
> > Since installing the LM-fix precludes continued use of windows 95
> > machines
> > in regards to talking to NT machines, it is still a moot point as to
> > how tough or well done the NT hash might or might not be.
> > 
> > The LM hash is incredibly weak and your more secure NT hash is
> brought
> > down to the lowest common denominator.
> > 
> > It would have been nice if you could type a password greater than
> > 14chars
> > into the UserManager app.
> > 
> > .mudge
> > 
> > --------------------
> > http://www.l0pht.com/advisories.html - for more security related
> > articles
> > published by the L0pht
> > --------------------
> > 
> > 
> 
> 
> 

Well, it shows numbers of a length of those many bits
being factored, but is that the same as cracking something
encrypted with the algorithm? (obviously, I'm demonstrating
my ignorance of the RSA algorithm details.. I'll break
out my Applied Cryptography and look it up.)

What I was assuming was that for a 128-bit RSA, the
most straightforward way to crack it was to
check 2^128 different keys for a match. If it's
as "simple" as factoring a 128-bit number, it would
obviously take much less time.

Another interesting question, then, relating
to the info you sent... what algorithm does
SSL use? 

 Ryan
---------- Previous Message ----------
To: Ryan.Russell
cc: paulle, ntsecurity
From: sunder@brainlink.com (Ray Arachelian) @ smtp
Date: 07/24/97 02:21:42 PM
Subject: RE: [NTSEC] Win95 sec

Ah hem - See the following articles:

It clearly shows 120 bit RSA cracked on June of 93, and estimates 830
MIPS/Years. 129 at 5000mips/years but cracked three years ago on April
1994. RSA 128 would be 1 bit easier, therefore 2500MIPS/years (each
additional bit makes it twice as hard to crack) RSA 130 was broken April
of last year, which is four times harder than RSA 128, etc...

Also keep in mind Moore's law would have enhanced today's machine speeds
as compared to 1993 and 1994 significantly. Not twice, but significantly
since those dates.

While piddling easy is an understatement for a single machine, and you
might not be able to do it on your machines, nor I, but it's not for a
machine farm which any serious opponent will have available, or for
dedicated hardware designed to break a specific algorithm.

Further, when using a PK system you're actually using two cyphers, and
breaking either of them will break the message. (Analogy is that of a
chain, weakest link's strength is the strength of the whole.) 

It is naive that the bad guy wouldn't have these resources or couldn't
rent them or build them. All it takes is money and time to design them.

=====
See http://www.rsa.com/rsalabs/html/status.html
At 11:05 AM 7/23/97 -0700, Paul Leach wrote:

>Since it is possible to install a DLL that checks whether passwords are
>strong enough, any site that cares enough about security will have 0%
>weak passwords, so your assumption is invalid.
>

Can you recommend any commercially available DLL's?

Thanks.


Just had the challenge stuff mailed to me..

Those are the number of DIGITS (base 10) not the
number of bits. Those numbers are even bigger.
Certainly this is something different. I must have
been, in my non-specific terms, reffering to RC4,
as Paul pointed out in a different note. 
Sorry for the confusion.

 Ryan

---------- Previous Message ----------
To: Ryan.Russell
cc: paulle, ntsecurity
From: sunder@brainlink.com (Ray Arachelian) @ smtp
Date: 07/24/97 02:21:42 PM
Subject: RE: [NTSEC] Win95 sec

Ah hem - See the following articles:

It clearly shows 120 bit RSA cracked on June of 93, and estimates 830
MIPS/Years. 129 at 5000mips/years but cracked three years ago on April
1994. RSA 128 would be 1 bit easier, therefore 2500MIPS/years (each
additional bit makes it twice as hard to crack) RSA 130 was broken April
of last year, which is four times harder than RSA 128, etc...

On 24 Jul 1997, Ryan Russell/SYBASE wrote:

> Another interesting question, then, relating
> to the info you sent... what algorithm does
> SSL use? 

Can use RSA/DH1/DES/RC4/IDEA/Blowfish and others... see
http://home.netscape.com/newsref/std/SSL.html and the links under it...
not sure what key sizes, as the only ref I've seen there is that it's
illegal to export RSA with a modulus greater thant 512 bits...


=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

Well, I thought we (on the list) were demonstrating
a demand.

Cost is irrelevant to me. What's important is what OS 
runs best on my hardware, where the features I need 
are, what my users demand, etc.. Not all software runs
on NT (yes, the converse is true of 95, too) and NT doesn't
do as well on laptops, the list goes on.

I'm just puzzled as to why MS wouldn't give folks the
choice to use the NT dialect if they want, and then
let them choose their level of security. Support issues
are the only reason I can think of, but MS has done a 
number of hotfixes for 95 that fall into the same category.

If one (or a team) of your guys can produce the LM
fix for NT in one night, certainly you could produce
one for 95 in a reasonable amount of time.

 Ryan

---------- Previous Message ----------
To: Ryan.Russell
cc: ntsecurity, NTBUGTRAQ
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 07/24/97 11:44:05 AM
Subject: RE: Windows NT rantings from the l0pht

Until there is a demonstrated demand for better security on Windows 95
that can't be best met by Windows NT, then it's that simple.

Especially if, as Dave Leblanc noted on this list recently, when cost of
ownership is factored in, Windows NT is actually cheaper.

> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Thursday, July 24, 1997 8:03 AM
> To: Paul Leach
> Cc: ntsecurity; NTBUGTRAQ
> Subject: RE: Windows NT rantings from the l0pht
> 
> Oh, come on. You aren't going to pretend that
> the issue is that simple, are you?
> 
> I realize these things aren't your personnal 
> choices, but it would appear that you've 
> been declared de-facto MS spokesperson here...
> 
> My personal opinion is that any OS ought to
> be securable on the network, even if it has
> no security when you sit down in front of it.
> Not using the network is not much of a choice.
> As the only supplier of the SMB stuff between
> 95 and NT, I would hope that MS has plans 
> to dump the unsecure LM dialect entirely.
> I'd prefer to see a hotfix for 95 soon, but I 
> could even live with it being fixed in Memphis.
> 
> Are you able to comment on any of the above?
> 
> Ryan
> 
> ---------- Previous Message ----------
> To: ntsecurity, NTBUGTRAQ, mudge
> cc: Ryan.Russell
> From: paulle@microsoft.com (Paul Leach) @ smtp
> Date: 07/24/97 10:42:01 AM
> Subject: RE: Windows NT rantings from the l0pht
> 
> It's amazing how hard it is for some people to get the idea that MS
> says
> "if security is a major concern, buy Windows NT". We've always said
> that. Maybe the 65% of all systems that run with no security at all
> (see
> the IDC report that Russ cites in his recent message) are happy to run
> Windows 95 even though it isn't as secure as Windows NT. Maybe thats
> why
> we concentrate our efforts on enhancing security in Windows NT.
> 
> For people who claim security is so important, why won't they admit
> that
> it's worth more money for a system that implements it?
> 
> > ----------
> > From: Who cares what the hell goes into a Gecos field
> > anyway![SMTP:mudge@l0pht.com]
> > Sent: Thursday, July 24, 1997 7:20 AM
> > To: ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca
> > Cc: Paul Leach; Ryan.Russell@sybase.com
> > Subject: Windows NT rantings from the l0pht
> > 
> > 
> > I didn't ask to be cc'd into the rantings of the MS Borg Marketing 
> > Juggernaut but since I'm here...
> > 
> > I find this hillarious. The people at MS should know better.
> > 
> > I haven't been following this thread tremendously but I've seen
> > bit's and pieces. Recently there was an attrocious article in
> > WindowsNT 
> > magazine, where they stated it would take 5000 or so years to break
> > the 
> > passwords; thus put policy in place to have users change their
> > passwords 
> > every 2500 years. HELLO? I think these people aren't getting it.
> > 
> > Let's shed some light on things shall we?
> > 
> > 1. Thank you very little MS for dropping any reference to the l0pht,
> > hobbit, or myself in reference to your recent LM-Hash fix. If this
> > is how you "correspond" with people who point out problems to you
> it's
> > no wonder that people prefer to release things to the public instead
> > of your "proper" channels. 
> > 
> > 2. MS agrees that the LM hash is a horrible implementation from a 
> > security standpoint. They respond with: "well we didn't write the 
> > protocol that was IBM".
> > 
> > 3. When MS had the chance to do things a different way (ie Network
> > challenge/response obfuscation on NT boxes) they implemented it
> based
> > upon LM techniques to break up components (see #2).
> > 
> > 4. The LM-hash fix works great if you don't have anything but NT
> > machines
> > on your network. If you want to continue being "productive" with
> your
> > win95 machines it is my understanding that you "do it insecurely" or
> > you are S.O.L.
> > 
> > 5. Few places are running "nothing but NT" (ie just about everyone 
> > has 95 or WfW boxes if MS has already gotten their foot in the
> door).
> > (see #4)
> > 
> > 6. MS can't swallow their pride enough to say "oops", even in 
> > technical circles where they don't have to worry about the general
> > public
> > mis-interpreting things.
> > 
> > 7. For the LM hash you only have to break 7 characters, not 14!
> > 
> > 8. MS keeps talking about the NT hash being so secure while refusing
> > to
> > talk
> > about how weak the LM hash is. Guess what, you probably won't be
> able
> > to use the "added security" of the NT hash on your network. Why keep
> 
> > talking about something people can't use?
> > 
> > 9. Even though the NT hash spec says you can have up to 128 char
> > passwords,
> > I'd really like someone to show me how they can type more than 14
> > characters
> > into UserManager before it starts Beep-Beep'ing at them.
> > 
> > 10. We demonstrate up front with proof of concept code in L0phtcrack
> > v1.0,
> > and L0phtcrack v1.5 that the following is indeed the case.
> > 
> > For those that don't know, L0phtcrack v1.5 will attack the challenge
> > response done over the network. The reason we came out with this was
> > that
> > the SYSKEY "fix" that MS came out with only managed to emasculate
> the
> > ADMINISTRATOR and not address the actuall problem. Can we say "save
> > face"? I knew we could.
> > 
> > L0phtcrack v1.5 is available for FREE from http://www.L0pht.com
> > (that's
> > a ZERO after the 'L', not an 'o') . It comes with source so you can
> > build 
> > it on just about any platform. It is proof-of concept code and thus
> > could be sped up tremendously.
> > 
> > Now, let's rip apart why it is so trivial to go through the LM hash
> on
> > the
> > network. And then talk about why the NT hash doesn't matter.
> > 
> > -------------------------- -----------------------------
> > | 16byte LM hash | | 16byte NT hash (md4) |
> > -------------------------- -----------------------------
> > 
> > We already know that you only have to go through 7 characters to
> > retrieve
> > passwords (up to 14 chars in length) in the LM hash, and that since
> > there
> > is
> > no salting being done, constants show up all over the place giving
> > away
> > too much information and speeding up attacks tremendously.
> > 
> > -------------------------------------------------
> > | 1st 8bytes of LMhash | second 8bytes of LMhash |
> > -------------------------------------------------
> > 
> > 1st 8 bytes are derived from the first seven characters of the
> > password
> > and
> > the second 8 bytes are derived from the 8th through 14th characters
> of
> > the password. If the password is less than 7 characters then the
> > second
> > half will always be: 0xAAD3B435B51404EE.
> > 
> > Let's assume for this example that the users password has a LM hash
> of
> > 0xC23413A8A1E7665fAAD3B435B51404EE (which I'll save everyone the
> > nanosecond 
> > it would have taken for them to plug this into L0phtcrack and have
> it
> > tell them the password is "WELCOME").
> > 
> > Here's what happens to this hash on the network:
> > 
> > -------- --------
> > | A | <______________| B |
> > | | | |
> > -------- --------
> > 
> > B sends an 8 byte challenge to A. (assume 0x0001020304050607)
> > 
> > Machine A takes the hash of 0xC23413A8A1E7665fAAD3B435B51404EE
> > and adds 5 nulls to it, thus becoming 
> > 0xC23413A8A1E7665fAAD3B435B51404EE0000000000.
> > 
> > The string 0xC23413A8A1E7665fAAD3B435B51404EE0000000000 is broken
> into
> > three groups of 7:
> > 
> > C23413A8A1E766 5fAAD3B435B514 04EE0000000000
> > 
> > The 7 byte strings are str_to_key'd (if you will) into 8 byte odd
> > parity
> > des keys.
> > 
> > Now we have :
> > 
> > | 8byteDeskey1 | | 8byteDeskey2 | | 8 byteDeskey3 |
> > 
> > 8byteDeskey1 is used to encrypt the challenge 0x0001020304050607.
> > Let's
> > assume the result is 0xAAAAAAAAAAAAAAAA.
> > 
> > 8byteDeskey2 is used to encrypt the challenge 0x0001020304050607.
> > Let's
> > assume the result is 0xBBBBBBBBBBBBBBBB.
> > 
> > 8byteDeskey3 is used to encrypt the challenge 0x0001020304050607.
> > Let's
> > assume the result is 0xCCCCCCCCCCCCCCCC.
> > 
> > The three 8byte values are concatenated (!dumb!), and the 24 byte
> > response
> > of 0xAAAAAAAABBBBBBBBCCCCCCCC is returned to the server. The server
> > does
> > the same thing to the hash on it's end and compares the result to
> the
> > 24 byte response. If they match, it was the correct original hash.
> > 
> > Why this is boneheaded:
> > ----------------------
> > 
> > 7 char or less passwords.
> > 
> > -------------------- --------------------
> --------------------
> > 
> > | C23413A8A1E766 || 5fAAD3B435B514 || 04EE0000000000
> |
> > -------------------- --------------------
> --------------------
> > 
> > The first thing we check is to see if the users password is less
> than
> > 8 characters in length. We do this by taking the 7 byte value of 
> > 0x04EE0000000000, turning it into an 8 byte odd parity DES key, 
> > and encrypting it against the 8 byte challenge of
> 0x0001020304050607.
> > If we get the result of 0xCCCCCCCCCCCCCCCC then we are pretty sure
> > it's < 8 chars in length. 
> > 
> > In order to be sure we can run through 0x??AAD3B435B514 (ie 256
> > possible
> > combinations) to see that 5f shows us the result is
> > 0xBBBBBBBBBBBBBBBB,
> > proving that the password is less than 7 characters and also giving
> us
> > the last byte of the first half of the LM hash.
> > 
> > From this point, even assuming we're just joyriding and not worried
> > about
> > optimizing the way this is done (believe me, there are much more
> > effective ways to do this that reduce the amount of time needed even
> > further... this whole this is just showing that even a simplistic
> > attack works against this implementation), it's no different than
> > how a tool like L0phtcrack attacks the hashes in the registry.
> > 
> > 8 char or greater passwords.
> > 
> > -------------------- --------------------
> --------------------
> > | C23413A8A1E766 || AC435F2DD90417 || CCD60000000000
> |
> > -------------------- --------------------
> --------------------
> > 
> > The first thing to check is whether the password is less than 8
> > characters
> > in length. Deriving the 8 byte odd parity des key from
> > 0x04EE0000000000 
> > and encrypting against 0x0001020304050607 does not, in this case,
> give
> > us 0xCCCCCCCCCCCCCCCC, so we know that the password is 8 characters
> or
> > greater. 
> > 
> > It takes us, in a worst case scenario, 65535 checks to figure out
> that
> > the 2bytes that are used in the last third are 0xCCD6. Even
> > approaching
> > this in a completely brain-dead fashion (hey, turn-about is fair
> > play),
> > you can go through your 7 digit combinations of characters for the
> > first third the same way you would the LM hash from the registry.
> This
> > will yield not only the first third of the response, but also the 
> > first byte of the second third. Keep in mind that you already have
> the
> > last two bytes that made up the third third. 
> > 
> > You could approach the middle third in the same fashion.
> > 
> > (note: this whole method that MS is doing screams for a precompute
> > table lookup attack - which given the small enough potential values
> > is not impossible by any means)
> > 
> > Thus, the challenge response is completely brute-forcable for the
> > LM-hash.
> > 
> > MS made the "oversight" of still sending the LM-hash response along
> > with 
> > the NT response even when SP3 was installed. Thus it was a moot
> point 
> > as to how tough or well done the NT hash might or might not be.
> > 
> > Since installing the LM-fix precludes continued use of windows 95
> > machines
> > in regards to talking to NT machines, it is still a moot point as to
> > how tough or well done the NT hash might or might not be.
> > 
> > The LM hash is incredibly weak and your more secure NT hash is
> brought
> > down to the lowest common denominator.
> > 
> > (note: this whole method that MS is doing screams for a precompute
> > table lookup attack - which given the small enough potential values
> > is not impossible by any means)
> > 
> > Thus, the challenge response is completely brute-forcable for the
> > LM-hash.
> > 
> > MS made the "oversight" of still sending the LM-hash response along
> > with 
> > the NT response even when SP3 was installed. Thus it was a moot
> point 
> > as to how tough or well done the NT hash might or might not be.
> > 
> > Since installing the LM-fix precludes continued use of windows 95
> > machines
> > in regards to talking to NT machines, it is still a moot point as to
> > how tough or well done the NT hash might or might not be.
> > 
> > The LM hash is incredibly weak and your more secure NT hash is
> brought
> > down to the lowest common denominator.
> > 
> > It would have been nice if you could type a password greater than
> > 14chars
> > into the UserManager app.
> > 
> > .mudge
> > 
> > --------------------
> > http://www.l0pht.com/advisories.html - for more security related
> > articles
> > published by the L0pht
> > --------------------
> > 
> > 
> 
> 
> 



I know nothing about windows 95 so i was wondering if anyone on here
could help me. I just got a new PcTel HSP 33.6 PNP Deluxe Modem and
I install the drivers for both the COM port and the modem. Then I run
Modem in control panels and run diagnostics it fails to communicate with
the modem. I tried all possible addresses and interupts that didn't
interfere with COM 1 and I don't know what to try next.
Chris Toth
c.toth@keene.k12.nh.us


> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Thursday, July 24, 1997 9:08 AM
> To: Paul Leach
> Cc: ntsecurity; NTBUGTRAQ
> Subject: RE: Windows NT rantings from the l0pht
> 
> Well, I thought we (on the list) were demonstrating
> a demand.
> 
It does -- I didn't mean to imply otherwise.
But it needs to add up to some at least single digit percentage of the
market; the list doesn't do that by itself. (If someone out there can
figure out how to show others here that kind of demand, I'll be happy to
pass it along.)

> Cost is irrelevant to me. What's important is what OS 
> runs best on my hardware, where the features I need 
> are, what my users demand, etc.. Not all software runs
> on NT (yes, the converse is true of 95, too) and NT doesn't
> do as well on laptops, the list goes on.
> 
I didn't mean to say that you might not have to trade something for the
security -- just that "if security is a major concern, then Windows NT
is the right system".

> I'm just puzzled as to why MS wouldn't give folks the
> choice to use the NT dialect if they want, and then
> let them choose their level of security. Support issues
> are the only reason I can think of, but MS has done a 
> number of hotfixes for 95 that fall into the same category.
> 
> If one (or a team) of your guys can produce the LM
> fix for NT in one night, certainly you could produce
> one for 95 in a reasonable amount of time.
> 
I don't know where you got the idea the LM-FIX was done in one night.
The LM-FIX took about two weeks to code, and was in test nearly that
long, in several product group test teams that use the NTLM SSP, to try
and insure that it didn't break other things. The development work was
spread out over several months, squeezed in between NT5 development.

Fixes for Win95 are harder; the kernel environment is more restrictive,
and these days there are far fewer people who understand it.

Paul

Thanks for the suggestion but I do use FrontPage 97. The users behind
firewalls can't connect to the server with FrontPage and some of the users
that are not behind firewalls have trouble too. If I use basic
authentification everyone can change the website they should be able to
change. My question is: how bad is this? If some of my pupils install a
sniffer will they be able to read every password in clear text when people
log on to the network?
Excuse me if the question looks simple - I'm just a teacher trying to have
some security. Our net can never be secure!//Ylva
At 07:07 PM 7/24/97 +0100, you wrote:
>Greetings
>Try using FrontPage 97. That no longer needs basic authentication.
>However you will have to upgrade all clients.
>
>
>> -----Original Message-----
>> From: Ylva Holm [SMTP:ylva.holm@hedbergska.sundsvall.se]
>> Sent: Quarta-feira, 23 de Julho de 1997 19:41
>> To: ntsecurity@iss.net
>> Subject: [NTSEC] Basic authentication
>> 
>> Hi!
>> I have an IIS-server with users connecting via FrontPage and it locks
>> as if
>> I have to turn on basic authentication for them to be able to connect
>> and
>> work with their webfiles. When I done this and users log in to the
>> network
>> to work is the passwords still encrypted or have I caused that all
>> passwords are transmitted in clear text now even if it has nothing to
>> do
>> with the web at all?
>> Worried! Ylva
>
>


>I don't know where you got the idea the LM-FIX was done in one night.
>The LM-FIX took about two weeks to code, and was in test nearly that
>long, in several product group test teams that use the NTLM SSP, to try
>and insure that it didn't break other things. The development work was
>spread out over several months, squeezed in between NT5 development.
>
>Fixes for Win95 are harder; the kernel environment is more restrictive,
>and these days there are far fewer people who understand it.
>
>Paul

Well, I was attending the Black Hat Briefings security conference
in Las Vegas where Mudge and Hobbit announced an exploit 
for the over-the-wire Lanman hash attacks stuff on July 9th.

On the 11th, I hear about this:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postsp3/lm-fix/

Then a bit later I see this article:

http://www.techweb.com/se/directlink.cgi?EET19970714S0021

And I know from being at the show (and, apparantly, from the article) that
there were some MS folks there checking things out.

I thought it looked rather like MS was reacting to something they 
saw the same time I did, and worked all night to get a fix made.

I suppose it just might have been excellent timing on MS's
part.

 Ryan






> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> Sent: Thursday, July 24, 1997 11:39 AM
> To: Paul Leach
> Cc: 'Andreas Kostyrka'; 'Stas Filshtinskiy'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> On Wed, 23 Jul 1997, Paul Leach wrote:
> 


> > > 
> > Since it is possible to install a DLL that checks whether passwords
> are
> > strong enough, any site that cares enough about security will have
> 0%
> > weak passwords, so your assumption is invalid.
> 
> Unfortunately, this reduces the keyspace, all the brute force timings
> assume any possible value, but if you go for non-dictionary passwords
> you've just limited the keyspace, reducing the time necessary for a
> brute
> force attack, and since most of those "strong passwords" require
> non-alpha
> characters, even non-dictionary possibilities are automatically
> eliminated
> from the attack sequence.
> 
This reasoning is not correct. I computed the actual number of possible
"strong" passwords. If you know the NT authentication protocol, you know
that the passwords are MD4 hashed to create the keys, and so as long as
there are more than 2**56 possible passwords, you'll get substantially
the whole DES key space even when "limiting" the password space.

I.e., limiting the password space does not limit the key space, if the
resulting password space is still larger than the key space.

Paul
When L0phtcrack 1.0 came out, LHI promised to produce a version that
would not require admin access. We took the promise seriously, and
started design and development work on the LM elimination. Later, there
were various hints and rumors that the Blackhat conference was where the
next version would be unveiled.

> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Thursday, July 24, 1997 10:24 AM
> To: Paul Leach
> Cc: ntsecurity; NTBUGTRAQ
> Subject: RE: Windows NT rantings from the l0pht
> 
> 
> >I don't know where you got the idea the LM-FIX was done in one night.
> >The LM-FIX took about two weeks to code, and was in test nearly that
> >long, in several product group test teams that use the NTLM SSP, to
> try
> >and insure that it didn't break other things. The development work
> was
> >spread out over several months, squeezed in between NT5 development.
> >
> >Fixes for Win95 are harder; the kernel environment is more
> restrictive,
> >and these days there are far fewer people who understand it.
> >
> >Paul
> 
> Well, I was attending the Black Hat Briefings security conference
> in Las Vegas where Mudge and Hobbit announced an exploit 
> for the over-the-wire Lanman hash attacks stuff on July 9th.
> 
> On the 11th, I hear about this:
> 
> ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfi
> xes-postsp3/lm-fix/
> 
> Then a bit later I see this article:
> 
> http://www.techweb.com/se/directlink.cgi?EET19970714S0021
> 
> And I know from being at the show (and, apparantly, from the article)
> that
> there were some MS folks there checking things out.
> 
> I thought it looked rather like MS was reacting to something they 
> saw the same time I did, and worked all night to get a fix made.
> 
> I suppose it just might have been excellent timing on MS's
> part.
> 
> Ryan
> 
> 
> 
> 
 I have 2 web servers iis 3.0 and nt 4.0 running on a compaq 5000.
For security on each server I would like to disable server services.
I would like to backup these servers preferrably on tape.

Would I have to have a backup unit on each web server?

Does disabling server services stop me from installing a backup
unit in one server to backup the other?

What procedures are other organizations using to backup their web
servers?


As an aside on the win95 sec and key length discussion
especially DES 56 bit, you might wanna check out:
http://www.rsa.com/des/

This is true brute force attack of the 72 quadrillion keys.
and it was broken in 140 days...

You can also take a look at the other challenges going on right now:

http://www.rc5.cyberian.org/
http://rc5.distributed.net/

Which both have taken on the greater task of brute force cracking the 
RSA 56 bit key.



Chris Larsen | We learn from history, 
vader@inet.uni-c.dk | that we do not learn from history...
System Manager |
Struers A/S | All opinions expressed herein are my own
 | and _not_ those of my employers !!.

PGP-key: http://swissnet.ai.mit.edu:11371/pks/lookup?op=get&search=0x137993A5

Enclose any groups which have white space in quotes.

 (e.g cacls file.txt /t /e /c /p "CREATOR OWNER:F")

This command will add full control to file.txt for the creator/owner.

Bob Karch

>----------
>From: kgjones@mitre.org[SMTP:kgjones@mitre.org]
>Sent: Wednesday, July 16, 1997 4:35 PM
>To: ntsecurity@iss.net
>Cc: msk@mitre.org
>Subject: [NTSEC] Use of cacls command
>
>Greetings-
> Background: I'm trying to employ the cacls command in a script to
>tighten the security on our systems.
>
> Question: I would like to include the CREATOR OWNER object in the
>list of users I extend permissions to through cacls. I know that CREATOR
>OWNER is not a user account. When I've tried to use CREATOR OWNER in the
>cacls command it has failed. I've tried different forms (no space, _, and
>/) without success. Bottom line question - is it even necessary or will
>the original creator/owner always have full control regardless of what I do
>through cacls? If it is necessary, how can I do it? Thanks!
>
>Ken
>
>Ken Jones
>Senior INFOSEC Engineer
>MITRE Corporation
>kgjones@mitre.org
>(617) 271-4873
>
>
>
>
At 06:33 PM 7/22/97 -0700, Paul wrote:
>Breaking a sniffed NT challenge/response will take approximately 5,700
>200mhz Pentium Pro _years_, if the user has a strong password. (This is
>the average time to search the key space at the rate of 1 million
>keys/sec on a 200mhz PPRO using the software developed for the RSA DES
>challenge, which was at the time the fastest known software
>implementation.)

Haven't we gone through this once before? ;)

NT Challenge response passwords are not that strong. DES key space (2^56) -
Chal/Resp - required 1.414 years to scan
(http://www.des.sollentuna.se/stat/). Splitting the key space into 100
500MHz 4-cpu systems (4100 5/500) should scan 2^56 in 1.07 years(~$100K per
system, or ~$10M).

The weakness of NT/W95 network encryption is not in DES, it's the strength
of Lan Manager security. Lan Manager security mechanisms can't be dropped
in a combined NT/W95 environment. From the network standpoint, all accounts
except the administrators' should be locked out after a set # of logon
failures, and the administrator account should be denied network access (a
must on Domain Controllers, though PITA to administer). Splitting the Lan
Manager key space into ten 500MHz 4-cpu systems (4100 5/500) should scan
78^7 completely in 22.3 hours, 100 should take approximately 2 hrs 18
minutes(4/rack=25 racks).
______________________________________________________________
Calculations use this rating from http://www.frii.com/~rcv/desbench.htm:
"Alpha 21164a 500MHz clone .... 5.336M keys per second -- bitslice v0.215dk002"

With NT logon, since passwords are hashed in sets of 7 characters, 104
possible characters. If you recognize that W95 machines can login
case-insensitive that reduces that value by 26 characters, or to 78^7. Key
space/rate of 5.336Mkeys/sec gives the following values:

78^7 = 17,565,568,854,912 (1.756556885491E+13)/rate = 0.10 yrs
104^7 = 131,593,177,923,584 (1.315931779236E+14)/rate = 0.78 yrs
2^56 = 72,057,594,037,930,000 (7.205759403793E+16)/rate = 428.21 yrs

(A note for those that use phone numbers, birthdays, numbers for passwords):
10^7 = 10,000,000 (1.000000000000E+07)/rate = ~1.8 sec
______________________________________________________________
Additional techniques for cracking Logons;

Excluding unacceptable passwords filtered out by passfilt.dll reduces
keyspace that needs scanning. (Passfilt should advise users, not establish
options that speed-up crack programs).

Running a Dictionary attack first would further reduce keyspace
(passfilt.dll exists as dictionary counter-attack).

An intelligent brute-force program would use historical success hit rates to
reorder the search sequence and dramatically reduce time required(~10-100x),
effectively combining Dictionary attack techniques with brute-force.
First scan dictionary, then scan remaining key space in order by historical
success rate. The specific key space for each system can then be reordered,
a job submitted to the farm would be fairly quick in returning solutions
(seconds), and/or less systems can be used.

Bill Stout
__________________________________________________________________________
Why do people claiming to be liberal, lobby for laws which reduce liberty?

Elected officials do represent those who pay their wages - they're called
'Special Interest groups' - was 'taxpayer' at one time. :(

> mine, and discovered I was wrong -- the average search time for DES key
> space is 1142 years at 1 million a second. (The number I quoted was for
> a 200,000 tests a second, which is the speed at which an MD4 of the
> password and DES test of the derived key can be done -- I read the wrong
> cell off of my spreadsheet.)

What hardware/software platforms are you basing 200,000/sec off of?

Thanks,

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

200 mhz Pentium Pro running Win32. The MD4 implementation is ours; it's
the fastest I've heard of. The DES speed is based on the software
distributed for the DES challenge -- you can find info about it starting
at www.rsa.com -- again, this is alleged to be the fastest DES key
cracker. The DES challenge appears to have motivated about a 5x increase
in DES crack speed.

> ----------
> From: Paul D. Robertson[SMTP:proberts@clark.net]
> Sent: Thursday, July 24, 1997 2:34 PM
> To: Paul Leach
> Cc: 'Ryan Russell/SYBASE'; ntsecurity; mudge
> Subject: RE: [NTSEC] Win95 sec
> 
> > mine, and discovered I was wrong -- the average search time for DES
> key
> > space is 1142 years at 1 million a second. (The number I quoted was
> for
> > a 200,000 tests a second, which is the speed at which an MD4 of the
> > password and DES test of the derived key can be done -- I read the
> wrong
> > cell off of my spreadsheet.)
> 
> What hardware/software platforms are you basing 200,000/sec off of?
> 
> Thanks,
> 
> Paul
> ----------------------------------------------------------------------
> -------
> Paul D. Robertson "My statements in this message are personal
> opinions
> proberts@clark.net which may have no basis whatsoever in fact."
> 
> PSB#9280
> 
I think MS addresses this situation, but you are not using any sort of
"master domain model", if you were to make the trust relationship, it
would be a kind of "complete trust model". Is it a one way trust, or two
way? Either way, it doesnt sound like your domain is incredibly large or
that it should cause any sort of complications...other than the
administrators from your domain would now be able to administer the
trusting domain.
Off point however, this doesnt seem to be security related...and I see
more and more of these emails not related to security on this mailing
list. Just an observation.

Will Morgan,
MCSE

On Wed, 16 Jul 1997, David R. Linn wrote:

> The MSWNT 4.0 Server Concepts and Planning book, the writers discuss
> "single domain", "single master domain", and "multiple master domains"
> models. What they don't talk about is *why* one should avoid other
> configurations.
> 
> Here is my situation: I have a domain setup using the "single domain"
> model, i.e. I have accounts and resources in one domain, with
> accounts for most people in my school. This domain serves the
> computer labs supported directly by the school. Today, I have been
> asked by the manager of a departmental computer lab if I will setup a
> one-way trust relationship with his domain so that my school-level
> accounts can be used in his department-level domain. This would
> enable people to avoid having yet another account deal with (worse
> case: Joe Student currently has to deal with *5* accounts and this
> would be #6!)
> 
> If I had started off with the "single master domain" model, this would
> be easy to do while staying within the MS recommendations.
> Unfortunately, since we chose to go with the "single domain" model, I
> cannot do as I have been asked and stay within the MS recommendations.
> 
> My question: How much weight should I give to the MS recommendations
> and the absence of this proposed configuration from those
> recommendations? Is there some good reason why I should not treat a
> domain with both accounts *and* other resources, initially setup using
> the "single domain" model, as though it were a master domain and allow
> some other domain to trust me?
> 
> David
> -- 
> David R. Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
> Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
> Box 3241, Station B |Disclaimer: I have no authority
> Nashville, TN, USA 37235 |to speak for anyone but myself.
> "Export crypto, not jobs." - Daniel Lynch
> http://www.vuse.vanderbilt.edu/~drl
> 

> Date: Tue, 22 Jul 1997 18:33:11 -0700
> From: Paul Leach 
> Subject: RE: [NTSEC] Win95 sec
> 
> Breaking a sniffed NT challenge/response will take approximately 5,700
> 200mhz Pentium Pro _years_, if the user has a strong password. (This is
> the average time to search the key space at the rate of 1 million
> keys/sec on a 200mhz PPRO using the software developed for the RSA DES
> challenge, which was at the time the fastest known software
> implementation.)

 There's something wrong with these numbers. The recent
 DES challenge was completed by a few thousand machines
 in parallel in under 10 weeks -- an the conservative estimate
 (given the number of machines and the rate of keyspace 
 check-in's) was under 20 weeks to exhaust the full key space.

 They didn't not have 15,000 participants -- these were 
 spare cycles on a couple of thousand machines. By your numbers
 They should have taken 4 years or so to complete the challenge.

 
> Breaking weak passwords is like stealing candy from a baby -- you get
> the candy, but you don't prove anything about your abilties as a thief.
> 
> Before I hear another word about NT challenge/response, I would really
> like any person doing so to state that they understand that: 

 Interesting phrase "state that they understand"
 (no room for disagreement -- I bet you'd like that)

> * breaking a sniffed NT challenge/response is almost exactly as
> hard (number of keys to examine) as breaking a sniffed Kerberos V5 login
> attempt -- both involve a brute force search through key space or
> password space (whichever is smaller).

 What if someone can demonstrate that this is not true?
 Just who has vetted the algorithms and implementations?

 I thought LM C/R used RC4 for hashing. I'm sure I've read
 that RC4 is weaker than DES 56-bit -- and computationally
 easier (quicker). That would suggest that a brute force
 keyspace search should be faster for RC4 than for DES.

 Kerberos seems to use DES -- but here's a couple of 
 links for people to read more about that:

 Kerberos: The Network Authentication Protocol
 "http://web.mit.edu/kerberos/www/
 Kerberos Users' Frequently Asked Questions 1.14
 "http://www.veritas.com/common/f/97042301.htm

> * Kerberos users' passwords can also be as weak as NT users'
> * a precomputed dictionary attack on NT challenge/response
> requires a dictionary of order 2**60 bytes -- 1 million terabytes.
> 
> People may say whatever they like about LM challenge/response -- it
> won't let you have a very strong password. Apply the LM-FIX from the MS
> FTP site so you don't use LM challenge/response if your security
> requirements demand it.

 Just what are you trying to say?

 "our stuff is as secure as Kerberos"

 "you should apply the patches to our stuff"

 Since you're from MS maybe you could clarify what 
 MS' plans are regarding support for a Kerberos/DCE 
 authentication model (hinted in the media for inclusion
 with NT v5). Is it going to conform to the IETF GSSAPI 
 and Open Group (formerly OSF) DCE specifications? Will 
 it be completely interoperable? 

--
Jim Dennis, info@mail.starshine.org
Proprietor, consulting@mail.starshine.org
Starshine Technical Services http://www.starshine.org

 PGP 1024/2ABF03B1 Jim Dennis 
 Key fingerprint = 2524E3FEF0922A84 A27BDEDB38EBB95A 
> Date: Tue, 22 Jul 1997 18:33:11 -0700
> From: Paul Leach 
> Subject: RE: [NTSEC] Win95 sec
> 
> Breaking a sniffed NT challenge/response will take approximately 5,700
> 200mhz Pentium Pro _years_, if the user has a strong password. (This is
> the average time to search the key space at the rate of 1 million
> keys/sec on a 200mhz PPRO using the software developed for the RSA DES
> challenge, which was at the time the fastest known software
> implementation.)

 There's something wrong with these numbers. The recent
 DES challenge was completed by a few thousand machines
 in parallel in under 10 weeks -- an the conservative estimate
 (given the number of machines and the rate of keyspace 
 check-in's) was under 20 weeks to exhaust the full key space.

 They didn't not have 15,000 participants -- these were 
 spare cycles on a couple of thousand machines. By your numbers
 They should have taken 4 years or so to complete the challenge.

 
> Breaking weak passwords is like stealing candy from a baby -- you get
> the candy, but you don't prove anything about your abilties as a thief.
> 
> Before I hear another word about NT challenge/response, I would really
> like any person doing so to state that they understand that: 

 Interesting phrase "state that they understand"
 (no room for disagreement -- I bet you'd like that)

> * breaking a sniffed NT challenge/response is almost exactly as
> hard (number of keys to examine) as breaking a sniffed Kerberos V5 login
> attempt -- both involve a brute force search through key space or
> password space (whichever is smaller).

 What if someone can demonstrate that this is not true?
 Just who has vetted the algorithms and implementations?

 I thought LM C/R used RC4 for hashing. I'm sure I've read
 that RC4 is weaker than DES 56-bit -- and computationally
 easier (quicker). That would suggest that a brute force
 keyspace search should be faster for RC4 than for DES.

 Kerberos seems to use DES -- but here's a couple of 
 links for people to read more about that:

 Kerberos: The Network Authentication Protocol
 "http://web.mit.edu/kerberos/www/
 Kerberos Users' Frequently Asked Questions 1.14
 "http://www.veritas.com/common/f/97042301.htm

> * Kerberos users' passwords can also be as weak as NT users'
> * a precomputed dictionary attack on NT challenge/response
> requires a dictionary of order 2**60 bytes -- 1 million terabytes.
> 
> People may say whatever they like about LM challenge/response -- it
> won't let you have a very strong password. Apply the LM-FIX from the MS
> FTP site so you don't use LM challenge/response if your security
> requirements demand it.

 Just what are you trying to say?

 "our stuff is as secure as Kerberos"

 "you should apply the patches to our stuff"

 Since you're from MS maybe you could clarify what 
 MS' plans are regarding support for a Kerberos/DCE 
 authentication model (hinted in the media for inclusion
 with NT v5). Is it going to conform to the IETF GSSAPI 
 and Open Group (formerly OSF) DCE specifications? Will 
 it be completely interoperable? 

--
Jim Dennis, info@mail.starshine.org
Proprietor, consulting@mail.starshine.org
Starshine Technical Services http://www.starshine.org

 PGP 1024/2ABF03B1 Jim Dennis 
 Key fingerprint = 2524E3FEF0922A84 A27BDEDB38EBB95A 
-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 23 Jul 1997, Paul Leach wrote:

> Since it is possible to install a DLL that checks whether passwords are
> strong enough, any site that cares enough about security will have 0%
> weak passwords, so your assumption is invalid.
Another point that M$ didn't learn from good old Unix. You never actually
know which dictionary the cracker will be using. And by filtering to much
the password space the cracker could even speed up his search. ;(

Andreas
P.S.: Isn't the real problem here, that M$ claims constantly that
one doesn't really need an Administrator to run NT. If one would need one
then one could stay with the competition, right?


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9Zw/lGrPWwMHrE1AQHmqAf8CGojGCXomubJD1rjodymxWMYkIJaBT4d
6z5yGxj6IcU486ARvpGbAZktzSGNDlMXdVH9dsxDHrP+EcJGYAIcJLHoU9K0nejS
NaIBzBrrwnll4jElDap6TlQHIX+x81m0GCaP0usDTE8uS74frnu6qbje3NXDXbtj
BeI4BjJB/8VvkyohjiKpqUWt068hpr/cktIezSJWdbSsfcnZScEVdZTZFfVff6Pl
XdV1J93O+AvDEzKb56I4S+eQZ7NN46VEiXM/LLSmA4g4tcZ4WC2N2fSGW7wISNUV
QDM6QueT/XoETnDlXkjEv98LJVRploJQQXRQumRgucMKN3aww0t7Rw==
=Mvia
-----END PGP SIGNATURE-----
Just on the issue of adding physical security to PC's:

I was made aware of one rather novel solution that was used to sorta
disable floppy drives several years ago.
The problem was they didn't want users booting off a fd but the users
still needed fd access.
The solution was to "mis-align" all the fd's by the same amount.

The users could only use those PC fd's to read/write their floppies, and
couldn't bring in any outside disks to boot the PC's... shall we say
inapropriately? :-)

Obviously users couldn't use their modified fds in any other
machines....



Steve
PS I have no idea how the misalignment was actualy performed.
-- 
Steve McInerney (stevemci@dsb.mil.adfa.oz.au)
"Why stop now just when I'm hating it?"
 - Marvin the Paranoid Android


 You can find it, and others, here: http://www.ntsecurity.net

mje

-----Original Message-----
From: Misha Gopaul 
To: ntsecurity@iss.net 
Date: Wednesday, July 23, 1997 11:35 PM
Subject: [NTSEC] C2MYAZZ.EXE



>Can anyone tell me where i can get the source for c2myazz.exe
>
>thanks
>Misha

> 
> this seems BAD. as far as i know, nt replicates the ENTIRE domain db every time
> a change is made, this is one of the reasons some people dislike it for
> enterprise (wan spanning) networks. domains should not span wan links, thus you
> get the pleasure of setting up trust relationships.....
no I believe this is incorrect. I was under the impression that only 
changes are replicated. If you check out eventlog when netlogon reports
sync changes it says 5 changes applied, 2 changes applied, etc.
We are in the process of setting up many distributed sites over WAN
links in one domain. One thing we DO NOI want to do is set up a 
separate domain for each site, what a nightmare.

Matt

>I just set up three new systems with NT WS 4.0. Our policy is to create
>an ID for the user, set the
>password to some easily remembered word and check the "User Must Change
>Password At Next Login" selection. The users don't have the
>Administrator password.
>
>password gets changed. On the third one there is a problem. After the
>user types in the new password and clicks OK he gets a message saying he
>
>does not permission to change the password.
>

What about "User must login to change password" ??

>The "Don't Allow User To Change Password" option is NOT checked. If the
>"User Must Change Password At Next Login" is unchecked the user can then
>

>Thanks,
>
>Allan McDoanld
>mcdonald@onramp.i2k.com

Virgil
virgil@eis.net.au
Microsoft Certified Professional
ICQ UIN 1548179


 Hi,
 
 I read on MS TechNet that the Password Change Notification duration 
 cannot be changed. But I think that someone posted a registry key a 
 while ago to change or turn it off...
 
 Anyone?
 
 
 Thanks a lot
 Roman
Dear all,

I am a newbie in this list so please excuse my ignorance.
I joined here because somebody succeeded to delete my web page. The
server runs on NT 4.0, SP3, IIS 3.0 and all hotfixes that I know about.
I must say that I am not an expert in NT but I set this machine up,
connected to the leased line and way it went... Until the deletion.
I am sure nobody from my company did it since nobody knows the
administrator password (7 letters if it helps).
But I had the IIS wwwroot folder shared to exactly one person from my
company (to be able to upgrade the price list every now and then - just
to copy two files there). Still no chance that this person would delete
files! Not that he was not able to, but I believe him. Please don't
comment this.

No firewall yet here, but still - how can somebody from outside
selectively delete files on the wwwroot folder? Because only the showing
files were deleted and there were a few more HTML, JPG and other files
that I used for the test purposes only and were not linked to the web
page. They stayed untouched.

I know the question is a bit naive but please let me know how can this
happen and if such attempts can be detected somehow. Or better yet,
point me to a possible comprehensive web page where I could learn more
about it.

Thanks in advance,
Mojmir


Hello NTSEC guru's

My question has probably been asked before, but, I would apreciate any
help here.

I have a small NT network connected to the Internet. The purpose is so
that Joe Q. Public employee
can surf. I have been working on server / workstation security and now
would like to tighten up the gateway PC.

The gateway server has a RAS connection to an ISP. I am told that by
blocking the appropraite UDP / TCP ports
( 137 / 138 / 139 ) on the RAS adaptor I can stop certain traffic moving
out off my LAN onto the Internet.
Thus people won't see the Domain name etc.

I know that configuring this can be done by :
Control panel->Network->Protocols->Tcp/ip->Properties->IP
Address->Advanced->Enabled security

Here I have the option to disable enable all ports or list the ones that
are necesscary.
My questions is which ports should I enter into the list and which not?
I want users to be able to continue surfing,
but, only traffic to go in and out that is necesscary.

Thanks,

B.


Paul Leach wrote:
> A person who denies the assertion that a chain is no stronger than its
> weakest link is obviously only interested in debating, and not in
> learning anything.

Hmm.

I don't think that is what he said, and I think it is pretty clear what
he meant too.

Clearly a chain is only as strong as the weakest link. However you're
assertion that physical security is necessarily the weakest link does not
hold under many situations.

Physical attacks are usually slow, and very visible. This is the sort of
situation potential thieves try to avoid.

Software based attacks are in contrast almost invisible (unless you have
very advanced auditing capabilities, or are actually looking out for them
at the time - both highly unlikely), and usually very fast (given that
you can do any lengthy processing such as brute-forcing of hashes
off-line and therefore out of sight).

What's more, a software based attack can be scripted, so involves very
little physical effort on the attackers part, and they can make it look
like they're doing something legitimate at the same time, or perform it
remotely. Physical attacks tend to be more labour intensive on the
attackers part - especially if basic physical precautions such as BIOS
passwords and disabling floppy-boot have been taken. It's quite hard to
be caught over a PC with the case off and a screwdriver in the innards
and make it look legitimate.

In the case that the target machine is not networked, in a lockable
office with no view inside, no security patrols and no physical security,
and the attacker has a good alibi and/or little chance of detection, then
the physical attack may win out. My personal opinion is that this will
not usually be the case and anyone with a little nouse will find the
software attack 'safer'.

Andreas Kostyrka[SMTP:andreas@ag.or.at] wrote:
> Nope. The relative weakness of each link depends upon the local
> situation.
> So how you guys in redmond know that on this whole planet physical
> attacks are the dominating headache? In many situatutions it's rather
> the
> other way. Should we take your comment to mean that Windows(tm)
> solutions
> are not useable in these contexts?

John
-- 
remember i was always true; remember that i always tried 
remember i loved only you; remember me and smile... 
for it's better to forget than to remember me and cry
:-p

In our environment servers are all locked in computer rooms where only a
trusted and hopefully competent few have access. Physical security is
taken very seriously. I will not go into details of how but the attacker
would almost certainly be identified and caught.

Now any user (we have >40K users) can download tools off the 'net that will
ultimately give them passwords (for NT servers) from challenge response
pairs. Even worse this is a passive attack we will not know has happened.
They can run several cookbook denial of service attacks against NT
machines. They would stand a low chance of being caught.

Where is the weak link here ?

Regards,
Robin.


______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] Win95 sec
Author: owner-ntsecurity@iss.net at INET-1
Date: 7/25/97 12:38 PM


A person who denies the assertion that a chain is no stronger than its
weakest link is obviously only interested in debating, and not in
learning anything.

> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> On Wed, 23 Jul 1997, Paul Leach wrote: >
> > > ----------
> > > From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> > > To: Paul Leach
> > > Cc: ntsecurity@iss.net
> > >
> > 
> >
> > > YOU are asserting, that because of the possibilty of a hardware
> > > security breach, YOU don't have to take precaution against
> > > software security breaches.
> > >
> > No -- I'm saying that the system software does not have to make it any
> > harder to break into a machine than it would be to break in by a
> > physical attack. A chain is only as strong as its weakest link -- > the
> > attacker will choose the easiest attack.
> Nope. The relative weakness of each link depends upon the local situation.
> So how you guys in redmond know that on this whole planet physical
> attacks are the dominating headache? In many situatutions it's rather the
> other way. Should we take your comment to mean that Windows(tm) solutions
> are not useable in these contexts?
> Andreas
>
 Isn't there a utility to compare the registries of two computers??? Or at least a utility to dump a registry into a text file for comparison by some other means. I know I used to have this utility laying around for 3.51 at my old place of employment, but I can't remember the program name. 

 Anyway compare the registries from one of the machines that works perfectly with the one that is acting funny, you may be able to find the inconsistency. Be sides that, you'll just have to get lucky and hope someone reading this newsgroup has seen this problem before (which is super likely with the experts on it!!)

Good luck and be sure to tell us what the problem was!
---------------------------------------------------------------------------------------------------------------------------------------
GREGORY A EISENBERG
greg@ycs.net NT Administrator and Web Developer YCS Internet Commerce
 a division of 
 Yamatech Scientific Ltd.



----------
From: Allan McDonald[SMTP:mcdonald@onramp.i2k.com]
Sent: Wednesday, July 23, 1997 8:30 PM
To: NT Security Mailing List
Subject: [NTSEC] NT 4.0 Password Problems

This might be off-topic for this group but I'll give it a try ...

I just set up three new systems with NT WS 4.0. Our policy is to create
an ID for the user, set the password to some easily remembered word and
check the "User Must Change
Password At Next Login" selection. The users don't have the
Administrator password.

On all three of these systems the user is prompted to change the
password after they first login, on two of them there is no problem, the

password gets changed. On the third one there is a problem. After the
user types in the new password and clicks OK he gets a message saying he

does not permission to change the password.

The "Don't Allow User To Change Password" option is NOT checked. If the
"User Must Change Password At Next Login" is unchecked the user can then

log in, (without being prompted to change the password, of course).
The user can then do a C-A-D and change the password successfully from
the Change Password selection.

This happens on this system no matter what ID I create. I would rather
not reinstall NT, no CD-ROM on the system, etc. And I'm really curious
how this happened and how to fix it. Any ideas??

Thanks,

Allan McDoanld
mcdonald@onramp.i2k.com









> Situation: 
> 
> - classroom with 25 computers ready to install NT workstation.
> - 1 NT workstation with the appropiate configuration
> 
> Question, 
> 
> What's the right way to duplicate the 1 installed workstation to the other
> 25 computers in the classroom?
We use Image Blaster. Great product!

> What will be the effect on SID and authentication when just making a copy
> to all stations.
We found that as long as you don't make the first workstation a member of 
a workgroup during the initial install of NT a SID isn't created. This 
way you can duplicate the image to identical workstations and have them 
work together successfully. We currently have this working in our lab 
environment so if you have any other questions feel free to contact 
me directly.
On Thu, 24 Jul 1997, Russ wrote:

> >DLLs that are installed in the system directory? A trojan may be hidden
> >also in some DLL that when run as Administrator starts to do bad
> things.
> 
> Doh!! This is Yobie-thinking. Here's one to try on...YOUR ADMINISTRATOR
> COULD BE A TROJAN. Where do you end such paranoia? At some point you

You never end such paranoia, it's part of being in security. :)

> have to assume that you've accepted to trust something, and that
> decision was based on some policy that you adhere to on a regular basis.
> Discussing what that policy is, and how paranoid you need to be, could
> go on back to the birth of your company, your administrator, or the guy
> who made the first punch card loom. Pick one and work forward from
> there, Ok?

Always have, always will.

> SMB is an session layer protocol, not a network protocol. If I protect
> the network at the IP layer or lower, I can run SMB securely on top of
> it (assuming of course I've written reasonable applications that use
> SMB...).

And visa versa, a point that is surely argued for PPTP, but forgotten for all
other protocols when arguing from the pro-MS Camp.

> >- - Win95 takes a no security stand point :(
> 
> Win95, as supplied out of the box by Microsoft, is not intended to be a
> secure OS. There are tons of products available today that can be added
> to a machine running Win95 (or in fact secure machines with Win95
> already loaded) that will make a machine running Win95 as secure as
> *most* would want it to be. I don't see it as Microsoft's job to provide
> all of that for $129 or whatever its going for these days.

That's a cop-out Russ. Surely you won't defend the original "miss the 
password three times, and I'll let you in!" as an issue of what they're 
charging for the OS?

The retail price is mostly a factor of volume sales calculations, and 
shouldn't have anything to do with the design and engineering of the OS, 
since Microsoft obviously has enough of a revenue stream to hire 
competant people, design and testing methodologies aren't trade secrets 
of some other company either.

> One thing that far too many members of this list seem to forget is that
> the size of the market (UNIX, NT, VMS, etc...) who want *strong*
> security is *far less* than what you think. A recent IDC report stated
> that more than 65% of all computer networks connected to the Internet
> today have *absolutely no security* on their Internet connection, no
> packet filters, no Firewalls, no nothing. Of the remaining -35%, less
> than 10% had commercial Firewalls (this isn't meant to denigrate fwtk
> and its siblings, just denote the commercial value of security).

The size of an implementation has very little to do with the size of a
market. There are legions of examples where that's been the case, both 
positive and negative. Your argument would be akin to "There are only 
100,000 lotter winners in history, therefore the market for lottery 
tickets is very low." Most people don't *know* what they need for 
security, most don't know that security is an option, a good number would 
like security, but they don't have any way to implement it. Also, the 
lack of a _commercial_ Firewall in no way denotes the importance of 
security to an organization. In many cases, the freely avaliable tools 
are either more flexible, or more secure than their commercial 
counterparts, and given the small subset of Internet Security clued, our 
obvious biases for things we can know and understand (remember, we're 
paranoid back to the decision for a zone 12 punch) is pretty high. I don't 
have to worry about one of Marcus' cats subverting him as he slept if I can 
examine the source code. It's also a great deal easier to make a change 
to "free" software than a commercial product even when the source is 
available.

> 
> When Microsoft designed NT, they did incorporate security features which
> could be enabled by those users who wanted them. As its progressed,
> those features have become more and more obvious, and more robust, and
> more feature rich, due in part to the whining and astute observations

One could make the argument that they were not robust or feature rich due
to a defect in the manufacturer's design and testing methodologies, and 
that there still seems to be a large ammount of room for improvement there.

> made here and other places. Never-the-less, we security focused people
> do not purchase the majority of NT systems, so obviously its going to
> reflect the majority customer.

It's not like there are a great number of alternatives. I'll admit that 
we were fairly close to just deciding to go with X terminals, and heavy 
protocol boundries on our networks, but the retrofit costs weren't 
attractive enough. Please note that this doesn't mean we *want* NT's 
problems, just that our support and financial infrastructure wasn't ready 
for any of the alternatives. If Novell had looked stronger, we'd 
probably have waited a couple more years to even start playing with NT.

> Have you ever sat down and looked over all the
> CERT/CIAC/AU-CERT/BUGTRAQ/ALT.2600/BoS/Firewalls/etc... bulletins? You
> make it sound like every exploit ever discovered is sitting in a list
> somewhere and that the information contained in those bulletins includes
> line numbers in the NT Source Code so the NT developers can just go and
> change their code!!

It's called developer training. You have to *teach* people how to write 
secure code. That's a restriction placed on development by most common 
programming languages today. I spent a whole bunch of years writing 
code, including for vendors. I *know* what it takes to teach people to 
write good code, as well as what it takes to teach them not to write bad 
code. Yes, I've been through multi-million line product development with 
legacy code (not just procotols) in it. It's not the mystery that 
everyone thinks it is. It does take concious focus on security and quality.

Of course, CERT and AUS-CERT won't help with NT, since Microsoft doesn't 
see it as being in its interest to go along with standard industry security
alerting procedures. Even given CERT's lack of user responsiveness and 
favor to vendor's fix timetables.

> NT 4.0, with IIS (but no BackOffice) is 17 million lines of code!!! More
> than half of all exploits ever discovered include a combination of
> requirements before the exploit is successful, this is not trivial to
> prevent.

At least 90% of it is *very* trivial to prevent. 1) Bounds check (eg. 
snprintf vs. printf), 2) Run at a priv. level that's absolutely the lowest you
can for as long as possible, 3) HAVE SOMEONE WITH A CLUE LOOK AT THE PROPOSED 
DESIGN. 4) Remind people that it's important. I'll stand by the 
assertion of at least 90% as well, that's from real-world experience in 
very secure and non-secure environments, including products with millions of 
lines of assembler.

That's it. It's not very difficult. Less than a week's worth of 
developer education up-front too. It isn't expensive, it isn't hard, and 
it doesn't take a room full of rocket scientists. 

> >wire, but one could counter work this by using something like ssh :)
> 
> And do what with SSH?? Come on, you going to run X through SSH, is that
> what you're telling us?

It's been done. Certainly given X's protocol weaknesses it shouldn't be 
discounted summarily. But then, we've got the source to X, so there's 
always the ultimate option of changing what you don't like about it, and 
it isn't necessary for real work to happen, so you can always just not 
use it. I have a total of one production machine which uses X, and that 
only locally.

> You know UNIX, but don't know NT, right? You think that nothing is

I think you're being too kind ;)

> >Oh, by the way, the server is usually hardware, that nobody would
> install
> >nowadays even for a Win95 workstation, and it still supports about 5
> >workstations without any problems :)
> 
> 5 workstations doing what? Now you are being patronizing...;-[ Here I
> thought all along that you were trying to be objective...

Actually, that's the least patronizing of the prior FUD. I've got 386 
machines with 8M of RAM that will support Web Servers, and a couple of 
users at the same time, and 486s that you could have about 15~20 people all 
doing real work with no problems. 95, and even NT's tasking system and 
memory utilization are certainly not textbook examples of how to do things. 

> Oh, and there isn't an X patch of the week for ??

No, actually there isn't. X's problems are at the protocol level, and 
not so much in the server codespace. Unless your is IRIX or 
HP/UX, it's not a weekly thing, and even then unless you load every thing 
known to man, woman and PeOPle Wh0 SpeLl WEirD it's not as bad as NT has 
been. Given that there is a maturity issue here, it _used_ to be that 
bad, but a lot of it has stableized, and even more importantly, there is 
a great deal more knowlege of how to write secure applications in the 
Unix space now. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280


wow......
since my incredibly inacurate (read WRONG) posting, i have received serveral
(read A TON) personal corrections. and (god forbid) if someone is watching this
list that is somehow more clueless than myself, i would like to relay some of
this info (because i haven't seen any of these corrections here)
nt does NOT replicate the entire domain db with every change (there, i said it)
it only replicates the delta. i am also informed that this is VERY configurable.
ms has a domain modeling freeware (i call it cheeseware) package i think you
should d/l, when i ran it, it didn't like wan spanning a domain (this was
admittedly over a year ago, and they may have rev'd it since)

chris
fsewell@csc.com wrote:
> 
> I don't know about you guys, but in my version of NT I can audit restarts,
> shutdown and system. I looked in the user manager, policies, audit and
> there it is.

But did you look in the security log? The issue originating the thread
is that the system (4.0 at least) doesn't actually cut the shutdown
record (or at least it doesn't make it out to the log), even if you have
it selected.
-- 
Dave Lyjak | Hewlett Packard Company
Email: drl@issl.atl.hp.com | Internet and System Security Lab
Voice: +1 404 648 9530 | 20 Perimeter Summit Blvd
Fax: +1 404 648 9516 | Atlanta GA USA 30319
The Microsoft Resource kit includes administration utilities that can
be installed on a Windows/NT workstation.

Fire up server manager from these and select a domain and then a server.
One can start, stop and configure the services on the selected server
from
the workstation.

John A. Jorgensen
Caliber Technology, Inc. (330) 384-9000 Ext 3848
557 E Tallmadge Ave. FAX (330) 258-6066
Akron, Ohio 44310

>----------
>From: John Rutkin[SMTP:John.Rutkin@bankerstrust.com]
>Sent: Thursday, July 24, 1997 4:17 AM
>To: ntsecurity
>Subject: [NTSEC] Stop/Start Services
>
>Excuse the off topic question..
>
>Is there a command line utility that will enable me to stop/start NT services
>on remote boxes, I obviously have admin rights on all the relevent boxes.
>Sorry again as this is somewhat off topic.
>
>Thanks
>
>John Rutkin
>
Dear John,

 Use an at command to schedule it and;

net start [service]
net stop [service]

Thanks,
Keith Lynch


 -----Original Message-----
From: John Rutkin [SMTP:John.Rutkin@bankerstrust.com]
Sent: Thursday, July 24, 1997 3:17 AM
To: KeithLl; ntsecurity
Subject: [NTSEC] Stop/Start Services


Excuse the off topic question..

Is there a command line utility that will enable me to stop/start NT 
services
on remote boxes, I obviously have admin rights on all the relevent boxes.
Sorry again as this is somewhat off topic.

Thanks

John Rutkin
Does anyone know whether NT can be supported as a Secure RPC client?

Todd Hudspeth
todd.hudspeth@norwest.com
You can use a utility that comes in Windows NT 4.0 Server Resource Kit (
Available in Technet July and newer )
The name of that utility is NETSVC.EXE. See the online help "Resource
Kit Tools Overview"

> -----Original Message-----
> From: John Rutkin [SMTP:John.Rutkin@bankerstrust.com]
> Sent: Quinta-feira, 24 de Julho de 1997 9:18
> To: ntsecurity
> Subject: [NTSEC] Stop/Start Services
> 
> Excuse the off topic question..
> 
> Is there a command line utility that will enable me to stop/start NT
> services 
> on remote boxes, I obviously have admin rights on all the relevent
> boxes.
> Sorry again as this is somewhat off topic.
> 
> Thanks
> 
> John Rutkin

Russ wrote:

Andreas, I would suggest to you that using sweeping generalities as a
means of debate, sucks. 
> By monitoring this mailing list, one comes to the conclusion that
> NT is about the same security level that Unix was two decades ago
(when 
> it was used mostly for LAN stuff, funny, not?). Seems

Yeah, right, and you were there, right Andreas? Do you know what UNIX
looked like 20 years ago?? Give me a break, I'll accept that in some
ways NT is where UNIX was 5 years ago, but in many ways its beyond where
UNIX is today, so the point has little merit beyond trying to sound
knowledgeable.

> like the guys in Redmond didn't feel that learning from the Unix
> mistakes, that gave Unix the bad security image it has/had :(, would
be
> a good idea. Learning by self-experience is better.

Granted, there is definitely a lack of awareness of *some* UNIX issues
that have arisen over time that were ignored when *similar*
functionality was/is implemented in NT. That being said, I know a few of
the developers down there in Redmond have *significant* UNIX or
UNIX-like experience, so their not totally ignorant to the issues.

[Jan Nelson] 

Those of us who were there "back when" remember a product called Xenix
made by a company called... hmmm... let's remember... oh, yeah! Microsoft!
Sold it to SCO. There is plenty of Unix expertise in Redmond. For awhile,
the telephone switch system included linux. As the company's servers (used
to "securely" manage the business) have grown and changed, the expertise
has come from the veteran engineers who came from [where?] large network
experiences. Many of those engineers have moved into the NT program teams.

Considering the time spent on NT, the growth of NT boxes in the market, the
connectivity and Internet, I am pleased with the response the Microsoft has
demonstrated to bugs, seams and holes and attacks on them. Security is
about packets, protocols, media, cables, locks, safes, background checks,
need to know, offsite backup, etc..... As scary as a successful exploit is, it is 
a piece of the whole. 

Folks who seem to perseverate on Unix as the truth to the exclusion of other
NOS might just go find a list where the theological bent is more compatible than
here. It sounds way too much like the Mac/PC religious wars we have had to
tolerate.

Thanks to Paul Leach who takes our thoughts back into the labs.
Thanks to Russ (who also manages NTBUGTRAQ list) for keeping the focus on
NT security.
Thanks to Dave at iss.net for the bandwidth and hardware to support us.

Jan
At 16:27 7/23/97 -0700, you wrote:
 
>No -- I'm saying that the system software does not have to make it any
>harder to break into a machine than it would be to break in by a
>physical attack. A chain is only as strong as its weakest link -- the
>attacker will choose the easiest attack.

I think we really need to seperate the issues. If I want to control
hardware access, I bolt the case to something, put it in some sort of
armored box with just the cables running out, or whatever. As software
manufacturers, you guys are obviously not in control of the physical
installation. So let's just acknowledge that if you want to maintain any
sort of data or system integrity, you have to have physical security and
move on.

The other issue is how the file system needs to be secured, and whether the
apps make that easier or more difficult. That is something that you guys do
have control over - at least to the extent of the OS and the apps that
Microsoft sells.

Right now, if we go set permissions as recommended by the paper that Peter's
group put on the web site, things are going to break. That is clearly
documented in the KB article on Office 97 permissions. We have no clue what
else is going to break. Just at the moment, if we want to make our systems
more secure (say a student cluster), we have to tighten it down, turn on
auditing, and go through a fair bit of PITA before we know what needs to be
loosened.

The problem here is that going through all this auditing, smoke testing,
etc. makes administration more difficult, and the temptation is just to say
screw it and let all the users run as admin locally - which will turn around
and bite you later when they break things. I think something we need to
understand better is just what we really can and should tighten, and what
might break. We also need to recognize that more and more sites will look
to NT workstation as a solution to the hassles of an uncontrolled PC. It is
also an issue we need to consider for multi-user NT installs. IMHO, the
apps people need to start thinking about this seriously and make some
improvements. Apps should not need to write into shared areas after
installation.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

i've been wondering about that too. i am currently unable to see
smbsrvr on my network when we have sp3 installed. we are currently
forbidding service pack 3 installs until we can sort out why this is
occurring.

boris

John Wells wrote:

> I have an NT 4.0 SP3 system which is currently running Netscape's Mail
>
> Server and BIND (plus evaluations of two proxy servers). Yet when I
> run
> "netstat -a" I see that the server is listening to high-numbered ports
>
> which, in addition to those used by the proxy servers, include a
> number
> which I know nothing about:
>
> 1028/tcp
> 1029/tcp
> 1565/tcp
> 1723/tcp
> 6050/tcp
>
> 1565/udp
>
> Plus, the system seems to have a connection with itself between
> 1026/tcp and
> 1027/tcp (each listening to the other on localhost).
>
> I checked these ports against a list of "known" ports
> (www.cavebear.com?),
> and either they weren't included, or obviously didn't match the
> entries in
> the lists.
>
> Can anyone explain what services might be listening on these ports?
> Alternatively, is there a way to determine which process/service is
> listening on a particular port?
>
> Thanks,
>
> John Wells
> jwells@pacificcoast.net



At 01:57 7/24/97 -0400, Russ wrote:
>I've got issues with NT Security, and I've got issues with the way some
>user friendliness has overridden *default* security, BUT I'VE NEVER HAD
>THE IMPRESSION THAT MICROSOFT BELIEVES THAT SECURITY DOESN'T MATTER IN
>WINDOWS NT.

I have to agree completely with this, and more so the more I get to know the
people actually involved in maintaining NT's security.

Also, I think that this whole thread has gone a bit over the edge into
MS-bashing. Can we please try to get back to something which has more real
impact?

We need to be able to secure our workstations. Given that there are a lot
of apps out there that won't be re-written that expect to write all over the
place, we need to deal with that as a reality. If MS wants to write Office
98 to work properly with respect to security, what do they need to do?

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Try looking at http://www.iana.org for a document that describes all the
known ports.

> -----Original Message-----
> From: John Wells [SMTP:jwells@pacificcoast.net]
> Sent: Quinta-feira, 24 de Julho de 1997 7:25
> To: NT Security
> Subject: [NTSEC] Why is NT listening on these high-numbered
> ports?
> 
> I have an NT 4.0 SP3 system which is currently running Netscape's Mail
> Server and BIND (plus evaluations of two proxy servers). Yet when I
> run
> "netstat -a" I see that the server is listening to high-numbered ports
> which, in addition to those used by the proxy servers, include a
> number
> which I know nothing about:
> 
> 1028/tcp
> 1029/tcp
> 1565/tcp
> 1723/tcp
> 6050/tcp
> 
> 1565/udp
> 
> Plus, the system seems to have a connection with itself between
> 1026/tcp and
> 1027/tcp (each listening to the other on localhost).
> 
> I checked these ports against a list of "known" ports
> (www.cavebear.com?),
> and either they weren't included, or obviously didn't match the
> entries in
> the lists.
> 
> Can anyone explain what services might be listening on these ports?
> Alternatively, is there a way to determine which process/service is
> listening on a particular port?
> 
> Thanks,
> 
> John Wells
> jwells@pacificcoast.net
John Rutkin wrote:
> 
> Excuse the off topic question..
> 
> Is there a command line utility that will enable me to stop/start NT services
> on remote boxes, I obviously have admin rights on all the relevent boxes.
> Sorry again as this is somewhat off topic.
> 
> Thanks
> 
> John Rutkin
Yep. Netsvc will do it. Part of NT Resource Kit. Also SC (service
create) will do this also. Last, Remote Console and Remoted Command
will allow you to do this (with quite a bit more work.) SC and Srvinstw
will allow you to install services on remote desktops.

Keep in mind you can use regedt32 to configure services on remote
registries.

Ryan Ferris
ryan25@hooked.net
>You never end such paranoia, it's part of being in security. :)

As I said, and I think you agreed, you start from some accepted point
and secure up from there.

>And visa versa, a point that is surely argued for PPTP, but forgotten
for
>all other protocols when arguing from the pro-MS Camp.

Not sure what you're referring to here Paul.

>That's a cop-out Russ. Surely you won't defend the original "miss the 
>password three times, and I'll let you in!" as an issue of what they're

>charging for the OS?

A bug is a bug is a bug. Bugs should be fixed and fixes shouldn't be
charged for. The question is, how do you differentiate between the
intended functionality a vendor supplied versus what you (or we)
consider a bug? Its entirely within any vendor's rights to decide that a
perceived bug is instead limited functionality, and refuse to change it
(as was the case in my assessment of Steelhead's filtering).

>The retail price is mostly a factor of volume sales calculations, and 
>shouldn't have anything to do with the design and engineering of the
OS, 

The retail price can't be stated as "mostly a factor of volume sales
calculations", its also a matter of support costs (how much free support
will the product require for it to sell), on-going research and
development costs (how much do I have to pay people to continue to make
the product a viable commercial offering), and in the case of an OS, the
cost of interacting with third parties (how many conferences must I
attend, how much free stuff should I give to press, other developers,
etc... how much do I spend on SDKs, white papers, etc...) And on and
on...

>since Microsoft obviously has enough of a revenue stream to hire 
>competant people, design and testing methodologies aren't trade secrets

>of some other company either.

You make it sound like competent NT people are just hanging around
employment centres everywhere...;-] I think you might be surprised at
how few competent people are actually available, willing to work at
Microsoft in Seattle, and willing to work for whatever rate Microsoft
offers. Besides, I'd suggest that design and testing methodologies can
be issues to resolve in hiring folks.

Never the less, I can confirm that Microsoft is rapidly ramping up their
testing groups, but its not like you can simply throw 100 new people
into these groups every week. Having 100 mediocre people testing
products can be less effective than having a single excellent person
doing the same work, wouldn't you agree?

>The size of an implementation has very little to do with the size of a
>market.

When designing or marketing any product, the size of the potential
market place is a huge factor. However, this always must be tempered by
the reality of what that market is currently prepared to purchase. There
is no doubt that the requirement for security in computer products is
increasing, and will continue to increase, probably dramatically. At the
same time, however, past history shows that an introduction of increased
base level security which simultaneously requires an increase in base
level understanding or knowledge to use causes a drop in product
acceptance. Hence all computer products have been attempting to make
themselves easier to use, to gain market acceptance.

You would seem to be suggesting that you can either;

a) increase the level of security in a given product without making it
more difficult to configure/use/administer, something which I believe
history does not prove true.

b) restrict existing functionality in a currently available product
without having the existing user community adversely affected, again,
something I think history does not prove true.

>Your argument would be akin to "There are only 100,000 lotter
>winners in history, therefore the market for lottery tickets is very
low."

I don't see how your analogy applies at all to what I've said.

>Most people don't *know* what they need for security, most don't
>know that security is an option, a good number would 
>like security, but they don't have any way to implement it.

Which is exactly my point. Adding security to a product doesn't make the
product more attractive since . It takes
more than Microsoft to effect a change in what "most people" know, and
as that happens Microsoft will make NT reflect that knowledge.

If someone out there has a package that can secure NT, satisfy all the
administration, user interface, and network interoperability
functionality needed/available today in NT, they'd likely have a very
large ear from Microsoft or investors. Fact is, such a product doesn't
exist yet because there isn't sufficient market demand for it (or
sufficient investor confidence that should such a product be introduced
into the market, the demand for it would support the cost of
developing/supporting said product).

Then there are the legal liability issues with such a product. Even
Firewall vendors don't claim in their license agreements that their
going to protect your network.

>One could make the argument that they were not robust or feature rich
due
>to a defect in the manufacturer's design and testing methodologies, and

>that there still seems to be a large ammount of room for improvement
there.

Totally accepted and whole-heartedly agreed. As I have said earlier,
both the design and test groups within Microsoft are improving
dramatically. However, we're obviously going to see more exploits before
we see a recognizable difference in NT itself. Paul Leach is but one
example of how dramatically Microsoft has changed. Like his comments or
not, they show both an interest and willingness to be more open and
interactive than Microsoft has ever been before. While many will say
this isn't enough, and I agree, I will stand and defend their efforts as
going in the direction it needs to go in for us, as customers, to get
what we need/want.

>Yes, I've been through multi-million line product development with 
>legacy code (not just procotols) in it. It's not the mystery that 
>everyone thinks it is. It does take concious focus on security and
quality.

Paul, not to diminish your personal experiences, but 17 million lines of
code is a lot of code, and that doesn't include the code for BackOffice,
considerable in its own right. Then there's the interoperability issues
resulting from years of third-party developer encouragement.
Never-the-less, it has to be done and its being done, but its not just a
matter of ensuring that every new line of code is produced securely.

One of the oldest issues at Microsoft was the cross-product development
issue. Different program groups developing different aspects of the OS.
This is one of the reasons that Microsoft has implemented a
cross-product Security team who, apart from being autonomous from any
particular product group, have high level access to policy decisions.
Issued raised by them are then forced down the food chain across all
products. This has finally gotten enough recognition throughout
Microsoft that it actually will be/is effective.

>Of course, CERT and AUS-CERT won't help with NT, since Microsoft
doesn't 
>see it as being in its interest to go along with standard industry
security
>alerting procedures. Even given CERT's lack of user responsiveness and

>favor to vendor's fix timetables.

This comment doesn't reflect the current situation between Microsoft and
these organizations. Some work still needs to be done in this area, but
as an example, neither CIAC nor AUS-CERT have the resources to
investigate NT issues thoroughly. Both are ramping their organizations
up to the task, and CIAC did release a bulletin recently on NT (as an
example that they do have some resources for NT), but Microsoft is not
solely responsible for the lack of interaction.

Again, from first hand conversations with the various parties, the
situation is far better than you seem to imply.

>That's it. It's not very difficult. Less than a week's worth of 
>developer education up-front too. It isn't expensive, it isn't hard,
and 
>it doesn't take a room full of rocket scientists. 

Moohahaha...;-] Great Paul, can't wait till your products have 200
million plus customers to consider when you make a change. Oh if life
were so simple.

>It's been done.

That's a far cry from a recommended solution, don't you think? There's
lots of things I've made work, but I wouldn't ever do them again if I
could avoid it. As I mentioned, there are several products which would
do similar functionality (i.e. Global Internet's TNT). I have lots of
Unix Admins who keep bugging me about being able to use SSH on NT, but
when I ask them what they expect to do with it all they can say is that
their going to install all of their Unix-like NT implemented tools on
their NT boxes and run them like they do with their Unix boxes. I say,
why not just replace the NT boxes with Unix boxes if this is what you
need??

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

p.s. Thanks for the interesting response Paul, it always enjoyable to
see the anti-NT point put forward with some consideration and
thought...;-]

On Fri, 25 Jul 1997, Russ wrote:

> >And visa versa, a point that is surely argued for PPTP, but forgotten
> for
> >all other protocols when arguing from the pro-MS Camp.
> 
> Not sure what you're referring to here Paul.

That a protocol can be securely transported over an insecure transport
layer if it is propperly designed.
 
> 
> >That's a cop-out Russ. Surely you won't defend the original "miss the 
> >password three times, and I'll let you in!" as an issue of what they're
> 
> >charging for the OS?
> 
> A bug is a bug is a bug. Bugs should be fixed and fixes shouldn't be
> charged for. The question is, how do you differentiate between the
> intended functionality a vendor supplied versus what you (or we)
> consider a bug? Its entirely within any vendor's rights to decide that a
> perceived bug is instead limited functionality, and refuse to change it
> (as was the case in my assessment of Steelhead's filtering).

But that wasn't the issue with that particular feature, it was a design
decision based on users forgetting passwords. The line that said

if (tries == 3 ) 
 {
 let_idiot_in();
 } 

Didn't cost less to produce.

> The retail price can't be stated as "mostly a factor of volume sales
> calculations", its also a matter of support costs (how much free support
> will the product require for it to sell), on-going research and
> development costs (how much do I have to pay people to continue to make
> the product a viable commercial offering), and in the case of an OS, the
> cost of interacting with third parties (how many conferences must I
> attend, how much free stuff should I give to press, other developers,
> etc... how much do I spend on SDKs, white papers, etc...) And on and
> on...

A well-engineered product costs less to support than a shoddily engineered
one.

> 
> >since Microsoft obviously has enough of a revenue stream to hire 
> >competant people, design and testing methodologies aren't trade secrets
> 
> >of some other company either.
> 
> You make it sound like competent NT people are just hanging around
> employment centres everywhere...;-] I think you might be surprised at
> how few competent people are actually available, willing to work at
> Microsoft in Seattle, and willing to work for whatever rate Microsoft
> offers. Besides, I'd suggest that design and testing methodologies can
> be issues to resolve in hiring folks.
> 
> Never the less, I can confirm that Microsoft is rapidly ramping up their
> testing groups, but its not like you can simply throw 100 new people
> into these groups every week. Having 100 mediocre people testing
> products can be less effective than having a single excellent person
> doing the same work, wouldn't you agree?

Quality engineering is much less expensive than quality QA. It's always
been the case, and it probably always will be. Quality engineering means
maybe 5-10% more time up-front. Fixing it in the back end means the same
engineer, a QA person, a tech writer, and all those damn resources you've
alread used going at least partly to waste. The American automobile
industry is a good example, and while it's not a Shangri-La perfect case,
it illustrates how quality can enhance profits. Too bad we don't have a
"cheaper, better, competitively marketed" Japaneese alternative to NT, eh?

> >The size of an implementation has very little to do with the size of a
> >market.
> 
> When designing or marketing any product, the size of the potential
> market place is a huge factor. However, this always must be tempered by
> the reality of what that market is currently prepared to purchase. There
> is no doubt that the requirement for security in computer products is
> increasing, and will continue to increase, probably dramatically. At the
> same time, however, past history shows that an introduction of increased
> base level security which simultaneously requires an increase in base
> level understanding or knowledge to use causes a drop in product
> acceptance. Hence all computer products have been attempting to make
> themselves easier to use, to gain market acceptance.
> 
> You would seem to be suggesting that you can either;
> 
> a) increase the level of security in a given product without making it
> more difficult to configure/use/administer, something which I believe
> history does not prove true.

Yes Russ, it has been proven true. If you look at the more recent (last 3
or so years) CERT advisories, the bulk of attacks have been through
command or buffer overflows (I think at least 80% of Web server attacks
have been pfh scripts). That has nothing to do with configuration, use,
or administration, it's got *everything* to do with what used to be called
"data editing". The use of *nprintf vs *printf in Sendmail would have
reduced the number of security advisories _significantly_. Running at
least privilige at the same time would have made them countable. That's
not tied to reduction in functionality, ease of use, or configuration, and
is directly attributable to teaching developers to write code correctly.

> 
> I don't see how your analogy applies at all to what I've said.
> 
> >Most people don't *know* what they need for security, most don't
> >know that security is an option, a good number would 
> >like security, but they don't have any way to implement it.
> 
> Which is exactly my point. Adding security to a product doesn't make the
> product more attractive since . It takes
> more than Microsoft to effect a change in what "most people" know, and
> as that happens Microsoft will make NT reflect that knowledge.

Instead of doing it correctly the first time? That's a lot more costly,
and a great deal less ethical. It also means that your bug-of-the-week
doesn't appear on CNN, enhancing your shareholder's value in the company.
Your employees also get the pride that comes with quality work. Nah, we
can't have all that, let's just ship the crap as it is....

> If someone out there has a package that can secure NT, satisfy all the
> administration, user interface, and network interoperability

It wouldn't take a package were the engineering procedures at Microsoft
more robust and complete. 

> >One could make the argument that they were not robust or feature rich
> due
> >to a defect in the manufacturer's design and testing methodologies, and
> 
> >that there still seems to be a large ammount of room for improvement
> there.
> 
> Totally accepted and whole-heartedly agreed. As I have said earlier,
> both the design and test groups within Microsoft are improving
> dramatically. However, we're obviously going to see more exploits before
> we see a recognizable difference in NT itself. Paul Leach is but one
> example of how dramatically Microsoft has changed. Like his comments or
> not, they show both an interest and willingness to be more open and
> interactive than Microsoft has ever been before. While many will say
> this isn't enough, and I agree, I will stand and defend their efforts as
> going in the direction it needs to go in for us, as customers, to get
> what we need/want.

Believe it or not, I actually am glad that Paul contributes, I just think
that it needs to be stated that what we're asking for isn't rocket
science, and that this whole premise of "Well, they're trying" doesn't
make a great number of things unflawed. Bad code is bad code, bad design
is bad design, and if I'm expected to run a multi-billion dollar
corporation using it, then I should *shout* about the weaknesses and
demand that the bar be raised much higher.

> >Yes, I've been through multi-million line product development with 
> >legacy code (not just procotols) in it. It's not the mystery that 
> >everyone thinks it is. It does take concious focus on security and
> quality.
> 
> Paul, not to diminish your personal experiences, but 17 million lines of
> code is a lot of code, and that doesn't include the code for BackOffice,
> considerable in its own right. Then there's the interoperability issues
> resulting from years of third-party developer encouragement.
> Never-the-less, it has to be done and its being done, but its not just a
> matter of ensuring that every new line of code is produced securely.

Russ, one of the primary products I worked on had about 5 million lines of
code, some of it 20 *years* old, most of the bad bits were in assembler,
and we didn't have 1/10th the number of folks that MS does. It also ran
over three different operating systems. I am well aware of what it takes.
I'm also well aware that it isn't that damn hard to solve for 90% of the
security related problems that we see. Also, how you interface new code
to old code has a great deal to do with how much of that old code remains
vulnerable. I don't know how much code you've written, or how much design
work you've done, but I've got a *bunch* of years of experience doing it,
and most of the stuff just isn't that hard to fix. That leaves legitimate
mistakes, and legacy code. That's what QA is for.

> This comment doesn't reflect the current situation between Microsoft and
> these organizations. Some work still needs to be done in this area, but
> as an example, neither CIAC nor AUS-CERT have the resources to
> investigate NT issues thoroughly. Both are ramping their organizations
> up to the task, and CIAC did release a bulletin recently on NT (as an
> example that they do have some resources for NT), but Microsoft is not
> solely responsible for the lack of interaction.

They certainly were initially according to CERT. I'm sorry if I'm not
overly impressed that they've finally started to fix things we've been
screaming about for literally years. I _could_ understand if it was
something that was difficult, untried, or didn't have historical
precident. None of these things are any of that for this industry.

I also find it hard to swallow that "It's their first time" pill when it's
being offered with a glass of "There's nothing wrong with running this in
production" milk. If you can't develop a system in less than 17 million
lines of code, and you can't fix those lines before you ship it, then try
something you can handle. 
 
> > Again, from first hand conversations with the various parties, the
> situation is far better than you seem to imply.
> 
> >That's it. It's not very difficult. Less than a week's worth of 
> >developer education up-front too. It isn't expensive, it isn't hard,
> and 
> >it doesn't take a room full of rocket scientists. 
> 
> Moohahaha...;-] Great Paul, can't wait till your products have 200
> million plus customers to consider when you make a change. Oh if life
> were so simple.

If I were responsible for products with 200 million customers, I'd be a
*hell* of a lot more careful in engineering and design. 

I've been responsible for products that potentially had an effect
_much_greater_than_ 200 million people, by an order of magnitude. 

I took that *very* seriously, and I sure as hell put effort into the
security and reliability of my designs. 
 
> p.s. Thanks for the interesting response Paul, it always enjoyable to
> see the anti-NT point put forward with some consideration and
> thought...;-]

Believe it or not, I'm not Anti-NT, I benefit as much personally on
one platform as any other. I am against stupidity, poor design, lack of
thought, and screw_the_customer_i'm_in_it_for_the_money design decisions.
It just so happens that NT currently personifies more of that than any
other platform, not that the other vendors get any slack either.

I'm probably a joy to work with too.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

 
>>The only way to attack such a system is to plug in a laptop in to the
>>wire, but one could counter work this by using something like ssh :)
> 
> And do what with SSH?? Come on, you going to run X through SSH, is that
> what you're telling us?

 This is a very common application of ssh (X11 forwarding).

 [I don't want to get involved in the greater debate here --
 too much bandwidth had been wasted on the great OS wars
 before Windows existed]

 
>>The only way to attack such a system is to plug in a laptop in to the
>>wire, but one could counter work this by using something like ssh :)
> 
> And do what with SSH?? Come on, you going to run X through SSH, is that
> what you're telling us?

 This is a very common application of ssh (X11 forwarding).

 [I don't want to get involved in the greater debate here --
 too much bandwidth had been wasted on the great OS wars
 before Windows existed]

net stop 
net start 

hth
Chris Mulcahy
cmulcahy@omnisource.com

____________________Reply Separator____________________
Subject: [NTSEC] Stop/Start Services
Author: PC:John.Rutkin@bankerstrust.com
Date: 7/25/97 9:33 AM

Excuse the off topic question..

Is there a command line utility that will enable me to stop/start NT services 
on remote boxes, I obviously have admin rights on all the relevent boxes.
Sorry again as this is somewhat off topic.

Thanks

John Rutkin

 {\rtf1\ansi \deff0\deflang1024{\fonttbl{\f0\froman Tms Rmn;}{\f1\froman Symbol;}{\f2\fswiss Helv;}}
{\colortbl;\red0\green0\blue127;\red0\green127\blue0;\red0\green127\blue127;\red127\green0\blue0;
\red127\green0\blue127;\red127\green127\blue0;\red127\green127\blue127;;\red0\green0\blue255;
\red0\green255\blue0;\red0\green255\blue255;\red255\green0\blue0;\red255\green0\blue255;
\red255\green255\blue0;\red255\green255\blue255;}\paperw12240\paperh15840\margl1800\margr1800\margt1440\margb1440
\gutter0 \defformat\sectd \pard\plain {\plain \f0 \cb7 \cf0 \John Rutkin\\ \>\net start \\hth\Chris Mulcahy\cmulcahy@omnisource.com\\____________________Reply Separator____________________\Subject: [NTSEC] Stop/Start Services\Author: PC:John.Rutkin@bankerstrust.com\Date: 7/25/97 9:33 AM\\Excuse the off topic question..\\Is there a command line utility that will enable me to stop/start NT services \on remote boxes, I obviously have admin rights on all the relevent boxes.\Sorry again as this is somewhat off topic.\\Thanks\\'0\'0\'0\'0hn Rutkin\\ \\par Hello 
> 1. Limit only certain webpages to users from a certain IP class.
Use an ASP, example (in the beginning of the asp file):
<%
if Request.ServerVariables ("REMOTE_ADDR") <> "207.0.213.8" and
Request.ServerVariables ("REMOTE_ADDR") <> "207.0.213.18" then
 Response.Redirect "nouser.htm" 
end if %>
(here goes your html code)
 
> 2. Protect only certain directories with a Username / Password
> using basic clear text authentication.
You can configure the entire server from the administrator, not each
directory.


Regards,

----
Javier Contreras Albesa
Administrador del Sistema/System Administrator
Interamerican Net de Venezuela
++58-61-970110
http://www.iamnet.com


> ----------
> From: Russ[SMTP:Russ.Cooper@RC.on.ca]
> Reply To: Russ
> Sent: Wednesday, July 23, 1997 11:11 PM
> To: Misha Gopaul; ntsecurity@iss.net; 'David LeBlanc';
> 'greg@ycs.net'
> Subject: RE: [NTSEC] Win95 sec
> 
> >There has been a wave of new technologies PCMCIA cards and SmartCards
> (with microchips) which you can use to "lock computers".
> 
> The only way to truly "lock computers" is to ensure that nothing other
> than the original HD controller (with embedded encrypt/decrypt
> hardware
> logic) can read the HD, and that the HD controller "key" will be
> *destroyed* if the case is tampered with/opened. A token is used,
> together with a PIN, to unlock the key on the HD controller to access
> the drive securely. A combination of all are used to encrypt the HD
> contents.
> 
> The limited processing power of CPU's today make it impossible to
> employ
> *very strong* encryption in software. An encrypting HD controller
> allows
> that task to be shared/off-loaded from the CPU, thereby allowing for
> much stronger encryption.
> 
That's not really the reason for wanting it in the HD -- any OS based
solution to the problem is susceptible to inserting something in the
non-encrypted part of the OS that grabs the key, intercepts the
password, whatever.

Paul


Andy-
 I'm not a telecom expert and I would appreciate you sending along
anything you get on the telecom side.

 I would recommend doing the following from the NT perspective.
Definitely implement the two items you've already mentioned. Don't give
remote access to your default Administrator's account. It is not subject
to account lockout. Use account lockout, since this is a global setting be
careful to pick values you and your users can live with, but don't give
away the farm. Additionally, use Callback if you are going to be calling
from the same phone line all the time or you can update the number before
you leave on a trip or whatever.

 By default, the name of last user who logged in is displayed in the
Winlogon dialog box. This can be considered a security risk, especially for
your RAS use, and modifying the Registry to prevent this is a good exercise
of the Registry Editor. The objective is to create an new value entry which
will prevent display of the last user's name. Run Regedt32.exe from the
Start menu/Run. The five subtrees will be displayed. From
HKEY_LOCAL_MACHINE, double click on the following keys to drill down to the
proper level:

 SOFTWARE
 Microsoft
 Windows NT
 Current Version
 Winlogon


 From the Edit menu bar, chose Add Value. The name is
DontDisplayLastUserName, the data type is REG_SZ for regular string. Click
OK and a String Editor dialog box will come up and enter "1" (no quotes) as
the string. Click OK again and the new value entry will appear in the right
hand box under the open Winlogon subkey.

 Turn on RAS specific auditing. There are two RAS-specific logs.
These logs are the PPP log and the device log. The PPP log records all PPP
events. The device log records all communications from the serial ports to
the device connected to them during command mode. Logging in the device
log stops after successful connection. These logs are text files and can be
viewed by a text editor or from the command line, they can not be view by
the Event Viewer. Also, they cannot be enabled by the common Administrative
Tools. You must use regedit.exe (described above) or some other tool to
edit the Registry.

To enable the PPP log, go to the following key and set the Logging
parameter to 1. The default setting is 0.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\PPP

To enable the device log, go to the following key and set the Logging
parameter to 1. The default setting is 0.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters

The PPP log is found at \%systemroot%\system32\ras\ppp.log
The device log is found at \%systemroot%\system32\ras\device.log

 Employ token authentication if it is available to you. Secure
Dynamics does have a SecureID client called ACEClient that installs on the
RAS server and will authenticate remote assess connections. Of course, you
must have a separate machine that is your ACEServer.

Good luck,

Ken

>Hi all,
>
>I was wondering if I could get some advice on the best source for hacking NT
>RAS over a phone line. I was considering setting up RAS as a backdoor
>"emergency" dial-in solution with only 1 modem and 1 user account but I want
>to know what kind of security issues I need to worry about.
>
>Thanks for any help,
>
>Andy


Ken Jones
Senior INFOSEC Engineer
MITRE Corporation
kgjones@mitre.org
(617) 271-4873



Paul Leach wrote:
> 
> A person who denies the assertion that a chain is no stronger than its
> weakest link is obviously only interested in debating, and not in
> learning anything.
> 
True, which leads to the next question, do we as a security profession
put too many resources in the technical aspects of security and not
enough in the social engineering aspects? 

or to put it another way, how much should we complain about 40 vs 128
bit encryption (and do all kinds of figuring) when a cracker can con
his/her way into our glass house claiming to be a repairperson, and
pretty much have thier own way with our 'trusted environment'??

The answer is, your paycheck depends on you playing the politics right
and questioning the 40/128 debate is more politically astute than
questioning a follow employees ability to tell a fraud from the real
repairperson.

But still, are we asking the right questions????? Alan
1723 is PPTP. As to the rest, I don't know them off hand. To isolate which 
service is listening on which port(s), do a port scan, shut down a service, do 
another portscan and note the differences. Keep repeating this until you 
figure out what's listening where.

----------
From: owner-ntsecurity@iss.net on behalf of John Wells
Sent: Thursday, July 24, 1997 1:24 AM
To: NT Security
Subject: [NTSEC] Why is NT listening on these high-numbered ports?

I have an NT 4.0 SP3 system which is currently running Netscape's Mail
Server and BIND (plus evaluations of two proxy servers). Yet when I run
"netstat -a" I see that the server is listening to high-numbered ports
which, in addition to those used by the proxy servers, include a number
which I know nothing about:

 1028/tcp
 1029/tcp
 1565/tcp
 1723/tcp
 6050/tcp

 1565/udp

Plus, the system seems to have a connection with itself between 1026/tcp and
1027/tcp (each listening to the other on localhost).

I checked these ports against a list of "known" ports (www.cavebear.com?),
and either they weren't included, or obviously didn't match the entries in
the lists.

Can anyone explain what services might be listening on these ports?
Alternatively, is there a way to determine which process/service is
listening on a particular port?

Thanks,

John Wells
jwells@pacificcoast.net



> ----------
> From: John Sullivan[SMTP:john.quillion@stjohns.co.uk]
> Sent: Friday, July 25, 1997 5:02 AM
> To: Paul Leach; 'Andreas Kostyrka'
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Win95 sec
> 


> Clearly a chain is only as strong as the weakest link. However you're
> assertion that physical security is necessarily the weakest link does
> not
> hold under many situations.
> 
I didn't say that.

What I said was that the software security didn't need to be any
stronger than the physical security. The _obvious_ corollary is that if
and when physical security is strong, the software needs to be equally
strong (but no stronger) if it is to support that configuration well.

If Andreas had been interested in holding a civilized discussion instead
of sneering at Microsoft, he could have just asked "does that or does
that not imply that when physical security is strong, the system
security should be equally strong" (or something to that effect) and I
would have said "yes". 

And I didn't say that physical security was always weak or always the
weakest link; but I certainly believe that it is often very weak.

I beleive that NT 4.0 with the latest service packs and hot-fixes is
secure enough so that, if the appropriate physical security measures are
taken for a user workstation, it can be configured so that an
_unauthorized_ user will not be able to log in to that workstation.

I personally have not studied the issue of how well a workstation can be
secured to prevent an _authorized_ (but non-admin) user from doing
things to a workstation when the desire was to set up the workstation so
that only admins should be able to them. I know that there are problems,
but I haven't looked at them in detail because:
1. Compared to other security issues (such as issues of preventing
unauthorized access), it's lower priority
2. Given the typically low level of physical security, there's not that
much to be gained for the vast majority of customers
3. Since one of the major problems is apps, which are very hard for me
to get changeed (even the MS ones), it's a big problem, and the problems
are not primarily technological

However, one of the thrusts of the "zero admininstration workstation"
(ZAW) initiative at MS is to lower cost of ownership by making it harder
for authorized non-admin users to accidentally or deliberately screw up
their workstation. That's not necessarily the same thing as making it
_secure_ against such users, so I'm not promising that, but because it
is a cross-organizational effort that involves our apps people, I have
some hopes that it will solve some of the apps related problems, and may
enable more secure solutions later. (I'm not an expert on ZAW, but there
are indications it will help.)

We've already released the "zero admin kit" for NT 4.0 which makes a
start in this direction -- see
http://www.microsoft.com/windows/zak/default.htm
for more information.

All that being said, I believe that the protection on system files is
enough that unauthorized users can't overwrite system files, install
device drivers, etc.

There have been discussions on the possibility of inserting trojans
because directories on the PATH are writable and some apps (inclusing MS
ones) need them to be. As shipped, I agree that this is a problem. I am
working on some customer installable steps to mitigate this, which I'll
post in a future message.


Paul
Finally, one stop shopping for ALL your NT exploit needs !!

I don't think this is a symptom of NT's immaturity. It just shows
security wasn't near the top of the m$ list when they developed NT. Sure
they got ACLs and encrypted passwords, but so what if you can walk right
through these side and back doors. NT may be scaleabull, but this stuff
scares the pants (and panties) off a lot of Enterprise types. Its going
to be a long time before NT gets in the door of the glass house.


Allan
Return-Path: 
Received: from mail.rc.on.ca(really [207.176.151.2]) by onramp.i2k.com
 via sendmail with esmtp
 id 
 for ; Fri, 25 Jul 1997 11:21:40 -0400 (EDT)
 (Smail-3.2.0.91 1997-Jan-14 #6 built 1997-Feb-15)
Message-Id: 
Received: from lists.rc.on.ca by mail.rc.on.ca with SMTP (Microsoft Exchange Internet Mail Service Version 5.0.1458.49)
 id PAR5T36Q; Fri, 25 Jul 1997 11:21:02 -0400
Date: Thu, 24 Jul 1997 16:27:30 +0100
Reply-To: Jonathan Tracey 
Sender: Windows NT BugTraq Mailing List 
From: Jonathan Tracey 
Subject: You may want to see this page
To: NTBUGTRAQ@RC.ON.CA
Content-Type: text

 I know people will complain about me sending this out but you may want to
see this page as it contains serious information about hackers and also
provides source code for people to hack your system

http://www.dhp.com/~fyodor/sploits_microshit.html

Regards

________________________
| Jonathan Tracey
| NT Systems Administrator
| UUNET (UK)
| Tel 01223 250739
| Fax 01223 250101
________________________

It's found in Supplement 1 to the resource kit. It's also found in the
July Technet Edition..on the NT Resource Kit CD.

Chance.

> -----Original Message-----
> From: Juan Evangelista David [SMTP:jevang@cc.upv.es]
> Sent: Thursday, July 24, 1997 7:38 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] xcacls
> 
> Hi, I need more flexibility than cacls gives to me, so i thought 
> that Xcacls is my solution.
> 
> I have Resource Kit Nt 4.0, but it doesn't contain it tool.
> 
> Where can i get it???
> Thanks for all
> 
> 
> 
> `````````````````````````````````````````
> Juan Evangelista David
> Centro de Proceso de Datos U.P.V.
> Direccion E-mail : jevang@cc.upv.es
> Telefono: 387.70.00 ( Ext.: 8743 )
> 
> ``````````````````````````````````````````


On Tue, 22 Jul 1997, Timothy D. First wrote:

> At 09:22 AM 7/21/97 -0700, you wrote:
> 
> >If I remember correctly, isn't it a requirement for C2 that you be able
> >to audit system shutdown?
> >If so, then how did Microsoft get C2 certified?
>
Maybe they gave RSA some free software. ;) 

> >Alva, am I correct in believing that shutdown logging is required for
> >C2?
> 
> Forgive me, If I am incorrect, but I believe that NT 4.0 does not truely hold C2 Approval from RSA. In general to have C2 security you basically have to be on a non-networked machine.
This is only for NT systems, because of the insecure network protocols all
MS OSs use; it is not a requirement of C2, just a requorement to get C2 on
a NT box because of the insecure networking.

I just installed a clean NT4, SP3, Office97 and then the Office service
release. Then I:
1. acled %systemroot% and %systemroot%\system32 so that admins had full
control and everyone had RX
2. acled the EXEs and DLLs in %systemroot% the same (notepad and taskman
were everyone full control)

After doing this, I was able to log in as a random user, and I was able
to run Word, Excel, and Powerpoint and create a small document.

I don't know if Office SR1 obsoleted the info in the KB article below,
or if I just didn't use the features that don't work, or what.

I didn't ACL the rest of the dirs from the KB article, because they
aren't on the path.

YMMV. But maybe it's worth checking out, for those who care. If it pans
out, it should make it harder for random users to install into system
directories, and insert trojans. (You would need to run "bash" if you
want a command line utility that won't run possibly bad programs from
the directory you are in. And every dir on the _admins_ path should be
protected from writing by random users.)

> ----------
> From: Paul J. LaCrosse[SMTP:paull@MISI.NET]
> Reply To: Paul J. LaCrosse
> Sent: Friday, July 25, 1997 7:40 AM
> To: NTBUGTRAQ@RC.ON.CA
> Subject: Re: NT security - why bother?
> 
> -----Original Message-----
> From: Peter da Silva 
> To: NTBUGTRAQ@RC.ON.CA 
> Date: Friday, July 25, 1997 10:33 AM
> Subject: Re: NT security - why bother?
> 
> 
> 
> >> According to http://www.microsoft.com/kb/articles/q169/3/87.htm ,
> after
> >> you install office97 you must grant full read write access to c:\,
> >> c:\winnt, c:\winnt\system32 plus the office directories plus
> others. The
> >> product will not function if you make those directories read-only.
> >
> >*sigh*
> >
> >I think I've mentioned this before.
> >
> >Maybe it's really time to make the "NT Support for UniX admins"
> mailing list
> >a reality. The acronym fits.
> 
> 
> If the article is read, one will note that read/write access is only
> required on a couple of files, which are enumerated in the
> knowledge-base article.
> 
does anyone know how to intalla modem that plugs into an ISA slot
manually (without plug and play) in Win95.
Chris Toth
The user account database has been doing PARTIAL database replications
from the PDC to the BDC's since NT 3.5. This was only an issue in
planning domains for NT 3.1 where DC's could only perform full
replication. Domain replication is tuneable to accomdate bandwidth by
adding a series of keys under the
CurrentControlSet\Services\Netlogon\Parameters key.

> -----Original Message-----
> From: CCCRE.CCULL@capital.ge.com [SMTP:CCCRE.CCULL@capital.ge.com]
> Sent: Wednesday, July 23, 1997 12:29 PM
> To: - (052)ntsecurity(a)iss.net
> Subject: Re: [NTSEC] Domain modeling
> 
> this seems BAD. as far as i know, nt replicates the ENTIRE domain db
> every time
> a change is made, this is one of the reasons some people dislike it
> for
> enterprise (wan spanning) networks. domains should not span wan links,
> thus you
> get the pleasure of setting up trust relationships.....
> 
> 
> chris
> 
> 
> 
> ______________________________ Reply Separator
> _________________________________
> Subject: [NTSEC] Domain modeling
> Author: owner-ntsecurity@iss.net at INTERNET
> Date: 7/23/97 1:52 AM
> 
> 
> Greeting all NT gurus out there. I just want to bounce off some ideas
> with y'all out there. We have three major site across the US: One in
> Atlanta, one in Houston and one in LA. We're implementing NTAS4.0
> across the board and are currently selecting the domain model we would
> like to use. I know what I want and what is feasible, but we have an
> administrator who likes an alternative model. That of a single Master
> Domain model. Offhandedly, I would call it nonsense, but I need some
> input from the WAN expert out there. What is the advantage and
> disadvantage of setting up a Master Domain at one of the central site
> (whether it be LA, Atlanta, Houston) and making the other sites
> domains
> a BDC to the Master PDC across the WAN. This don't make sense to me
> technologically, administratively as well as when it comes to
> maintenance. I see chaos all over the place and very, very poor
> planning. Any input?

I recently installed MSIE4 
preview on three of my machines, with varying success.

Apart from the problems with running beta software, of 
which I am fully aware, I am shocked and utterly amazed by what I have just 
seen.
My wwwroot directory has no permissions at all granted, to anyone except 
admins. It has Frontpage extensions installed, which allows configured users to 
publish to it.
On my laptop, which has been running ie4 for about a week and I just 
brought into the office - as soon as I plugged it into an ethernet cable it's 
just dumped the following directories to my wwwroot directory, presumably by 
using some of the rights granted to 'publishers'
Application Data\Microsoft\Address Book
Application Data\Microsoft\Internet ExplorerApplication 
Data\Microsoft\Address Book

As I was saying, before Outlook 
Express (also part of IE4) decided I'd finished typing and sent the (unfinished) 
message for me...

MSIE4 preview has dumped all 
these directories in my wwwroot directory - the entire "application 
Data" subdirectories (Including all my mail!), "cookies", 
"temporary Internet files", etc...
In other words, it seems to have 
decided to 'publish' them to my web, the only way I can think of that they could 
have gotten there given the security and permissions which are granted 
there.
To cut a long story short, be very 
careful with ie4! It seems capable of doing things completely at will, at least 
I don't remember asking it to publish my entire e-mail directory to my root 
web... ;-)
Regards
Bob

Ryan Ferris wrote:
> 
> Zeller, Tom S wrote:
> >
> > cacls.exe comes with nt. it allows use of f,c,r rights. for full
> > flexibility use xcacls.exe that comes with the addendum to the server
> > 4.0 resource kit.
> >
> > > -----Original Message-----
> > > From: Jay Urbanski [SMTP:strops@well.com]
> > > Sent: Wednesday, July 16, 1997 3:17 PM
> > > To: ntsecurity@iss.net
> > > Subject: [NTSEC] Need utitlity to assign user right from command
> > > line
> > >
> > > Well the topic says it all. I need to grant advanced user rights for
> > > a 6000 server roll-out, and I don't look forward to doing click,
> > > click, click 6000 times. Does anyone know of a utitlity to grant user
> > > rights to groups and users from a command line?
> > >
> > > Jay Urbanski
> > > strops@well.com 
> > >
> Adduser.exe sets up gobal and local groups fro the command line. This
> could also be useful. It is in the NT resource group. I have found
> using the the "for /f" command an appropriate way to process lists of
> names.
Have you seen Enterprise Administrator???? Alan
>Since installing the LM-fix precludes continued use of windows 95
machines
>in regards to talking to NT machines, it is still a moot point as to
>how tough or well done the NT hash might or might not be.
>
>The LM hash is incredibly weak and your more secure NT hash is brought
>down to the lowest common denominator.

Hey Mudge, you're welcome to your opinion that NOBODY will rip out Win95
machines and replace them with NT, such that they have a completely
NT-based site, but I strongly disagree with this assertion.

You say that *all* sites will *always* have WfWg and Win95 boxes, and
this is the basis for your claim that the LM-fix does nothing.

Given the number of implementations out there for the LM authentication,
and the amount of interoperability that might break if you changed how
it works, replacing it completely makes more sense than fixing it.
Problem is, with Win3.x, WfWg, Win95, replacing it is the same as fixing
it, since you might not necessarily be using those OS' to work with NT
(you might be using them to talk to OS/2, LanMan, Samba, or any other
system that uses LM challenge/response)

So here you've got this NT stuff, that would be relatively secure if it
weren't for the need to support legacy stuff and insecure OS'. The point
being, even if you did replace your LM-using boxes with NT, you could
still end up with LM c/r's across the wire, THAT DIDN'T MAKE SENSE.

So being able to get rid of LM altogether in NT was just an obvious
thing to do, so that you could, if you wanted, use nothing but NT c/r
and know that you were relatively more secure than when you had the LM
crap going across your wire.

If I use Kerberos, I don't want plain text passwords going across my
wire, do I? I have to make sure everything I'm authenticating against
uses Kerberos, don't I? So doing the same thing to NT c/r is just the
same thing for the NT authentication domain. If you chose to use the
LM-fix, you have to make sure that everything you use can do NT c/r,
what's the big deal? If that's not flexible enough for your environment,
then you have to accept the insecurities in LM (presumably because you
have to use something that can do LM).

Will Memphis support NT c/r, not likely, especially since Kerberos will
be available on NT within a similar time-frame. Will Memphis support
Kerberos, yeah, but geez, what do you do about all those Win3.x, WfWg,
and Win95 boxes that didn't come with a Kerberos authentication
mechanism??

LM-fix let's you implement a strong authentication mechanism within NT
environments now, because Kerberos support couldn't be delivered in an
equivalent time-frame. That's a Good Thing(tm) in my book, and I know
many customers who have opted for NT Workstation over Win95 on every
desktop, and they are all happy about this as well.

Now maybe you read something somewhere (you seemed to start this thread
here on NTSecurity, I haven't seen the marketing stuff where you were
referred to), that seemed to make you think that LM-fix was released
simply to counter what l0phtcrack does. Maybe you are just implying this
because it makes you feel like you've had an impact? Hey, maybe LM-fix
*was* released to counter your program.

I know I asked for the removal of LM stuff from NT c/r over a year ago,
and I've seen many others ask for the same thing since then. Should I/we
all be asking for attribution?

If MS said it defeats l0phtcrack, their wrong. If you say it doesn't,
your wrong. What it does do is give a site Administrator the ability to
prevent programs like l0phtcrack from working effectively, should the
chose to configure their environments appropriate (e.g. removing all
non-NT LM-based systems and replacing them with NT). How feasible that
is, how realistic, and how likely are all subject to discussion, but I
know of more than 10 companies who are doing/have done precisely that.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

On Thu, 24 Jul 1997, Ray Arachelian wrote:

> > I think the 5700 years is how long it takes to check
> > every single RSA 128 bit combo regardless of whether
> > it is a password than can be used or not.
> 
> Think again. RSA 128 is piddling easy to crack. Recall the French dude
> that broke the cheezy encryption Netscape was using.

The encryption Netscape is using isn't "cheezy", the keylength 
restrictions placed on them required a "cheezy" keylength. There's a 
magnitude of difference between a bad cypher and a bad keylength. The 
encryption was brute-forced, not broken. There's a whole bunch of 
difference between the two.

> For Public Key cyphers such as RSA, DH, and Elliptical Curve, you want a

Diffie-Hellman is a key exchange protcol, not a cypher. elliptic curves are
mathematical constructs.

> huge sized key. 1024 IMHO is barely secure. For private key cyphers, you

1024 bit RSA is secure enough for anything that doesn't make it a whole
bunch cheaper to gain the data in non-intrusive ways. Remember that to 
use encrypted information, you need to decrypt it, that's generally where 
the most vulnerable point is.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

I think we're missing the point here...

The question is not "is this ethical or legal"...the question is "is
PWDUMP limited to the size of the output file, and how does one get
around those size limitations, if any?"

Sorry to start a way-off-topic thread. That wasn't my intention.
Getting a quick hack of the PW just seemed like the easiest solution
since our users are required to change passwords every two weeks, and at
the rate of software upgrades, we were looking at bothering them quite a
bit. 

-David Melczer

>----------
>From: Frank Knobbe[SMTP:FKnobbe@BellSouth.net]
>Sent: Thursday, July 24, 1997 1:36 AM
>To: Victor Nardo; ntsecurity@iss.net
>Subject: RE: [NTSEC] PWDUMP problems...
>
>-----BEGIN PGP SIGNED MESSAGE-----
>
>On 20 Jul 97 at 22:27, Victor Nardo wrote about: RE: [NTSEC] PWDUMP
>problems...
>
>> [...]
>> Based on my understanding that the company already has the legal
>> right (someone correct me if they have a different understanding) to
>> view email sent/received under an account issued by the company, it
>> seems to follow that a password is also the property of the company.
>> While it sets a bad corporate image, in the eyes of the employee,
>> to hold their passwords, it is probably within their rights to do
>> so. If I am recalling the C2 specification correctly, one reason to
>> have each password known only by the account holder is to ensure the
>> objects generated/owned by that person are indeed his own. The
>> employee who is aware of a password policy and who is accused of
>> violating corporate policy based on evidence generated from a
>> computer system can probably legally argue that since he wasn't the
>> only person to know his account password, it cannot be proven that
>> he/she actually violated the policy/law in question (since someone
>> else could have used his/her password and done the evil deed in
>> question).
>
>So it is a matter of self-protection that the password is only known
>to the user. Interesting, never thought of that...
>
>> It seems that the absence of a written corporate computing usage /
>> awareness policy leads to this dilemma. As an administrator, I can
>> recover passwords on an as need basis, but with the understanding
>> that the employee/user will have to be informed of this, as he will
>> become aware of it the next time he logs on to the system anyways.
>
>Not necessarily. You can recover the password, move over to another
>system, and plunk the same password down, without the user knowing
>that the system changed.
>
>> [...]
>> This would put users on the alert that anything they do not want
>> shared to corporate superiors should not be left on their systems
>> and also give the company immediate grounds for termination or legal
>> recourse should they turn something up in violation in their policy.
>
>Company policy, if present, hold the right for actions should the user
>be in violation with the terms. However, that is independent of the
>password issue. The password can be known to admins, but is not
>required. Doesn't matter how many people know a users password, the
>user still has the responsibility of his system, and the software
>thereon.
>
>> [...]
>> But for the person who wants to encrypt material on their PC's, what
>> are you going to do w/o a password? What are you going to do to keep
>> a person from holding such information?
>
>I guess the user could encrypt his ZIP archive of pirated software, or
>whatever is in violation with the user agreement, independent from the
>network and its passwords. The data should be safe on his PC, but he
>may be asked by a judge to provide the key/password to gain access to
>the data. Well, maybe not immediately a judge, maybe the
>supervisor/manager will be able to exact enough force on the user so
>that he hands over anything suspicious.
>
>Security is a game of trust and deceit, ethics and perversion. In
>other words really interesting...
>
>
>
>Regards,
>Frank
>
>
>
>-----BEGIN PGP SIGNATURE-----
>Version: 2.6.2
>
>iQCVAwUBM9bbgcZP3ocmY5AlAQHFrAP/XsSGvJZKL8jW2LrImPgzUKTeVzq3i8p+
>BBtT8pJfYL52TgPbZt3uYjcuZipx39I5/3sOjhH0dsWeRm4Yi54Jb4d8FNcex2Ui
>JLb5F7PEdgEBLH6KbLYrXmIrPLZSgxmYz65lrWOQQ+Zwz1elSNgXJQjn1OjhQxyB
>mavmiFqBp9k=
>=hF1I
>-----END PGP SIGNATURE-----
>-----BEGIN SPAM WARNING-----
>
>WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
>VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
>AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
>THIS WILL DISABLE FURTHER CORRESPONDENCE.
>PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
>THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
>EMAIL LIST.
>
>-----END SPAM WARNING-----
>
When someone write "assign user right from command line" I think he' s
meaning the user right you can find in "user manager for domain", second
selection, user rights, in which you can assign the "logon locally" user
right, "act as part of the operating system" user right, etc etc. 

Does anyone out there eventually know if there is a utility like that ?

I'm very interested in it too !

Thanks very much

----------
> Da: ryan25@hooked.net
> A: zeller@indiana.edu
> Cc: strops@well.com; ntsecurity@iss.net
> Oggetto: Re: [NTSEC] Need utitlity to assign user right from command line
> Data: sabato 26 luglio 1997 14.43
> 
> 
> 
> 
> 
> Zeller, Tom S wrote:
> >
> > cacls.exe comes with nt. it allows use of f,c,r rights. for full
> > flexibility use xcacls.exe that comes with the addendum to the server
> > 4.0 resource kit.
> >
> > > -----Original Message-----
> > > From: Jay Urbanski [SMTP:strops@well.com]
> > > Sent: Wednesday, July 16, 1997 3:17 PM
> > > To: ntsecurity@iss.net
> > > Subject: [NTSEC] Need utitlity to assign user right from command
> > > line
> > >
> > > Well the topic says it all. I need to grant advanced user rights
for
> > > a 6000 server roll-out, and I don't look forward to doing click,
> > > click, click 6000 times. Does anyone know of a utitlity to grant
user
> > > rights to groups and users from a command line?
> > >
> > > Jay Urbanski
> > > strops@well.com 
> > >
> Adduser.exe sets up gobal and local groups fro the command line. This
> could also be useful. It is in the NT resource group. I have found
> using the the "for /f" command an appropriate way to process lists of
> names.
> 
> --=_005BD0FDC12564E000407089C12564E0_=--
Ok .. no speculation here (except if you require that I speculate if 
all NT/Win95 combo's will behave similarly (:>)):

I've got two NT boxes w/SP3 + all hot fixes applied. One is WS and has 
LM compat set to 1 (it hosts the backups and requires that it be able 
to act as a client to Win/95 'server's in order to backup their data). 
The other is SVR and has LM compat set to 2 (it shares files with 
everybody but doesn't act as a client for any other machines share's). 
The Win/95 boxes include both SP1 and SR2 systems.

The Win/95 boxes can mount shares from either of the NT boxes. The NT 
boxes can mount shares from the other NT box. (All this subject to the 
user-level share permissions, of course).

The NT WS (lm compat == 1) can mount shares from any of the Win/95 
boxes. The NT SVR (lm compat == 2) cannot mount shares from any of the 
Win/95 boxes.

Remember that the Q-note says:

If a Windows NT client selects level 2, it cannot connect to servers 
that
support only LM authentication, such as Windows 95 and Windows for
Workgroups.

After running with this setup for a couple of weeks, I believe it means 
exactly what it says. An NT system active as *CLIENT* with LM compat == 
2 can't connect to machines that require it to present LM style auth 
info. An NT system active as *CLIENT* with LM compat == 1 doesn't 
present LM style auth info unless the client needs it (now, that is 
speculation .. I haven't actually watched it on the lan sniffer). An NT 
system under any other conditions spews both styles of auth info when 
authenticating to a server of any type.

Nothing here directly affects NT running as a *SERVER*. If the client 
presents NT style auth info, it can process it. If the client presents 
LM style auth info, it can process that also.

In other words, the fix only prevents the NT system from putting the 
insecure LM hashes on the wire. It does nothing to prevent other 
systems from presenting insecure LM hashes to the NT system for 
authentication credentials. Because of this, while it really doesn't 
clean up a mixed 95-NT environment very much (the 95 boxes still speak 
LM), it also doesn't hurt most environments where the NT box is the 
server not the client (and the NT box wasn't going to be spitting out 
LM info anyway). It really *DOES* help when applied to the NT WS 
machines which connect to NT server shares. It really can hurt if you 
have an upside down network where NT client machines connect to Win/95 
or WfWg 'server' machines.

I hope this helps clear the air (and the speculation) about the LM 
'fix' behavior!

Ferrell

-----Original Message-----
From: Juha Jaykka [SMTP:juolja@utu.fi]
Sent: Thursday, July 24, 1997 11:54 AM
To: Daniel Melameth
Cc: Robert P. MacDonald; ntsecurity@iss.net
Subject: Re: [NTSEC] Denying Win95 Machines from accessing NT.

> You wrote, "With this setting the NT cannot use 95's shares and the 
95
> cannot use NT's (although this is not told in the Q-article!!!)."
> Actually, the article does explain it:
> "If a Windows NT client selects level 2, it cannot connect to servers 
that
> support only LM authentication, such as Windows 95 and Windows for
> Workgroups."

 All that Q147706 explains is NT accessing other machines. It tells us
NOTHING of others accessing NT - which was my original question! Does
lm-fix with "level 2" in the registry break 95 connecting to NT? Does
"level 1" this as well? Speculation is not needed nor wanted - could
someone point either a Q-article or other source which could confirm
this? And if 95 cannot connect to NT, is there a fix (or should people
wait for the Memphis-horror)?
 Off the subject&topic: is there a way to connect 95 machines to
NT4+SP3 machines when NT _REQUIRES_ SMB signing? Fix or registry key?

--
Juha Jaykka, juolja@utu.fi
In NT a service is not manageble by a user. Or, however, there are same
services yon can stop but not start, or start but not stop , or you cannot
start and stop if you are just a user, with no admin privilegies.
I looked for some parameters in order to change this behaviour. I mean, I
wanted that an ordinary user could start a particular service if this had
failed ( i.e. the SnaBase service ). I did not succed.

Anyone can help me ?

In general I'm looking for a way to customize the privilegies on the Nt
services so I can decide who can start and stop a particular service.

Thanks in advance.
Ferrell Moultrie wrote:
> Ok .. no speculation here (except if you require that I speculate if
> all NT/Win95 combo's will behave similarly (:>)):
[rest of message cut]

 Now THIS is the kind of mail I expect of this list!!! Thank you! My
other question was left unanswered, though: can W95 connect to a NT
server share that REQUIRES SMB signing?

-- 
Juha Jäykkä, juolja@utu.fi
> OTOH, lame passwords are not just a problem with NT - for example, SGIs come
> equipped with 4 default accounts for your hacking pleasure 8-)

 What are they thinking..? Nothing?-) Anyway, lame passwords are never
the system's fault but the users'! What can a system do to a password
such as F1na1e!, where the L's are replaced with ones (numericals)?
Quite much nothing, but still quite easy a guess...

-- 
Juha Jäykkä, juolja@utu.fi
net stop [service] or net start [service]

> -----Original Message-----
> From: John Rutkin [SMTP:John.Rutkin@bankerstrust.com]
> Sent: Thursday, July 24, 1997 3:18 AM
> To: ntsecurity
> Subject: [NTSEC] Stop/Start Services
> 
> Excuse the off topic question..
> 
> Is there a command line utility that will enable me to stop/start NT
> services 
> on remote boxes, I obviously have admin rights on all the relevent
> boxes.
> Sorry again as this is somewhat off topic.
> 
> Thanks
> 
> John Rutkin
At 10:20 7/24/97 -0400, Who cares what the hell goes into a Gecos field
anyway! wrote:
 
>4. The LM-hash fix works great if you don't have anything but NT machines
>on your network. If you want to continue being "productive" with your
>win95 machines it is my understanding that you "do it insecurely" or
>you are S.O.L.

[snip-a-lot]

>Since installing the LM-fix precludes continued use of windows 95 machines
>in regards to talking to NT machines, it is still a moot point as to
>how tough or well done the NT hash might or might not be.

If I'm not mistaken, the patch keeps NT from -sending- the LM hashes, not
from accepting them. This would mean that only the Win95 boxes would be
sending LM hashes in the first place, and your network will still function.
 The only place I can see getting things hosed up would be if you had a
Win95 machine acting as a server, which isn't something I'd recommend in a
secure environment (to put it quite mildly). 

Also, I could have missed something, but I'm not sure Win95 was ever
patched against the downgrade attack, so I think you can still badger it
into sending clear-text. Why waste CPU time cracking even the LM hashes
when you can just read clear-text?

IMHO, MS ought to make a patch to Win95 that will let it send the NT style
hashes, not allow itself to be downgraded, and we will be better off.
Personally, I feel Win95 isn't something you want around if you care much
about security, and that a pure NT network is a MUCH better idea, but I
can't even seem to exterminate all the Win95 boxes HERE, sooo... (Hmmm -
maybe I should set the patch on all of the NT boxes, and if it works like
you think... nah - the other admin will kill me - slowly)

If you do need to crack the NT style hashes, then it is a bit more
difficult. Another point is that if you've installed a sniffer on my
network, then you've already accomplished a very significant breach - I'm
owned somehow or another. Unless you've got some sort of network running
nothing but ssh, once you get a sniffer going, I'm fairly well screwed. It
is also the case that on all of the really secure networks I'm aware of,
they use a completely switched network, and you can only sniff yourself
(hope you've bathed lately...).


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

You all seem to be confused:

RSA = public key cryptography = Normally 1024 bit
RC4 = symetric key cryptopgraphy = Normally 128 bit

It was RC4 40 bit that was craked by the French student. Not RSA.

On 24 Jul 1997, Ryan Russell/SYBASE wrote:

> Date: 24 Jul 97 10:06:13 EDT
> From: Ryan Russell/SYBASE 
> To: Ray Arachelian 
> Cc: Paul Leach , ntsecurity 
> Subject: RE: [NTSEC] Win95 sec
> 
> Well, I'm a poor cryptographer, but I think
> you might be mistaken on a few points....
> 
> The french guy broke the 40 bit version
> of RSA. Only 1 trillion possibilities there,
> most folks could get together the few fast machine it
> would take to brute force that. The point was
> to demonstrate the fact the 40 bit stuff was usless.
> 
> The guys at berkeley broke the Netscape encryption
> because of a bad random number generator on
> Netscape's part. A bad implementation.
> 
> If RSA 128 is implemented properly, it is certainly not
> piddling easy to brute force.
> 
> I may be mistaken, but I don't think the other things 
> you mentioned are public-key ciphers. Diffie-Hellman
> is a secret sharing protocol, and elliptic curves are
> numbers with a certain set of characterisitics, and
> are intended to be useful for encryption using fewer
> bits.
> 
> Ryan
> 
> ---------- Previous Message ----------
> To: Ryan.Russell
> cc: paulle, ntsecurity, mudge
> From: sunder@brainlink.com (Ray Arachelian) @ smtp
> Date: 07/24/97 10:45:12 AM
> Subject: RE: [NTSEC] Win95 sec
> 
> On 23 Jul 1997, Ryan Russell/SYBASE wrote:
> 
> > I think the 5700 years is how long it takes to check
> > every single RSA 128 bit combo regardless of whether
> > it is a password than can be used or not.
> 
> Think again. RSA 128 is piddling easy to crack. Recall the French dude
> that broke the cheezy encryption Netscape was using.
> 
> For Public Key cyphers such as RSA, DH, and Elliptical Curve, you want a
> huge sized key. 1024 IMHO is barely secure. For private key cyphers, you
> want at least 128 bits. However various cyphers do vary in strength, so
> it also depends on which cypher you chose.
> 
> =====================================Kaos=Keraunos=Kybernetos==============
> .+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
> ..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
> <--*-->| ------------------ | syrup, don't you?" |\/|\/
> ../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
> .+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
> ======================== http://www.sundernet.com =========================
> 
> 
> 
> 

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

Paul Leach wrote:

> For people who claim security is so important, why won't they admit that
> it's worth more money for a system that implements it?

Absolutely. For those people who claim that security is so important,
they *should* use a product with a C2 rating. (Instead of, for example,
a B3 rating.) :-)

Is there any truth to the rumor that the *real* reason MS concentrates
their efforts on NT security (as opposed to 95) is because....that's
where the money is? All those slobs (myself, included, at least here at
the office) that use 95 are only worth $XX.XX. However, large
corporations - who often make a long-term commitment with MS - are worth
$XXXXXX.XX and therefore....

Ahhh...what's the sense. One thing worthy of note, though. That response
doesn't in any way really address the previous post from Lopht.
Paul Leach wrote:
> 
> Until there is a demonstrated demand for better security on Windows 95
> that can't be best met by Windows NT, then it's that simple.
> 
> Especially if, as Dave Leblanc noted on this list recently, when cost of
> ownership is factored in, Windows NT is actually cheaper.
> 
One interesting computation for you quantroids out there is to figure
how much in people time it takes to boot Win95 vs. WinNt. The trick
here is to note that WinNT is much more stable than Win95 so you need
fewer boots per day. Yes the BSOD does exist, but how many ways does
Win95 go down, lock-up, go to never-never land, and just make you
wonder????

It may be easier to sell NT to Management using uptime figures (people
productivity) than security. Alan
On Thu, 24 Jul 1997, Paul Leach wrote:

> It's amazing how hard it is for some people to get the idea that MS says
> "if security is a major concern, buy Windows NT". We've always said
> that. Maybe the 65% of all systems that run with no security at all (see
> the IDC report that Russ cites in his recent message) are happy to run
> Windows 95 even though it isn't as secure as Windows NT. Maybe thats why
> we concentrate our efforts on enhancing security in Windows NT.

You mean buy Windows NT 4.0, and then next year it will be 'if your 
worried about security by Windows NT 5.0' and then 9 months after that 
'if your serious about security by Windows NT 6.0' etc.. etc... ad 
nauseum. 

It's getting obvious that Microsoft has no clue what they are doing and 
are getting their asses whooped by the Internet community on security 
issues. Their answer is to keep pushing their upgrade path, telling you 
to upgrade to NT if you want security, meaning your gonna have to pay for 
NT workstation licenses, and upgrade time (because the path from Win95 to 
NT Workstation is not a caekwalk by any means) then you have to apply the 
new SP that fixes the bugs the previous SP introduced but also fixes the 
security bug found last week, but doesn't really fix it but only stops 
the published exploit so you have to apply the Post SP security patch to the 
NT 4.0 machines that you just upgraded at a non-trivial cost from NT 
3.51 and that will eventually have it's entire authentication and domain 
security model replaced when NT 5.0 comes out next year. Trying to run a 
secure, stable enterprise on that shit is like trying to hit a gnat
in the dark with a wiffle ball at 40 paces.

In other words your 'TCO' which MS always like to say is so low for NT 
ends up sky rocketing if you want to run anything else but a closed LAN 
or a server just waiting to be hijacked for warez distribution. If it 
wasn't for the people outside of MS, like Russ and Dave LeBlanc(and 
others) you'd think anyone talking about 'security' ona NT or 95 
platform was a total fuckhead.

> For people who claim security is so important, why won't they admit that
> it's worth more money for a system that implements it?

You mean 'give MS more money for another product upgrade from something 
we said was secure and usable, to another platform which we're gonna be 
replacing in a few months that will render the entire issue moot as you 
have to upgrade then anyways to get the next generation of 
applications'. It's a gaddman rat race.



Craig Brozefsky craig@onshore.com
onShore Inc. http://www.onshore.com/~craig
Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)

> Until there is a demonstrated demand for better security on Windows 95
> that can't be best met by Windows NT, then it's that simple.
> Especially if, as Dave Leblanc noted on this list recently, when cost of
> ownership is factored in, Windows NT is actually cheaper.

> plus billions of lines of quoted stuff.

 I agree that quoting is important to keep track of what we are
discussing but could we quote only the relevant parts - and especially
drop out those parts which are already quoted some three times? Paul's
message had 4 new lines of text and about 100 quoted - necessary to
quote them all...?

-- 
Juha Jäykkä, juolja@utu.fi

At 09:08 AM 24/07/97 +0200, w.wessels@cc.ruu.nl wrote:

>Hello, maybe this is not a realy security related question but it burns in
>my mind so i gave it a try.
>
>Situation: 
>
> - classroom with 25 computers ready to install NT workstation.
> - 1 NT workstation with the appropiate configuration
> 
>Question, 
>
>What's the right way to duplicate the 1 installed workstation to the other
>25 computers in the classroom?
>
>What will be the effect on SID and authentication when just making a copy
>to all stations.


Has anyone one got any views/information on the SID issue??? 

Microsoft state that they will not provide support for systems that have
been installed by duplicating fully installed copies of either Windows NT
Workstation or Server. They state that simply copying the contents of one
hard disk to another would give each computer the same SID, making security
impossible to maintain. For further information, read the Knowledge Base
article: 

 "Do Not Disk Duplicate Installed Versions of Windows NT"
 

So what are the current implications for using programs, such as GHOST, to
duplicate workstation configurations? Has anyone got any 'real world'
experiences they wish to share?!?!
 
Regards,


Paul Warren.


_____________________________________________________________________

Paul Warren - Network Analyst | http://www.its.unimelb.edu.au:801/
ITS - Networks & Communications | E-mail: P.Warren@its.unimelb.EDU.AU
**The University of Melbourne** | Phone: 9344 4136 Fax: 9347 4803
_____________________________________________________________________
"The only place where success comes before work is in a dictionary!"

If we are going to reply to these threads, could everybody
take a small moment to *edit* the replies.

I do not think that the entire original mudge article
(interesting tho' it was), needed to be quoted for context.

Thanks,
 -mouse

-- 
Tim Smithers.
DMouse Pty. Ltd.
ph: 0414 366 873 (Mobile)
ph: +61 2 9351 5698
e-mail: mouse@mml.usyd.edu.au

( Perfection is a hobby many pursue,
 but few have a chance of success )
I have an NT4 (SP3) server providing DNS, SMTP, and POP3; it has been used
for proxy server and Routing & RAS evaluation, and has IIS installed but
with the services disabled. It does not provide any file or print services,
so has no user accounts apart from the Administrator, a test account, and an
acccount for the mail server.

Recently I enabled auditing for successful as well as failed logons, just as
a precaution. I was surprised to see that every time the system starts,
there is a successful logon by "NT AUTHORITY\ANONYMOUS". Can anyone explain
what this is for, where it comes from, or where I might find out?

Thanks,

John Wells
jwells@pacificcoast.net
Hello 

Does all users have to have read&add rights to the whole system patrition
when using ASP?


 =============================================================================
 Charlie Helin
 netsolutions sweden ab
 humlegårdsgatan 20, box 14083, SE-104 40 stockholm
 phone +46-8-58748725, fax +46-8-58748750
 e-mail charlie.helin@netsolutions.se, web http://www.netsolutions.se
=============================================================================

Does your firewall support NT Challenge/Response Authentication Method??

> -----Original Message-----
> From: Ylva Holm [SMTP:ylva.holm@hedbergska.sundsvall.se]
> Sent: Quinta-feira, 24 de Julho de 1997 21:05
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Basic authentication
> 
> Thanks for the suggestion but I do use FrontPage 97. The users behind
> firewalls can't connect to the server with FrontPage and some of the
> users
> that are not behind firewalls have trouble too. If I use basic
> authentification everyone can change the website they should be able
> to
> change. My question is: how bad is this? If some of my pupils install
> a
> sniffer will they be able to read every password in clear text when
> people
> log on to the network?
> Excuse me if the question looks simple - I'm just a teacher trying to
> have
> some security. Our net can never be secure!//Ylva
> At 07:07 PM 7/24/97 +0100, you wrote:
> >Greetings
> >Try using FrontPage 97. That no longer needs basic authentication.
> >However you will have to upgrade all clients.
> >
> >
> >> -----Original Message-----
> >> From: Ylva Holm [SMTP:ylva.holm@hedbergska.sundsvall.se]
> >> Sent: Quarta-feira, 23 de Julho de 1997 19:41
> >> To: ntsecurity@iss.net
> >> Subject: [NTSEC] Basic authentication
> >> 
> >> Hi!
> >> I have an IIS-server with users connecting via FrontPage and it
> locks
> >> as if
> >> I have to turn on basic authentication for them to be able to
> connect
> >> and
> >> work with their webfiles. When I done this and users log in to the
> >> network
> >> to work is the passwords still encrypted or have I caused that all
> >> passwords are transmitted in clear text now even if it has nothing
> to
> >> do
> >> with the web at all?
> >> Worried! Ylva
> >
> >

Two questions I would appreciate any help with

To quote the NT Server resource kit; registry entries help file.

"DeleteRoamingCache REG_DWORD

Range: 0 or 1
Default: 0

If the value of this entry is 1, locally cached profiles are deleted when 
users with domain profiles log off. This setting is designed to conserve 
disk space."

q> How do you prevent profiles from caching period to ensure settings are 
only changed on the server and that assuming 
\\server\winnt\profiles\username\personal is assigned the home directory 
that this is always saved to this location as well.

Secondly, someone sugessted the SAM caches the last ten users locally. I.E 
Having removed the network connection a user could logon locally if he was 
one of the last ten users to use the workstation irrelevant of the SAM on 
the server. I can find no documentation to this and no key to prevent this. 

Any bright ideas ?

Regards,


Mark

___________________________________________________________
Mark Curphey
Insight Consulting
Churchfield House
The Quintet
Walton on Thames
Surrey
KT12 2TZ


Electronic Mail :markc@insight.co.uk
Electronic Mail :m.curphey@rhbnc.ac.uk
Telephone : 01932 - 241000
Fax : 01932 - 244590
Mobile : 0410 - 034066
WWW : www.insight.co.uk
WWW : www.curphey.com


Dear gurus,
 I am having a bit of a problem coming up with a clean solution
to back up the HKEY_CURRENT_USER key (NTUSER.DAT) while the user is
logged on. We, unfortunately, cannot force a logoff. I have tried
REGBACK.EXE but it misses components of the NTUSER.DAT file while it is
open (user logged on). I have resorted to create a service called
BACKREG that is created by the SRVANY/INSTSRV combo. The BACKREG
service calls rdisk with the /S- parameter. This parameter prevents the
popup of the dialog box that asks whether or not one wants to create an
emergency disk. I am just interested in updating the repair directory
at certain intervals per week and then SCOPY'ing it to a network drive
and then backing the stuff up on tape. Unfortunately, the rdisk
procedure backs up just the Default User version of the NTUSER.DAT and
not the loggoed on user's NTUSER.DAT file. I suppose I can make the
user's profile be the Default User profile but that would be tedious
unless there is a command line quickie option for the task.

This procedure needs to be applied to about 12,000 NT 4.0 workstations
in the near future. Has anyone here come up with a procedure to do this
on NT 4.0WS? Any help would be much appreciated.

Chance Neale.

Chris Larsen wrote:
> 
> http://www.rc5.cyberian.org/
> http://rc5.distributed.net/
> 
> Which both have taken on the greater task of brute force cracking the
> RSA 56 bit key.
> 
I think you mean "RC5" not "RSA". RSA 56 is trivial to crack.

-- 
bye,
c0s

Costin RAIU, Data Security Expert

E-MAIL : BUSINESS mailto:craiu@gecad.ro, PERSONAL craiu@usa.net
PGP Key : http://www.gecad.ro/~craiu/craiu.asc (or search www.pgp.com)
KeyID : 2048/DD35A295 Costin RAIU 
Key fingerprint = FD 14 2A 90 64 41 58 9A 6B 34 47 D8 C5 E2 F4 5C
I will not even try to comment on the technical ins and outs of LM/NT
hash. This is in direct response to the posting by Paul Leach and his
comments listed below. While security is a major concern for some
people, doing business outweighs that concern when business would not be
possible if you implement the security "fix". For a company that has
say 5000 pc's each running Win 95 the "buy Windows NT" statement would
cost them conservatively $200 per pc. This would be a total cost of $1
million dollars, a tough pill to swallow for most companies of this
size. In addition to this any 16-bit apps that they are currently using
will (maybe not all but a majority) not work. They would then have to
get this app pushed to NT and add upgrade costs, or purchase a product
that does run on NT and pay for purchase, training, and the cost of
moving data to the new app. Yes some companies don't choose to go to NT
but a good portion of companies are unable to due to Microsofts
ineptness in making products that are backwards compatible.

Tim

Views expressed in this message do not reflect those of my employer.

 ----------
From: Paul Leach
To: ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca; 'Who cares what the hell
goes into a Gecos field anyway!'
Cc: Ryan.Russell@sybase.com
Subject: [NTSEC] RE: Windows NT rantings from the l0pht
Date: Thursday, July 24, 1997 1:42PM

It's amazing how hard it is for some people to get the idea that MS says
"if security is a major concern, buy Windows NT". We've always said
that. Maybe the 65% of all systems that run with no security at all (see
the IDC report that Russ cites in his recent message) are happy to run
Windows 95 even though it isn't as secure as Windows NT. Maybe thats why
we concentrate our efforts on enhancing security in Windows NT.

For people who claim security is so important, why won't they admit that
it's worth more money for a system that implements it?


> http://www.rc5.cyberian.org/
> http://rc5.distributed.net/
> 
> Which both have taken on the greater task of brute force cracking the
> RSA 56 bit key.

 This is getting a bit annoying. About half the messages on this list
concern cryptography and almost no one seems to know what they are
talking about. Could you people begin to understand what you are talking
about or simply shut up? There is NOTHING common between RSA 56 bit key
and the 56 bit RC5 -algorithm which the two mentioned sites are trying
to break. Read the damn FAQ at http://www.rsa.com/rsalabs/newfaq/. It
will tell you the following:
 RSA is a public-key cryptosystem for both encryption and
authentication; it was invented in 1977 by Ron Rivest, Adi Shamir, and
Leonard Adleman.
 RC5 [Riv95] is a fast block cipher designed by Rivest for RSA Data
Security.
 A block cipher transforms a fixed-length block of plaintext data into
a block of ciphertext data of the
same length. This transformation takes place under the action of a
user-provided secret key. Decryption
is performed by applying the reverse transformation to the ciphertext
block using the same secret key.

 The previous said, please stop confusing secret-key and public-key
systems with each other and second of all stop confusing two different
cryptosystems patented by the same company (i.e. RSA the public-key
cipher patented by RSA Data Security Inc. and RC5 the secret-key cipher
almost patented by RSA Data Security Inc.).

 FYI: The security of the cryptosystem depends (mainly) on two things:
the size of the key space needed to brute force it and its resistance
against cryptanalysis. The "number of bits" usually mentioned refers to
the size of the modulus of a public-key system or the size of the key
space of a secret-key system. These two figures are not (directly)
comparable.

-- 
Juha Jäykkä, juolja@utu.fi
On Thu, 24 Jul 1997, Paul Leach wrote:

> Ryan is right on almost all counts. (Elliptic curve is, AFAIK, a PK
> system; it is correct that it alleges to need fewer bits of key.)
> 
> However, even a little elementary arithmetic would convince you that
> searching a 128 bit key space will take a long time, even with millions
> of machines doing billions of crack tests a second. Where long time is
> about 10**16 years, for example.

128 bit IDEA isn't easily searchable. 2**128 is supposedly larger than
the number of atoms in the universe or some such. However, 128 bit RSA
isn't considered as safe. While you are forced to brute force the IDEA
key as currently there are no known publicized short cuts, RSA 128 can be
more easily cracked since it can be factored, and thus takes less time
since you don't need to brute force the beast.

Anyway, this is getting waaay off topic (unless NT uses 128 bit RSA keys.
:)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

I saw a recent article referring to this feat where DES was "cracked by
a 90-MHz Pentium." Well, not quite!

My reading of RSA Web page (apart from them selling us RC* now that "DES
is dead") is that this was still a brute-force attack. If so, the phrase
"cracked DES" seems inappropriate. This is really a comment on the
availability of a world-wide network to lend the processing power of
10,000 mostly-idle Pentiums (etc.) for a $10,000 reward. It's not DES
that was "cracked" but that 56-bit barrier. Although still a lot of
work, "56" is beginning to be abridged.

However, those same speed-burning Pentiums can now do triple-DES
efficiently. If your secrets are of such value that 10,000 Pentium
owners (etc.) deem it profitable to attack them, you shouldn't mind
paying the price for the big "triple."

Anyway, it really WOULD be interesting to see DES really "cracked" that
is, a weakness in the S-boxes, etc., but news just doesn't excite this
reader.

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
Does anybody know of a good program that can take a dictionary, a crack
rule set, and generate a new dictionary with all the rules expanded ? I
ask this because I'd like to run l0phtcrack on an NT system, but it
doesn't do rulesets, which I would like.

--Aurobindo
On 24 Jul 1997, Ryan Russell/SYBASE wrote:

> Well, it shows numbers of a length of those many bits
> being factored, but is that the same as cracking something
> encrypted with the algorithm? (obviously, I'm demonstrating
> my ignorance of the RSA algorithm details.. I'll break
> out my Applied Cryptography and look it up.)

(revisiting this...) Welp, take 2^128 and see the length of the number in
digits for comparison... 
 
> What I was assuming was that for a 128-bit RSA, the
> most straightforward way to crack it was to
> check 2^128 different keys for a match. If it's
> as "simple" as factoring a 128-bit number, it would
> obviously take much less time.

I do seem to recal that someone came up with an algorithm that would break
RSA in factorial time, not sure of the details, and while it does manage
to do better than brute force, it doesn't do much better, but it's there.
There may be other ways... 


=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

I don't know where people get this idea that a majority of 16 bit apps
don't work under NT. All MS office productivity apps do -- it was a
requirement, and at least all the top 100 apps were tested against NT
before NT 3.1 shipped. The only major class of apps that don't work are
games, with a second (relatively small in number) class being ones that
deal with specialized hardware.

Paul


Hello 

I am sorry that the following problem is probably not in the
general concern of the list.

My hard drive boot record is lost and the I have lost my emergency repair
disks. I was wandering if it is possible to create E.R.D's on another
computer and use it with my configuration. 

I am using a Seagate ST 32140A (2.1 GB) HDD running on a P-133.

I would be grateful if someone with the same HDD could create an E.R.D set
that could be used to retrieve some of the lost files.

Thanks

Alex 

PS I've already tried NT Recover from NT-Internals but it does not seem to
work. 

At 01:29 PM 7/24/97 -0700, Paul Leach wrote:
>When L0phtcrack 1.0 came out, LHI promised to produce a version that
>would not require admin access. We took the promise seriously, and
>started design and development work on the LM elimination. Later, there
>were various hints and rumors that the Blackhat conference was where the
>next version would be unveiled.

Paul mentioned to me at Black Hat that they had the LM fix ready to go, so
apparently MS is now trying to stay with the curve. This is a good thing.


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
On Thu, 24 Jul 1997, Paul D. Robertson wrote:

> Unfortunately, this reduces the keyspace, all the brute force timings
> assume any possible value, but if you go for non-dictionary passwords
> you've just limited the keyspace, reducing the time necessary for a brute
> force attack, and since most of those "strong passwords" require non-alpha
> characters, even non-dictionary possibilities are automatically eliminated
> from the attack sequence.

Not by much. We do have 14 characters to play with after all, unlike Unix
which is limited to 8. (Though we've seen that from 95 machines, you lose
case sensitivity - which is much more damning as is reduces the keyspace
by 26^14. If you find a case insensitive version of a password, it only
takes 2^14 tries to figgure out the proper case, if you need to use said
password from under NT.) 

However, does anyone know (really know) how well these DLL's are protected
from taking your password and say writing it to the hard drive or keeping
them around in memory, or sending them to another machine? (I do vaguely
recall that they were protected from doing such, is that true?)

IMHO forcing long passwords with many types of characters won't reduce the
keyspace by much in a 14 character space, but I'd be worried about how
clean the DLL is. Said DLL would be a great place to stick a trojan. :)

Also, anyone have pointers to docs as how NT authenticates against a
PDC/BDC? What the protocol is to get the access token and all that?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

On 24 Jul 1997 C.Toth@keene.k12.nh.us wrote:

> I know nothing about windows 95 so i was wondering if anyone on here
> could help me. I just got a new PcTel HSP 33.6 PNP Deluxe Modem and
> I install the drivers for both the COM port and the modem. Then I run
> Modem in control panels and run diagnostics it fails to communicate with
> the modem. I tried all possible addresses and interupts that didn't
> interfere with COM 1 and I don't know what to try next.

Try going into your CMOS setting through the BIOS. On most PC's, this
means holding down the DEL or F2 key durring boot up. Go into Features or
Built in Devices. See if your motherboard will let you reconfigure one of
the COM ports. Say, change COM1 to COM3, or change COM2 to COM4. In the
worst case, try disabling the port. Then see if you can communicate with
the modem.

(This is why I always reccomend external modems. :) I've had nothing but
trouble with internal PnP modems, and everyone I've spoken to also had the
same, but with enough hair pulling it can be gotten to work.)

If there's some configuration disk with the modem that you can run from
DOS mode, try it and see if you can disable the plug and play options and
force the modem to lock itself to a fixed port.

Also be aware that if you use traditional I/O and IRQ addresses, you can't
access both COM1 and COM3 at the same time, nor COM2 and COM4 at the same
time. This is because COM1/3 share IRQ4, COM2/4 share IRQ3. If you're
using a serial mouse, or other serial device on these ports, they might
cause conflicts with the modem. See if you can assign an unused IRQ to
the modem - say 10 or 11 and tell 95 of this. Good luck.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Having already read and fully understood the requirements for various 
DoD security ratings, I've come to a different conclusion. C2 CAN be 
implemented in a networked environment, following trusted network 
specifications from the red book pertaining to C2, but an NT network 
is not capable of adhering to this standard. So---In order for NT to 
successfully implement C2, it must not be attached to a network. 
This is due to the way trust relationships are maintained with NT 
networking clients. The NT domain itself doesn't default to C2-style 
security, being discretionary access control defaulting to restricted 
access to everyone but the owner. This seems basic at first glance, 
but can actually vastly change the way a networked environment is 
implemented. Besides that, there is no default method for insuring 
audit trail integrity over an NT-based network.

So.. I have concluded that NT can only be classified C2 secure in a 
standalone environment.

- --Ben


- -----Original Message-----
From: Jeff Barber 
Sent: Wednesday, July 23, 1997 8:58 AM
To: ntsecurity@iss.net
Subject: Re: [NTSEC] Problem with Event-ID 513

> That is correct tim. One of the C2 requirement is: the system 
must 
> be stand-alone. Once it's attached to a network or to another 
system, 
> you can throw the C2 talk out of the windows.

There seems to be no end on this list to uninformed speculation
about what C2 requires. There is no C2 requirement that a system
be standalone. If you want to know what the C2 requirements are,
why not (gasp!) actually read them? The Orange Book is online at:
http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html

If you want to know how the NCSC interprets C2 with respect to
networks, continue by reading the Red Book at:
http://www.radium.ncsc.mil/tpep/library/rainbow/NCSC-TG-005.html

(Granted, these documents are rather vague and you won't find an
[explicit] answer to detailed questions like "does C2 require
auditing of system shutdown?", but you'll certainly be able to
reject glaring falsehoods l
-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBM9zjTf/9uJQnX5lKEQJs4QCgowa9AdRfXuutmCfYLuf29IxJejkAoOID
XDFLHvKECs24MkSVRj4nu7qL
=ZrtK
-----END PGP SIGNATURE-----

Hello 

I am sorry that the following problem is probably not in the
general concern of the list.

My hard drive boot record is lost and the I have lost my emergency repair
disks. I was wandering if it is possible to create E.R.D's on another
computer and use it with my configuration. 

I am using a Seagate ST 32140A (2.1 GB) HDD running on a P-133.

I would be grateful if someone with the same HDD could create an E.R.D set
that could be used to retrieve some of the lost files.

Thanks

Alex

PS I've already tried NT Recover from NT-Internals but it does not seem to
work. 


Tried GetAdmin on Dutch language NT4 SP2.
Bad luck, it seems GetAdmin tries for 'Administrator' authorization, while
our's is called 'Beheerder'. If so: for maximum security forget about your
English language version and learn te speak our language...

Groetjes,

André Koot
Ryan Russell/SYBASE wrote:
> 
> Oh, come on. You aren't going to pretend that
> the issue is that simple, are you?
> 
> I realize these things aren't your personnal
> choices, but it would appear that you've
> been declared de-facto MS spokesperson here...
> 
> My personal opinion is that any OS ought to
> be securable on the network, even if it has
> no security when you sit down in front of it.
> Not using the network is not much of a choice.
> As the only supplier of the SMB stuff between
> 95 and NT, I would hope that MS has plans
> to dump the unsecure LM dialect entirely.
> I'd prefer to see a hotfix for 95 soon, but I
> could even live with it being fixed in Memphis.
> 
> Are you able to comment on any of the above?

Frankly, I'd say this is just another indication that MS is pretty
clueless about networking.
Does anybody know if there is any NIS+ client for WinNT
or Novell?

Please contact me at: pirot@cti.gr

Thanks in advance,
Ipirotis Panayotis

Hiya,

Just wondered if anyone can help me...

I want to setup policies that are obeyed by all all machines on the
network.. As I understand it, you just save the .pol file in the
\\PDC\NETLOGON folder (NT4 by the way)...However, i can't seem to get
permissions to write to the folder :((

Without this, all users can have access to just about anything..(control
panel etc. etc. )..

Thanks
Misha
>Off point however, this doesnt seem to be security related...and I see
>more and more of these emails not related to security on this mailing
>list. Just an observation.

Will, I'm sorry but I don't see how you can call a discussion of the
domain models in NT anything other than a security topic. The only
distinctions of domains are their security realms, and interaction with
other security realms, so I think this is totally on-topic for this
list.

That being said, to address the original posters questions;

David, you have not compromised your security...yet...;-]

The "Single Master Domain" affords you less administrative overhead than
what you call the "Single Domain" because it doesn't associate resources
directly with the administration of users/groups. The advantage here is
that you can then add any number of "Resource Domains" without affecting
your user Domain, and further leave administration of the Resource
Domains to whatever powers control the resources.

With the addition of a single Resource Domain, as in your case, your
model doesn't break. You've currently accepted to administer users and
resources jointly, and now another department has come along who are
prepared to administer their own resources while you administer the
users. Potentially you may find that your Resource Domain requires
additional accounts established that you might not consider "Global",
but beyond that there should be little change to your approach from a
security perspective. As long as you keep the trust one-way, as you've
stated, you don't introduce any new security objects into your Master
Domain.

To create the true Single Master Domain, you would gradually migrate
your resources into another Resource Domain created to hold those
devices currently in your Master Domain. Since, however, you've already
accepted that accounts added to the Master Domain are going to have
access to resources currently in your Master Domain (to whatever extent
you already give them access), this would seem to be a moot issue and
probably unnecessary.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html



> ----------
> From: Jim Dennis[SMTP:jimd@starshine.org]
> Reply To: Jim Dennis
> Sent: Thursday, July 24, 1997 1:50 PM
> To: ntsecurity@iss.net
> Cc: ntsecurity-digest@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> > Date: Tue, 22 Jul 1997 18:33:11 -0700
> > From: Paul Leach 
> > Subject: RE: [NTSEC] Win95 sec
> > 
> > Breaking a sniffed NT challenge/response will take approximately
> 5,700
> > 200mhz Pentium Pro _years_, if the user has a strong password. (This
> is
> > the average time to search the key space at the rate of 1 million
> > keys/sec on a 200mhz PPRO using the software developed for the RSA
> DES
> > challenge, which was at the time the fastest known software
> > implementation.)
> 
> There's something wrong with these numbers. The recent
> DES challenge was completed by a few thousand machines
> in parallel in under 10 weeks -- an the conservative estimate
> (given the number of machines and the rate of keyspace 
> check-in's) was under 20 weeks to exhaust the full key space.
> 
> They didn't not have 15,000 participants -- these were 
> spare cycles on a couple of thousand machines. By your numbers
> They should have taken 4 years or so to complete the challenge.
> 
I only know what I see on the Web :-) (That's a paraphrase of Will
Roger's famous quote "I only know what I read in the papers")

According to the DES challenge stats web page,
http://www.des.sollentuna.se/stat/,
your numbers are not correct.

According to that page, there were almost 50,000 machines employed at
one time or antother, over a period of 84.90 days (12+ weeks), and the
average real time rate was equivalent to 1387 machines doing 1 million
crack tests/sec. They only searched 14% of the key space before finding
the key; they said 1.4 years to search the entire space.

Also, I already posted a correction -- searching the key space will only
(!) take one machine and average of 1142 years and 1 millions tests/sec;
I accidentally posted the time to search a password space big enough to
generate the full DES key space will take 5700 years.

I hope that makes the numbers work out.
> 
> > * breaking a sniffed NT challenge/response is almost exactly as
> > hard (number of keys to examine) as breaking a sniffed Kerberos V5
> login
> > attempt -- both involve a brute force search through key space or
> > password space (whichever is smaller).
> 
> What if someone can demonstrate that this is not true?
> 
Then they will have proven me wrong. I'll be glad to post an NT
challenge response pair so they can try....

> Just who has vetted the algorithms and implementations?
> 
The algorithm has been published. As I have posted many times here, see
"ftp://ftp.microsoft.com/developr/drg/cifs/sec.htm" for the spec. There
are publically available source code implemtations of it in Samba,
SMBCLIENT, and L0phtcrack -- I'd be interested if anyone found any bugs.

> I thought LM C/R used RC4 for hashing. I'm sure I've read
> that RC4 is weaker than DES 56-bit -- and computationally
> easier (quicker). That would suggest that a brute force
> keyspace search should be faster for RC4 than for DES.
> 
No. NT C/R uses MD4 to hash the password to create a key; LM C/R uses
DES to create a key. Both use DES to compute the response from the
challenge (as does Kerberos).

NT C/R and LM C/R are way different, BTW.

> Kerberos seems to use DES -- but here's a couple of 
> links for people to read more about that:
> 
> Kerberos: The Network Authentication Protocol
> "http://web.mit.edu/kerberos/www/
> Kerberos Users' Frequently Asked Questions 1.14
> "http://www.veritas.com/common/f/97042301.htm
> 
> > * Kerberos users' passwords can also be as weak as NT users'
> > * a precomputed dictionary attack on NT challenge/response
> > requires a dictionary of order 2**60 bytes -- 1 million terabytes.
> > 
> > People may say whatever they like about LM challenge/response -- it
> > won't let you have a very strong password. Apply the LM-FIX from the
> MS
> > FTP site so you don't use LM challenge/response if your security
> > requirements demand it.
> 
> Just what are you trying to say?
> 
> "our stuff is as secure as Kerberos"
> 
NT C/R is as resistant to a known plaintext attack as Kerberos.
NT C/R and Kerberos are both bad if you use weak passwords.

> "you should apply the patches to our stuff"
> 
Yes.

> Since you're from MS maybe you could clarify what 
> MS' plans are regarding support for a Kerberos/DCE 
> authentication model (hinted in the media for inclusion
> with NT v5). Is it going to conform to the IETF GSSAPI 
> and Open Group (formerly OSF) DCE specifications? Will 
> it be completely interoperable?
> 
We will support Kerberos in NT5; it will conform to RFC 1510 and RFC
1964. GSSAPI is an API, not a protocol. 

Paul
 Check your DNS configuration on all three machines. Even if you are using
straight IP addresses, the Firewall and Tunnel must be able to do reverse
lookups to authenticate those addresses.


>
>Hi !
>
> I hope this is not new but I can't find properly information
>on the Altavista site.
>
> I'm in a trouble when I like to use Altavista Tunnel trhough an
>Altavista Firewall. If I turn off the firewall the tunnel (from outsider
>client to insider Tunnel) works fine, when I try to use it trhough the
>firewall, the client gives timeout when tries to contact; the firewall
>report (into proxy tunnel log) "args too long".
>
> I'm tried several things (lmhost of tunnel, /etc/hosts of
>tunnel, lmhost of firewall, etc.)
>
> Also, I think is not a routing problem because when I turn off
>Firewall service and turn on IP forwarding it works fine.
>
> The configuration is:
>
> - Tunnel Server 96 v1.1 with Windows NT 3.51
> - Firewall 96 v1.1 with Windows NT 4.0
> - Tunnel Client v97 2.0 (Build 101) with Windows 95
>
>
> Somebody knows where can I find more information ?
>
>--
>
>Saludos
>Ruben Sajnovetzky - ruben@is.com.ar
>



Seems to me the basic premise of the "Win95 sec" thread was 'how to secure
NT systems in an environment where there must be Win95 interoperability'. 

The thread went off on a tangent rehashing the DES cracking issue.

Anyone finally establish for the _current_ versions of NT/ W95/ MSoffice/
Exchange/ SQLserver/ IIS/ etc, a 'step-by-step process/magic
formula/instruction sheet/white paper' for securing (a relative term ;) ) NT
servers when serving W95 clients? 

I could make one, but I'm hoping someone else did the work already.

BTW - I already know an NT-only network can be made fairly secure, as long
as you don't have users directly accessing the systems (tounge in cheek,
ref: MS Office, getadmin). I also already know about the MS document
"Securing Windows NT Installation".

Bill Stout

Hi All

I have just installed a pair of NT server on our local network and our small
lan is connected to the internet via a 64 K Lease line via an ISP. 

I have configured MS DNS Servers on both NT Server and created a zone,
"pg.net.my", and when I clicked finish it creates a file named "
pg.net.my.dns" inside WINNT directory. 

Here are the configurations

zeus.pg.net.my SOA 202.185.147.85
zeus.pg.net.my NS 202.185.147.85
www CNAME zeus
ftp CNAME zeus

I also have PostOffice Installed but I do not know how to configure a MX
record.. can some one give me a hand here ?

And plus if I want to host a second domain name, "aftereden.com.my", how do
I do that with MS DNS ?


Regards
Cherri

On Mon, 28 Jul 1997, Ray Arachelian wrote:

> Not by much. We do have 14 characters to play with after all, unlike Unix

Paul's already corrected my keyspace mistake.

> which is limited to 8. (Though we've seen that from 95 machines, you lose

Not every Unix has only 8 character passwords. For example, Linux, BSDi, 
and FreeBSD support 128 character passwords, and AIX 45 characters.

>From the (Linux) crypt(3) manpage:

Warning: The key space consists of 2**56 equal 7.2e16 possible values. 
 Exhaustive searches of this key space are possible using
 massively parallel computers.

>From the (Linux) getpass(3) manpage:
 
The password may be up to _PASSWORD_LEN (currently 128)
 characters in length. Any additional characters and the
 terminating newline character are discarded.

> IMHO forcing long passwords with many types of characters won't reduce the
> keyspace by much in a 14 character space, but I'd be worried about how
> clean the DLL is. Said DLL would be a great place to stick a trojan. :)

Just as with Unix passwords, any time you want a place to check for
dictionary attacks in the password mechanism, you have to protect that
place, as well as the login screen, and make sure your users know when to
type passwords in to applications.
 
Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

What resources we're used to crack the DES 56 bit encryption?

 -Daggers Keep

On Thu, 24 Jul 1997 23:02:55 +0200 (METDST) Chris Larsen
 writes:
>
>As an aside on the win95 sec and key length discussion
>especially DES 56 bit, you might wanna check out:
>http://www.rsa.com/des/
>
>This is true brute force attack of the 72 quadrillion keys.
>and it was broken in 140 days...
>
>You can also take a look at the other challenges going on right now:
>
>http://www.rc5.cyberian.org/
>http://rc5.distributed.net/
>
>Which both have taken on the greater task of brute force cracking the 
>RSA 56 bit key.
>
>
>
>Chris Larsen | We learn from history, 
>vader@inet.uni-c.dk | that we do not learn from history...
>System Manager |
>Struers A/S | All opinions expressed herein are my 
>own
> | and _not_ those of my employers !!.
>
>PGP-key: 
>http://swissnet.ai.mit.edu:11371/pks/lookup?op=get&search=0x137993A5
>
>
Gregory A. Eisenberg wrote:
> 
> Isn't there a utility to compare the registries of two computers??? Or at least a utility to dump a registry into a text file for comparison by some other means. I know I used to have this utility laying around for 3.51 at my old place of employment, but I can't remember the program name.
[snip]
As far as I remember this utility is called 'DumpReg' and you can find
it at Frank Ramos site (www.somarsoft.com ?? or similar).

Hope this helps.
Greetings,
 Franz Josef
-- 
======================================================================
Klinikum Aachen ! Tel: ++49 (0)241 80-88518 
Dept. Radiology ! Fax: ++49 (0)241 8888-480 
DI Franz Josef Katterbach ! 
Pauwelsstr. 30 ! 
52057 AACHEN ! email: 
Germany ! katterbach@linus.rad.rwth-aachen.de
At 11:26 25.07.97 +0200, you wrote:
>
>
>Hello NTSEC guru's
>
>My question has probably been asked before, but, I would apreciate any
>help here.
>
>I have a small NT network connected to the Internet. The purpose is so
>that Joe Q. Public employee
>can surf. I have been working on server / workstation security and now
>would like to tighten up the gateway PC.
>
>The gateway server has a RAS connection to an ISP. I am told that by
>blocking the appropraite UDP / TCP ports
>( 137 / 138 / 139 ) on the RAS adaptor I can stop certain traffic moving
>out off my LAN onto the Internet.
>Thus people won't see the Domain name etc.
>
>I know that configuring this can be done by :
>Control panel->Network->Protocols->Tcp/ip->Properties->IP
>Address->Advanced->Enabled security
>
>Here I have the option to disable enable all ports or list the ones that
>are necesscary.
>My questions is which ports should I enter into the list and which not?
>I want users to be able to continue surfing,
>but, only traffic to go in and out that is necesscary.
>
This vary a little bit depending on the programs you're using to 'surf'.
E.g. a standalone Browser like MS IE or Netscape accesses web-server
normally on port 80, sometimes special pages on 8000 or ... If you're using
the proxy-server of your ISP, you will access it with 8080 or 3128 or ...
Or you setup your own proxy on the gateway, leaving only port e.g. 8080
open to the inside ...

regards


Christian Krackowizer | email: kra1@technodat.co.at
TECHNODAT CAD/CAM - Systeme fuer Moebel GmbH | Phone: +43 - (0)662-454944-0
Jakob-Haringer-Strasse 6 | FAX: +43 - (0)662-454944-9
A-5020 Salzburg | Compuserve: 74343,2225
AUSTRIA | http://www.technodat.co.at
There are several utilities in the resource kit for Windows NT 4.0 -
REGDMP.EXE REGINI.EXE

> -----Original Message-----
> From: greg@ycs.net [SMTP:greg@ycs.net]
> Sent: Sexta-feira, 25 de Julho de 1997 14:15
> To: NT Security Mailing List; 'Allan McDonald'
> Subject: RE: [NTSEC] NT 4.0 Password Problems
> 
> Isn't there a utility to compare the registries of two
> computers??? Or at least a utility to dump a registry into a text
> file for comparison by some other means. I know I used to have this
> utility laying around for 3.51 at my old place of employment, but I
> can't remember the program name. 
> 
> Anyway compare the registries from one of the machines that
> works perfectly with the one that is acting funny, you may be able to
> find the inconsistency. Be sides that, you'll just have to get lucky
> and hope someone reading this newsgroup has seen this problem before
> (which is super likely with the experts on it!!)
> 
> Good luck and be sure to tell us what the problem was!
> ----------------------------------------------------------------------
> -----------------------------------------------------------------
> GREGORY A EISENBERG
> greg@ycs.net NT Administrator and Web Developer YCS Internet
> Commerce
> a
> division of 
> Yamatech
> Scientific Ltd.
> 
> 
> 
> ----------
> From: Allan McDonald[SMTP:mcdonald@onramp.i2k.com]
> Sent: Wednesday, July 23, 1997 8:30 PM
> To: NT Security Mailing List
> Subject: [NTSEC] NT 4.0 Password Problems
> 
> This might be off-topic for this group but I'll give it a try ...
> 
> I just set up three new systems with NT WS 4.0. Our policy is to
> create
> an ID for the user, set the password to some easily remembered word
> and
> check the "User Must Change
> Password At Next Login" selection. The users don't have the
> Administrator password.
> 
> On all three of these systems the user is prompted to change the
> password after they first login, on two of them there is no problem,
> the
> 
> password gets changed. On the third one there is a problem. After the
> user types in the new password and clicks OK he gets a message saying
> he
> 
> does not permission to change the password.
> 
> The "Don't Allow User To Change Password" option is NOT checked. If
> the
> "User Must Change Password At Next Login" is unchecked the user can
> then
> 
> log in, (without being prompted to change the password, of course).
> The user can then do a C-A-D and change the password successfully from
> the Change Password selection.
> 
> This happens on this system no matter what ID I create. I would rather
> not reinstall NT, no CD-ROM on the system, etc. And I'm really curious
> how this happened and how to fix it. Any ideas??
> 
> Thanks,
> 
> Allan McDoanld
> mcdonald@onramp.i2k.com
> 
> 
> 
> 
> 
> 
> 
> 
McInerney, Stephen wrote:
> I was made aware of one rather novel solution that was used to sorta
> disable floppy drives several years ago.
> The problem was they didn't want users booting off a fd but the users
> still needed fd access.
> The solution was to "mis-align" all the fd's by the same amount.

Yes... the question is then why did they need fd access? Purely for
internal file transfer (you mean they weren't networked? In this day and
age too!), or for general file transfer (including working at home then
bringing in their finished Word document), in which case they're stuffed.

Also, if they know what's going on (and I suspect that anyone with a bit
of nouse would figure out pretty quickly that there was some consistent
systematic difference between drives there and drives at home), this is
trivially easy to break. Just format a floppy there and write some data
to it, take it away and use it as a master to 'realign' the drive on your
own friendly machine.

> The users could only use those PC fd's to read/write their floppies,
and
> couldn't bring in any outside disks to boot the PC's... shall we say
> inapropriately? :-)
> 
> Obviously users couldn't use their modified fds in any other
> machines....

Quite.

There are BIOS modifications and network-boot ROMs and such that
accomplish this much better.

> PS I have no idea how the misalignment was actualy performed.

Probably by opening the FD unit, and adjusting the head position slightly
(say moving the physical head position one track towards the centre -
that way track 0, the boot track, on a normal floppy in completely
inaccessible.

A simple screwdriver job.

John
-- 
remember i was always true; remember that i always tried 
remember i loved only you; remember me and smile... 
for it's better to forget than to remember me and cry
:-p


Situation : 5 NT wks and 1 PDC. All of the wks log on automaticly.

When using Ctrl-A-Del it is possible to lock the workstation. We want to
disable CAD to prevent somebody doing this without knowing the password
(he won`t be able to unlock the workstation).

With Taskmngr it is also possible to kill tasks. Killing specific tasks
could mean killing production kritic processes.....
Disabling CAD in one way or another would solve the above mentioned
problems.

I found a Gina.dll which would capture CAD, this is doesn`t work. After
two CAD`s I get the famous blue screen with a mem dump...
Are there other way to capture CAD on a NT wks?

Somebody got an idea to disable the Ctrl-A-Del on the NTwks?


Jeroen Jansen
Consultant


DISCLAIMER: This statement is not an official statement from, nor does
 it represent an official position of, PTT Telecom BV.

>I am a newbie in this list so please excuse my ignorance.
>I joined here because somebody succeeded to delete my web page. The
>server runs on NT 4.0, SP3, IIS 3.0 and all hotfixes that I know about.
>I must say that I am not an expert in NT but I set this machine up,
>connected to the leased line and way it went... Until the deletion.
> I am sure nobody from my company did it since nobody knows the
>administrator password (7 letters if it helps).
>But I had the IIS wwwroot folder shared to exactly one person from my
>company (to be able to upgrade the price list every now and then - just
>to copy two files there). Still no chance that this person would delete
>files! Not that he was not able to, but I believe him. Please don't
>comment this.

It maybe discussed before but I`m also a newbie in this list.....
I found a way to delete the wwwroot (if the FTP service is running on
your site). I opened a FTP session (anonymous login) to a NT machine.
Because I installed a IIS server before, I could remember that the
default FTP users root is `inetpub/ftproot` and the default wwwroot was
just one directory back...so I tried `cd ../wwwroot`. And it worked. In
the wwwroot I got read as well as write rights....I was ABLE to delete
the whole site....

Jeroen Jansen.
jeroen.jansen@cmg.nl

DISCLAIMER: This statement is not an official statement from, nor does
it represent an official position of, PTT Telecom BV or CMG Noord
Nederland B.V.

Is anyone aware of a way to reboot a NTServer4.0 from a Win95 client local or remote?

Thanks for any help in advance...

James Hinders-Blue Chip Computers
Wright Patterson AFB ASC/YWIM
2240 B ST STE 7 WPAFB, OH 45433-7104
COM: 937-255-7209x223 FAX: 937-656-4651
DSN: 785-7209 Blue Chip: 299-4594


HKLM/Software/Microsoft/WindowsNT/CurrentVersion/Winlogon/PasswordExpiry
Warning: REG_DWORD

Please heed the standard warnings about mucking in the registry. I
believe that you have to create the Value of "PasswordExpiryWarning" and
type DWORD. Set the value to whatever your policy dictates.

My users were thrilled when we backed it down to 5 from the standard 15.
 Apparently "Password change anxiety" was causing a great deal of stress
around the office.

Chris

>-----Original Message-----
>From: roman.fischer@ubs.com [SMTP:roman.fischer@ubs.com]
>Sent: Thursday, July 24, 1997 11:39 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Password Change Notification
>
> Hi,
> 
> I read on MS TechNet that the Password Change Notification duration 
> cannot be changed. But I think that someone posted a registry key a 
> while ago to change or turn it off...
> 
> Anyone?
> 
> 
> Thanks a lot
> Roman
>
I recently implemented a certificate authority for my company. I want my 
web servers to check the certificate revocation list each time a client 
presents a certificate. How do I implement this on a Windows NT server 
running Netscape Enterprise 2.0?

The information about using the extensions in the certificates is very 
unclear to me. Any help would be greatly appreciated.

Thank You.

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

 
 
 ------------------------------------------------------------------------- 





>no I believe this is incorrect. I was under the impression that only
>changes are replicated. If you check out eventlog when netlogon reports
>sync changes it says 5 changes applied, 2 changes applied, etc.

This is right. Just in the case, the changes of the domaindb exceed a
certain amount (can be modified by registry) the complete db is replicated.
Just imageine the replication of the complete domaindb. The database often
is up to 20-30MB. In that case a complete replication in daytime can stun
your wan...

Wilko


John

There is a utility called 'sc.exe' that handles all services remotely, that
comes with the NT Server 4.0 Resource Kit.

Regards
Paul Snyman

----------
> From: John Rutkin 
> To: ntsecurityReturn requested 
> Subject: [NTSEC] Stop/Start Services
> Date: Thursday, July 24, 1997 10:17 AM
> 
> Excuse the off topic question..
> 
> Is there a command line utility that will enable me to stop/start NT
services 
> on remote boxes, I obviously have admin rights on all the relevent boxes.
> Sorry again as this is somewhat off topic.
> 
> Thanks
> 
> John Rutkin
At 05:44 PM 7/25/97 +0100, Artur Oliveira wrote:
>Try looking at http://www.iana.org for a document that describes all the
>known ports.

You will not find these ports listed (and if you do, they will be wrong).
These ports tend to be dynamic RPC services that are using TCP as the
transport. All NT boxes I have seen have two localhost connects between two
ports just above 1024 - these are some necessary RPC services that NT needs
to function correctly (from observation, not known for a fact). The UDP
service is more of the same kind of thing. What services and applications
are running on the box mentioned? It probably would not be too hard to
figure out which is listening on what port.

This brings up another question of mine: does anybody know of a program
like epdump.exe that actully spits out useful information (like rpcinfo on
unix)? If not, I will write one.

Dominique

>
>> -----Original Message-----
>> From: John Wells [SMTP:jwells@pacificcoast.net]
[snip] 
>> 1028/tcp
>> 1029/tcp
>> 1565/tcp
>> 1723/tcp
>> 6050/tcp
>> 
>> 1565/udp
>> 
>> Plus, the system seems to have a connection with itself between
>> 1026/tcp and
>> 1027/tcp (each listening to the other on localhost).

Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
I apologize for the intrusion.

Could someone please send me subscription instructions.

Thank you in advance.

Has anyone figured out how to overide the:

 Are you sure (Y/N)?

That is prompted when you use CACLS.EXE without the /e flag. This is
anoying since I want to script this? Is there a hidden flag, or another
utility to use in this situation?

 -- T.J. Fiske
 http://www.qualcomm.com
---------------------------------------+-------------------------------
Senior Engineer / Manager | 
QUALCOMM Incorporated | Perception IS Reality
San Diego, CA | 

I recently installed the simple tcp/ip services hotfix and now I receive
warning mesages in the system log each time I boot:

"The Simple TCP/IP Services could not open the UDP QOTD port. The UDP QOTD
service was not started." (Event ID 20)

This also applies to UDP Chargen (ID 18), UDP Daytime (ID 16), UDP Discard
(ID 14), and UDP Echo (ID 12) ports and services. I installed the hotfix
to remedy occasional lockup of my system.

I am running NT4.0 Workstation with SP3 and the available hotfixes on an HP
Vectra Dual PPro 200. I never got these errors before the hotfix. I have
not explicitly disabled any ports under TCP/IP advanced configuration.

Any clues? Should I just remove the hotfix and return to the earlier config?

I apologize if this is the wrong place to post this...

Thanks!

George Cameron
________________________________________________________________

George Cameron, Engineering Associate
Lawrence Livermore National Laboratory
cameron1@llnl.gov
Bldg. 3777 Room 1023
Tel: (510)422-4925 FAX: (510)424-4936 Pager 01926
Hi,

I have some questions regarding security of Microsoft RAS.

Remote Access Service using MS_CHAP
-----------------------------------

|-----------| |-------| |-------| |-----------|
| NT Client |-----| modem |----------| modem |-----| NT Server |
| | |-------| |-------| | as RAS | 
|-----------| |-----------|

1) NT client calls NT Server RAS and negotiate. Assume MS_CHAP is used.

2) NT Server sends 16 byte challenge (nonce) to NT client.

3) NT client replied with his encrypted password and nonce, then encrypt
the encrypted password together with nonce and send to NT Server.

4) NT Server encrypt the user 's encrypted password from User Account
database together with nonce.

5) If the values match, NT Server checks if the NT client has RAS logon
permissions.

6) If NT client has permission, it will be authenticated and allow to
access the RAS and network.

Questions
---------
1. Is the above steps correct for MS_CHAP?
 
2. How was DES used ? Which key is used to encrypt ?

3. Which password was used ? NT or LAN MANAGER password.

4. Why DES is used instead of MD5 for MS_CHAP because RFC defined MD5 as
the algorithm.


Please advise or point to some sites that have the answers already.


Thanks
Lup Kuen




[Double indent (>>) text came from Paul Leach]
At 01:05 PM 7/25/97 -0400, Russ wrote:
[snip]
>Paul, not to diminish your personal experiences, but 17 million lines of
>code is a lot of code, and that doesn't include the code for BackOffice,
>considerable in its own right. Then there's the interoperability issues
>resulting from years of third-party developer encouragement.

Ah, the nuances of security.

>Never-the-less, it has to be done and its being done, but its not just a
>matter of ensuring that every new line of code is produced securely.

Indeed, it is really not that easy. One must hear Bruce Schneier's talk
"Why Cryptography Is Harder Than It Looks." The same can be said for security.

>
>One of the oldest issues at Microsoft was the cross-product development
>issue. Different program groups developing different aspects of the OS.
>This is one of the reasons that Microsoft has implemented a
>cross-product Security team who, apart from being autonomous from any
>particular product group, have high level access to policy decisions.
>Issued raised by them are then forced down the food chain across all
>products. This has finally gotten enough recognition throughout
>Microsoft that it actually will be/is effective.

I guess they finally listened to me. I made the recommendation for exactly
such a team over a year and a half ago, but it fell on deaf ears for the
most part (though there were a few techies that were driving for the same
thing). Now I feel like a martyr.

[snip]
>>That's it. It's not very difficult. Less than a week's worth of 
>>developer education up-front too. It isn't expensive, it isn't hard,
>and 
>>it doesn't take a room full of rocket scientists.

It does not take a lot to teach a developer the basics of secure coding
practices, but that won't solve all the security issues. The product has to
be designed correctly in the first place, which is definitely not as easy
as it sounds. Plus, there can be implementation details that have very
subtle security implications that even a very good developer won't see.
Somethings will only be caught by a good security hack (or system
penetrator). The point being that it is not so easy to go back on an
existing product, and new products do call for a great deal of thought at
the design, feature definition, and implementation phase.
 
[snip]
>>It's been done.

Has it really (and am I taking this quote in the right context)?

>That's a far cry from a recommended solution, don't you think? There's
>lots of things I've made work, but I wouldn't ever do them again if I
>could avoid it. As I mentioned, there are several products which would
>do similar functionality (i.e. Global Internet's TNT). I have lots of
>Unix Admins who keep bugging me about being able to use SSH on NT, but
>when I ask them what they expect to do with it all they can say is that
>their going to install all of their Unix-like NT implemented tools on
>their NT boxes and run them like they do with their Unix boxes. I say,
>why not just replace the NT boxes with Unix boxes if this is what you
>need??
>
>Cheers,
>Russ

Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
I think the double indent text came from Paul Robertson (or some other
Paul), but not me.

> ----------
> From: Dominique
> Brezinski[SMTP:dominique.brezinski@CyberSafe.COM]
> Sent: Tuesday, July 29, 1997 7:43 PM
> To: Russ
> Cc: Paul Leach; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> [Double indent (>>) text came from Paul Leach]
> At 01:05 PM 7/25/97 -0400, Russ wrote:
> [snip]
> >Paul, not to diminish your personal experiences, but 17 million lines
> of
> >code is a lot of code, and that doesn't include the code for
> BackOffice,
> >considerable in its own right. Then there's the interoperability
> issues
> >resulting from years of third-party developer encouragement.
> 
> Ah, the nuances of security.
> 
> >Never-the-less, it has to be done and its being done, but its not
> just a
> >matter of ensuring that every new line of code is produced securely.
> 
> Indeed, it is really not that easy. One must hear Bruce Schneier's
> talk
> "Why Cryptography Is Harder Than It Looks." The same can be said for
> security.
> 
> >
> >One of the oldest issues at Microsoft was the cross-product
> development
> >issue. Different program groups developing different aspects of the
> OS.
> >This is one of the reasons that Microsoft has implemented a
> >cross-product Security team who, apart from being autonomous from any
> >particular product group, have high level access to policy decisions.
> >Issued raised by them are then forced down the food chain across all
> >products. This has finally gotten enough recognition throughout
> >Microsoft that it actually will be/is effective.
> 
> I guess they finally listened to me. I made the recommendation for
> exactly
> such a team over a year and a half ago, but it fell on deaf ears for
> the
> most part (though there were a few techies that were driving for the
> same
> thing). Now I feel like a martyr.
> 
> [snip]
> >>That's it. It's not very difficult. Less than a week's worth of 
> >>developer education up-front too. It isn't expensive, it isn't
> hard,
> >and 
> >>it doesn't take a room full of rocket scientists.
> 
> It does not take a lot to teach a developer the basics of secure
> coding
> practices, but that won't solve all the security issues. The product
> has to
> be designed correctly in the first place, which is definitely not as
> easy
> as it sounds. Plus, there can be implementation details that have very
> subtle security implications that even a very good developer won't
> see.
> Somethings will only be caught by a good security hack (or system
> penetrator). The point being that it is not so easy to go back on an
> existing product, and new products do call for a great deal of thought
> at
> the design, feature definition, and implementation phase.
> 
> [snip]
> >>It's been done.
> 
> Has it really (and am I taking this quote in the right context)?
> 
> >That's a far cry from a recommended solution, don't you think?
> There's
> >lots of things I've made work, but I wouldn't ever do them again if I
> >could avoid it. As I mentioned, there are several products which
> would
> >do similar functionality (i.e. Global Internet's TNT). I have lots of
> >Unix Admins who keep bugging me about being able to use SSH on NT,
> but
> >when I ask them what they expect to do with it all they can say is
> that
> >their going to install all of their Unix-like NT implemented tools on
> >their NT boxes and run them like they do with their Unix boxes. I
> say,
> >why not just replace the NT boxes with Unix boxes if this is what you
> >need??
> >
> >Cheers,
> >Russ
> 
> Dominique Brezinski
> ----------------------------------------------------
> My opinions expressed here, and in any public forum, 
> are my own and do not represent those of my employer 
> or its clients. I am an individual. 
> 
Jim Dennis wrote:
> 
> 
> >>The only way to attack such a system is to plug in a laptop in to the
> >>wire, but one could counter work this by using something like ssh :)
> >
> > And do what with SSH?? Come on, you going to run X through SSH, is that
> > what you're telling us?
> 
> This is a very common application of ssh (X11 forwarding).

Jim is correct. ssh is simply a way of connecting two machines together
with encryption of the data transferred between them. Any protocol can
run down them (X11, ftp, telnet).

The encryption adds an overhead, but you then basically have a secure connection.
The only way to attack these systems is to:
1. Crack the encryption
2. Manage to get the encryption key in the initalisation phase
 I don't remember how ssh does this off the top of my head.
3. Steal the entire session, and crack it off site.


1. Too hard for most encryptions, in the time a session takes place.

2. One common way, is for the client to request the servers public key.
It then encrypts its public key with the servers public key.
The server uses this to transfer a session encryption key.

They use RSA for the initial transfer, and DES etc for the session encryption.
This is because RSA encryption is expensive (too expensive to use in a session),
and the DES is quicker, but not as secure.

3. If the data you are transferring (including passwords), is very valuable, people
can steal it and crack it off site. [ Of course it may not be worth anything when
they do crack it]. The encryption normally assumes that no-one can crack it during
the session. ( Some algorithms negotiate new keys intra-session to enhance this, 
but does not help if they are cracking off site, cause you can read the new key)

 -mouse

-- 
Tim Smithers.
DMouse Pty. Ltd.
ph: 0414 366 873 (Mobile)
ph: +61 2 9351 5698
e-mail: mouse@mml.usyd.edu.au

( Perfection is a hobby many pursue,
 but few have a chance of success )
Michael & John,

Read the SP3 release notes. The change to SMB dialect negotiation in
SP3 is why your smbsrvr won't work. It's a security fix that many on
this list and in other places requested.

As to the ports, 1028 and 1029 are likely RPC ports for managing server
services. The RPC endpoint mapper at port 135 gets queried by a client
for the port to talk to for a particular service, the endpoint mapper
returns back the appropriate answer (1028 or 1029 or whatever) and the
client opens a socket to that port (which must, consequently be
listening). Since the RPC endpoint mapper allocates ports sequentially
starting at 1024, it is logical to see ports close to that listening.
Since every time a new service is registered the port allocated is
implemented, if you start and stop things like the server service, the
messenger service, IIS, etc., you will see the ports that are listening
increment. There's a resource kit utility whose name slips my mind that
will report the services attached to each of those high ports.
The loopback connection from 1026-1027 is the same thing most likely.

I know I've seen 1723 before, but can't recall where. The others ....?

regards
Andy


======================================================
Andy Webb "Mauve has more RAM." - Dilbert
awebb@swinc.com Simpler-Webb, Inc. Austin, TX
======================================================

> -----Original Message-----
> From: Michael A. Syiek [SMTP:msyiek@andovercg.com]
> Sent: Friday, July 25, 1997 11:26 AM
> To: John Wells; NT Security
> Subject: Re: [NTSEC] Why is NT listening on these high-numbered
> ports?
> 
> i've been wondering about that too. i am currently unable to see
> smbsrvr on my network when we have sp3 installed. we are currently
> forbidding service pack 3 installs until we can sort out why this is
> occurring.
> 
> boris
> 
> John Wells wrote:
> 
> > I have an NT 4.0 SP3 system which is currently running Netscape's
> Mail
> >
> > Server and BIND (plus evaluations of two proxy servers). Yet when I
> > run
> > "netstat -a" I see that the server is listening to high-numbered
> ports
> >
> > which, in addition to those used by the proxy servers, include a
> > number
> > which I know nothing about:
> >
> > 1028/tcp
> > 1029/tcp
> > 1565/tcp
> > 1723/tcp
> > 6050/tcp
> >
> > 1565/udp
> >
> > Plus, the system seems to have a connection with itself between
> > 1026/tcp and
> > 1027/tcp (each listening to the other on localhost).
> >
> > I checked these ports against a list of "known" ports
> > (www.cavebear.com?),
> > and either they weren't included, or obviously didn't match the
> > entries in
> > the lists.
> >
> > Can anyone explain what services might be listening on these ports?
> > Alternatively, is there a way to determine which process/service is
> > listening on a particular port?
> >
> > Thanks,
> >
> > John Wells
> > jwells@pacificcoast.net
> 
> 
John, I think you really were only questioning the first two, 1028 and
1029, cause the others are all services/protocols which you must be able
to see in your system configuration. I'll assume you inherited the box,
but if you didn't, and installed all this stuff yourself without the
knowledge of what it was going to do, I'd say you've got bigger problems
than just what ports are being listened to.

> 1028/tcp
> 1029/tcp

Probably "Managers", like IIS Manager, NT DNS Manager, MS Exchange
Manager, etc... RPC-based services dynamically assigned listening ports
at boot/service startup.

> 1565/tcp

WinDD, from Tektronix, you know, that big thing running as a service??

> 1723/tcp

PPTP, Point to Point Tunneling Protocol

> 6050/tcp

Part of the X11 suite, more than likely part of the WinDD subsystem.

> 1565/udp

UDP component of WinDD

> I checked these ports against a list of "known" ports
> (www.cavebear.com?),
> and either they weren't included, or obviously didn't match the
> entries in
> the lists.

Either www.cavebear.com isn't up to date, or you're saying your not
running WinDD or an X-Windows subsystem, and that you don't have PPTP
installed as a network protocol??

> Can anyone explain what services might be listening on these ports?
> Alternatively, is there a way to determine which process/service is
> listening on a particular port?

The best way to do this is to install the system yourself, and read
about what you're installing before you install it. There is a utility
which will list what is listening to RPC EndPointMapper requests (calls
to TCP135 that get redirected to listening ports, statically and
dynamically created) called EPDUMP.exe, written by Microsoft but
unsupported. You can get this program by emailing me and including the
word EPDUMP in the subject line. Anything else you send in such a
message will be ignored, but the file MSEPDUMP.ZIP will be mailed to you
in reply.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

A list of 18 exploits in 2 years?? 5 of which are IIS specific?? and
you're saying this many scares the pants off of Enterprise types, give
me a break. Like the list for any particular flavor of any other OS
isn't as long, or longer, for the same period of time.

I think your enthusiasm hoping to convince people to switch away from NT
is a bit overblown. Heck, if we don't see that many more before the year
is out I'll be disappointed. Of course you don't seem to care what the
exploit is, what its potential effect or damage can be, how easy it
is/was to prevent it, how many of them were prevented through other
"normal" security measures, or how quickly fixes were available. That
would dampen your point, wouldn't it, and you wouldn't want to do that.

Maybe you should try to be a bit less subliminal with your message next
time, or at least do enough research to make a point worth making.

Enterprise types are working on issues that Fyodor's Playhouse can't
even imagine, and in my experience, they mostly wish that all their
desktops had as much security as NT has today. What kind of enterprise
are you working in/with anyway?

Sorry ISS, didn't mean to get back on the band wagon, just can't seem to
let these snipes go by unopposed.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

as I saw Microsoft released Supplement 2 of the NT 4.0 Resource Kit. It 
contains quite a bunch of new & interesting tools. I copied this from their 
webpage:

"On the first disc, you get:

•Fourteen completely new tools, including:

- - Reg.Exe--a consolidated command-line registry manipulation utility that 
replaces and improves on eight of the current registry utilities
- - SrvMon.exe--A tool that monitors any service on any machine and sends e-
mail and/or a paging signal when the service stops or starts
- - FileWise.Exe--a GUI-based file version extraction tool. Operates on
single 
files and entire folders and provides more file information than any current 
tool
- - NetDom.Exe--A full-featured command-line domain management utility
- - AuditPol.Exe--A command-line tool for modifying the audit policies on
local 
or remote machines
- - Waitfor.Exe--A batch command, with easy-to-use syntax, for synchronizing 
batch processes between remote machines over the network
- - Translate.Exe--A very useful command-line tool that simply translates 
obscure return codes from Win32® to error messages that are readable by 
humans

•More than 18 updated and enhanced tools

•The latest information on:
- - Point-to-Point Tunneling Protocol (PPTP) technology and how to implement, 
install, and configure it on Windows NT
The Windows NT Registry and system error message descriptions

On the second disc, you get:
•Hundreds of megabytes of valuable information directly from TechNet"

(from: http://mspress.microsoft.com/mspress/Books/Abs/1358.HTM)


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBM97hlDMtLCX5yPzjEQL++QCfdpSLL4k3scedumx1Nz02EZyN41YAn0ue
fdv4tLvH0YDnHic+XkNZXecK
=t9eR
-----END PGP SIGNATURE-----

 \^o^o/
 ,^ ( ..)
---------------oOOo--| \ \--oOOo----------------------------
 '''' \ `^--^ ''''
Donald van de Weyer \ \ \
 ^--^
e-mail: donald@demag.rwth-aachen.de
talk: donald@daiquiri.demag.rwth-aachen.de
WWW: http://users.demag.rwth-aachen.de/donald/
PGP: send a mail with subject: "get public key"
 PGP 5.0 mail preferred

 .oo0O O0oo.
 ( ) ( )
------------------\ (-----) /---------------------------------
 \_)___(_/
 ^\ |___|
 \ `^^^__ /
 `------/
> Turn on RAS specific auditing. There are two RAS-specific logs.
>These logs are the PPP log and the device log. The PPP log records all PPP
>events. The device log records all communications from the serial ports to

Thank you, thank you, thank you....

I've sat quietly and patiently watching several million (okay, I'm prone to exaggeration) messages go by over the last few days, going into great depth about whether it takes 14.753 light years or can be reduced to 1.8 light years if the password's less than 14 characters and I employ a few thousand redundant machines and sneak in some parallel processing blah blah 1024 bit key blah....

And then this one comes along... I've been searching for this information for 2 months now, but didn't ask *this* list because I thought it had little to do with security...

Just thought I drop a note of appreciation, and I don't care if 'appreciations' are off-topic, I'd happily read a thousand off-topic messages to find another piece of information like you've just imparted upon us... ;-)

Thanks again

Bob


VIRUS WARNING: 

A message was received which contained a virus:

 From: Allan McDonald
 Address: mcdonald@onramp.i2k.com
 Date: 25. júl 1997
 Time: 23:18:41
 Subject: [NTSEC] [Fwd: You may want to see this page]

This message contains 1 virus:

 Unknown infected with the â? virus

This message was generated by ThunderBYTE Anti-Virus for MS Exchange
 http://www.thunderbyte.com/aboutmx.html
On 25 Jul 1997 C.Toth@keene.k12.nh.us wrote:

> does anyone know how to intalla modem that plugs into an ISA slot
> manually (without plug and play) in Win95.
> Chris Toth
> 
no problem at all... just enter manually the com port and modem type - may
be hayes compatible will work for you. my modem also isn't plug'n'play,
but it works all right for years...

Yours truly,
 Stanislav Grozev
 (aka Tacho)
 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
 There are two ways of success: | "Why be a man when you can be a
 1. Don't reveal all of | success?"
 your secrets. |
 2. | -- Bertold Brecht
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Public PGP key available on request - finger tacho@comm.uni-svishtov.bg.

Hi there NT Gurus!


I hope somebody can help me to understand an strange logging in my event
log. The reson I start wondering about this, is the time of the day
(Night), when NO one uses this server.

EventID 4005
Source: perfctrs

Load of INETMIB1.DLL failed. Make sure the DLL file is in the PATH.
WIN32 Error number is returned in the data. 

As far as I can understand, it is a module for performance monitoring,
but I don't have any active performance monitors at the moment.

What cind of DLL is INETMIB1, and why is it loaded in the middle of the
night. For the record, the server was not restartet at this point.



Regards

Bjørn Arne
Why am i receiving two copies of each message posted in this mailling
list????

Far too much "I can do the math better than you can" macho 
cryptography flash.

Far too much "Microsoft was stupid/evil to do it this way."

I've been in the business almost thirty years, and have never been
attacked by brute force, and have never had the least interest in
theoretical issues.

There's lots of good, useful, nuts-and-bolts traffic on the list, but I
don't have the patience to parse the posturing.

BTW, I don't mean to attack you, and thanks for hosting the list. 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
David A. Smith Netword LLC
Director of Operations 703-516-4610
david@netword.com http://www.netword.com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Is that a security question?

I didn't get it?

Rodrigo

----- Mensagem original -----
De: C.Toth@keene.k12.nh.us [SMTP:C.Toth@keene.k12.nh.us]
Enviada em: Friday, July 25, 1997 9:09 PM
Para: ntsecurity@iss.net
Assunto: [NTSEC] Installing a modem in Win95

does anyone know how to intalla modem that plugs into an ISA slot
manually (without plug and play) in Win95.
Chris Toth


Hi,

I don't have much experience with NT, so pardon me if this question is very
basic.

If I have an NT service, I understand that I can optionally provide an
account and password for the service to run under. I assume it is good
practice to change the service password on some regular basis. If I'm
storing a copy of the password for the service in this way, how can I
programmatically update the copy of the password (securely of course)?

In general, is it bad form to make use of this service password feature? If
so, what are other ways that a process can store and recall a password by
which to authenticate?

Thanks in advance,
Jane Marcus
jane@apollo.hp.com

 Since this is a forum for Windows NT Security you may not get many 
 responses.


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Installing a modem in Win95
Author: C.Toth@keene.k12.nh.us at Internet
Date: 7/25/97 8:09 PM


does anyone know how to intalla modem that plugs into an ISA slot 
manually (without plug and play) in Win95.
Chris Toth
DHCP Manager's Active Lease dialog displays current IP address
assignments. Is there a way to view this list (querying the active
lease, in effect) from another computer--one that is NOT running DHCP
Manager? My NT Workstation, for instance?

 - H2Os -
This has to be a bad feature or bug if no command line equivalent is
available:

I would like to have a command line equivalent to the following mousing
movements:

Control Panel|System|User Profiles|Copy To|Location for Copy Profile
To|Change "Permitted to use" entry and execute.


This will allow me to copy the open profile to anything else and then
back it up. Anyone have any insights?



Chance.

On Sat, 26 Jul 1997, Russ wrote:

> Will Memphis support NT c/r, not likely, especially since Kerberos will
> be available on NT within a similar time-frame. Will Memphis support
> Kerberos, yeah, but geez, what do you do about all those Win3.x, WfWg,
> and Win95 boxes that didn't come with a Kerberos authentication
> mechanism??

You take all the 3.1 boxes and install Linux on them :) (ducking the
flames) :)

How about getting Microsoft to write new LM clients for these boxes? If
not, someone else could make a nice bit of money selling security. :) 

Hey, why not. Microsoft itself did the same thing for the Macintosh File
and Print clients. There's a nice Microsoft UAM extension for Macs that
uses Microsoft authentification instead of clear text. Why not implement
the same for Win31?

=====================================Kaos=Keraunos=Kybernetos================
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see you|./|\.
..\|/..|sunder@sundernet.com|once again. I thought you were hiding. |/\|/\
<--*-->| ------------------ |And you thought that I had run away. |\/|\/
../|\..| "A toast to Odin, |Chasing the tail of dogma. I opened my eye|.\|/.
.+.v.+.|God of screwdrivers"|and there we were.... |.....
======================== http://www.sundernet.com ===========================





--
*******************************************************************************
Bear Stearns is not responsible for any recommendation, solicitation, offer or
agreement or any information about any transaction, customer account or account
activity contained in this communication.
*******************************************************************************
At 20:09 7/25/97 EDT, C.Toth@keene.k12.nh.us wrote:
>does anyone know how to intalla modem that plugs into an ISA slot
>manually (without plug and play) in Win95.

Please don't send questions like this to the NT security list. It has
nothing to do with NT or security.

comp.os.ms-windows.misc would be a better place to ask this.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

I don't really feel that I can agree with assertion that software
security does not need to be stronger physical security. Different
environments have different threat levels on the various system
vulnerabilities.

In the current age it could be argued that the likelihood of a software
(i.e. network) based attack is much higher for the common environment.
In response we implement strict firewalls and gateways, dial-ins are
locked up, and rogue modems inside the firewall are smashed on sight.
In some respects this actually lowers security inside the firewall in
many organizations because they rely on the firewall and become willing
to accept larger risk factors on equipment inside. We all know this is
a cardinal sin, but that doesn't mean it doesn't happen.

This makes the "temp agency" a great means of attack.

On the hardware side vendors are catching on to our desire for security.
 Micron machines, for example, ship standard with a padlock receptacle
that makes it fairly difficult and obvious to get into the box. I would
argue that this was really done to help stem the massive RAM theft
epidemic (even physically secure sites have been hit by this), and in
this case we should count it as benefit.

So where are we at now? Between locking cases, BIOS floppy lockouts,
and robust filesystems I would say that physical security is pretty darn
tight. Maybe my argument is moot and it's time for software security to
catch up.

The name of this thread (it was "win95 security") is beyond laughable.
Windows 95 never has been, nor has it ever wanted to be, secure. Any
discussions about the security of Windows 95 would appear to be a waste
of our time (isn't this the "Windows NT Security Mailing List"). This
doesn't mean that Windows 95 has no place around here, because it does.
Most of us still have to work with Win95 in our networks. NT 5.0 may
allow us to secure our laptops, but that is a ways away at best.

As far as NT on the laptops (the machines that really need it) the
biggest issue has been software. Now with the strong rise in NT that
issue will hopefully clear out. The price point for NT is great for
what it brings to the table. I run several Linux servers and in reality
they are more expensive than the NT boxes because of the time factor (I
don't work cheap).

I'd like to wind up this rant with some questions that are really
relevant to this forum.

What are our real issues with ensuring desktop and server security in an
NT environment?

What can Microsoft do in NT 5.0 to really make our lives easier and more
productive?
(Things like remote or loading of service packs, more granular control
of services...)

What are the realistic avenues of attack on an NT based network?

Will Microsoft change NT so that it is shipped more secure out of the
box and has to be _unsecured_ for relevant environments? Can they do
this without causing undo frustration and problems associated with the
vast shortage of experienced NT admins?

Chris

IMNSHO It is a waste of time to whine about past grievances with
Microsoft. It does us all more good to help each other bring up our own
level of security, and to provide feedback and criticism so that
Microsoft can improve the security in NT.

>
>What I said was that the software security didn't need to be any
>stronger than the physical security. The _obvious_ corollary is that if
>and when physical security is strong, the software needs to be equally
>strong (but no stronger) if it is to support that configuration well.
>
>If Andreas had been interested in holding a civilized discussion instead
>of sneering at Microsoft, he could have just asked "does that or does
>that not imply that when physical security is strong, the system
>security should be equally strong" (or something to that effect) and I
>would have said "yes". 
>
>And I didn't say that physical security was always weak or always the
>weakest link; but I certainly believe that it is often very weak.
>
>I beleive that NT 4.0 with the latest service packs and hot-fixes is
>secure enough so that, if the appropriate physical security measures are
>taken for a user workstation, it can be configured so that an
>_unauthorized_ user will not be able to log in to that workstation.
>
I have a question concerning secured access to an IIS intranet server
from the internet...

We have intranet servers on our LAN that we would like to provide access
to (via the internet) for our remote sales staff (confidential content
on the intranet servers). Our LAN is 'protected' by a firewall (Raptor
Eagle v4) from the internet. We are utilizing a Security Dynamics
SecurID authentication server (ACE) for remote access authentication
thru the firewall (but not on the http protocol).

What we are having problems with is providing 'secured' access to the
intranet server from the internet. We do not want to have to have our
internal LAN users (250+) be required to use SecurID tokens (expense and
inconvenience) to access our intranet servers. 

Is there a configuration/product out there that we can use to provide
secured access, thru our Raptor firewall, from the internet to our IIS
intranet servers?

Thanks in advance,
Tim Averbeck, Network Services Manager, Firstlogic Inc.
Hi,

I have some questions regarding security of Microsoft RAS.

Remote Access Service using MS_CHAP
-----------------------------------

|-----------| |-------| |-------| |-----------|
| NT Client |-----| modem |----------| modem |-----| NT Server |
| | |-------| |-------| | as RAS | 
|-----------| |-----------|

1) NT client calls NT Server RAS and negotiate. Assume MS_CHAP is used.

2) NT Server sends 16 byte challenge (nonce) to NT client.

3) NT client replied with his encrypted password and nonce, then encrypt
the encrypted password together with nonce and send to NT Server.

4) NT Server encrypt the user 's encrypted password from User Account
database together with nonce.

5) If the values match, NT Server checks if the NT client has RAS logon
permissions.

6) If NT client has permission, it will be authenticated and allow to
access the RAS and network.

Questions
---------
1. Is the above steps correct for MS_CHAP?
 
2. How was DES used ? Which key is used to encrypt ?

3. Which password was used ? NT or LAN MANAGER password.

4. Why DES is used instead of MD5 for MS_CHAP because RFC defined MD5 as
the algorithm.


Please advise or point to some sites that have the answers already.


Thanks
Lup Kuen



david pederzoli wrote:
> 
> When someone write "assign user right from command line" I think he' s
> meaning the user right you can find in "user manager for domain", second
> selection, user rights, in which you can assign the "logon locally" user
> right, "act as part of the operating system" user right, etc etc.
> 
> Does anyone out there eventually know if there is a utility like that ?
> 
> I'm very interested in it too !
> 
> Thanks very much
> 
> ----------
> > Da: ryan25@hooked.net
> > A: zeller@indiana.edu
> > Cc: strops@well.com; ntsecurity@iss.net
> > Oggetto: Re: [NTSEC] Need utitlity to assign user right from command line
> > Data: sabato 26 luglio 1997 14.43
> >
> >
> >
> >
> >
> > Zeller, Tom S wrote:
> > >
> > > cacls.exe comes with nt. it allows use of f,c,r rights. for full
> > > flexibility use xcacls.exe that comes with the addendum to the server
> > > 4.0 resource kit.
> > >
> > > > -----Original Message-----
> > > > From: Jay Urbanski [SMTP:strops@well.com]
> > > > Sent: Wednesday, July 16, 1997 3:17 PM
> > > > To: ntsecurity@iss.net
> > > > Subject: [NTSEC] Need utitlity to assign user right from command
> > > > line
> > > >
> > > > Well the topic says it all. I need to grant advanced user rights
> for
> > > > a 6000 server roll-out, and I don't look forward to doing click,
> > > > click, click 6000 times. Does anyone know of a utitlity to grant
> user
> > > > rights to groups and users from a command line?
> > > >
> > > > Jay Urbanski
> > > > strops@well.com 
> > > >
> > Adduser.exe sets up gobal and local groups fro the command line. This
> > could also be useful. It is in the NT resource group. I have found
> > using the the "for /f" command an appropriate way to process lists of
> > names.
> >
> > --=_005BD0FDC12564E000407089C12564E0_=--
Someone claimed there was a utility to assign user rights specifically.
There is a utility called Addusers.exe (NT resource Kit) which will add
your users to a global or local group. I am reasoning that if you had
assigned that group specific rights, those users in that group would
have those rights.

I'll admit I'm a little unclear on how to batch that out:

Addusers syntax is like this:

ADDUSERS [/?] [\\computername [[/c | /d | /e] filename]] [/s:?]

 /? Display this help screen.
 /c Create accounts specified in the file.
 /d Write current accounts to the specified file.
 /e Erase user accounts specified in the file.
 /s:? Sets the seperator character for the input/output file. Replace
the
 ? with the character to be used for seperating fields. (eg /s:~)
 Note: The seperator character is a comma ',' by default.

Where filename is the list of users,groups,etc to be added to the
\\computername. My idea is that a globalor local group could be
createded and assign certain rights. Then (through addusers) any number
of users could be added to that group. 

Whenver I have to process large lists I use the "for" command like
below:

FOR /F ["options"] %variable IN (filenameset) DO command
[command-parameters]

This allows me to conditionally process long lists (in filenameset). 
For example:

for /f "eol= delims= "%%i in (C:\dommachines.txt) do addusers %%i /c
NewGRP.txt

would add to all the machines listed in "C:\dommachines.txt" (one at a
time as %%i) to a new global or local group (i.e. Users) that would
have been given the appropriate rights.

Now that I've opened my fat mouth, I'm going to actually have to see if
I can make this work.

One things that's getting lost here is the simple fact that budgets are
finite things. The cost of converting to NT goes beyond licenses and
bodies -- the additional resources required by NT mean that we'd be
converting useable WFWG and lame 95 boxen to crippled NT boxen. It's a
catch-22 -- the funds are there to upgrade the hardware or the software
but not both. To say that NT does it (which is another debate) so we 
won't fix 95 doesn't help -- it'd be fun to own Lamborginis but I'm 
having enough trouble trying to keep the VWs we've got in spark plugs.

[Paul -- you needn't duck. I don't intend this as a flame, just a 
reality check... ]

 warren

Warren Auld
State of Missouri
Dept of Labor and Industrial Relations
MIS


On Sun, 27 Jul 1997, Alan Raymond wrote:

> Paul Leach wrote:
> > 
> > Until there is a demonstrated demand for better security on Windows 95
> > that can't be best met by Windows NT, then it's that simple.
> > 
> > Especially if, as Dave Leblanc noted on this list recently, when cost of
> > ownership is factored in, Windows NT is actually cheaper.
> > 
> One interesting computation for you quantroids out there is to figure
> how much in people time it takes to boot Win95 vs. WinNt. The trick
> here is to note that WinNT is much more stable than Win95 so you need
> fewer boots per day. Yes the BSOD does exist, but how many ways does
> Win95 go down, lock-up, go to never-never land, and just make you
> wonder????
> 
> It may be easier to sell NT to Management using uptime figures (people
> productivity) than security. Alan
> 

 subcribe

 Hi all,
 
 At least you can always count on Micro$oft for a good laugh - in this 
 case not their own fault.
 
 The following text has been taken from "BackOffice News - Tuesday, 
 July 29, 1997"
 
 - Start quote -----------------------------------------------------
 
 COBB GROUP TIP OF THE WEEK
 http://www.cobb.com/ewn/cuvyeu.htm
 
 The following tip is presented by The Cobb Group, publishers of 
 EXPLORING WINDOWS NT. For a FREE issue of EXPLORING WINDOWS NT, visit 
 their web site today. 
 
 CREATING PASSWORDS THAT ARE EASY TO REMEMBER, BUT HARD TO CRACK You 
 can use a simple character substitution scheme to create a password 
 that's easy to remember but hard to crack. First, think of an 
 easy-to-remember two- or three-word phrase. Substitute the numbers 0, 
 1 and 5 for the letters O, L and S, respectively. You can also replace 
 spaces (which are normally illegal in a password) with a 
 non-alphabetic character such as a tilde or an ampersand. Use 
 uppercase letters for vowels and lowercase letters for consonants. 
 With this system, an easy-to-remember but hard-to -crack password like 
 "the bulls" becomes thE&bU115. 
 
 - End quote -----------------------------------------------------
 
 Perhaps they should have read any number of articles going back to 
 "Foiling the Cracker: A Survey of, and Improvements to, Password 
 Security" from way back in 1989.
 
 Tragically, I have seen some company policies on password security 
 having equally bad examples.
 
 At a previous workplace, we had a healthy competition in setting 
 convoluted and weird admin passwords that were extremely hard to crack 
 (let alone remember). Only once did we get "The Professor" struggling 
 to remember a password. BTW - this is not good competition if people 
 are allowed to write down the password.
 
 Keeps me in a job (If only I had a life),
 :)
 Matthew

davidpederzoli writes:
> 
> In NT a service is not manageble by a user. Or, however, there are same
> services yon can stop but not start, or start but not stop , or you cannot
> start and stop if you are just a user, with no admin privilegies.
> I looked for some parameters in order to change this behaviour. I mean, I
> wanted that an ordinary user could start a particular service if this had
> failed ( i.e. the SnaBase service ). I did not succed.
> 
> Anyone can help me ?
> 
> In general I'm looking for a way to customize the privilegies on the Nt
> services so I can decide who can start and stop a particular service.

I haven't played with this, but according to the SDK, there is an ACL
associated with each service that determines who can do which
operations on that service. As far as I can tell, there is no user
interface to allow the ACL to be manipulated, but there are functions
documented in the SDK that provide a way to change it so presumably
you could write your own program to do it. Search for
SetServiceObjectSecurity in the SDK.


-- Jeff
It works fine for me using NT 4.0. However, there has been some news in
some lists that indicate that there are *TWO* SIDS to be concerned
about, one representing the original *permanent* SID generated by the OS
when the WS is prepared (provided during the GUI portion of the install)
and one generated by the PDC when the WS joins the domain. You can use
the getsid program to verify this. NT 5.0 may have problems with this
issue but I have not seen any concrete evidence. Most of it has been
somewhat hearsay. There are also security implications with cloned
workstations having similar SID's for their workstations. I suppose
more elaboration is needed to help you with this issue. On a final
note, GhostSoft has promised to release a utility or a new verion of
GHOST that will generate a unique SID for the cloned workstations.

Chance. 

> -----Original Message-----
> From: Paul Warren [SMTP:P.Warren@its.unimelb.EDU.AU]
> Sent: Sunday, July 27, 1997 7:59 PM
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] double sid's installing workstations
> 
> 
> At 09:08 AM 24/07/97 +0200, w.wessels@cc.ruu.nl wrote:
> 
> >Hello, maybe this is not a realy security related question but it
> burns in
> >my mind so i gave it a try.
> >
> >Situation: 
> >
> > - classroom with 25 computers ready to install NT workstation.
> > - 1 NT workstation with the appropiate configuration
> > 
> >Question, 
> >
> >What's the right way to duplicate the 1 installed workstation to the
> other
> >25 computers in the classroom?
> >
> >What will be the effect on SID and authentication when just making a
> copy
> >to all stations.
> 
> 
> Has anyone one got any views/information on the SID issue??? 
> 
> Microsoft state that they will not provide support for systems that
> have
> been installed by duplicating fully installed copies of either Windows
> NT
> Workstation or Server. They state that simply copying the contents of
> one
> hard disk to another would give each computer the same SID, making
> security
> impossible to maintain. For further information, read the Knowledge
> Base
> article: 
> 
> "Do Not Disk Duplicate Installed Versions of Windows NT"
> 
> 
> So what are the current implications for using programs, such as
> GHOST, to
> duplicate workstation configurations? Has anyone got any 'real world'
> experiences they wish to share?!?!
> 
> Regards,
> 
> 
> Paul Warren.
> 
> 
> _____________________________________________________________________
> 
> Paul Warren - Network Analyst | http://www.its.unimelb.edu.au:801/
> ITS - Networks & Communications | E-mail: P.Warren@its.unimelb.EDU.AU
> **The University of Melbourne** | Phone: 9344 4136 Fax: 9347 4803
> _____________________________________________________________________
> "The only place where success comes before work is in a dictionary!"
Does anybody know of a product that will allow an NT PDC to use 
Kerberos authentication for its accounts?

Example... We currently have Kerberos and NT (and other stuff) on 
campus, but they all have separate usernames & passwords. What I 
would like is for the NT DCs to query Kerberos for a password. 
Specifically, if a Win95/Mac/NT client connects to a server, then the 
server asks the PDC/BDC to validate the username & password. If the 
username exists in its SAM, then it would query Kerberos to validate 
the password, not the SAM. If it validates, then things proceed as 
usual.
--Robert

-------------------------+------------------------------------------
 Robert Kulp | Academic Computing
 Network Analyst | & Information Services (ACIS)
 Vanderbilt University | Voice : (615) 343-1612
 105 Stevenson Center | Fax : (615) 343-1391
 Nashville, TN 37240 | Email : Robert.Kulp@Vanderbilt.edu
-------------------------+------------------------------------------


I'm currently making a listing of all users/groups in the Domain SAM at
work in an attempt to tighten up group/user permissions and to aid this
I could do with a utility that will present me with a workable file of
all the accounts. 
I used the net user command, redirected the output to a text file, then
ammended the text file to run as a batch file running the net user
command for all domain users. 
However this solution is a bit clumsy and the results are not in the
best format for examining groups and users etc.

Is there a product available that will list the SAM database of the PDC
and present it in an organised fashion? Any suggestions would be
appreciated.

Paul.
Management bought into NT 2 years ago here because of the uptime and
stability issues. At that time I ended up moving the laptops to Win95
(also based on reliability costs). Since NT 4 I have moved several
laptops to NT, but the momentum is to leave them at 95 instead of
dealing with some of the software issues. Management also understands
that the Win95 machines require twice as much support time as NT
machines.

That has been the biggest supporting issue from the management
perspective: NT is simply more reliable. Management understands the
security issues of 95 (most of them run 95 laptops) but it has never
been enough of a concern for them to switch.

Support costs and reliability are the issues that management is going to
understand. These are numbers that fit and spreadsheet and add up.
Managers that will buy into an upgrade for "security" are rare.

Chris

- favorite Microsoft promo shirt of all time = "Windows 95 sucks less!"
May WfW die a miserable death.

Alan Raymond wrote:
> One interesting computation for you quantroids out there is to figure
>how much in people time it takes to boot Win95 vs. WinNt. The trick
>here is to note that WinNT is much more stable than Win95 so you need
>fewer boots per day. Yes the BSOD does exist, but how many ways does
>Win95 go down, lock-up, go to never-never land, and just make you
>wonder????
>
>It may be easier to sell NT to Management using uptime figures (people
>productivity) than security. Alan
Paul,

> So what are the current implications for using programs, such as GHOST, to
> duplicate workstation configurations? Has anyone got any 'real world'
> experiences they wish to share?!?!

At work, a couple of months ago, we had to roll out about 200 workstations
'yesterday'.

I saw several possibilities, being

1. Unattended installation with sysdiff
2. Complete unattended installation (including for the application
programs).
3. emergency-last ressort - ... solution: duplicate the HD's

We tried 1 and 2. But heck... if the oemsetup.inf of your (3COM TR) NIC
contains errors, and if you have 3 different types of machines to install,
it would take more time (a colleague of mine did it that way. After 3
months they succeeded. Now they can re-start from scratch)

We chose the last option. There are only 3 different machine SIDs on our
network, as we have 3 different HD's for the machines, and our program
only copies when C/H/S is *identical*. 
The master copies have funny names, and are in a funny WORKGROUP.
Takes 6 minutes to copy the HD, and another 10 minutes to setup the
machine at the user's desk, mainly because we need to reboot 2 times.

Particularities: these are only WORKSTATIONs, they have their BROWSER and
SERVER service disabled. Although we already have more printers than
workstations, some users still feel they need to share their printer.
Then, we (have to) enable the server service (BTW is it possible to allow
someone to SHARE only his/her PRINTER ? Like in WfW ? It wouldn't help
much with this, but I've seen horror with people sharing their
directories...)

At the user's desk, we change the name, IP-address, LAA (MAC-address).
Reboot 1
Join the domain - SID on the DOMAIN is unique (or at least it should be)
Reboot 2
Logon to the domain, start user manager and add the user's global group
(domain) to the local PowerUsers group.

kr=


 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)



At 08:08 7/27/97 -0500, you wrote:
>Paul Leach wrote:
 
>> Especially if, as Dave Leblanc noted on this list recently, when cost of
>> ownership is factored in, Windows NT is actually cheaper.
 
>One interesting computation for you quantroids out there is to figure
>how much in people time it takes to boot Win95 vs. WinNt. The trick
>here is to note that WinNT is much more stable than Win95 so you need
>fewer boots per day. Yes the BSOD does exist, but how many ways does
>Win95 go down, lock-up, go to never-never land, and just make you
>wonder????
 
That's a good point. I figure I normally boot NT on average about once
every 0.02 days, and it takes 2-3 minutes to get booted and logged in, so
that's an average of 0.03 minutes/day. Win95 takes about 1-2 minutes to
boot, but need to be booted at least once/day, and sometimes 4x/day, so
that would mean that I'd be spending an average of maybe 5 minutes/day
booting Win95. Then you can figure in lost work. YMMV. If NT doesn't
like your hardware, YMWV. If Win95 manages to corrupt the file system on
the way down, add lots of extra time.

>It may be easier to sell NT to Management using uptime figures (people
>productivity) than security. Alan

I'd say both are big bonuses. OTOH, uptime and stability are why I dealt
with NT 3.1 (though it was SLOW).

IMNSHO, anyone installing Win95 in a desktop business setting (assuming
that you don't require software that just won't run on NT) needs their
heads examined. The lack of security, poor administrative capabilities
compared to NT, the fact that it won't keep the user out of several kinds
of trouble, and stability issues all make it a much worse choice than NT.
The extra $100 or so that NT costs you up front is peanuts compared to what
it will save you in the long run.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 20:28 7/26/97 +0200, you wrote:
>In NT a service is not manageble by a user. Or, however, there are same
>services yon can stop but not start, or start but not stop , or you cannot
>start and stop if you are just a user, with no admin privilegies.
>I looked for some parameters in order to change this behaviour. I mean, I
>wanted that an ordinary user could start a particular service if this had
>failed ( i.e. the SnaBase service ). I did not succed.

Who is allowed to stop and start services is determined by the DACL on the
service object itself. By default, only admins and power users are allowed
to do this. If you wish to change this behavior, you'll need to write code
to do so. I have code which will dump the DACL on a service, but I haven't
bothered to write code to change them.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

It could run a crack lib enabled version
of the passwd program, which would catch
things like 1's instead of l's if you like.

Yes, crack will speak 31337.

Well...that is, for unix machines anyway :)
Anyone tried doing their own
msgina.dll with similar functionality?

 Ryan

---------- Previous Message ----------
To: dleblanc
cc: andreas, ntsecurity
From: juolja@utu.fi ("Juha =?iso-8859-1?Q?J=E4ykk=E4?=") @ smtp
Date: 07/26/97 09:47:09 PM
Subject: Re: [NTSEC] Win95 sec

Unknown MIME transfer encoding 8BIT will be ignored
Content-Transfer-Encoding: 8BIT

> OTOH, lame passwords are not just a problem with NT - for example, SGIs come
> equipped with 4 default accounts for your hacking pleasure 8-)

 What are they thinking..? Nothing?-) Anyway, lame passwords are never
the system's fault but the users'! What can a system do to a password
such as F1na1e!, where the L's are replaced with ones (numericals)?
Quite much nothing, but still quite easy a guess...

-- 
Juha JÏykkÏ, juolja@utu.fi




 Why am i receiving two copies of each message posted in this
mailling list????

On Sat, 26 Jul 1997, Aleph One wrote:

> Date: Sat, 26 Jul 1997 19:30:09 -0500 (CDT)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

5 days of delay? Ouch. ISS needs to get either a faster machine or better 
listserver software.

> From: Aleph One 
> To: Ryan Russell/SYBASE 
> Cc: Ray Arachelian ,
> Paul Leach , ntsecurity 
> Subject: RE: [NTSEC] Win95 sec

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

>>You mean buy Windows NT 4.0, and then next year it will be 'if your 
>>worried about security by Windows NT 5.0' and then 9 months after that 
>>'if your serious about security by Windows NT 6.0' etc.. etc... ad 
>>nauseum. 
>
>> Snipping more lines, ad nauseum, about service packs, post SP fixes, new
>>>versions, along the lines of the edit-requests we all recently received.
>
>>Craig Brozefsky craig@onshore.com
>>onShore Inc. http://www.onshore.com/~craig
>>Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)
>
>
>Craig, your issue with new versions, patches, fixes and security updates
>occur with every operating system, including all of the major and minor
>varieties of Unix, other OSes/NOSes and Router IOSes. Choosing an old,
>irrelevant argument about M$ and it's penchant for bug fixing is pretty much
>a waste of time. It could be applied to every software manufacturer out
>there, including Sun, HP, Digital, and Cisco. But we all keep buying _their_
>software (many in the Chicago area seem to buy the aforementioned products
>and services from OnShore). As far as upgrade paths, all companies do the
>same, over time. There is no way for Digital to effectively support multiple
>versions of Unix, which is why they dropped Ultrix, forcing the upgrade to
>Digital Unix (on new hardware, one might add). Similarly, Cisco just
>forklifted all of their 7000 router users, informing them that the 7000
>chassis was no longer supported. All will soon either buy into the 7500
>series or go support-less.
>
>NT, at this point, has a LOT of talented people trying hard to punch holes in
>it's armor. Some do it because they hate M$, some do it because they
>genuinely believe in using a secure operating system. What counts is that M$
>_generally_ responds, in a timely fashion, to those security holes which are
>found and reported. 
>
>Actually, from your web site [a nice one, BTW], your company must do a good
>bit of work with NT and NT related products, and one can't complain too much
>about those paychecks, can they? Whether or not it is the best thing out
>there, lots of people are buying it, and some of us are making money on that
>trend.
>
>As much as it would be nice to have edited, readable replies and rebuttals,
>we should also try not to cloud issues with pointless, irrelevant arguments.
>Mudge's original note in this thread, and many recent ones, had a LOT of good
>information about encryption routines, cracking them, how to better secure
>your network/ computers, why NT has multiple authentication paths and how to
>tighten up that dirty little secret. Let's stick to that and learn.
>
>
>Micah O'Connor
>Sumitomo Bank Capital Markets
>micaho@sbcm.com
>www.sbcm.com


On Sat, 26 Jul 1997, Osiris wrote:

> 
> Absolutely. For those people who claim that security is so important,
> they *should* use a product with a C2 rating. (Instead of, for example,
> a B3 rating.) :-)
> 

Maybe you were being sarcastic and I just don't get it, but B3 is a
stronger rating than C2. In descending order it is A2, A1, B3, B2, B1,
C2, C1, D. There may be an A3 but I don't remember. 

> Is there any truth to the rumor that the *real* reason MS concentrates
> their efforts on NT security (as opposed to 95) is because....that's
> where the money is? All those slobs (myself, included, at least here at
> the office) that use 95 are only worth $XX.XX. However, large
> corporations - who often make a long-term commitment with MS - are worth
> $XXXXXX.XX and therefore....
> 

Win95 was not designed the same way as NT, hence security is totally
different on the two machines. NT has built in security, at the kernel
level, 95 is really just an extension of the ideas of Dos. If you really
want security it has to start at the kernel level, and Win95 just can't
offer that.

Artimage.-

Does anybody know if there is any NIS+ client for WinNT
or Novell?

Please contact me at: pirot@cti.gr

Thanks in advance,
Ipirotis Panayotis

I used GHOST on 130 workstations for a client. The trick is to take the
image before the workstation is added to the domain. After downloading
the image to a workstation, boot the machine (one at a time to avoid
name conflicts on the net) and do additional NT configuration (change
name to be unique, configure network if required, add groups to local
Administrators, etc). Some programs might also need tweaking (e.g.
McAfee VirusScan kept the image machine name for the Alert service).
All the workstations are up and running without issues. However, that
doesn't mean MS will support it.

Dan Nelson
Cambridge Network Solutions - Cambridge Technology Partners
V: 617.374.8344 F: 617.415.3300 mailto:dnelso@ctp.com


>-----Original Message-----
>From: Paul Warren [SMTP:P.Warren@its.unimelb.EDU.AU]
>Sent: Sunday, July 27, 1997 7:59 PM
>To: ntsecurity@iss.net
>Subject: Re: [NTSEC] double sid's installing workstations
>
>
>
>Has anyone one got any views/information on the SID issue??? 
>
>Microsoft state that they will not provide support for systems that have
>been installed by duplicating fully installed copies of either Windows NT
>Workstation or Server. They state that simply copying the contents of one
>hard disk to another would give each computer the same SID, making security
>impossible to maintain. For further information, read the Knowledge Base
>article: 
>
> "Do Not Disk Duplicate Installed Versions of Windows NT"
> 
>
>So what are the current implications for using programs, such as GHOST, to
>duplicate workstation configurations? Has anyone got any 'real world'
>experiences they wish to share?!?!
> 
>Regards,
>
>Paul Warren.
>
Naturally for this to work you will have to have a Telnet or RCMD 
server installed on the remote PC. We use the RCMD and it works well. 
 You can get if from the ResKit. Anyone have other packages that work 
better?

----------
From: Stephen Wiles[SMTP:swiles@empower.com]
Sent: Saturday, July 26, 1997 4:04 PM
To: 'John Rutkin'; ntsecurity
Subject: RE: [NTSEC] Stop/Start Services

net stop [service] or net start [service]

> -----Original Message-----
> From: John Rutkin [SMTP:John.Rutkin@bankerstrust.com]
> Sent: Thursday, July 24, 1997 3:18 AM
> To: ntsecurity
> Subject: [NTSEC] Stop/Start Services
> 
> Excuse the off topic question..
> 
> Is there a command line utility that will enable me to stop/start NT
> services 
> on remote boxes, I obviously have admin rights on all the relevent
> boxes.
> Sorry again as this is somewhat off topic.
> 
> Thanks
> 
> John Rutkin

Hi Ray,
 thanks for the note. The rdisk /s- does not back up the
HKEY_CURRENT_USER because it would run in the system context and not the
user context. We came up with a couple of other options that seems to
be successful:

1) using the regback utility to specificall back up just the SID of
interest. This creates a binary that REGREST can restore.
2) Use the regedit tool with the "/e filename.reg hkey_users" parameters
to dump the hkey_users file. Then replace the HKEY_USER/SID prefix
within the reg file with the HKEY_CURRENT_USER prefix. This step
creates an HKEY_CURRENT_USER file that can then be scopy'd to a network
drive.

Wew!! It was challenging.

Chance.

> -----Original Message-----
> From: Ray Arachelian [SMTP:sunder@brainlink.com]
> Sent: Thursday, July 31, 1997 3:48 PM
> To: Chance Neale
> Cc: 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] Backing up NTUSER.DAT on NTWS 4.0
> 
> On Mon, 28 Jul 1997, Chance Neale wrote:
> 
> > This procedure needs to be applied to about 12,000 NT 4.0
> workstations
> > in the near future. Has anyone here come up with a procedure to do
> this
> > on NT 4.0WS? Any help would be much appreciated.
> 
> Hmmm, if it were on the server (in a domain) rather than the
> workstation
> you could simply stop the Server service. Will stopping NetLogon kick
> users currently logged on off?
> 
> For servers, you could simply schedule something like this to run:
> 
> @echo off
> net stop server
> rdisk /s-
> xcopy %SYSTEMROOT%\Repair \\otherserver\repairinfo\machinename
> /s/e/v/h/c
> ntbackup [.....]
> net start server
> 
> 
> (Only other possibility off the top of my head for this is to write
> code
> that walks HKEY_CURRENT_USER and dumps it out to a file that can be
> reimported.) 
> 
> =====================================Kaos=Keraunos=Kybernetos=========
> =====
> .+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see
> |./|\.
> ..\|/..|sunder@sundernet.com|you once again. I thought you were
> |/\|/\
> <--*-->| ------------------ |hiding, and you thought that I had run
> |\/|\/
> ../|\..| "A toast to Odin, |away chasing the tail of dogma. I
> opened|.\|/.
> .+.v.+.|God of screwdrivers"|my eye and there we were....
> |.....
> ======================= http://www.sundernet.com
> ==========================
Boys, boys, this thread is getting mighty boring. Let's put some things
into perspective:

- On every commercial OS one must constantly install updates and patches to
keep the system secure, not just on NT. I work with Solaris, and it is a
very good OS IMO, but I still have to apply patches regularly.

- A difference is that security patches for other commercial OSes tend to
be more stable currently.

- (elitist statement coming) If one had any clue about security, then Win95
would never have been installed in the first place. I have never had Win95
on any of my work or private machines, because I care about security. You
are a moron if you think security and Win95 have anything to do with each
other. (there are factors of economics that play here, but if Win95 is part
of the system a hugh set of risks are introduced) 

- We can argue infinitely about the theoretical security of a system,
protocol, or algorithm, but the reality is that all types of machines are
broken into regularly. So, a vendor that can deliver a system that is
relatively secure even in the presence of poor administration
wins...period. I can tighten up a NT box pretty damn tight, as can I a
Solaris box, but they both fail pretty miserably in the absence of good
administration. Both also need third party products when actually trying to
deploy a useable secure system.

- Microsoft is still learning how to play this game (which admittedly some
other vendors already know how to play), but they are learning very
quickly. It is also a fairly rough game.

- In the future, we should discuss technical issues on their own, outside
of this context of what MS does or is.
 
Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
Can someone please tell me:
If I install the post-sp3 LanMan hash fix on every NT Server in my
domain (including PDC and BDC's), will Win95 clients still be able to
login to the domain, run login scripts, and connect to shared folders on
the NT servers?
Microsoft's KB article that accompanies the LanMan hash fix (Q147706) is
marvelously unclear on what affect it will have on down-level clients.

Thanks!
Vlad Mott


> -----Original Message-----
> From: David LeBlanc [SMTP:dleblanc@iss.net]
> Sent: Saturday, July 26, 1997 3:49 PM
> To: Who cares what the hell goes into a Gecos field anyway!;
> ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca
> Cc: Paul Leach
> Subject: Re: [NTSEC] Windows NT rantings from the l0pht
> 
> At 10:20 7/24/97 -0400, Who cares what the hell goes into a Gecos
> field
> anyway! wrote:
> 
> >4. The LM-hash fix works great if you don't have anything but NT
> machines
> >on your network. If you want to continue being "productive" with your
> >win95 machines it is my understanding that you "do it insecurely" or
> >you are S.O.L.
> 
> [snip-a-lot]
> 
> >Since installing the LM-fix precludes continued use of windows 95
> machines
> >in regards to talking to NT machines, it is still a moot point as to
> >how tough or well done the NT hash might or might not be.
> 
> If I'm not mistaken, the patch keeps NT from -sending- the LM hashes,
> not
> from accepting them. This would mean that only the Win95 boxes would
> be
> sending LM hashes in the first place, and your network will still
> function.
> The only place I can see getting things hosed up would be if you had
> a
> Win95 machine acting as a server, which isn't something I'd recommend
> in a
> secure environment (to put it quite mildly). 
> 
> Also, I could have missed something, but I'm not sure Win95 was ever
> patched against the downgrade attack, so I think you can still badger
> it
> into sending clear-text. Why waste CPU time cracking even the LM
> hashes
> when you can just read clear-text?
> 
> IMHO, MS ought to make a patch to Win95 that will let it send the NT
> style
> hashes, not allow itself to be downgraded, and we will be better off.
> Personally, I feel Win95 isn't something you want around if you care
> much
> about security, and that a pure NT network is a MUCH better idea, but
> I
> can't even seem to exterminate all the Win95 boxes HERE, sooo...
> (Hmmm -
> maybe I should set the patch on all of the NT boxes, and if it works
> like
> you think... nah - the other admin will kill me - slowly)
> 
> If you do need to crack the NT style hashes, then it is a bit more
> difficult. Another point is that if you've installed a sniffer on my
> network, then you've already accomplished a very significant breach -
> I'm
> owned somehow or another. Unless you've got some sort of network
> running
> nothing but ssh, once you get a sniffer going, I'm fairly well
> screwed. It
> is also the case that on all of the really secure networks I'm aware
> of,
> they use a completely switched network, and you can only sniff
> yourself
> (hope you've bathed lately...).
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
Hi,

I have some questions regarding security of Microsoft RAS.

Remote Access Service using MS_CHAP
-----------------------------------

|-----------| |-------| |-------| |-----------|
| NT Client |-----| modem |----------| modem |-----| NT Server |
| | |-------| |-------| | as RAS | 
|-----------| |-----------|

1) NT client calls NT Server RAS and negotiate. Assume MS_CHAP is used.

2) NT Server sends 16 byte challenge (nonce) to NT client.

3) NT client replied with his encrypted password and nonce, then encrypt
the encrypted password together with nonce and send to NT Server.

4) NT Server encrypt the user 's encrypted password from User Account
database together with nonce.

5) If the values match, NT Server checks if the NT client has RAS logon
permissions.

6) If NT client has permission, it will be authenticated and allow to
access the RAS and network.

Questions
---------
1. Is the above steps correct for MS_CHAP?
 
2. How was DES used ? Which key is used to encrypt ?

3. Which password was used ? NT or LAN MANAGER password.

4. Why DES is used instead of MD5 for MS_CHAP because RFC defined MD5 as
the algorithm.


Please advise or point to some sites that have the answers already.


Thanks
Lup Kuen



[More below...]

At 09:59 AM 28/07/97 +1000, Paul Warren wrote:

>At 09:08 AM 24/07/97 +0200, w.wessels@cc.ruu.nl wrote:
>
>>Hello, maybe this is not a realy security related question but it burns in
>>my mind so i gave it a try.
>>
>>Situation: 
>>
>> - classroom with 25 computers ready to install NT workstation.
>> - 1 NT workstation with the appropiate configuration
>> 
>>Question, 
>>
>>What's the right way to duplicate the 1 installed workstation to the other
>>25 computers in the classroom?
>>
>>What will be the effect on SID and authentication when just making a copy
>>to all stations.
>
>
>Has anyone one got any views/information on the SID issue??? 
>
>Microsoft state that they will not provide support for systems that have
>been installed by duplicating fully installed copies of either Windows NT
>Workstation or Server. They state that simply copying the contents of one
>hard disk to another would give each computer the same SID, making security
>impossible to maintain. For further information, read the Knowledge Base
>article: 
>
> "Do Not Disk Duplicate Installed Versions of Windows NT"
> 
>
>So what are the current implications for using programs, such as GHOST, to
>duplicate workstation configurations? Has anyone got any 'real world'
>experiences they wish to share?!?!

"Unverified" quotes taken from the GHOST Software forum
:

--------------------

"...As has been noted in other responses to this issue, Microsoft has an
article (Q162001) available both on their Web site as well as in Technet
that explains the problem with "cloning" NT. The MACHINE SID is created as
soon as the first GUI portion of the install begins. Any users created in
the LOCAL user database have a unique ID based on the SID and then the
equivalent of 1 then 2 then 3, for the first three local users. (Since
ADMINISTRATOR is always the first user created, it will be 1). 

Therefore the problem is that in a cloned environment (not just Ghost) the
ADMINSTRATOR SID is duplicated throughtout your environment. Anyone who
logs on locally (not onto the domain) can attach to the C$ (hidden share
for the C: Drive) of any other cloned machine, because that machine
believes the person attaching is it's own administrator. Passwords do not
have to match, as you have already been validated by your local machine.
Thus you have FULL ACCESS to all directly attached resources on all other
cloned machines.

I hope this clarifies what the security issue really is."


"...Microsoft claims the problem is in the Workstation SID and NT 5 will
need to have a unique workstation SID because it will use this via Kerberos
to connect the workstation to an NT 5 server or to upgrade to workstation
NT 5."

--------------------

Any further "constructive" comments on the security risks associated with
duplicate Workstation SID's???

Regards,


Paul Warren.


_____________________________________________________________________

Paul Warren - Network Analyst | http://www.its.unimelb.edu.au:801/
ITS - Networks & Communications | E-mail: P.Warren@its.unimelb.EDU.AU
**The University of Melbourne** | Phone: 9344 4136 Fax: 9347 4803
_____________________________________________________________________
"The only place where success comes before work is in a dictionary!"

As I said before, if you duplicate the workstation BEFORE YOU JOIN THE
DOMAIN... you will have no problems with SID'S, Ive done it and it works
fine. And as far as support, MS doesnt need to know you duped it. >-)
They cant tell the difference, unless you either do it wrong or you tell
them...

-----------------------------------------------------------
Joshua J. Soliz,MCSE
jsoliz@dpai.com
Network Engineer
DeCarlo, Paternite, And Associates, Inc.


>-----Original Message-----
>From: Paul Warren [SMTP:P.Warren@its.unimelb.EDU.AU]
>Sent: Sunday, July 27, 1997 7:59 PM
>To: ntsecurity@iss.net
>Subject: Re: [NTSEC] double sid's installing workstations
>
>
>At 09:08 AM 24/07/97 +0200, w.wessels@cc.ruu.nl wrote:
>
>>Hello, maybe this is not a realy security related question but it burns in
>>my mind so i gave it a try.
>>
>>Situation: 
>>
>> - classroom with 25 computers ready to install NT workstation.
>> - 1 NT workstation with the appropiate configuration
>> 
>>Question, 
>>
>>What's the right way to duplicate the 1 installed workstation to the other
>>25 computers in the classroom?
>>
>>What will be the effect on SID and authentication when just making a copy
>>to all stations.
>
>
>Has anyone one got any views/information on the SID issue??? 
>
>Microsoft state that they will not provide support for systems that have
>been installed by duplicating fully installed copies of either Windows NT
>Workstation or Server. They state that simply copying the contents of one
>hard disk to another would give each computer the same SID, making security
>impossible to maintain. For further information, read the Knowledge Base
>article: 
>
> "Do Not Disk Duplicate Installed Versions of Windows NT"
> 
>
>So what are the current implications for using programs, such as GHOST, to
>duplicate workstation configurations? Has anyone got any 'real world'
>experiences they wish to share?!?!
> 
>Regards,
>
>
>Paul Warren.
>
>
>_____________________________________________________________________
>
>Paul Warren - Network Analyst | http://www.its.unimelb.edu.au:801/
>ITS - Networks & Communications | E-mail: P.Warren@its.unimelb.EDU.AU
>**The University of Melbourne** | Phone: 9344 4136 Fax: 9347 4803
>_____________________________________________________________________
>"The only place where success comes before work is in a dictionary!"
>
Yes!! This is correct.
I was refering to USER RIGHTS e.g. "logon locally" NOT ACL.
from this point in time, no one has said thier is a command line program to do this. 

Jules 


-----Original Message-----
From: david pederzoli [SMTP:davidpederzoli@cariplo.it]
Sent: Sunday, July 27, 1997 2:59 AM
To: ntsecurity@iss.net
Subject: R: [NTSEC] Need utitlity to assign user right from command line

When someone write "assign user right from command line" I think he' s
meaning the user right you can find in "user manager for domain", second
selection, user rights, in which you can assign the "logon locally" user
right, "act as part of the operating system" user right, etc etc. 

Does anyone out there eventually know if there is a utility like that ?

I'm very interested in it too !

Thanks very much

----------
> Da: ryan25@hooked.net
> A: zeller@indiana.edu
> Cc: strops@well.com; ntsecurity@iss.net
> Oggetto: Re: [NTSEC] Need utitlity to assign user right from command line
> Data: sabato 26 luglio 1997 14.43
> 
> 
> 
> 
> 
> Zeller, Tom S wrote:
> >
> > cacls.exe comes with nt. it allows use of f,c,r rights. for full
> > flexibility use xcacls.exe that comes with the addendum to the server
> > 4.0 resource kit.
> >
> > > -----Original Message-----
> > > From: Jay Urbanski [SMTP:strops@well.com]
> > > Sent: Wednesday, July 16, 1997 3:17 PM
> > > To: ntsecurity@iss.net
> > > Subject: [NTSEC] Need utitlity to assign user right from command
> > > line
> > >
> > > Well the topic says it all. I need to grant advanced user rights
for
> > > a 6000 server roll-out, and I don't look forward to doing click,
> > > click, click 6000 times. Does anyone know of a utitlity to grant
user
> > > rights to groups and users from a command line?
> > >
> > > Jay Urbanski
> > > strops@well.com 
> > >
> Adduser.exe sets up gobal and local groups fro the command line. This
> could also be useful. It is in the NT resource group. I have found
> using the the "for /f" command an appropriate way to process lists of
> names.
> 
> --=_005BD0FDC12564E000407089C12564E0_=--


As a security consultant, I've run into several large corporations who
have banned upgrading to new MS products until they are tested and
approved by management. This included Office '97, MS Internet Explorer
4.0, NT 5.0 (when released), and other new products that are released.

Is anyone else associated with this list having the same issues in their
organization? Can anyone comment on the process they are having to go
through to assure management that these applications warrent upgrade and
are safe to use? 

Kelly Gibbs


 Hi Folks,
 has anyone got c2myazz to work yet? I've tried on an LSL, VLM machine 
 but to no avail.
 
 Any ideas?
 
 
 Thanx
 
 Mark


______________________________ Reply Separator _________________________________
Subject: [NTSEC] C2MYAZZ.EXE
Author: Misha Gopaul at Internet
Date: 23/07/97 14:02


Can anyone tell me where i can get the source for c2myazz.exe
 
thanks
MishaReceived: from iss.net (208.21.0.5) by mlhst.wavetech.com with SMTP
 (IMA Internet Exchange 2.1 Enterprise) id 00014187; Wed, 23 Jul 97 23:40:58
-0500
Received: (qmail 7686 invoked by alias); 23 Jul 1997 13:03:06 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 7633 invoked by alias); 23 Jul 1997 13:02:42 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 7581 invoked by uid 15); 23 Jul 1997 13:02:17 -0000
Received: (qmail 7536 invoked from network); 23 Jul 1997 13:02:02 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 23 Jul 1997 13:02:02 -0000
Received: from monsoon.dial.pipex.net (monsoon.dial.pipex.net [158.43.128.69])
by arden.iss.net (8.8.6/8.7.3) with SMTP id JAA27855 for ;
Wed, 23 Jul 1997 09:02:00 -0400
Received: (qmail 8701 invoked from network); 23 Jul 1997 13:01:58 -0000
Received: from client8761.globalnet.co.uk (HELO comms-server) (194.126.87.97)
 by smtp.dial.pipex.com with SMTP; 23 Jul 1997 13:01:58 -0000
Message-ID: <33D600EC.739B@dial.pipex.com>
Date: Wed, 23 Jul 1997 14:02:36 +0100
From: Misha Gopaul 
X-Mailer: Mozilla 3.0 (Win95; I)
MIME-Version: 1.0
To: ntsecurity@iss.net
Subject: [NTSEC] C2MYAZZ.EXE
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Misha Gopaul 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
> Does anyone know where can i get WIndows NT Server 4.0 Enterprise
> Edition ???
> Will it be released in CD-Select CD-ROM's ???
> 
If you have access to Microsoft's Technet look for an article in
 - Microsoft Backoffice and Enterprise Systems
 - MS BackOffice
 - MS Windows NT Server
 - MS Windows NT Server 4.0 Resource Kit
 - Resource Guide

Look for "Creating a Boot Disk" and look in chapter 6


> -----Original Message-----
> From: Computer_Freaks [SMTP:freaksoc@ukc.ac.uk]
> Sent: Segunda-feira, 28 de Julho de 1997 18:18
> To: ntsecurity@iss.net
> Subject: [NTSEC] NT Crash - Please help
> 
> 
> Hello 
> 
> I am sorry that the following problem is probably not in the
> general concern of the list.
> 
> My hard drive boot record is lost and the I have lost my emergency
> repair
> disks. I was wandering if it is possible to create E.R.D's on another
> computer and use it with my configuration. 
> 
> I am using a Seagate ST 32140A (2.1 GB) HDD running on a P-133.
> 
> I would be grateful if someone with the same HDD could create an E.R.D
> set
> that could be used to retrieve some of the lost files.
> 
> Thanks
> 
> Alex 
> 
> PS I've already tried NT Recover from NT-Internals but it does not
> seem to
> work. 
Pardon this seemingly out of bound question.

I seems to recall that someone mentioned in this list that
he/she can enable plug'n play on NT4.0, similar to that of Windows95.
However, upon checking my NT4.0 box, I did see a Plug and Play
device active already without me fiddling around with the registry.

My questions are:

(1) What's the difference?
(2) If there are major difference, can anyone post that fix again?
(3) What potential damage can it caused to the NT security environment
 or the NT devices compatibilities? ( don't want to enable detection
 of devices just to crash my NTs ) I'm sure MS has an explanation
 of why they did not allow Plug'N play sez Win95 for NT4.0. Pls do
 comment, Paul.

Regards,
Henry
Hello !

I whish to set up an NT-based FTP server that allows authentication of
users against a dedicated authentication server (e.g. Safeword) using
tokens and dynamic passwords.

I have been looking around for an FTP server that can use RADIUS or
TACACS+ to communicate with the authentication server but found none.

Does anybody on this list know about such a server ????


Greetings,
Anders Sandell

 ====================================
Anders Sandell Tel: +46 8775 8000
WM-data Dataservice AB Fax: +46 8 775 8490
Box 47104 Cellular: +46 70 5893209
100 74 Stockholm E-mail: ansad@wmdata.com
Sweden

PGP key fingerprint: 
F3 3E A2 O4 E9 C4 27 OE CE A7 91 19 F6 AB B8 A1


I got one of these seagate's HD last year... and also a bunch of friends of mine did the same... ALL of us lost ALL data on it by PHYSICAL DAMAGES!!!! Seagate is not the same it used to be some years ago....

Rodrigo

----- Mensagem original -----
De: Computer_Freaks [SMTP:freaksoc@ukc.ac.uk]
Enviada em: Monday, July 28, 1997 2:18 PM
Para: ntsecurity@iss.net
Assunto: [NTSEC] NT Crash - Please help


Hello 

I am sorry that the following problem is probably not in the
general concern of the list.

My hard drive boot record is lost and the I have lost my emergency repair
disks. I was wandering if it is possible to create E.R.D's on another
computer and use it with my configuration. 

I am using a Seagate ST 32140A (2.1 GB) HDD running on a P-133.

I would be grateful if someone with the same HDD could create an E.R.D set
that could be used to retrieve some of the lost files.

Thanks

Alex 

PS I've already tried NT Recover from NT-Internals but it does not seem to
work. 


Can anyone recommend a list or web site that has a good basic grasp of how
to set up a NT-based website? For me, this list is too involved in
theories, and I just need some practical advice, something a beginner could
use.

Thanks for any help you might give.


James Corey

mailto:Webmeister@beerglass.com
http://www.beerglass.com

Hi,

I'm in process of justifying the need for NT from a security
point of view over win95, and was wondering if anyone knows
of a site about win95 exploits via the network, or if
there exists a white paper or any other info comparing
the 2 OS's from a security point of view.

If I get enough response, I'll compile the information
and repost to this list.

Thanks,

*///////////////////////////////////////////////////*
| Jeff Welty * |
| Biometric Support Engineer * |
| Weyerhaeuser Company * |
| Tacoma, WA * (253)-924-6390 |
*///////////////////////////////////////////////////*

I don't understand why one would prefer a Single Domain configuration 
on a WAN link. Since MOST administration can be handled by the Master 
Domain. My thinking is that a Master Domain model would make more 
sense since it allows you to segment your administration as well as 
bandwidth, not to mention the security. On the subject of security, 
aside from the occasional hw/sw maintenance which will require your 
present at the site anyway, one way trust relationship works great 
between Master and "Slave" domains in distributed sites. Why would 
setting up a Master Domains in each distributed site a nightmare? 
 It's like reading a book. We break down the book to pages rather 
than have the whole book on one page. It makes it easier for your 
eyes to manage and read. I can't imagine trying to read 650 pages at 
once or on one page. Imagine. I wouldn't even be able to read past 
the first 30 paragraphs. In Network Sense, bandwidth savings make all 
the network sense. Security can be as tight as the organization wants 
it to be no matter the domain configurations. Administration 
segmentation should be a plus not a minus. Many point to trust 
relationship as a nightmare. I look at it as another security issues, 
as in file/directory securities. You will work with it one day if you 
have NT. Once you understand trust relationship, it takes but a 
trivial portion of your overall security and configuration concerns. 
 What makes trust relationship more nightmarish than the overall 
security implementation itself? Please explain.

-----Original Message-----
From: Matt Gillard [SMTP:mattg@dhs.vic.gov.au]
Sent: Friday, July 25, 1997 7:50 AM
To: CCCRE.CCULL@capital.ge.com
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] Domain modeling

>
> this seems BAD. as far as i know, nt replicates the ENTIRE domain db 
every time
> a change is made, this is one of the reasons some people dislike it 
for
> enterprise (wan spanning) networks. domains should not span wan 
links, thus you
> get the pleasure of setting up trust relationships.....
no I believe this is incorrect. I was under the impression that only 
changes are replicated. If you check out eventlog when netlogon 
reports
sync changes it says 5 changes applied, 2 changes applied, etc.
We are in the process of setting up many distributed sites over WAN
links in one domain. One thing we DO NOI want to do is set up a
separate domain for each site, what a nightmare.

Matt


The bandwidth implication sounds very promising here. Negligible. I 
will keep that in mind. Thanks


-----Original Message-----
From: BRADLEY, GREGORY S [SMTP:GSBRAD@exchange.monsanto.com]
Sent: Thursday, July 24, 1997 6:18 AM
To: 'CCCRE.CCULL@capital.ge.com'
Cc: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Domain modeling


This is incorrect.

Windows NT only replicates the changed userids. It does not 
replicate
the ENTIRE domain database everytime a change is made. That is only
done when a specific "Synchronize domain" command is issued from 
Server
Manager. Believe me, we would know with a master domain of 17,000 
users
spanning the entire US, we would know.

We have many domains that span WAN links currently and the traffic
overhead is negligable with todays high speed connections. We are
successfully spanning 56Kb WAN links, we have only had problems 
trying
to go slower than that.

Greg...

> -----Original Message-----
> From: CCCRE.CCULL@capital.ge.com [SMTP:CCCRE.CCULL@capital.ge.com]
> Sent: Wednesday, July 23, 1997 11:29 AM
> To: - (052)ntsecurity(a)iss.net
> Subject: Re: [NTSEC] Domain modeling
>
> this seems BAD. as far as i know, nt replicates the ENTIRE domain 
db
> every time
> a change is made, this is one of the reasons some people dislike it
> for
> enterprise (wan spanning) networks. domains should not span wan 
links,
> thus you
> get the pleasure of setting up trust relationships.....
>
> 
> chris
>
>
>
> ______________________________ Reply Separator
> _________________________________
> Subject: [NTSEC] Domain modeling
> Author: owner-ntsecurity@iss.net at INTERNET
> Date: 7/23/97 1:52 AM
>
>
> Greeting all NT gurus out there. I just want to bounce off some 
ideas
> with y'all out there. We have three major site across the US: One 
in
> Atlanta, one in Houston and one in LA. We're implementing NTAS4.0
> across the board and are currently selecting the domain model we 
would
> like to use. I know what I want and what is feasible, but we have 
an
> administrator who likes an alternative model. That of a single 
Master
> Domain model. Offhandedly, I would call it nonsense, but I need 
some
> input from the WAN expert out there. What is the advantage and
> disadvantage of setting up a Master Domain at one of the central 
site
> (whether it be LA, Atlanta, Houston) and making the other sites
> domains
> a BDC to the Master PDC across the WAN. This don't make sense to 
me
> technologically, administratively as well as when it comes to
> maintenance. I see chaos all over the place and very, very poor
> planning. Any input?

I would recommend Applied Cryptography by Bruce Schneier (John Wiley &
Sons publishers). It has a lot of excellent information on the subject.



-Andre

Juha Jäykkä wrote:

> > http://www.rc5.cyberian.org/
> > http://rc5.distributed.net/
> >
> > Which both have taken on the greater task of brute force cracking
> the
> > RSA 56 bit key.
>
> This is getting a bit annoying. About half the messages on this list
>
> concern cryptography and almost no one seems to know what they are
> talking about. Could you people begin to understand what you are
> talking
> about or simply shut up? There is NOTHING common between RSA 56 bit
> key
> and the 56 bit RC5 -algorithm which the two mentioned sites are trying
>
> to break. Read the damn FAQ at http://www.rsa.com/rsalabs/newfaq/. It
> will tell you the following:
> RSA is a public-key cryptosystem for both encryption and
> authentication; it was invented in 1977 by Ron Rivest, Adi Shamir, and
>
> Leonard Adleman.
> RC5 [Riv95] is a fast block cipher designed by Rivest for RSA Data
> Security.
> A block cipher transforms a fixed-length block of plaintext data
> into
> a block of ciphertext data of the
> same length. This transformation takes place under the action of a
> user-provided secret key. Decryption
> is performed by applying the reverse transformation to the ciphertext
> block using the same secret key.
>
> The previous said, please stop confusing secret-key and public-key
> systems with each other and second of all stop confusing two different
>
> cryptosystems patented by the same company (i.e. RSA the public-key
> cipher patented by RSA Data Security Inc. and RC5 the secret-key
> cipher
> almost patented by RSA Data Security Inc.).
>
> FYI: The security of the cryptosystem depends (mainly) on two
> things:
> the size of the key space needed to brute force it and its resistance
> against cryptanalysis. The "number of bits" usually mentioned refers
> to
> the size of the modulus of a public-key system or the size of the key
> space of a secret-key system. These two figures are not (directly)
> comparable.
>
> --
> Juha Jäykkä, juolja@utu.fi



At 01:42 PM 7/28/97 -0400, you wrote:
>On 24 Jul 1997 C.Toth@keene.k12.nh.us wrote:
>
>> I know nothing about windows 95 so i was wondering if anyone on here
>> could help me. I just got a new PcTel HSP 33.6 PNP Deluxe Modem and
>> I install the drivers for both the COM port and the modem. Then I run
>> Modem in control panels and run diagnostics it fails to communicate with
>> the modem. I tried all possible addresses and interupts that didn't
>> interfere with COM 1 and I don't know what to try next.

As far as I know this is an *NT* *security* list. There are newsgroups and
other emailing lists for other issues concerning Windows NT or 95. Alot of
people rely on this list for keeping their NT servers and networks stable
and secure, myself included. We don't have the time or patience to wade
through very off topic posts. I would recommend people read through the FAQ
for this list which they received when joining. Hopefully in the future
people will think for a minute before they post messages to this list.

Lets try to keep this list to what it is intended for, which is NT Security
and nothing else...

Thanks,
Conrad

Thank you, for the program "Ntrights.exe". However, I don't know all the 
API names for rights nor does your program say.

NTreights.exe /?
"NTRights Ver 0.91 Nov96 by G.Zanzen (c) MCS Central Europe
Grants/Revokes NTRights
usage: -u xxx User/Group
 -r xxx revokes the xxx right
 +r xxx grants the xxx right
some valid NTRights are:
 SeSystemtimePrivilege
 SeShutdownPrivilege
 SeServiceLogonRight
 SeInteractiveLogonRight
 SeNetworkLogonRight"

Could you please provided? Please note the use of "SeServiceLogonRight" is 
not in the MS right list.

Is this program-copyrighted "(c) MCS Central Europe"? Do I need a license? 
If so whom do I get the license from?


_________
access rights List.

Access this computer from the network Access this computer from the network 
 A user to connect over the network to the computer.
Granted by default : Administrators, Everyone, Power Users

(SeDebugPrivilege) Debug programs The user can debug various low-level 
objects such as threads.
Granted by default: Administrators

(SeIncreaseBasePriorityPrivilege) Increase scheduling priority The user can 
boost the priority of a process
Granted by default: Administrators and Power Users

(SeLoadDriverPrivilege) Load and unload device drivers The user can load an 
unload device drivers.
Granted by default: Administrators

(SeShutdownPrivilege) Shut down the system Allows a user to shut down 
Windows NT
Granted by default: Administrators, Backup Operators, Everyone, Power 
Users, and Users. Deny Everyone and Users this right.

(SeTcbPrivilege) Act as part of the operating system A process to perform 
as a secure, trusted part of the operating system. Some subsystems are 
granted this right
Granted by default: (None)

(SeSystemTimePrivilege) . A user to set the time for the internal clock of 
the computer
Granted by default: Administrators, Power Users

(SeCreatePagefilePrivilege) . Nothing. This right has no effect in current 
versions of Windows NT
Granted by default: Administrators

(SeCreateTokenPrivilege) Create a token object A process to create access 
tokens. Only the Local Security Authority can do this
Granted by default: (None)

 (SeCreatePermanentPrivilege) Create permanent shared objects A user to 
create special permanent objects, such as \\Device, that are used within 
Windows NT.
Granted by default: (None)

(SeDebugPrivilege) Debug programs A user to debug various low-level 
objects such as threads.
Granted by default: Administrators

(SeRemoteShutdownPrivilege) Force shutdown from a remote system Nothing. 
This right has no effect in current versions of Windows NT
Granted by default: Administrators, Power Users

(SeAuditPrivilege) Generate security audits A process to generate security 
audit log entries
Granted by default: (None)

(SeLoadDriverPrivilege) Load and unload device drivers A user to install 
and remove device drivers
Granted by default: Administrators

(SeSecurityPrivilege) Manage auditing and security log A user to specify 
what types of resource access (such as file access) are to be audited, and 
to view and clear the security log. Note that this right does not allow a 
user to set system auditing policy using the Audit command in the Policy 
menu of User Manager. Also, members of the Administrators group always have 
the ability to view and clear the security log
Granted by default: Administrators

(SeSystemEnvironmentPrivilege) Modify firmware environment variables A 
user to modify system environment variables stored in nonvolatile RAM on 
systems that support this type of configuration.
Granted by default: Administrators

(SeProfSingleProcess) Profile single process A user to perform profiling 
(performance sampling) on a process
Granted by default: Administrators, Power Users

(SeSystemProfilePrivilege) Profile system performance A user to perform 
profiling (performance sampling) on the system
Granted by default: Administrators

(SeAssignPrimaryTokenPrivilege) Replace a process-level token A user to 
modify a process's security access token. This is a powerful right used 
only by the system
Granted by default: (None)

(SeShutdownPrivilege) Shut down the system A user to shut down Windows NT.
Granted by default: Administrators, Backup Operators, Power Users, Users

(SeTakeOwnershipPrivilege) Take ownership of files or other objects A user 
to take ownership of files, directories, printers, and other objects on the 
computer. This right supersedes permissions protecting objects
Granted by default: Administrators



Err... This has _what_ to do about security? I'd really like to see the
snr on this list drop... If you see an off-topic post and feel inclinded
to reply, please do it privately, so all of the other people on this list
don't have to see it.

On Mon, 28 Jul 1997, Ray Arachelian wrote:

> On 24 Jul 1997 C.Toth@keene.k12.nh.us wrote:
> 
> > I know nothing about windows 95 so i was wondering if anyone on here
> > could help me. I just got a new PcTel HSP 33.6 PNP Deluxe Modem and
> > I install the drivers for both the COM port and the modem. Then I run
> > Modem in control panels and run diagnostics it fails to communicate with
> > the modem. I tried all possible addresses and interupts that didn't
> > interfere with COM 1 and I don't know what to try next.
> 
> Try going into your CMOS setting through the BIOS. On most PC's, this
> means holding down the DEL or F2 key durring boot up. Go into Features or
> Built in Devices. See if your motherboard will let you reconfigure one of
> the COM ports. Say, change COM1 to COM3, or change COM2 to COM4. In the
> worst case, try disabling the port. Then see if you can communicate with
> the modem.
> 
> (This is why I always reccomend external modems. :) I've had nothing but
> trouble with internal PnP modems, and everyone I've spoken to also had the
> same, but with enough hair pulling it can be gotten to work.)
> 
> If there's some configuration disk with the modem that you can run from
> DOS mode, try it and see if you can disable the plug and play options and
> force the modem to lock itself to a fixed port.
> 
> Also be aware that if you use traditional I/O and IRQ addresses, you can't
> access both COM1 and COM3 at the same time, nor COM2 and COM4 at the same
> time. This is because COM1/3 share IRQ4, COM2/4 share IRQ3. If you're
> using a serial mouse, or other serial device on these ports, they might
> cause conflicts with the modem. See if you can assign an unused IRQ to
> the modem - say 10 or 11 and tell 95 of this. Good luck.
> 
> =====================================Kaos=Keraunos=Kybernetos==============
> .+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
> ..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
> <--*-->| ------------------ | syrup, don't you?" |\/|\/
> ../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
> .+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
> ======================== http://www.sundernet.com =========================
> 






Morland Halliday
08-02-97 11:20 AM

I am currently on vacation. I will be returning to the office on Tuesday
Aug. 12th. If you require assistance please contact one of the following:
For COMPAS access problems contact Shelley Francoeur at 613-781-9242.
For all other SRCI Banyan Vines, Lotus Notes and PC hardware problems
contact the FMC at 660-3513 or 1-800-263-4014.


 I am finding that Navigator clients often cannot access a certain page of
my
website. I read the Netscape FAQ, which identified the problem, but
provided 2 completely (?) useless fixes. The error message is;

"An I/O error occurred during security authorization. Please try your
connection again."

The situation is this: NT4.0 SP3+ server with SSL. Access to the site is
no problem. Transition to SSL is no problem. However, when a NN client
requests a page that is generated by the database on the fly, and can often
be as big as 5k, the error comes up. There is no difference in security
settings on the 4 or 5 files that are processed on the way to this page, and
the page itself.

The (didn't) workarounds I have found through bugtracking sites, Netscape's
KB, etc., were to clear the browser cache, and to remove the site
certificate from the list of trusted client certificates in the
browser. When I do this and then go to the site again, it makes me allow it
to trust the certificate over again, but accomplishes nothing toward
rectification of the problem.

I was wondering if anyone had access to better information about this
feature, or how anyone might be dealing with it...

Thanks,

Scott Colvin MCSE
Principal
Pacific Management Center



This is a test, because I didn't receive any mail since saturday




This little tidbit came across my e-mail. The WinNTMag update told
people to use the format command to convert from FAT to NTFS. This just
goes to show that sometimes NT Security has very little to do with
parameters, switches, and settings. Every once in a while, a really bad
bit of advice is worse than a huge security gap!

Since there has been a lull in the NT security world, I guess I will get my
fire-retardant suit on now.....
---------------------- Forwarded by Pat Hayden/USCONNECT on 08/04/97 14:47
---------------------------

To: update@ntmail.winntmag.com
cc: (bcc: Pat Hayden/USCONNECT)
Subject: WinNTMag UPDATE Notice




>Hi Everyone,
>
>I wanted to make you immediately aware of a problem with this week's
>tip. The tip was taken from Mike Reilly's book, but was apparently
>edited out of context. Mike emailed me immediately to notify me of the
>problem. Here is his message:
>
>>This week you suggest using FORMAT from Disk Administrator to convert
from FAT
>>to NTFS. WRONG!!!. It will wipe out your data. Use the command:
>> convert D:\ /fs:ntfs
>>from the command line and the D: drive will be converted, without data
loss.
>>
>>Mike Reilly
>
>Sincerely,
>Eric Shanfelt (Electronic Publishing Manager)
>eric@winntmag.com


All,
Need some help here. I am trying to filter TCP ports on NT 4.0
workstation (Trying to keep users away from the web etc.) It's a half
and half shop. Half of the users truly need to get to the net and half
don't. I figured on filtering at the workstation. Only problem is when
trying this (Network|Protocols\TCP/IP Protocol|Properties -> Advanced
Button, Select Enable Security|Configure Button) I can only "allow"
ports, I cannot, say, "select all portd BUT Port 80, 21 etc..". Any
ideas on how I can "button" up this workstation without having to add
thousands of Ports (minus the "net" ports).

Any help is appreciated

Mike Barnes
barnesmj@westinghouse.com
or
cbsii@sgi.net


It's always a good idea to rename the administrator account to something
other than the default. The administrator account does not get locked
out due to multiple invalid password attempts.

CYa
J!

>----------
>From: André Koot[SMTP:A_Koot@dds.nl]
>Sent: Monday, July 28, 1997 1:18 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] GetAdmin double dutch
>
>Tried GetAdmin on Dutch language NT4 SP2.
>Bad luck, it seems GetAdmin tries for 'Administrator' authorization, while
>our's is called 'Beheerder'. If so: for maximum security forget about your
>English language version and learn te speak our language...
>
>Groetjes,
>
>André Koot
>

 Where can I find a freeware program that locks my Win95, so nobody could access it at all?


 Thanks all

 
 Rodrigo


 

























Paul Leach wrote:

> We will support Kerberos in NT5; it will conform to RFC 1510 and RFC
> 1964. GSSAPI is an API, not a protocol.
First, thank you for the many prompt replys to this group.

GSSAPI [RFC-1508 and now RFC-2078] is often seen as an API only,
however,
as soon as we start to look at the security mechanisms we are back in
the
protocol business. For example RFC-1964 actually defines a protocol.

There are also a set of application protocols that are related to GSSAPI
and this is where security gets interesting for us users. Some eksample
protocols: IMAP4 [RFC-1731 IMAP4 Authentication Mechanisms (hopefully to
be
updated soon), SOCKS [RFC-1961 GSS-API Authentication Method for SOCKS
Version 5]
and FTP [draft-ietf-cat-ftpsec-09.txt FTP Security Extensions].

Can you reveal which "applications" Microsoft plans to make GSSAPI
compatible
on a protocol level? (IMAP, SOCKS, ftp, telnet, CIFS, etc.)

Best regards

Steen

-- 

Steen Koefoed Larsen

SITA R&D Nice, France | @ Home
E-mail: steen.larsen@ed.nce.sita.int | NEW E-mail: steen@who.net
Phone : +33 4 92.96.63.67 | GSM Mobile: +45 40512486
Fax : +33 4 92.96.64.92 | or (French) +33 6 09090568

Disclaimer: This letter may reflect my personal opinion.
 
 "Liberty lies in the rights of that person whose views
 you find most odious" - John Stuart Mill
Hi,

does anybody have some experiences with the new Routing and RAS service
form Microsoft? We have a small network (one NT Server and 5 NT
Workstations) and look for a cheap Internet access for all the
Workstations. What about security?

We installed an ISDN board and the Routing and RAS service on the NT
Server and the demand-dial connection works fine - but only on the
server. From the workstations we're able to ping our ISP but that's all.
Thanks for any information.

Martin Schetat
ITC SA - Switzerland

Look for Service Manager NT 1.0 (beta) 
http://www-rnks.informatik.tu-cottbus.de/~fsch! You 
can manage all services about the whole domain (if you have the rights) 
with a nice GUI.

 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 
Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
+49 355 69 2752 fsch@informatik.tu-cottbus.de
http://www-rnks.informatik.tu-cottbus.de/~fsch
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 

 

On Fri, 25 Jul 1997, Jorgensen, John wrote:

> The Microsoft Resource kit includes administration utilities that can
> be installed on a Windows/NT workstation.
> 
> Fire up server manager from these and select a domain and then a server.
> One can start, stop and configure the services on the selected server
> from
> the workstation.
> 
> John A. Jorgensen
> Caliber Technology, Inc. (330) 384-9000 Ext 3848
> 557 E Tallmadge Ave. FAX (330) 258-6066
> Akron, Ohio 44310
> 
> >----------
> >From: John Rutkin[SMTP:John.Rutkin@bankerstrust.com]
> >Sent: Thursday, July 24, 1997 4:17 AM
> >To: ntsecurity
> >Subject: [NTSEC] Stop/Start Services
> >
> >Excuse the off topic question..
> >
> >Is there a command line utility that will enable me to stop/start NT services
> >on remote boxes, I obviously have admin rights on all the relevent boxes.
> >Sorry again as this is somewhat off topic.
> >
> >Thanks
> >
> >John Rutkin
> >
> 
Since enough people have asked, a reasonable representation of the slides
from my "kick Microsoft's butt" talk in Vegas is available as a web
page at www.avian.org/avian/slides/caca.html. Enjoy, fwiw..

_H*
This directory is shared and in my NT PDC is located in
C:\WINNT\system32\Repl\Import\Scripts.
Why don't you try to write directly to the directory on the NT Server,
because by default the permissions on that share are EVERYONE - READ.
Good Luck

> -----Original Message-----
> From: Comms_Server [SMTP:f1ash@dial.pipex.com]
> Sent: Segunda-feira, 28 de Julho de 1997 23:31
> To: ntsecurity@iss.net
> Subject: [NTSEC] Policies.
> 
> Hiya,
> 
> Just wondered if anyone can help me...
> 
> I want to setup policies that are obeyed by all all machines on the
> network.. As I understand it, you just save the .pol file in the
> \\PDC\NETLOGON folder (NT4 by the way)...However, i can't seem to get
> permissions to write to the folder :((
> 
> Without this, all users can have access to just about
> anything..(control
> panel etc. etc. )..
> 
> Thanks
> Misha
In my german NT 4.0 GetAdmin doesn't work. In my opinion GetAdmin tries 
for "Administrator" in the group "Administrators". This account already 
exists in german NT, but the local group called "Administratoren". Thats 
why GetAdmin doesn't work under german NT 4.0. If you create a local 
group "Administrators" and put the account "Administrator" into, GetAdmin 
work correctly. I was wondering about GetAdmin (PWDump) doesn't work with 
IDs ...

 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 
Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
+49 355 69 2752 fsch@informatik.tu-cottbus.de
http://www-rnks.informatik.tu-cottbus.de/~fsch
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 



On Mon, 28 Jul 1997, =?ISO-8859-1?Q?Andr=E9_Koot?= wrote:

> Tried GetAdmin on Dutch language NT4 SP2.
> Bad luck, it seems GetAdmin tries for 'Administrator' authorization, while
> our's is called 'Beheerder'. If so: for maximum security forget about your
> English language version and learn te speak our language...
> 
> Groetjes,
> 
> André Koot
> 
Sorry, i was not aware of this... shame on me for assuming MS could
handle case sensitive passwds on any client

:(

-jjs

>-----Original Message-----
>From: Vinci CHOU [SMTP:vkmchou@HK.Super.NET]
>Sent: Monday, July 21, 1997 7:16 AM
>To: 'ntsecurity@iss.net'
>Subject: Re: [NTSEC] Denying Win95 Machines from accessing NT.
>
>Article Q98724 in the May 97 Technet mentioned that the password is only
>case sensitive if BOTH the workstation you're logged on to and the
>server the resources are residing are NT.
>
>So, if you log on to an NT domain using Win95 or Workgroup, the password
>is not case sensitive (though I myself always assumed that they should
>be case sensitive in this case, but obviously this assumption is wrong
>!) And if you sign on to the PDC or a server (not necessarily a BDC),
>it is case sensitive.
>
>I've tried this out myself and verified the above to be the case.
>
>
>Henry Lim Chee Wee wrote:
>
>> You know, I was about to reply to the same thing when I remember
>> something....I can logon to WindowsNT 3.51 PDC with my password
>> typed in UPPER-CASE and LOWER-CASE using a Windows95 client.
>> When it is not documented, I believe that somehow along the validation
>>
>> process, something is done or not done.
>>
>> To reconfirm my hazy memories:
>> I tried logon to a known WindowsNT3.51 PDC with which I have
>> lowercase password access as a normal user. For 10 times, I logon
>> successful with either uppercase, lowercases or a mixture of both.
>>
>> With that evidence, I walked over to the same NT server and logon
>> using the same account and password again. No luck this time,
>> password is case-sensitive. I did not confirm using a NT workstation
>> logon, don't have one handy around.
>>
>> I guess the key-issue of this post is that you can key in either
>> uppercase or lowercase versions of your password to logon
>> to a NT machine USING A WINDOWS95 CLIENT.
>>
>> But then again, I am never overly confident when it comes to WindowsNT
>>
>> problem, so, can someone verify this again?
>>
>> -------------------------------------------
>> ------------------------------------------------------------
>> Henry Lim Office: Techpoint
>> Systems Engineer, Projects PTSC Tel: (65)
>> 4865259
>>
>>
>> Disclaimer: All my opinions are my own and could arise from lack of
>> sleep.
>> So give me your most gracious forgiveness.
>> All flames > ../devices/pseduo/mm@0:null
>> ----------------------------------------------------------
>> ---------------------------------------------
>>
>> -----Original Message-----
>> From: Joshua Soliz [SMTP:jsoliz@dpai.com]
>> Sent: 20 July 1997 21:05
>> To: 'ntsecurity@iss.net'
>> Subject: RE: [NTSEC] Denying Win95 Machines from accessing NT.
>>
>> Im not sure how your workstation is setup, but when you log on to a NT
>>
>> domain, the passwd is ALWAYS case sensitive... (or at least I have
>> never
>> been able to bypass it) The username I believe is not however.
>>
>> -jjs
>>
>> >-----Original Message-----
>> >From: Robert P. MacDonald [SMTP:RMACDONALD@perrigo.com]
>> >Sent: Sunday, July 20, 1997 11:59 AM
>> >To: ntsecurity@iss.net
>> >Subject: [NTSEC] Denying Win95 Machines from accessing NT.
>> >
>> >I'm new to the security environment, and have a couple of questions
>> regarding
>> >Windows95 and security( yeah, I know.;-) )
>> >
>> >Under NT, I setup a user with a case sensitive password, and noticed
>> that NT
>> >does not care about that case sensitive part, when logging in from a
>> 95
>> >station. Wouldn't this reduce the number of tries I would have to
>> make, in
>> >order to 'guess' a password?
>> >
>> >NT must know that I'm coming from a Win95 station, so couldn't you
>> watch for
>> >this and block access? Is it possible to 'watch' for NT only
>> stations, and
>> >deny all others? Or even variations of this?(UNIX, SAMBA, etc.)
>> >
>> >What kind of 'signature' is Win95 sending or is NT capable of
>> 'asking' what
>> >the OS of the incomig machine is?
>> >
>> >With all of the known security holes in both NT & Win95, couldn't I
>> use
>> >Win95(or some other OS) to gain access to parts of NT, because NT is
>> >compromising some of it's security(i.e case sensative passwords)
>> because the
>> >other OS is incapable(on purpose?) of complying with NT's security?
>> >
>> >Sorry for the ramblings(and asking more than a couple of questions
>> :-) ), but
>> >the above sounds like some possible ways of attacking NT or even
>> bypassing
>> >security.
>> >
>> >Thanks to all for the great discussions on this list. I look forward
>> to being
>> >blasted about any stupidity I may have asked(be gentle please) and
>> any
>> >responses which may be helpful to me and all others on this list.
>> >
>> >Robert
>> >
>> >
>> >* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
>> >Robert P. MacDonald (rmacdonald@perrigo.com)
>> >Systems, Network & Security Analyst
>> >Perrigo Company, Allegan, Michigan
>> >
>> >
>
>
>
This does NOT work on remote servers. It only works for the local
machine...

-jjs

>-----Original Message-----
>From: cmulcahy@omnisource.com [SMTP:cmulcahy@omnisource.com]
>Sent: Friday, July 25, 1997 1:49 PM
>To: ntsecurity@iss.net
>Subject: Re:[NTSEC] Stop/Start Services
>
>net stop 
>net start 
>
>hth
>Chris Mulcahy
>cmulcahy@omnisource.com
>
>____________________Reply Separator____________________
>Subject: [NTSEC] Stop/Start Services
>Author: PC:John.Rutkin@bankerstrust.com
>Date: 7/25/97 9:33 AM
>
>Excuse the off topic question..
>
>Is there a command line utility that will enable me to stop/start NT services
>on remote boxes, I obviously have admin rights on all the relevent boxes.
>Sorry again as this is somewhat off topic.
>
>Thanks
>
>John Rutkin
>
> << File: MSGCC.RTF >> 

Many thanks to everybody who sent me their suggestions.

The problem was that my HDD was infected by a boot sector virus(FORM-A),
thus rendering my boot sector completely unusable, As a result no other
machine could understand the file structure of the HDD. Not even when I
physically attached the HDD to another NT box. I tried to use an ERD
created by another computer with the same configuration (same HDD & NT
installation) but this again did not work. When I tried to re-install NT
on top of the current installation since the installation program could
not understand that the HDD already had data on it, it only gave me a
warning that it needs to reformat the entire disk.

Finally I found a program called Tiramisu that was able to read almost all
of my files, but since I only had the shareware version I was only capable 
of reading the files but not saving any of them. Since the registration
for the software was about 400 pounds, in the end my only solution was to
re-format & re-build the whole box.

Maybe it would be a nice function for NT to allow the creation of a set
of repair disks that can actually save the entire boot sector to
floppies, instead of just the files of the repair directory.

Regards,

Alex

> -----Original Message-----
> From: Computer_Freaks [SMTP:freaksoc@ukc.ac.uk]
> Sent: Monday, July 28, 1997 1:44 PM
> To: ntsecurity@iss.net
> Cc: weld@l0pht.com
> Subject: [NTSEC] NT Crash - Please help (fwd)
> 
> 
> Hello 
> 
> I am sorry that the following problem is probably not in the
> general concern of the list.
> 
> My hard drive boot record is lost and the I have lost my emergency repair
> disks. I was wandering if it is possible to create E.R.D's on another
> computer and use it with my configuration. 
> 
> I am using a Seagate ST 32140A (2.1 GB) HDD running on a P-133.
> 
> I would be grateful if someone with the same HDD could create an E.R.D set
> that could be used to retrieve some of the lost files.
> 
> Thanks
> 
> Alex
> 
> PS I've already tried NT Recover from NT-Internals but it does not seem to
> work. 
> 
> 


 Hey all!

I was wondering if someone may know how to help me. I have a RAS machine
set up and a web server on another machine... all NT 4 with SP3. What I
would like to do is allow people dialing in on RAS be able to access ONLY
their web page directory on the web server. For security purposes I do not
want to allow them access to any other machine or any other directories on
the network. If this is indeed possible, could someone point me in the
right direction.

What I'm trying to do is allow users to use Front Page, or FrontPad that
ships with IE 4 to create and edit their home pages on the fly.

Thanks for the help!
Charlie

-== Charlie Derk, EAKI (NOC), http://www.eaki.net ==-
 224 Nazareth Pike, Suite 22, Bethlehem, PA 18017
 Phone: (610) 746-0807 Fax: (610) 746-3688

RUNTIME ERROR 6D at 417A: 32CF: Incompetent user


Ok. Another example of the snr. I personally feel that this is getting way
out of hand; this is a _security_ forum, _not_ a general WinNT helpdesk;
If you have a question not related to security, please take it to a more
appropriate area.

On Tue, 29 Jul 1997, CJ wrote:

> Hi All
> 
> I have just installed a pair of NT server on our local network and our small
> lan is connected to the internet via a 64 K Lease line via an ISP. 
> 
> I have configured MS DNS Servers on both NT Server and created a zone,
> "pg.net.my", and when I clicked finish it creates a file named "
> pg.net.my.dns" inside WINNT directory. 
> 
> Here are the configurations
> 
> zeus.pg.net.my SOA 202.185.147.85
> zeus.pg.net.my NS 202.185.147.85
> www CNAME zeus
> ftp CNAME zeus
> 
> I also have PostOffice Installed but I do not know how to configure a MX
> record.. can some one give me a hand here ?
> 
> And plus if I want to host a second domain name, "aftereden.com.my", how do
> I do that with MS DNS ?
> 
> 
> Regards
> Cherri
> 

 
> Tried GetAdmin on Dutch language NT4 SP2.
> Bad luck, it seems GetAdmin tries for 'Administrator' authorization, while
> our's is called 'Beheerder'. If so: for maximum security forget about your
> English language version and learn te speak our language...
> 
> Groetjes,
> 
> André Koot

 Certainly no offense intended but your term for "administrator"
 suggests an interesting pun in English.

 Don't we all feel like we're "herding bee's" sometimes?
 What would "be harder?"

--
Jim Dennis, info@mail.starshine.org
Proprietor, consulting@mail.starshine.org
Starshine Technical Services http://www.starshine.org

 PGP 1024/2ABF03B1 Jim Dennis 
 Key fingerprint = 2524E3FEF0922A84 A27BDEDB38EBB95A 
On Mon, 28 Jul 1997 sundaram@austin.asc.slb.com wrote:
> Does anybody know of a good program that can take a dictionary, a crack
> rule set, and generate a new dictionary with all the rules expanded ? I
> ask this because I'd like to run l0phtcrack on an NT system, but it
> doesn't do rulesets, which I would like.

I've patched Crack 5.0 to work on pwdump'd password lists (my web-page
is down at the moment, but I can mail it to you) if this helps.
(You still need a Unix box to run it on though, obviously...)

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346

On Sun, 27 Jul 1997, Craig Brozefsky wrote:
> Their answer is to keep pushing their upgrade path, telling you 
> to upgrade to NT if you want security, meaning your gonna have to pay for 
> NT workstation licenses, and upgrade time (because the path from Win95 to 
> NT Workstation is not a caekwalk by any means) then you have to apply the 
> new SP that fixes the bugs the previous SP introduced but also fixes the 
> security bug found last week, but doesn't really fix it but only stops 
> the published exploit so you have to apply the Post SP security patch to the 
> NT 4.0 machines that you just upgraded at a non-trivial cost from NT 
> 3.51 and that will eventually have it's entire authentication and domain 
> security model replaced when NT 5.0 comes out next year. Trying to run a 
> secure, stable enterprise on that shit is like trying to hit a gnat
> in the dark with a wiffle ball at 40 paces.

And one thing that massively increases the real costs of keeping
an NT machine secure (particularly if starting from a fresh install)
is the time needed to download and apply the growing number of hot-fixes.

1. Couldn't find a hotfix mirror on ftp.microsoft.co.uk; ftp.microsoft.de
 has one (on port 80 although this is not an alias for www...), but
 the German ones only.

2. Cross the Atlantic to download 22Mb of binaries and documentation.

3.

Install hot-fix 1.
Reboot.
Delay.
Login.

Install hot-fix 2.
Reboot.
Delay.
Login.

Install hot-fix 3.
Reboot.
Delay.
Login.

etc...

4. Puzzle over why the machine claims I'm out of virtual memory on boot-up,
 despite the fact that I have 48Mb of real RAM; this is resolved with the
 next reboot, delay, login.

5. Wonder what happened to my small TCP services; these reappear with the next
 reboot, delay, login.

Is there some way to install multiple hot-fixes without a reboot between each
(and yes I know about several hot-fixes are bundled together -- but why
isn't there a single, large, accumulated-hotfixes-YYMMDD file?)

I MUST have missed something obvious... :-(

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346

By default, the sharename for NETLOGON is set up to allow only READ
access to the EVERYONE group.

If you are using replication to distribute the contents of your NETLOGON
directory, you should have a sharename set up for the *source* directory
(not the NETLOGON directory). Make your modifications there.

If you are not using replication, IMHO, you should be! (If you are
running more than one xDC server!)

If you are only running one server, set up a new share name (maybe
SCRIPTS?) for the %SYSTEMROOT%\SYSTEM32\REPL\IMPORT\SCRIPTS directory
and give R/W privileges to the appropriate users/groups. (Maybe Domain
Admins?)

This should take care of your problem.

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com



> -----Original Message-----
> From: Comms_Server [SMTP:f1ash@dial.pipex.com]
> Sent: Monday, July 28, 1997 18:31
> To: ntsecurity@iss.net
> Subject: [NTSEC] Policies.
> 
> Hiya,
> 
> Just wondered if anyone can help me...
> 
> I want to setup policies that are obeyed by all all machines on the
> network.. As I understand it, you just save the .pol file in the
> \\PDC\NETLOGON folder (NT4 by the way)...However, i can't seem to get
> permissions to write to the folder :((
> 
> Without this, all users can have access to just about
> anything..(control
> panel etc. etc. )..
> 
> Thanks
> Misha
André Koot wrote:
> 
> Tried GetAdmin on Dutch language NT4 SP2.
> Bad luck, it seems GetAdmin tries for 'Administrator' authorization, while
> our's is called 'Beheerder'. If so: for maximum security forget about your
> English language version and learn te speak our language...
> 
Yesteday someone from France (hi Adam !) contacted me regarding the same
issue.
However, changing "Administrator" to "Administrateurs" or "Beheerder"
is trivial and can be done with a simple hex editor (not to mention
re-compiling
the gasys source). So, if you care about security, better apply
SP3+HOFIXES.

-- 


bye,
c0s

Costin RAIU, Data Security Expert

E-MAIL : BUSINESS mailto:craiu@gecad.ro, PERSONAL craiu@usa.net
WWW : http://www.gecad.ro/~craiu/
PGP Key : http://www.gecad.ro/~craiu/craiu.asc (or from WWW.PGP.COM)
KeyID : 2048/DD35A295 Costin RAIU 
Key fingerprint = FD 14 2A 90 64 41 58 9A 6B 34 47 D8 C5 E2 F4 5C


Are you refering to authentication? There is an NIS (not NIS+)
authentication package for Windows NT available. It's freeware, too, but
is somewhat limited. Web address for this is
http://www.dcs.qmw.ac.uk/~williams/

 -Bart
 Pola@cns.uni.edu
 CNS NT Administrator

On Sun, 27 Jul 1997, Ipirotis Panayotis wrote:

> Does anybody know if there is any NIS+ client for WinNT
> or Novell?
> 
> Please contact me at: pirot@cti.gr
> 
> Thanks in advance,
> Ipirotis Panayotis
> 
> 

> > Isn't there a utility to compare the registries of two computers??? Or
at least a utility to dump a registry into a text 


> As far as I remember this utility is called 'DumpReg' and you can find


Why don't you simply "export" from the "file" menu in regedit?

Meanwhile, I recently lost my 'D' drive, a volume set, when I re-installed
NT on my C drive. Both are NTFS, C was a 2Gb partition on Drive 1, D was a
volume set of 5 x 2Gb on the other half of drive 0, plus drives 1 and 2.

I have given up trying to figure why this happened. To make matters worse,
in restoring my ERD to try to fix the problem I accidentally made the
machine think it was a PDC again so it, and the temporary PDC, clashed and
crashed horribly.

I had another BDC which I persuaded to become a PDC by forcing it to via a
standalone server (the only one which could access 'server manager' because
there was no PDC) so in the end I gave up. Both of the 'dead' PDCs now
refused to run the netlogon service, so server manager thought they were
both 'workstations'. It was a horrible mess, so in the end I started from
scratch and reinstalled / restored backup.

Subsequently, I have been looking into why my server refused to restore the
'D' partition from the ERD. It is clear to me, now, that RDisk does NOT
save partition information on the ERD, and that this must be done manually
from Disk Administrator. Disk Administrator, however, says it will restore
partition information from an ERD and mentions nothing about RDISK not
saving it for you (in the 'help' text).

I can't see why 2 PDCs can't fight it out and decide (or ask) which should
be the 'real' one. I can figure even less how I lost my D drive by
re-installing NT on C.... now, if I try to save my partition information,
Disk Admin tells me there's "not enough space on the floppy". A blank
floppy. A subsequent attempt at saving to another floppy, just in case the
first blank was faulty, Disk Admin now says the registry is corrupt and it
can't save the information. I am now afraid to re-boot the machine in case
D disappears again. Otherwise, the machine is working perfectly, but I am
very nervous.

Can anyone offer any assistance on how I can save my partition information
*without* using disk admin?

Regards

Bob

 There is both a remote shell daemon and a reboot command that
comes with the NT resource kit. A combination of the two will allow you to
reboot your NT server remotely.

--tim



On Tue, 29 Jul 1997, Hinders, James D. wrote:

> Is anyone aware of a way to reboot a NTServer4.0 from a Win95 client local or remote?
> 
> Thanks for any help in advance...
> 
> James Hinders-Blue Chip Computers
> Wright Patterson AFB ASC/YWIM
> 2240 B ST STE 7 WPAFB, OH 45433-7104
> COM: 937-255-7209x223 FAX: 937-656-4651
> DSN: 785-7209 Blue Chip: 299-4594
> 
> 

You may install the Web Administration part of the Resource Kit 4.0 or use
Remotely Possible or PC Anywhere.

On Tue, 29 Jul 1997, Hinders, James D. wrote:

> Is anyone aware of a way to reboot a NTServer4.0 from a Win95 client local or remote?
> 
> Thanks for any help in advance...
> 
> James Hinders-Blue Chip Computers
> Wright Patterson AFB ASC/YWIM
> 2240 B ST STE 7 WPAFB, OH 45433-7104
> COM: 937-255-7209x223 FAX: 937-656-4651
> DSN: 785-7209 Blue Chip: 299-4594
> 
> 

I have been trying to find a way in RAS on NT Wkstn 4.0 to disallow my
users from being to save their dial up password(which would then
automate the dialup process) by selecting "Save password". Using the
NTREGMON utility, I found that RAS is looking in the registry for
HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters\DisableSavePass
word value(which doesn't exist).
I then found that adding this value to the Parameters key with a Hex
value of 1 caused the Save Password box to disappear. 

This works great if I use the regular Start->Accessories->Dial-Up
Networking method to dial but it causes a problem dialing from the
command line: I get a rasphone.exe Dr.Watson application error when I
try to dial using the rasphone -d method(The same thing will
happen when I try to right click on the RAS taskbar icon and try to dial
something). I need to be able to use the command line rasphone.exe for
a script(the other command-line app RasDIAL.exe won't work for my needs
becuase it doesn't allow after dial scripts) so now I'm stuck.

Question is: Is there any other way to disable a user from being able to
save their RAS password?
Also: Can anyone tell more about the DisableSavePassword value? Is this
the generally used method to disable Save Password.


Tom Wadzinski
>We found that as long as you don't make the first workstation a member
of 
>a workgroup during the initial install of NT a SID isn't created. This 
>way you can duplicate the image to identical workstations and have them

>work together successfully. We currently have this working in our lab 
>environment so if you have any other questions feel free to contact 
>me directly.

We recently had a lengthy discussion on NTBugTraq about duplication, and
I certainly don't want to cause it to arise here again. Feel free to
check out http://ntbugtraq.rc.on.ca for the archives of the discussion
with a subject of "Duplication problems" (use the search feature to find
the messages from both June and July).

However, a SID is created no matter how you do the initial installation
of NT. Duplicate SIDs will not *stop* machines from working together
successfully, they *may* permit access to secured resources by users
other than those you've designated as being allowed access to those
resources (see archive for more detail). So simply successfully using
two (or more) machines with duplicate SIDs *does not* mean that
everything is hunky doory.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

Here's a question purely out of curiosity. (Low priority). Is there any
way with an NT system, for a program to access otherwise locked files?

If I use pagefile.sys as an example, I don't see an obvious point in time
where it is unlocked, and available to a program. Except for the time you
manually change which disk you paged to... Hmm. I answered that one...
Note to myself: New possible exploit - Pagefile.sys containing security
information accessible after changing pagefile location.

O.K., except for stopping the process which locks a file, is there a way for
a program to read a currently locked file?

Bill Stout

> Here's a good security question about iss.. Why is their majordomo
> server sending me these HELP requests around the clock, completely
> unsolicited? Oh, and by "around the clock" I mean as often as hourly, and
> as seldom as one every 2 hours.

 No, it's not a security question. It's a stupid computer tricks
question when a massive mailing list fills up a file system and runs
out of inodes question. Qmail may be an exceptionally high performance
package but seems to have some problems in error recovery when it runs
out of room in it's spool directory. At the point of failure, we had
over 60,000 messages queued for delivery and had almost 200,000 inodes
tied up. I've shut the list engine down while I decontaminate.

 Sorry for the inconvenience...

> Mind you, I have never sent any message to ISS save for subscribe.
> Unsubscribing from the list will not stop the problem.
> ISS: Do you have a security problem over there? I've written you
> on this a dozen times over the past 2 weeks with no response. So I'll ask
> the list:

> -Does ISS have a security problem with their mail?
> -Is qmail comprimised or broken at iss?
> -Does ISS have a history of ignoring mail from people their systems are
> spamming?

 No mail gets ignored. If I responded to each of the 500 messages
I've gotten over the last two days, I would be able to get this fixed.

> -Is this problem intentional, unintentional, the result of a lack of
> technical knowledge, or a combination?

> I have tried you, ISS, for weeks with no response at all. Now I'll
> ask the user community why your systems are having this problem.

 We have been working on it. That's why we have not responded. We've
been too busy with tracking the source of the problem.

> If your company lacks the ability to respond to user queries about
> mail security, perhaps you're just under-staffed. I'm looking for a
> job-make me an offer. At least I'll answer my email.

 I would be willing to bet you wouldn't get anything else done if
you responded to every message I get. I average approximately 200 messages
a day here and another 400 messages a day at my personal address
(mhw@wittsend.com) some days I'm lucky to wade through the subject lines
and still get some work done... :-(

 On the other hand - If you are a UNIX C or C++ programmer, I would
be delighted to make you an offer. Send me a resume. I've got four openings
to fill right now and it would free me up for more entertaining things
like answering E-Mail! :-)

> "While it's true winning isn't everything-LOSING IS NOTHING!" -Ed Bighead


> P.S. C'mon guys, look at the dates on all the messages you've been
> sending..

> ---------- Forwarded message ----------
> Date: 29 Jul 1997 19:13:39 -0000
> From: Majordomo@iss.net
> To: ptrainor@aura.title14.com
> Subject: Majordomo results
> 
> --
> 
> >>>> HELP
> This is the "Majordomo" mailing list manager, version 1.94.1.
> 
> In the description below items contained in []'s are optional. When
> providing the item, do not include the []'s around it. Items in angle
> brackets, such as
, are meta-symbols that should be replaced
> by appropriate text without the angle brackets.
> 
> It understands the following commands:
> 
> subscribe [
]
> Subscribe yourself (or
if specified) to the named .
> 
> unsubscribe [
]
> Unsubscribe yourself (or
if specified) from the named .
> "unsubscribe *" will remove you (or
) from all lists. This
> _may not_ work if you have subscribed using multiple addresses.
> 
> get 
> Get a file related to .
> 
> index 
> Return an index of files you can "get" for .
> 
> which [
]
> Find out which lists you (or
if specified) are on.
> 
> who 
> Find out who is on the named .
> 
> info 
> Retrieve the general introductory information for the named .
> 
> intro 
> Retrieve the introductory message sent to new users. Non-subscribers
> may not be able to retrieve this.
> 
> lists
> Show the lists served by this Majordomo server.
> 
> help
> Retrieve this message.
> 
> end
> Stop processing commands (useful if your mailer adds a signature).
> 
> Commands should be sent in the body of an email message to
> "Majordomo@iss.net". Multiple commands can be processed provided
> each occurs on a separate line.
> 
> Commands in the "Subject:" line are NOT processed.
> 
> If you have any questions or problems, please contact
> "Majordomo-Owner@iss.net".
> 
> >>>>
> >>>>

 Regards,
 Mike
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
-----BEGIN PGP SIGNED MESSAGE-----


 First response from ISS follows, unedited.

 If you're still looking for help, I'm intersted. Unfortunately,
you're not very local to me:

Internet Security Systems, Inc. (ISS2-DOM)
 41 Perimeter Center East, Suite 660
 Atlanta, Georgia 30326
 US

 Too bad..

P.S. When we strobe servers here they generate log entries between 20-30
megs..

pat 
:) 

System Administrator Guy

"While it's true winning isn't everything-LOSING IS NOTHING!" -Ed Bighead

- ---------- Forwarded message ----------
Date: Tue, 5 Aug 1997 07:43:01 -0400 (EDT)
From: Michael Warfield 
To: Pat Trainor 
Subject: Re: Majordomo results (fwd)

Hello,

 Sorry if no one has gotten back to you on this. Yes, several of
us are looking into this trying to determine the source of the problem
and what remedial action to take. We recently had qmail run out of inodes
in it's spool file system (almost 200,000 files). We are looking into
the possibility that this may have been the result of someone attempting
to "flood" our system, which would indicate you are seeing a symptom of
that attack. Another possibility is that what you are seeing is a result
of the malfunction itself. I think the least likely (but non-negligable)
is that someone is using us to target you specifically. To be quite
frank, if they really wanted to get you, they would come at you from all
sides. So I suspect it's really some sort of problem solely at our end
and we are working to get to the root of it. With logs that hit 20Meg
per day and over 200,000 files (~50,000 messages spooled for delivery)
you can imagine what a task we face.

> These messages come every 2 hours. One of 2 things is happenning:

> 1. My domain is being spoofed in a cron job through email to your
> majordomo
> 2. You are doing this intentionally for some whacked reason

 I can assure you, it is not intentional from our site. It may
be a "stuck" message somewhere, either in the out-bound spool, or inbound
to majordomo. If it's in the outbound spool, all of the messages would
have identical "Message-Id" headers. If it's in the inbound spool,
the message headers will be different and I should be able to see its
fingerprint in the majordomo log. The two hour latency would certainly
indicate a delivery retry interval.

> Either way, you should be able to look at your logs and figure it
> out. Geez, after all your site is a security site, right?

 Secure yes. Perfect... I would have never imagined the random
problems which occur with a mailing list this big... Each message sent
through that list results in the creation of something on the order of
24,000 files (4 files in qmail for each message recepient). The logistics
are down right scary... Oh well... My problem, not yours.

> If you continue to ignore these messages and allow this UCE to
> flow between our systems I'll be forced to start taking more drastic
> measures of intervention. Your call..

 Not being ignored. Just being snowed under.

 I will get back to you later today when I know a little bit more.
I'm actually posting from home right now and will be at the console in
a couple of hours.

> pat 
> :) 

 Sorry for the inconvenience....

> System Administrator Guy
> ptrainor@aura.title14.com
> http://www.title14.com/resume
> 
> "While it's true winning isn't everything-LOSING IS NOTHING!" -Ed Bighead
> 
> ---------- Forwarded message ----------
> Return-Path: Majordomo-Owner@iss.net
> Received: from iss.net (qmailr@ns.iss.net [208.21.0.5]) by aura.title14.com (8.8.5/8.6.9) with SMTP id BAA29676 for ; Tue, 5 Aug 1997 01:02:01 -0400
> Received: (qmail 18875 invoked by uid 15); 29 Jul 1997 14:56:04 -0000
> Date: 29 Jul 1997 14:56:04 -0000
 ^^^^^^^^^^^^^^^^^
 Maybe relevant point - this message was generated right smack in
the middle of our file system full situation. Looks more like "stupid
computer tricks" at this point and I may end up just flushing the entire
spool system to get rid of them. Sigh...

> Message-ID: <19970729145604.18873.qmail@iss.net>
> To: ptrainor@aura.title14.com
> From: Majordomo@iss.net
> Subject: Majordomo results
> Reply-To: Majordomo@iss.net
> 
> --
> 
> >>>> HELP
> This is the "Majordomo" mailing list manager, version 1.94.1. 
> 
> In the description below items contained in []'s are optional. When
> providing the item, do not include the []'s around it. Items in angle
> brackets, such as
, are meta-symbols that should be replaced
> by appropriate text without the angle brackets.
> 
> It understands the following commands:
> 
> subscribe [
]
> Subscribe yourself (or
if specified) to the named .
> 
> unsubscribe [
]
> Unsubscribe yourself (or
if specified) from the named .
> "unsubscribe *" will remove you (or
) from all lists. This
> _may not_ work if you have subscribed using multiple addresses.
> 
> get 
> Get a file related to .
> 
> index 
> Return an index of files you can "get" for .
> 
> which [
]
> Find out which lists you (or
if specified) are on.
> 
> who 
> Find out who is on the named .
> 
> info 
> Retrieve the general introductory information for the named .
> 
> intro 
> Retrieve the introductory message sent to new users. Non-subscribers
> may not be able to retrieve this.
> 
> lists
> Show the lists served by this Majordomo server.
> 
> help
> Retrieve this message.
> 
> end
> Stop processing commands (useful if your mailer adds a signature).
> 
> Commands should be sent in the body of an email message to
> "Majordomo@iss.net". Multiple commands can be processed provided
> each occurs on a separate line.
> 
> Commands in the "Subject:" line are NOT processed.
> 
> If you have any questions or problems, please contact
> "Majordomo-Owner@iss.net".
> 
> >>>> 
> >>>> 
> 

 Mike
- -- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2
Comment: key: www.title14.com/pgp/pub-key.asc * encrypted mail preferred

iQCVAwUBM+c78vOhKSGmXl1lAQFVKQQAs2x95jFKMAB0dZkkMfu2dyizL2BDfcJ0
jIC9d5BX6JRjLPBq9/19c7yjaWDtDX11BF+rAWL5cgh9U5dZ8I1St8wqP6it+TSo
FwbOXbtP2qeo9WRKS/J/lipgTkQ+cuUE4KTfL0wJyU9emZrov+CTmV/zWMTC9O9A
DBaJQwPfmss=
=ICvS
-----END PGP SIGNATURE-----

I wonder if anybody can help with this question.

When installing NT, a unique SID is given to the machine after entering
the Graphics Card is installed. 

What security implications or side affects are their if machines are
disk cloned using a disk copier and they have the same machine SID ?

shutdown.exe or shutgui.exe from the NT4 Resource Kit.

Jason Nash

> -----Original Message-----
> From: Hinders, James D. [SMTP:HinderJD@ASC-YW.WPAFB.AF.MIL]
> Sent: Tuesday, July 29, 1997 10:21 AM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Reboot
> 
> Is anyone aware of a way to reboot a NTServer4.0 from a Win95 client
> local or remote?
> 
> Thanks for any help in advance...
> 
> James Hinders-Blue Chip Computers
> Wright Patterson AFB ASC/YWIM
> 2240 B ST STE 7 WPAFB, OH 45433-7104
> COM: 937-255-7209x223 FAX: 937-656-4651
> DSN: 785-7209 Blue Chip: 299-4594
> 
 When NT establishes a connection with another machine on port 139, it 
 negotiates a new, high-numbered port for the established connection. I 
 believe this is what you're seeing and can be verified with a sniffer 
 or netmon.
 
 Sorry about the the late response.
 
 Bill


______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] Why is NT listening on these high-numbered ports
Author: "James Strompolis" at smtp-sca
Date: 7/25/97 7:52 PM


1723 is PPTP. As to the rest, I don't know them off hand. To isolate which 
service is listening on which port(s), do a port scan, shut down a service, do 
another portscan and note the differences. Keep repeating this until you 
figure out what's listening where.
 
----------
From: owner-ntsecurity@iss.net on behalf of John Wells 
Sent: Thursday, July 24, 1997 1:24 AM
To: NT Security
Subject: [NTSEC] Why is NT listening on these high-numbered ports?
 
I have an NT 4.0 SP3 system which is currently running Netscape's Mail 
Server and BIND (plus evaluations of two proxy servers). Yet when I run 
"netstat -a" I see that the server is listening to high-numbered ports 
which, in addition to those used by the proxy servers, include a number 
which I know nothing about:
 
 1028/tcp
 1029/tcp
 1565/tcp
 1723/tcp
 6050/tcp
 
 1565/udp
 
Plus, the system seems to have a connection with itself between 1026/tcp and 
1027/tcp (each listening to the other on localhost).
 
I checked these ports against a list of "known" ports (www.cavebear.com?), 
and either they weren't included, or obviously didn't match the entries in 
the lists.
 
Can anyone explain what services might be listening on these ports? 
Alternatively, is there a way to determine which process/service is 
listening on a particular port?
 
Thanks,
 
John Wells
jwells@pacificcoast.net
 

Just to set minds at ease, the "I believe" disclaimer below is not
necessary, this is in fact the correct registry hack. Just tried it
myself and it solved a longstanding big question mark over the head
situation. Thanks all.

>-----Original Message-----
>From: Chris Pugrud [SMTP:ChrisP@steldyn.com]
>Sent: Tuesday, July 29, 1997 11:09 AM
>To: 'roman.fischer@ubs.com'; 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Password Change Notification
>
>HKLM/Software/Microsoft/WindowsNT/CurrentVersion/Winlogon/PasswordExpiry
>Warning: REG_DWORD
>
>Please heed the standard warnings about mucking in the registry. I
>believe that you have to create the Value of "PasswordExpiryWarning" and
>type DWORD. Set the value to whatever your policy dictates.
If you disable CAD, you'll increase your vulnerability to trojans.

Maybe in your case, you don't care, so this may mainly be FYI for the
rest of the list.

> ----------
> From:
> j.h.h.jansen@PTT-Telecom.NL[SMTP:j.h.h.jansen@PTT-Telecom.NL]
> Reply To: j.h.h.jansen@PTT-Telecom.NL
> Sent: Tuesday, July 29, 1997 5:00 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Disable CAD on NTwks
> 
> 
> Situation : 5 NT wks and 1 PDC. All of the wks log on automaticly.
> 
> When using Ctrl-A-Del it is possible to lock the workstation. We want
> to
> disable CAD to prevent somebody doing this without knowing the
> password
> (he won`t be able to unlock the workstation).
> 
> With Taskmngr it is also possible to kill tasks. Killing specific
> tasks
> could mean killing production kritic processes.....
> Disabling CAD in one way or another would solve the above mentioned
> problems.
> 
> I found a Gina.dll which would capture CAD, this is doesn`t work.
> After
> two CAD`s I get the famous blue screen with a mem dump...
> Are there other way to capture CAD on a NT wks?
> 
> Somebody got an idea to disable the Ctrl-A-Del on the NTwks?
> 
> 
> Jeroen Jansen
> Consultant
> 
> 
> DISCLAIMER: This statement is not an official statement from, nor does
> it represent an official position of, PTT Telecom BV.
> 
Install IIS on the NT Server. Install WebAdmin on the NT Server. Then
you can reboot the server from a web client.

-Vlad Mott


> -----Original Message-----
> From: Hinders, James D. [SMTP:HinderJD@asc-yw.wpafb.af.mil]
> Sent: Tuesday, July 29, 1997 7:21 AM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Reboot
> 
> Is anyone aware of a way to reboot a NTServer4.0 from a Win95 client
> local or remote?
> 
> Thanks for any help in advance...
> 
> James Hinders-Blue Chip Computers
> Wright Patterson AFB ASC/YWIM
> 2240 B ST STE 7 WPAFB, OH 45433-7104
> COM: 937-255-7209x223 FAX: 937-656-4651
> DSN: 785-7209 Blue Chip: 299-4594
> 
I send this with the fear of being flamed, but I have not received any 
postings to the security list since 7/30. Can anyone confirm that the list 
is still up and operating??

Thank you,

Andy
scoggins@progress.com



=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Andy Scoggins scoggins@progress.com
Progress Software www.progress.com

 "Subvert the dominant paradigm!"
T.J. Fiske wrote:
> 
> Has anyone figured out how to overide the:
> 
> Are you sure (Y/N)?
> 
> That is prompted when you use CACLS.EXE without the /e flag. This is
> anoying since I want to script this? Is there a hidden flag, or another
> utility to use in this situation?
> 
> -- T.J. Fiske
> http://www.qualcomm.com
> ---------------------------------------+-------------------------------
> Senior Engineer / Manager |
> QUALCOMM Incorporated | Perception IS Reality
> San Diego, CA |

I beleive I once glanced at a knowledge base page which suggested the
following syntax for batch files:

[command (Y,N)] |echo Y

I not sure if it was the calcs command but I remember that the pipe had
TO BE ADJACENT to the echo. 

Ryan Ferris
On Tue, 29 Jul 1997, Dominique Brezinski wrote:

> [Double indent (>>) text came from Paul Leach]

No, it came from me.

> At 01:05 PM 7/25/97 -0400, Russ wrote:
> 
> >Never-the-less, it has to be done and its being done, but its not just a
> >matter of ensuring that every new line of code is produced securely.
> 
> Indeed, it is really not that easy. One must hear Bruce Schneier's talk
> "Why Cryptography Is Harder Than It Looks." The same can be said for security.

Every line? No, I never intimated that absolute security was even 
possible, let alone easy.

> I guess they finally listened to me. I made the recommendation for exactly
> such a team over a year and a half ago, but it fell on deaf ears for the
> most part (though there were a few techies that were driving for the same
> thing). Now I feel like a martyr.

That's a stop-gap measure from a development standpoint. QA is never as 
effective as quality engineering up-front.

 > 
> [snip]
> >>That's it. It's not very difficult. Less than a week's worth of 
> >>developer education up-front too. It isn't expensive, it isn't hard,
> >and 
> >>it doesn't take a room full of rocket scientists.
> 
> It does not take a lot to teach a developer the basics of secure coding
> practices, but that won't solve all the security issues. The product has to

That was my point. Exactly my point. At this point, "Best common practice"
would be so much of an improvement over the defacto NT design and 
implementation that I'd be happy to see that much progress, and count it 
as major. I am familiar with what it takes to produce secure code, and 
yes, it is very difficult to design things in such a way that security 
goals are met up front. Looking at an Evaluate Product's Interim 
evaluation reports will show that. What I'm saying is that there are 
simple, basic, easy to do education processes for developers that have 
been ignored by Microsoft which wouldn't take a great deal of effort to 
impliment.

> [snip]
> >>It's been done.
> 
> Has it really (and am I taking this quote in the right context)?

Yes it has, and I have no idea if you are or not.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280


Hello,

Just a simple question - if it is off-topic I will take it elsewhere.

Who belongs to the group everyone on a PDC ? Does this include domain
users ?

Thank You

Warren Milne


Hello !

I whish to set up an NT-based FTP server that allows authentication of
users against a dedicated authentication server (e.g. Safeword) using
tokens and dynamic passwords.

I have been looking around for an FTP server that can use RADIUS or
TACACS+ to communicate with the authentication server but found none.

Does anybody on this list know about such a server ????


Greetings,
Anders Sandell

 ====================================
Anders Sandell Tel: +46 8775 8000
WM-data Dataservice AB Fax: +46 8 775 8490
Box 47104 Cellular: +46 70 5893209
100 74 Stockholm E-mail: ansad@wmdata.com
Sweden

PGP key fingerprint: 
F3 3E A2 O4 E9 C4 27 OE CE A7 91 19 F6 AB B8 A1

T.J. Fiske wrote:
> 
> Has anyone figured out how to overide the:
> 
> Are you sure (Y/N)?
> 
> That is prompted when you use CACLS.EXE without the /e flag. This is

You can do it the way it was since the ol' DOS-days:

 ECHO j|cacls.exe *.* /G Owner:F

For me it works on NT3.51 pretty well.

HTH

-- 
======================================================================
Klinikum Aachen ! Tel: ++49 (0)241 80-88518 
Dept. Radiology ! Fax: ++49 (0)241 8888-480 
DI Franz Josef Katterbach ! 
Pauwelsstr. 30 ! 
52057 AACHEN ! email: 
Germany ! katterbach@linus.rad.rwth-aachen.de
T.J. Fiske wrote:
> 
> Has anyone figured out how to overide the:
> 
> Are you sure (Y/N)?
> 
> That is prompted when you use CACLS.EXE without the /e flag...

Did you try to redirect the input with "cacls options When NT establishes a connection with another machine on port 139, it 
> negotiates a new, high-numbered port for the established connection. I
> believe this is what you're seeing and can be verified with a sniffer 
> or netmon.

Thanks for the suggestion. However, would these high-numbered connections
not then show up as "ESTABLISHED", rather than "LISTENING"?

John
jwells@pacificcoast.net
At 16:40 29/07/97 -0700, Dominique Brezinski wrote:
 [...]
>This brings up another question of mine: does anybody know of a program
>like epdump.exe that actully spits out useful information (like rpcinfo on
>unix)? If not, I will write one.

Please! I've tried EPDUMP.EXE, and it doesn't seem very helpful. I run
 epdump 
locally on my NT4+SP3 server named and get back
 binding is 'ncacn_ip_tcp:'
 no more entries

What is it supposed to display, that my server has none of (notwithstanding
the mystery listening ports)?

John
jwells@pacificcoast.net

[Resent as it never appeared on the list]

Paul Leach wrote:

> We will support Kerberos in NT5; it will conform to RFC 1510 and RFC
> 1964. GSSAPI is an API, not a protocol.
First, thank you for the many prompt replys to this group.

GSSAPI [RFC-1508 and now RFC-2078] is often seen as an API only,
however, as soon as we start to look at the GSS security mechanisms we
are back in the protocol business. For example RFC-1964 actually defines
a protocol.

There are also a number of application protocols related to GSSAPI
and this is where security gets interesting for us users. Some eksample
protocols: IMAP4 [RFC-1731 IMAP4 Authentication Mechanisms (hopefully to
be updated soon), SOCKS [RFC-1961 GSS-API Authentication Method for
SOCKS
Version 5] and FTP [draft-ietf-cat-ftpsec-09.txt FTP Security
Extensions].

Can you reveal which "applications" Microsoft plans to make GSSAPI
compatible on a protocol level? (IMAP, SOCKS, ftp, telnet, CIFS, etc.)

Best regards

Steen

-- 

Steen Koefoed Larsen

SITA R&D Nice, France | @ Home
E-mail: steen.larsen@ed.nce.sita.int | NEW E-mail: steen@who.net
Phone : +33 4 92.96.63.67 | GSM Mobile: +45 40512486
Fax : +33 4 92.96.64.92 | or (French) +33 6 09090568

Disclaimer: This letter may reflect my personal opinion.
 
 "Liberty lies in the rights of that person whose views
 you find most odious" - John Stuart Mill
At 17:42 29.07.97 -0700, you wrote:
>Has anyone figured out how to overide the:
>
> Are you sure (Y/N)?
>
>That is prompted when you use CACLS.EXE without the /e flag. This is
>anoying since I want to script this? Is there a hidden flag, or another
>utility to use in this situation?

I use it together with /p or /r. And then you'll not pe prompted!

regards


Christian Krackowizer | email: kra1@technodat.co.at
TECHNODAT CAD/CAM - Systeme fuer Moebel GmbH | Phone: +43 - (0)662-454944-0
Jakob-Haringer-Strasse 6 | FAX: +43 - (0)662-454944-9
A-5020 Salzburg | Compuserve: 74343,2225
AUSTRIA | http://www.technodat.co.at

 We recently implemented ssh as a secure method to login to our machines.
Unfortunately we did not find a scp (secure cp) for Win95/NT.

 Where can I find one?

 Regards,
rogersm.
Use the following syntax:

 echo y|cacls .....

Bob Karch

>----------
>From: T.J. Fiske[SMTP:tfiske@qualcomm.com]
>Sent: Tuesday, July 29, 1997 8:42 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] CACLS
>
>Has anyone figured out how to overide the:
>
> Are you sure (Y/N)?
>
>That is prompted when you use CACLS.EXE without the /e flag. This is
>anoying since I want to script this? Is there a hidden flag, or another
>utility to use in this situation?
>
> -- T.J. Fiske
> http://www.qualcomm.com
>---------------------------------------+-------------------------------
>Senior Engineer / Manager | 
>QUALCOMM Incorporated | Perception IS Reality
>San Diego, CA | 
>
>
hello all,
 Today I buy a new Motherboard,asus TX97-E,and an
intel pentium MMX 200.
 I already have an asus T2P4,pentium 133,and a
seagate harddisk,1705MB,the OS is NT4.0,with NTFS.
 I build the new system with the new motherboard
and new CPU,but still use the seagate harddisk.
 After configuring the system,I boot it,but it
cannot load NT and says it is not bootable drive!
 I am sure the configuration is right,is there
something wrong with the bios?
 Can anyone with expericence on TX97-E tell me why?
 Thanks in advance.
 
Cheers.
Han Donghai
On Wed, Jul 30, 1997 at 03:12:53AM -0400, Russ wrote:
> A list of 18 exploits in 2 years?? 5 of which are IIS specific?? and
> you're saying this many scares the pants off of Enterprise types, give
> me a break. Like the list for any particular flavor of any other OS
> isn't as long, or longer, for the same period of time.
> 

 Well, considering that NT isn't an open system as most UNIX'es are I would
say 18 exploits in 2 years are QUITE a lot... how many would be found if the
source code was avaiable ? Besides, count the number of exploits that work
REMOTELY... an OOB and ICMP bug ? Ridiculous for a comercial, "network oriented"
 OS -- lets face it, Microsoft has the worst TCP/IP implementation of all.
 Until Micro$oft proves that their network stack is reliable I'll just don't
believe in NT for network services.
 And what about scalability ? NT sucks compared with other OS's like Solaris
for example.

-- 
Nuno Leitao (leitao@convex.pt)
Convex Informatica e Sistemas de Comunicacoes Portugal, Lda.
Tel.: +351 1 422 10 40, Fax.: +351 1 421 37 87
PGP public key: "finger -l npll@tejo.convex.pt"
PGP Key fingerprint = C3 07 7A 52 BB B4 7D 8B 98 85 A5 2B A2 83 71 5B
> 
> Date: Tue, 29 Jul 1997 17:42:15 -0700
> From: "T.J. Fiske" 
> Subject: [NTSEC] CACLS
> 
> Has anyone figured out how to overide the:
> 
> Are you sure (Y/N)?
> 
> That is prompted when you use CACLS.EXE without the /e flag. This is
> anoying since I want to script this? Is there a hidden flag, or another
> utility to use in this situation?
> 
> -- T.J. Fiske
> http://www.qualcomm.com
> - ---------------------------------------+-------------------------------
> Senior Engineer / Manager | 
> QUALCOMM Incorporated | Perception IS Reality
> San Diego, CA | 
> 


I think you might want it to look like:

 echo y | cacls xxxxxxxxxxxxxxxxxxxx

Good luck.
-- 
Steve
mailto:sjneeland@ahcccs.state.az.us
Very well said.

qp
<_

> -----Original Message-----
> From: Russ [SMTP:Russ.Cooper@RC.on.ca]
> Sent: Wednesday, July 30, 1997 2:13 AM
> To: 'Allan McDonald'; 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] [Fwd: You may want to see this page]
> 
> A list of 18 exploits in 2 years?? 5 of which are IIS specific?? and
> you're saying this many scares the pants off of Enterprise types, give
> me a break. Like the list for any particular flavor of any other OS
> isn't as long, or longer, for the same period of time.
> 
> I think your enthusiasm hoping to convince people to switch away from
> NT
> is a bit overblown. Heck, if we don't see that many more before the
> year
> is out I'll be disappointed. Of course you don't seem to care what the
> exploit is, what its potential effect or damage can be, how easy it
> is/was to prevent it, how many of them were prevented through other
> "normal" security measures, or how quickly fixes were available. That
> would dampen your point, wouldn't it, and you wouldn't want to do
> that.
> 
> Maybe you should try to be a bit less subliminal with your message
> next
> time, or at least do enough research to make a point worth making.
> 
> Enterprise types are working on issues that Fyodor's Playhouse can't
> even imagine, and in my experience, they mostly wish that all their
> desktops had as much security as NT has today. What kind of enterprise
> are you working in/with anyway?
> 
> Sorry ISS, didn't mean to get back on the band wagon, just can't seem
> to
> let these snipes go by unopposed.
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list:
> http://ntbugtraq.rc.on.ca/index.html
On Wed, 30 Jul 1997, David Smith wrote:

> I've been in the business almost thirty years, and have never been
> attacked by brute force, and have never had the least interest in
> theoretical issues.

I've been in this business for about 14 years, and I've been in areas 
where being attacked cryptographically, including brute force attempts 
was a 99.9999% certainty. Unlike you, I don't consider cryptographic attacks 
to be theoretical. Not everyone has the same experiences or security 
requirements, but if a system is secure, nobody loses out. If it's insecure, 
then those with more stringent requirements, or those who don't have the 
benifit of a decade of experience almost always lose out. If we all took 
the "never happened to me" approach, we'd be decades behind where we are, 
and that's *really* frightening. 

Password cracking attempts happen every single day. If you're not exposed to 
that, then you're fortunate. At least you're aware of the risks and able to 
make choices competantly. There are a lot of folks who read the list who 
don't have dozens of years of experience, and to whom the issues are 
new and important. 

> There's lots of good, useful, nuts-and-bolts traffic on the list, but I
> don't have the patience to parse the posturing.

It's always been said that you get what you pay for. In the case of most 
mailing lists, you also get what's contributed. If you want the bar raised
in S/N then contribute some S. If you can't handle, or don't have the 
facilities for filtering traffic based on thread, and you can't take the 
noise levels, then you're going to get very frustrated very quickly if 
you subscribe to *any* non-moderated mailing lists.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

I have a friend who wants join the mailing list, how does he need to do?

We recently expanded our site's LAN to include 2 new Class C subnets, for a total of 4 Class C's. Since Phase One of this expansion, we have been experiencing some strange logon validation problems. I'm hoping somebody here can shed some light. Here is a summary of what we've encountered:

Network before expansion:
- 2 Class C subnets (110 and 111). Each subnet has it's own port on the Cisco 7000 router.
- 2 local NT domains (Domain_A and Domain_B), 2 remote domains.
- Two-way trust between each domain.
- 3 DC's for Domain_A (PDC and BDC on 110, BDC on 111 segment), PDC for Domain_B (110 segment).
- All servers running NT 3.51 Service Pak 4. TCP/IP is the only protocol enabled.
- 6 remote sites (one Class C at each site).
- Switched 10Base-T/100Base-T ethernet, 5 Synoptics switches per site.
- 2 local DHCP/WINS servers (110 and 111 segments), located on PDC and BDC for Domain_A.
- 1 DHCP/WINS/DC server at each remote site.
- Users can log on to any Domain from any segment or site (assuming they have a valid domain account). We've 
 been running for well over a year without a problem (none related to this anyways).

Expansion Phase 1 (Temporarily added 2 new subnets as virtual networks while waiting for router ports to ship)
- Added 2 new Class C subnets (112 and 113)
- PDC for Domain_A and Domain_B remain on 110 segment.
- 110 and 112 segments share router port #1, 111 and 113 segments share router port #2.
- Helper addresses are set up on the router ports to point to Domain controllers.
- BOOTP is enabled on the router.
- Install new BDC for Domain_A. This server is multi-homed, and provides DHCP services for new 112 and 113 
 segments.
- PDC for Domain_A becomes multihomed, with 100Base-T NIC for each local subnet to minimize router traffic.
- Problem: Users on 113 segment get logon error when logging into Domain_B. All other segments appear to be ok,
 including the remote sites. These users, however, can still map drives to Domain_B resources (guest account is
 disabled on both domains). The logon error basically states that the PDC for Domain_B could not be found.
- I can ping all servers from any segment (including 113), either by computer name or by IP address. I assume 
 from this that routing and name resolution are working fine.
- Appears that users from 113 are hitting one of the multi-homed domain controllers for Domain_A for validation, and
 pass-through to Domain_B is failing. The PDC and BDC's for Domain_A can locate and map drives to the
 Domain_B controller, and vice-versa. The trust appears to be intact.
- Since users can still access resources, this is more of an inconvenience than an emergency. We decide to wait
 until segments are physically separate, and see if the problem goes away.

Expansion Phase 2 (Physical router ports added)
- Segments are now physically separate and virtual networks are dissolved.
- Users still cannot get validated to Domain_B from 113 segment. All other segments appear to have no problems.
- Since the server providing DHCP services to 112 and 113 segment is a new server (untested in the stable 
 environment before the expansion), and handled every logon attempt we were able to check, we decide to schedule
 another downtime and remove this server for testing. We also want to see what happens when PDC for Domain_B
 is moved to 113 segment.
- Prior to Phase 3 downtime, we confirm that there are some problems connecting this BDC to other subnets when 
 cable to the 112 segment is disconnected.

Phase 3 expansion (rearrange DHCP services and remove questionable server)
- All DHCP services moved to PDC of Domain_A (multihomed - all segments)
- Moved PDC for Domain_B to 113 segment.
- Updated LMHOSTS to reflect new server locations, refreshed name cache on all servers enterprise-wide. Confirmed
 connectivity and name resolution between all servers.
- Users on 113 can now log on to Domain_B and run all scripts.
- Problem: now we cannot establish a trust between Domain_A and Domain_B. THE PDC on each domain cannot find 
 the domain controller for the other domain (only when setting up the trusts - I can still ping by both name and
 address).
- Moved Domain_B controller to 111 segment, reconfigure trusts. Trusts work fine, but logon problem returns.

We have confirmed that the DHCP lease information obtained by the clients is accurate (gateways, subnets, etc. are correct). We have had the router dieties (routers and WAN links are maintained by a separate, internal EDS group) run router diagnostics and try different helper addresses - they say that the router configuration is correct. I have tested all the NICs in the multi-homed systems to ensure that data is being transmitted (although I have not broken down the transmissions by subnet). I have checked the bindings on all NICs for accuracy. 

I apologize for the length of this message, but I'm hoping to minimize some of the more obvious suggestions by detailing some of the steps we have already taken. Also, I have very little personal experience with multi-homed NT 3.51 servers and router configs, so I realize that some of the things we've looked at may have been way off track, and that I may be missing something very obvious. Any suggestions, comments, solutions would be GREATLY appreciated.


Kevin Daum, MCSE
Sr. Communications Engineer
EDS/CSAO 






Hi,

I have some questions regarding security of Microsoft RAS.

Remote Access Service using MS_CHAP
-----------------------------------

|-----------| |-------| |-------| |-----------|
| NT Client |-----| modem |----------| modem |-----| NT Server |
| | |-------| |-------| | as RAS | 
|-----------| |-----------|

1) NT client calls NT Server RAS and negotiate. Assume MS_CHAP is used.

2) NT Server sends 16 byte challenge (nonce) to NT client.

3) NT client replied with his encrypted password and nonce, then encrypt
the encrypted password together with nonce and send to NT Server.

4) NT Server encrypt the user 's encrypted password from User Account
database together with nonce.

5) If the values match, NT Server checks if the NT client has RAS logon
permissions.

6) If NT client has permission, it will be authenticated and allow to
access the RAS and network.

Questions
---------
1. Is the above steps correct for MS_CHAP?
 
2. How was DES used ? Which key is used to encrypt ?

3. Which password was used ? NT or LAN MANAGER password.

4. Why DES is used instead of MD5 for MS_CHAP because RFC defined MD5 as
the algorithm.


Please advise or point to some sites that have the answers already.


Thanks
Lup Kuen

________________________________________
lupkuen@pacific.net.sg

________________________________________
Maybe you're subscribed twice.
Maybe you're subscribed twice.

>-----Original Message-----
>From: Artur Oliveira [SMTP:artur.oliveira@imperio.pt]
>Sent: Wednesday, July 30, 1997 3:40 AM
>To: NT Security
>Subject: [NTSEC] Mailling LIst
>
>Why am i receiving two copies of each message posted in this mailling
>list????
>
At 08:55 PM 8/5/97 -0400, Paul wrote:
>On Tue, 29 Jul 1997, Dominique Brezinski wrote:
>
>> [Double indent (>>) text came from Paul Leach]
>
>No, it came from me.

Whoops, sorry about that. This thread is pretty messy.

>
>> At 01:05 PM 7/25/97 -0400, Russ wrote:
>> 
>> >Never-the-less, it has to be done and its being done, but its not just a
>> >matter of ensuring that every new line of code is produced securely.
>> 
>> Indeed, it is really not that easy. One must hear Bruce Schneier's talk
>> "Why Cryptography Is Harder Than It Looks." The same can be said for
security.
>
>Every line? No, I never intimated that absolute security was even 
>possible, let alone easy.

I was not referring to absolute security, but rather security development
in general.

>
>> I guess they finally listened to me. I made the recommendation for exactly
>> such a team over a year and a half ago, but it fell on deaf ears for the
>> most part (though there were a few techies that were driving for the same
>> thing). Now I feel like a martyr.
>
>That's a stop-gap measure from a development standpoint. QA is never as 
>effective as quality engineering up-front.

No, the goal of the team, as I understand it, is not to just review
previously implemented code, but also to help in the upfront design and
implementation of new software. It is a two pronged approach, and therefore
it is not a stop gap measure. At least that is what I recommended, and to
some degree that is what it sounds like is happening at MS. 

>> [snip]
>> >>That's it. It's not very difficult. Less than a week's worth of 
>> >>developer education up-front too. It isn't expensive, it isn't hard,
>> >and 
>> >>it doesn't take a room full of rocket scientists.
>> 
>> It does not take a lot to teach a developer the basics of secure coding
>> practices, but that won't solve all the security issues. The product has to
>
>That was my point. Exactly my point. At this point, "Best common practice"
>would be so much of an improvement over the defacto NT design and 
>implementation that I'd be happy to see that much progress, and count it 
>as major. I am familiar with what it takes to produce secure code, and 
>yes, it is very difficult to design things in such a way that security 
>goals are met up front. Looking at an Evaluate Product's Interim 
>evaluation reports will show that. What I'm saying is that there are 
>simple, basic, easy to do education processes for developers that have 
>been ignored by Microsoft which wouldn't take a great deal of effort to 
>impliment.

I am trying to differentiate between coding, design, and platform specific
issues that cause security issues. Admittedly, the first is probably the
biggest source of security problems though.

>> [snip]
>> >>It's been done.
>> 
>> Has it really (and am I taking this quote in the right context)?
>
>Yes it has, and I have no idea if you are or not.

This comment was aimed towards the person that I thought had written this,
so never mind ;)

>
>Paul
>-----------------------------------------------------------------------------
>Paul D. Robertson "My statements in this message are personal opinions
>proberts@clark.net which may have no basis whatsoever in fact."
> PSB#9280

Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual. 
At 11:05 AM 7/30/97 -0400, Jane Marcus wrote:
>
>If I have an NT service, I understand that I can optionally provide an
>account and password for the service to run under. I assume it is good
>practice to change the service password on some regular basis. If I'm
>storing a copy of the password for the service in this way, how can I
>programmatically update the copy of the password (securely of course)?
>
>In general, is it bad form to make use of this service password feature? If
>so, what are other ways that a process can store and recall a password by
>which to authenticate?

And...assuming that it is good form to make use of the password feature, is
there a way to synchronize passwords for groups of services?

>Thanks in advance,
>Jane Marcus
>jane@apollo.hp.com

Wow, Apollo as in those old 68K based machines? I used to administer a
token ring network of 40+ Apollos. Great machines.

Travis
At 11:44 AM 7/30/97 -0400, you wrote:

>DHCP Manager's Active Lease dialog displays current IP address

>assignments. Is there a way to view this list (querying the active

>lease, in effect) from another computer--one that is NOT running DHCP

>Manager? My NT Workstation, for instance?


Just install DHCP manager for domains on your Workstation and point it at the dhcp server. All other services are managable in this same way. Many also have managment clients for 95


-tim



0000,8080,0000MMM MMM SSSSSSSS UU UU 
 0000,0000,ffffTimothy D. First,
MCPS

0000,8080,0000MMMM MMMM SS UU 
 UU firsttim@acm.msu.edu

0000,8080,0000MM MM MM MM SSSSSSSS UU UU 
 tim@friesenphoto.com

0000,8080,0000MM MMMM MM SS UU UU 
 http://www.acm.cps.msu.edu/~firsttim

0000,8080,0000MM MM MM SSSSSSSS 
UUUUUUUU

Hi,
the command is as follows:
echo y|cacls options etc.
Mitchell Cohen

At 05:42 PM 7/29/97 -0700, T.J. Fiske wrote:
>Has anyone figured out how to overide the:
>
> Are you sure (Y/N)?
>
>That is prompted when you use CACLS.EXE without the /e flag. This is
>anoying since I want to script this? Is there a hidden flag, or another
>utility to use in this situation?
>
> -- T.J. Fiske
> http://www.qualcomm.com
>---------------------------------------+-------------------------------
>Senior Engineer / Manager | 
>QUALCOMM Incorporated | Perception IS Reality
>San Diego, CA | 
>
>
Phone 212-722-7953 Fax 212-427-1169
e-mail mitch@kewling.com 
Imagination is more important than knowledge.....
Knowledge is limited.....
Imagination is not....... Albert Einstein, (1879-1955)
> ------------------------------
> 
> Date: Tue, 29 Jul 1997 17:42:15 -0700
> From: "T.J. Fiske" 
> Subject: [NTSEC] CACLS
> 
> Has anyone figured out how to overide the:
> 
> Are you sure (Y/N)?
> 
> That is prompted when you use CACLS.EXE without the /e flag. This is
> anoying since I want to script this? Is there a hidden flag, or another
> utility to use in this situation?
> 
> -- T.J. Fiske
> http://www.qualcomm.com
> - ---------------------------------------+-------------------------------
> Senior Engineer / Manager | 
> QUALCOMM Incorporated | Perception IS Reality
> San Diego, CA | 
> 
> ------------------------------

Create a file called 'yesfile' with a 'Y' as the only thing in the file.

Then create a script such as 'cacls.exe *.tmp /g administrator:f /d everyone Will Memphis support NT c/r, not likely, especially since Kerberos will
> be available on NT within a similar time-frame. Will Memphis support
> Kerberos, yeah, but geez, what do you do about all those Win3.x, WfWg,
> and Win95 boxes that didn't come with a Kerberos authentication
> mechanism??

Create a fix for them just like you did for NT?

( being sarcastic for the challenged among us )

Oh. I'am sorry. I forgot Paul said if care about security we should
upgrade out 300 Win95 boxes to NT workstation. Give me a break. It would
take them at the most one week to produce such a fix for 95. Something
everyone seems to want, yet Microsoft does not deliver.

> Cheers,

Indeed.

> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list:
> http://ntbugtraq.rc.on.ca/index.html

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

At 04:04 PM 07/30/97 -0600, Chris Pugrud wrote:
>I'd like to wind up this rant with some questions that are really
>relevant to this forum.
>
>What are our real issues with ensuring desktop and server security in an
>NT environment?

My biggest complaint about NT is and has always been that "Everyone" is
given full read rights to the registry every time a service pack is
applied. This is soooo stupid!

>What can Microsoft do in NT 5.0 to really make our lives easier and more
>productive?
>(Things like remote or loading of service packs, more granular control
>of services...)

The new command line registry commands w/ 4.0 RESKIT Part 2 are a step in
the right direction. NT NEEDS a command line interface at boot time. I
can't count the number of times that a new piece of hardware or an updated
driver has necessitated a reinstallation of NT. At this point, I keep two
copies on our key servers just in case... I want a way to be able to edit
the registry, control panel, add/remove drivers, run disk administrator and
perform other essential tasks in an emergency boot situation. I would also
like to be able to right click on my desktop, click properties, and choose:
select computer. I think that ALL bundled and third party NT utilities
should have a select computer option for remote control - even the Task
Manager. Any and every system should be capable of this without installing
the resource kit or running Pview or another utility that isn't on every
system.

>What are the realistic avenues of attack on an NT based network?

Lax security because of improper setup and/or very lax default permissions.
I wish there were a way to disable remote reads and writes to the registry.
It would sometimes be a pain, but I would gladly sacrifice convenience for
peace of mind. The NT RAS & Routing is a step in the right direction, but
it certainly seems of very limited usefulness since I can't seem to setup <
or > rules for port numbers. For example on an Internet web, ftp, and mail
server I want to: permit incoming on only: TCP 20,21,25,80,110,>1080 from
0.0.0.0 AND permit outgoing only: TCP 20,21,25, >1080 0.0.0.0 AND I want to
be able to permit NBT traffic from my network 192.0.0.1 Also, I want to be
able to permit AND deny not simply permit OR deny packets! MS says that
they worked with Cisco, but it seems to me that nobody that has had ANY
experience with a stand alone router such as a Cisco or a Livingston was
involved with that project. I also want to delete the group Everyone. I
don't want ANY unauthenticated users to access the computer at all. I know
that I can remove Everyone from the User Policies in UM or UMD, but I want
to delete this user. 

>Will Microsoft change NT so that it is shipped more secure out of the
>box and has to be _unsecured_ for relevant environments? Can they do
>this without causing undo frustration and problems associated with the
>vast shortage of experienced NT admins?

There should be an option during setup right around the time that you
choose PDC,BDC, or Server... Something like:

Please select one of the following: 

A. I am an expert system administrator and I will grant access as needed
after installation. Please install with maximum security and with only the
administrator account having access to anything. I understand that this
will severely restrict users ability to do anything.

B. I am a novice and I would like setup to install NT on this computer
automatically with lax security since this computer will not be connected
to any other networks (including the Internet) and we trust everyone in our
office will all information. I understand that this nullify's the built-in
security options of NT.

or better yet... A user customizable .ini file that we can setup to provide
the baseline permissions for the default install.

>IMNSHO It is a waste of time to whine about past grievances with
>Microsoft. It does us all more good to help each other bring up our own
>level of security, and to provide feedback and criticism so that
>Microsoft can improve the security in NT.

A major gripe that I have is that MS seems untouchable when it comes to
requesting an enhancement or reporting a bug. A contact us section on their
home page or an email address in the Help, About boxes of all of their
programs would be a great thing. NT has come a long was since I first
played with 3.1, but it is still in its infancy. Although recently I
believe that they did setup an address of security@microsoft.com for
security bugs. I hope this rambling is useful to someone and if I'm wrong
and asking for something that's already there, please let me know.

-Robert




Use the DHCPCMD.EXE found in the Server Resource Kit.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Christopher G. Waters [SMTP:cwaters@essent.com]
Sent: Wednesday, July 30, 1997 11:44 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] Determining IP Addresses

DHCP Manager's Active Lease dialog displays current IP address
assignments. Is there a way to view this list (querying the active
lease, in effect) from another computer--one that is NOT running DHCP
Manager? My NT Workstation, for instance?

 - H2Os -

I recently posted some results of "locking down" the NT system32
directory with Office 97 SR1 installed -- several people asked how they
could get SR1. I had jumped the gun a little bit, not knowing that it
wasn't available yet.

Anyway -- now it is available. Details below.

Paul

> ----------
> 
> Microsoft Office 97 Service Release Now Available for Download
> 
> Microsoft Corp. (Nasdaq: MSFT) today announced immediate availability
> of the
> Microsoft(R) Office 97 Service Release, further assisting large
> organizations
> migrating to Office 97. 
> 
> When: Wednesday, Aug. 6, at 6 a.m. PDT 
> 
> What: The Office Service Release (SR) is an update to Office 97
> designed
> primarily for large organizations in mixed-version environments that
> need to
> address migration issues. The Service Release incorporates product
> updates to
> date into a single downloadable patch. The downloadable version may
> be
> installed directly over existing versions of Office 97. 
> 
> The most significant component of the Office SR is the new Word
> 6.0/95 Binary
> Converter for Word 97. This converter enhances the ability to share
> Word
> documents with users of previous versions by saving in true .doc
> format by
> default. Other components include enhanced Internet e-mail support
> for the
> Outlook(TM) 97 desktop information manager, Snapshot technology in
> Microsoft
> Access, support for Intel's MMX technology, and other minor
> enhancements. 
> 
> Where: Downloadable at no charge from 
> 
> http://www.microsoft.com/office/office97/servicerelease/ 
> 
> (connect-time charges may apply) 
> 
> NOTE: Microsoft and Outlook are either registered trademarks or
> trademarks of
> Microsoft Corp. in the United States and/or other countries. Other
> product and
> company names herein may be trademarks of their respective owners. 
> 
> CONTACT: press only, Tamarie Ellis, 503-245-0905, or
> tamariee@wagged.com, or
> Ann Irwin, 503-245-0905, or airwin@wagged.com, both of Waggener
> Edstrom, for
> Microsoft; or for online product information: Microsoft Office Web
> site:
> http://www.microsoft.com/office/
> 
I wonder if anybody can help with this question.

When installing NT, a unique SID is given to the machine after entering
the Graphics Card is installed. 

What security implications or side affects are their if machines are
disk cloned using a disk copier and they have the same machine SID ?

There is a tool in NT 4.0 Resource Kit called DHCPCMD.EXE that let's you
manage the DHCP Server from the command line.

> -----Original Message-----
> From: Christopher G. Waters [SMTP:cwaters@essent.com]
> Sent: Quarta-feira, 30 de Julho de 1997 16:44
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Determining IP Addresses
> 
> DHCP Manager's Active Lease dialog displays current IP address
> assignments. Is there a way to view this list (querying the active
> lease, in effect) from another computer--one that is NOT running DHCP
> Manager? My NT Workstation, for instance?
> 
> - H2Os -
Hi,

We are in the process of setting up a student computer laboratory using
NT 4.0. We'd like to establish security on the systems which would
establish drive c: as the operating system disk (write protected) and d:
as the user files drive. We have set up a directory on d: as
/users/username with subdirectories of public and private under each
username. The public directories are set to be shared. We also need to
restrict installation of software by the users.

When setting up the file permissions as described by Microsoft at 
http://www.microsoft.com/security/guidesecnt.htm under NTFS, windows
asking for the password to the c$ and d$ shares appear (even though the
shares have no passwords), and nothing is accessible to the user.

Also, errors that OSA.EXE (Office 97) failed to initialize properly
appear.

We have tried setting the c: and d: root shares to not shared, which
temporarily fixes the problem, but upon reboot, or if the user access
Office 97, the problem re-appears.

We're running NT4.0 build 1381, service pack 1. Microsoft's knowledge
base indicates that service packs 2 and 3 are needed to support Office
97, so I suspect that the Office-related problems might have a fix;
however, the file permissions problem and restricting software
installation are still a problem.

I would appreciate any insights the list readership may have. 

Thanks!

Don
-- 
Donald D. Bustamante 
New Mexico State University
Box 30002, Dept. 3548
Las Cruces, New Mexico USA 88003
(505)-522-9209 FAX: (505)-522-9434
 When NT establishes a connection with another machine on port 139, it 
 negotiates a new, high-numbered port for the established connection. I 
 believe this is what you're seeing and can be verified with a sniffer 
 or netmon.
 
 Sorry about the the late response.
 
 Bill


______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] Why is NT listening on these high-numbered ports
Author: "James Strompolis" at smtp-sca
Date: 7/25/97 7:52 PM


1723 is PPTP. As to the rest, I don't know them off hand. To isolate which 
service is listening on which port(s), do a port scan, shut down a service, do 
another portscan and note the differences. Keep repeating this until you 
figure out what's listening where.
 
----------
From: owner-ntsecurity@iss.net on behalf of John Wells 
Sent: Thursday, July 24, 1997 1:24 AM
To: NT Security
Subject: [NTSEC] Why is NT listening on these high-numbered ports?
 
I have an NT 4.0 SP3 system which is currently running Netscape's Mail 
Server and BIND (plus evaluations of two proxy servers). Yet when I run 
"netstat -a" I see that the server is listening to high-numbered ports 
which, in addition to those used by the proxy servers, include a number 
which I know nothing about:
 
 1028/tcp
 1029/tcp
 1565/tcp
 1723/tcp
 6050/tcp
 
 1565/udp
 
Plus, the system seems to have a connection with itself between 1026/tcp and 
1027/tcp (each listening to the other on localhost).
 
I checked these ports against a list of "known" ports (www.cavebear.com?), 
and either they weren't included, or obviously didn't match the entries in 
the lists.
 
Can anyone explain what services might be listening on these ports? 
Alternatively, is there a way to determine which process/service is 
listening on a particular port?
 
Thanks,
 
John Wells
jwells@pacificcoast.net
 

Try ADDUSERS.EXE from NT 4.0 Resource Kit

> -----Original Message-----
> From: Paul Burtwistle [SMTP:paulbur@ei.csg.mot.com]
> Sent: Quinta-feira, 31 de Julho de 1997 16:42
> To: 'ntsecurity@iss.net.'
> Subject: [NTSEC] SAM database list
> 
> 
> I'm currently making a listing of all users/groups in the Domain SAM
> at
> work in an attempt to tighten up group/user permissions and to aid
> this
> I could do with a utility that will present me with a workable file of
> all the accounts. 
> I used the net user command, redirected the output to a text file,
> then
> ammended the text file to run as a batch file running the net user
> command for all domain users. 
> However this solution is a bit clumsy and the results are not in the
> best format for examining groups and users etc.
> 
> Is there a product available that will list the SAM database of the
> PDC
> and present it in an organised fashion? Any suggestions would be
> appreciated.
> 
> Paul.
DumpACL from SomarSoft

http://www.somarsoft.com/

>-----Original Message-----
>From: Paul Burtwistle [SMTP:paulbur@ei.csg.mot.com]
>Sent: Thursday, July 31, 1997 11:42 AM
>To: 'ntsecurity@iss.net.'
>Subject: [NTSEC] SAM database list
>
>
>I'm currently making a listing of all users/groups in the Domain SAM at
>work in an attempt to tighten up group/user permissions and to aid this
>I could do with a utility that will present me with a workable file of
>all the accounts. 
>I used the net user command, redirected the output to a text file, then
>ammended the text file to run as a batch file running the net user
>command for all domain users. 
>However this solution is a bit clumsy and the results are not in the
>best format for examining groups and users etc.
>
>Is there a product available that will list the SAM database of the PDC
>and present it in an organised fashion? Any suggestions would be
>appreciated.
>
>Paul.
Excuse me, I've forget what should I do if my e-mail was changed. Please
help me. My e-mail was leonid@teia.org.

Leonid
Does anyone know if the Test TCP program, ttcp, has been ported to NT?

Thanks, Joe
-- 
In theory, theory and practice are the same; 
In practice, they're not even close!
Domain Admin Tool by Pukka Software is pretty good....you can get users, last login date, password age, etc. by server.

The eval copy off their web site is fully functional so you can see if it's what you want: www.pukka.com

------------------------------------------------------------------------------------------
Pam Hackett LitleNet, LLC
NT/Notes Analyst 900 Chelmsford Street
Technical Administration Group Lowell MA 01851-8207
E-mail: p_hackett@litle.net Phone: 508.551.5061 Fax: 508.551.5060
-------------------------------------------------------------------------------------------

-----Original Message-----
From: Paul Burtwistle [SMTP:paulbur@ei.csg.mot.com]
Sent: Thursday, July 31, 1997 11:42 AM
To: 'ntsecurity@iss.net.'
Subject: [NTSEC] SAM database list


I'm currently making a listing of all users/groups in the Domain SAM at
work in an attempt to tighten up group/user permissions and to aid this
I could do with a utility that will present me with a workable file of
all the accounts. 
I used the net user command, redirected the output to a text file, then
ammended the text file to run as a batch file running the net user
command for all domain users. 
However this solution is a bit clumsy and the results are not in the
best format for examining groups and users etc.

Is there a product available that will list the SAM database of the PDC
and present it in an organised fashion? Any suggestions would be
appreciated.

Paul.

Try the Addusers.exe from the NT resource kit. It will grab
users/groups from a domain or any workstation...

use the /d option to dump to a comma delimited test file...

Later..boB...
Bob Toth
Director of Enterprise Technologies @ PC DOCS, Inc.
bobt@pcdocs.com

>-----Original Message-----
>From: Paul Burtwistle [SMTP:paulbur@ei.csg.mot.com]
>Sent: Thursday, July 31, 1997 11:42 AM
>To: 'ntsecurity@iss.net.'
>Subject: [NTSEC] SAM database list
>
>
>I'm currently making a listing of all users/groups in the Domain SAM at
>work in an attempt to tighten up group/user permissions and to aid this
>I could do with a utility that will present me with a workable file of
>all the accounts. 
>I used the net user command, redirected the output to a text file, then
>ammended the text file to run as a batch file running the net user
>command for all domain users. 
>However this solution is a bit clumsy and the results are not in the
>best format for examining groups and users etc.
>
>Is there a product available that will list the SAM database of the PDC
>and present it in an organised fashion? Any suggestions would be
>appreciated.
>
>Paul.
There is a utility called NTRIGHTS.EXE in the NT Server 4.0 Resource
Kit, Supplement 2, that provides this functionality.

Eric Fitzgerald
Windows NT Server Domain/Client Team



> -----Original Message-----
> From: Ryan Ferris [SMTP:ryan25@hooked.net]
> Sent: Wednesday, July 30, 1997 10:30 PM
> To: david pederzoli
> Cc: ntsecurity@iss.net
> Subject: Re: R: [NTSEC] Need utitlity to assign user right from
> command line
> 
> david pederzoli wrote:
> > 
> > When someone write "assign user right from command line" I think
> he' s
> > meaning the user right you can find in "user manager for domain",
> second
> > selection, user rights, in which you can assign the "logon locally"
> user
> > right, "act as part of the operating system" user right, etc etc.
> > 
> > Does anyone out there eventually know if there is a utility like
> that ?
> > 
> > I'm very interested in it too !
> > 
> > Thanks very much
> > 
> > ----------
> > > Da: ryan25@hooked.net
> > > A: zeller@indiana.edu
> > > Cc: strops@well.com; ntsecurity@iss.net
> > > Oggetto: Re: [NTSEC] Need utitlity to assign user right from
> command line
> > > Data: sabato 26 luglio 1997 14.43
> > >
> > >
> > >
> > >
> > >
> > > Zeller, Tom S wrote:
> > > >
> > > > cacls.exe comes with nt. it allows use of f,c,r rights. for
> full
> > > > flexibility use xcacls.exe that comes with the addendum to the
> server
> > > > 4.0 resource kit.
> > > >
> > > > > -----Original Message-----
> > > > > From: Jay Urbanski [SMTP:strops@well.com]
> > > > > Sent: Wednesday, July 16, 1997 3:17 PM
> > > > > To: ntsecurity@iss.net
> > > > > Subject: [NTSEC] Need utitlity to assign user right from
> command
> > > > > line
> > > > >
> > > > > Well the topic says it all. I need to grant advanced user
> rights
> > for
> > > > > a 6000 server roll-out, and I don't look forward to doing
> click,
> > > > > click, click 6000 times. Does anyone know of a utitlity to
> grant
> > user
> > > > > rights to groups and users from a command line?
> > > > >
> > > > > Jay Urbanski
> > > > > strops@well.com 
> > > > >
> > > Adduser.exe sets up gobal and local groups fro the command line.
> This
> > > could also be useful. It is in the NT resource group. I have
> found
> > > using the the "for /f" command an appropriate way to process lists
> of
> > > names.
> > >
> > > --=_005BD0FDC12564E000407089C12564E0_=--
> Someone claimed there was a utility to assign user rights
> specifically.
> There is a utility called Addusers.exe (NT resource Kit) which will
> add
> your users to a global or local group. I am reasoning that if you had
> assigned that group specific rights, those users in that group would
> have those rights.
> 
> I'll admit I'm a little unclear on how to batch that out:
> 
> Addusers syntax is like this:
> 
> ADDUSERS [/?] [\\computername [[/c | /d | /e] filename]] [/s:?]
> 
> /? Display this help screen.
> /c Create accounts specified in the file.
> /d Write current accounts to the specified file.
> /e Erase user accounts specified in the file.
> /s:? Sets the seperator character for the input/output file.
> Replace
> the
> ? with the character to be used for seperating fields. (eg
> /s:~)
> Note: The seperator character is a comma ',' by default.
> 
> Where filename is the list of users,groups,etc to be added to the
> \\computername. My idea is that a globalor local group could be
> createded and assign certain rights. Then (through addusers) any
> number
> of users could be added to that group. 
> 
> Whenver I have to process large lists I use the "for" command like
> below:
> 
> FOR /F ["options"] %variable IN (filenameset) DO command
> [command-parameters]
> 
> This allows me to conditionally process long lists (in filenameset). 
> For example:
> 
> for /f "eol= delims= "%%i in (C:\dommachines.txt) do addusers %%i /c
> NewGRP.txt
> 
> would add to all the machines listed in "C:\dommachines.txt" (one at
> a
> time as %%i) to a new global or local group (i.e. Users) that would
> have been given the appropriate rights.
> 
> Now that I've opened my fat mouth, I'm going to actually have to see
> if
> I can make this work.
On Thu, 31 Jul 1997, Paul Burtwistle wrote:
I think that you can use the addusers.exe program from the NT Resource Kit
to dump user info and groups to a comma dilineated file.
Maybe addusers /d filename? I'm not sure.
Good Luck,
Buz Dale
> 
> I'm currently making a listing of all users/groups in the Domain SAM at
> work in an attempt to tighten up group/user permissions and to aid this
> I could do with a utility that will present me with a workable file of
> all the accounts. 
> I used the net user command, redirected the output to a text file, then
> ammended the text file to run as a batch file running the net user
> command for all domain users. 
> However this solution is a bit clumsy and the results are not in the
> best format for examining groups and users etc.
> 
> Is there a product available that will list the SAM database of the PDC
> and present it in an organised fashion? Any suggestions would be
> appreciated.
> 
> Paul.
> 


--
Buz Dale UCNS Lan Support
hdale@arches.uga.edu
hdale@uga.cc.uga.edu


>Paul Leach wrote:
 
>> Especially if, as Dave Leblanc noted on this list recently, when cost of
>> ownership is factored in, Windows NT is actually cheaper.
 
>One interesting computation for you quantroids out there is to figure
>how much in people time it takes to boot Win95 vs. WinNt. The trick
>here is to note that WinNT is much more stable than Win95 so you need
>fewer boots per day. Yes the BSOD does exist, but how many ways does
>Win95 go down, lock-up, go to never-never land, and just make you
>wonder????

Well, my personal favorite is when Win95 croaks after a SUCCESSFUL shutdown. I
have lost count of the # of times I've lost my SHELL32.DLL and/or VMM32.VXD. Of
course, this could be because I run Win95, WinNT and OS/2 Warp on the same
machine (OS/2's Boot manager helps a LOT), but it doesn't give me much faith in
Win95 since it's the only OS that gets upset in this configuration...

Brian


David LeBlanc Wrote

> That's a good point. I figure I normally boot NT on average about once
> every 0.02 days, and it takes 2-3 minutes to get booted and logged in, so
> that's an average of 0.03 minutes/day. Win95 takes about 1-2 minutes to

Teh Heh 

1 Day = 24 Hours
0.1 Day = 2.4 Hours
0.01 Day = .24 Hours
0.02 Day = .48 Hours

You have to reboot NT every half hour ? Linux looks better all the time !!

Sorry could not resist,
Robin
Robin.Pollard@INGBank.com
There is a utility included with SQL Server which will allow you to do
this:

SVCPERM.EXE

Eric Fitzgerald
Windows NT Server Domain/Client Team

> -----Original Message-----
> From: David LeBlanc [SMTP:dleblanc@iss.net]
> Sent: Thursday, July 31, 1997 10:32 AM
> To: davidpederzoli
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Changing security of NT services
> 
> At 20:28 7/26/97 +0200, you wrote:
> >In NT a service is not manageble by a user. Or, however, there are
> same
> >services yon can stop but not start, or start but not stop , or you
> cannot
> >start and stop if you are just a user, with no admin privilegies.
> >I looked for some parameters in order to change this behaviour. I
> mean, I
> >wanted that an ordinary user could start a particular service if this
> had
> >failed ( i.e. the SnaBase service ). I did not succed.
> 
> Who is allowed to stop and start services is determined by the DACL on
> the
> service object itself. By default, only admins and power users are
> allowed
> to do this. If you wish to change this behavior, you'll need to write
> code
> to do so. I have code which will dump the DACL on a service, but I
> haven't
> bothered to write code to change them.
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
Try using addusers.exe /d (with the appropriate other parameters). It
will provide a list of users and groups (including their members) in a
comma delimited file, suitable for use with any spreadsheet.

Addusers is available in the NT Resource Kit.

Brad Ipsan, MCSE
Spectrum Technology Group
www.spectrumntp.com

 -----Original Message-----
 From: Paul Burtwistle [SMTP:paulbur@ei.csg.mot.com]
 Sent: Thursday, July 31, 1997 11:42 AM
 To: 'ntsecurity@iss.net.'
 Subject: [NTSEC] SAM database list


 I'm currently making a listing of all users/groups in the Domain
SAM at
 work in an attempt to tighten up group/user permissions and to
aid this
 I could do with a utility that will present me with a workable
file of
 all the accounts. 
 I used the net user command, redirected the output to a text
file, then
 ammended the text file to run as a batch file running the net
user
 command for all domain users. 
 However this solution is a bit clumsy and the results are not in
the
 best format for examining groups and users etc.

 Is there a product available that will list the SAM database of
the PDC
 and present it in an organised fashion? Any suggestions would be
 appreciated.

 Paul.
At 09:26 7/31/97 -0600, you wrote:

>Support costs and reliability are the issues that management is going to
>understand. These are numbers that fit and spreadsheet and add up.
>Managers that will buy into an upgrade for "security" are rare.

This is true. However, it is the security features that are primarily what
gives you the lowered support costs. I guess we should just stress the
points you name and quietly take the security benefits.

OTOH, since we're in the security biz, we do see a tremendous increase in
awareness of security issues, so perhaps there is hope.

What brought all of this home to me was when I was doing support (and
programming, and ...) for a mixed NT, Netware, WfW, Mac, and UNIX network
at a prior job. The $$!!@! WfW machines were _always_ giving me fits. We
took a look at Win95, decided to go all NT for the PCs. After an initial
bit of getting used to it, and having a few snags with some older DOS apps,
I found that my time spent on support was about 1/2 of what it was
previously, and that crashes went from normal to signifying some sort of
hardware failure.

We see mostly the same thing here - NT just runs unless the hardware is
sick. Win95 keeps the network admin looking worried.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Forgive me for my ignorance, but is there a system in the world that has 
not been attacked and hacked? Every operating system has holes that the 
designers and programmers don't conceived of when creating the program. 
 Granted, Microsoft is not perfect despite the advertisements, and there 
are holes with lanman passwords etc, but those exploits exist so that 
Microsoft can continue to work OS's that admins refuse to upgrade. 
 Microsoft probably should have seen this coming when they created windows, 
but at the same time, we should have seen the Internet worm as well...i.e. 
hindsight is 20/20. Let he hackers hack NT; that will help make this 
relatively young Os just as strong as Unix is today, but please, this 
Microsoft bashing, while it seems to be our favorite past-time, is just 
wasting bandwidth.

That having been said, I'll let the flaming begin.

 Cole

Cole@TechTrain.com

Parsing the posturing is part of being on a list, and probably for the
1st 25 yrs of your career you didnt need to worry about hackers. I feel
sorry for you if you feel you dont need to be concerned now just because
you have never been hit.

just my two pesos.

-jjs

>-----Original Message-----
>From: David Smith [SMTP:david@netword.com]
>Sent: Wednesday, July 30, 1997 8:52 AM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] Bye, here's why
>
>Far too much "I can do the math better than you can" macho 
>cryptography flash.
>
>Far too much "Microsoft was stupid/evil to do it this way."
>
>I've been in the business almost thirty years, and have never been
>attacked by brute force, and have never had the least interest in
>theoretical issues.
>
>There's lots of good, useful, nuts-and-bolts traffic on the list, but I
>don't have the patience to parse the posturing.
>
>BTW, I don't mean to attack you, and thanks for hosting the list. 
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>David A. Smith Netword LLC
>Director of Operations 703-516-4610
>david@netword.com http://www.netword.com
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
At 11:25 8/7/97 -0500, you wrote:
> Your numbers are a mystery to me. See below.

Invert them.

(Doh!)

>> That's a good point. I figure I normally boot NT on average about once
>> every 0.02 days, and it takes 2-3 minutes to get booted and logged in, so
> ^^^^
> .02 x 24 hours = .48 hours ~ .5 hours = 30 minutes
> You boot NT every 30 minutes?

Should be 0.02 boots/day. Whoops.

>> that's an average of 0.03 minutes/day. Win95 takes about 1-2 minutes to
>> boot, but need to be booted at least once/day, and sometimes 4x/day, so
 
> Out of curiosity, what is crashing on Win95 every day? I never
> that much trouble with Win95.

One of our marketing people has Corel graphics tools lock it up fairly
consistently. We also have an older database app that can lose its grip
and cause freezes.

> In a new installation, I agree, NT is the way to go modulo price and
> hardware avaiability. Minimum requirements for NT are probably in the
> range of
>
> 32MB memory
> 1GB Disk
> Pentium 90 Mhz or better
> YMMV

I'll agree with that - for an end-user, it is quite adequate.
 

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Tim Averbeck wrote:
> 
> I have a question concerning secured access to an IIS intranet server
> from the internet...
> 
> We have intranet servers on our LAN that we would like to provide access
> to (via the internet) for our remote sales staff (confidential content
> on the intranet servers). Our LAN is 'protected' by a firewall (Raptor
> Eagle v4) from the internet. We are utilizing a Security Dynamics
> SecurID authentication server (ACE) for remote access authentication
> thru the firewall (but not on the http protocol).
> 
> What we are having problems with is providing 'secured' access to the
> intranet server from the internet. We do not want to have to have our
> internal LAN users (250+) be required to use SecurID tokens (expense and
> inconvenience) to access our intranet servers.
> 
> Is there a configuration/product out there that we can use to provide
> secured access, thru our Raptor firewall, from the internet to our IIS
> intranet servers?
> 
> Thanks in advance,
> Tim Averbeck, Network Services Manager, Firstlogic Inc.
I may be wrong, but I don't beleive that Raptor will support the use 
of SecurID or any other one time passwords for the HTTP login.

There is the Eagle Mobile, which has a high degree of security, but runs
around 100 dollars a piece.

The only other solution would be HTTPS, which would supply the 
encryption for the information, but would allow for weak password,
and guessing at them.
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
> I assume it is good
> practice to change the service password on some regular basis.

I can think of no compelling reason to change this password regularly.
I've never heard of a way to directly log onto a service account.
Anyway, you could always set a 14-char truly random password then forget
it.

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
On Thu, 31 Jul 1997, Artimage wrote:

> On Sat, 26 Jul 1997, Osiris wrote:
> 
> > Absolutely. For those people who claim that security is so important,
> > they *should* use a product with a C2 rating. (Instead of, for example,
> > a B3 rating.) :-)
> 
> Maybe you were being sarcastic and I just don't get it, but B3 is a
> stronger rating than C2. In descending order it is A2, A1, B3, B2, B1,
> C2, C1, D. There may be an A3 but I don't remember. 

 Does there really exist such thing as A2 rating? I've only heard
about A1 (and I'd like to know what are the systems that have
passed it). Anyhow, IMHO, it doesn't mean much, at least with NT:
I remember reading that C2 was considered just as formal test to
pass by NT dev team...

VZ

Hi,

This may be something that you are all aware of, but I have been on the NT
security mailing list for several months and have not seen it discussed in
terms of NT security. I realise it is a long mail - but I think it may be
worth the read ...

A few months ago, a utility called Revelation was mentioned (on this list I
think) which displays the password for a shared drive under Windows 95. This
in itself is worrying.

However, having played around a bit further with Revelation under Windows NT,
it appears that the password displaying doesn't stop under Windows 95! There
are many instances under Windows NT where password boxes are used and
Revelation will display the passwords being typed in most of them. For
example, under User Manager/User Manager for Domains, when a password is
being entered (ie. before the Return key is pressed - it won't work after
return is pressed - thank goodness!), Revelation will display the password.
 Other examples are:

Mounting any network drive where a password is requested
Dial-up networking connection screen
Change Windows NT Password screen under Exchange Server tab in Microsoft
Exchange
Change Windows NT Password screen under Manage Forms tab in Microsoft Outlook
Probably when connecting a hand-held PC (ie. when requested for
authentication - not confirmed yet)
Probably Netscape Navigator/Communicator when entering password for mail
retrieval (ie. not confirmed yet)
Probably Microsoft Outlook/Exchange when connecting to a Microsoft Mail
server (ie. not confirmed yet)

Almost all of these (with the exception of the last one) are not of too much
concern with regard to Revelation because the passwords are not stored on the
system - ie. Revelation would have to be used while the user was entering the
password (difficult to do!). However, it would probably not be difficult to
amend Revelation so that it doesn't display the GUI and rather just does what
it has to - ie. locate the password box and obtain the password (and maybe
send it to a file for later retrieval). This would be particularly useful
when using SMS as the user would probably be unaware that their password
entry was being monitored. Please note: if using Revelation with SMS,
Revelation must be copied to, and run on, the remote system. This is because
if Revelation is run on the Administrator's machine, the password box is
purely a bitmap.

Of more concern is when the password is stored on the system using the
standard Windows encrpytion (which is what Revelation 'decrypts'). I am not
prepared to name names, but a particular NFS package does this and the
potential damage that could be caused is horrific. Imagine the scenario
below (slightly complicated - I know!!):

If I am a local administrator for a company, I can connect to a remote
computer (if the remote administrator settings are the same) and view the
remote registry. I can then go to HKey_Current_User/software/.../password
and copy the string entered there (and make a note of the user's username).
 I can then return to view my own registry and paste the copied password
string into the same place of my own registry. I can then open the control
panel for that particular piece of software and will see the password
represented as stars. I then run Revelation and it displays the remote
user's NFS password. With these details, I can then telnet into the UNIX
system using that user's credentials and, if the user has root privileges on
the UNIX system, do whatever the root user could do on the UNIX system (ie.
delete all files, etc.). Not only this, but there is a strong chance that
the user's Windows NT password is the same as their UNIX password, meaning
that I can probably log in locally or remotely to the user's Windows NT
machine and do whatever they could do on that ... (worrying, huh?)

Another way of getting the password (which removes the need to have
administrator privileges) is to simply walk up to someones machine while they
are away from it (ie. before the screensaver has kicked in) and go to the
same registry position and make a note of the encrypted password string.
 This can be done in less than 30 seconds, so there is relatively little
chance of being caught by the user. The only problem here is that, under the
particular package being described here, the password string was represented
by 8-bit characters (ie. vowels with lines above them and unusual shapes,
etc.) which it is not easy to write down quickly.

I haven't tested it yet, but I have noticed that Microsoft Outlook/Exchange
seems to retain 'password stars' for a user's Microsoft Mail password (if
connecting to a standard Microsoft Mail server - ie. not an Exchange server).
 I imagine that these can be abused with Revelation ...

I am not aware of any patches that change the standard Windows encryption
routine. If there are any out there, please let me know.

This brings me on to my next point (not related to Revelation but still a
security risk). Under Netscape Communicator, if a user chooses to have their
password remembered, it is saved in a file called "prefs.js". If you can
access this file in either of the ways described above, then you can copy the
encrypted password string. Once copied, the string and username can then be
entered into your own copy of prefs.js on your own machine and then used to
get that user's mail whenever you want.

I look forward to receiving any comments about any of the issues mentioned
above. I suggest you look at any software which saves passwords in the
registry or elsewhere and attempt to use Revelation on it.

Please be aware that I am only trying to make people aware of these things -
I am not advising that you use any of the potential risks mentioned above
inappropriately.

Regards,


Richard Warner MCPS
Security Administrator
Cheltenham, UK
(Please feel free to reply directly to Rikwarner@aol.com)

At 01:18 PM 7/31/97 -0500, Artimage wrote:

>Win95 was not designed the same way as NT, hence security is totally
>different on the two machines. NT has built in security, at the kernel


This is a long drawn out thread similar to 'W95 sec' which has no strong
ties to NT security.

Windows '98 will be the last (monolithic code) Windows anyway, being
replaced by a lite version of (modular code) NT. _That_ will be interesting
to talk about, especially if large masses of home PCs will be connected via
cablemodems or internet-fed apartment building LANs.

The end of Windows is in sight! Die 2.0! Die 3.1! Die 3.11! Die W95! Death
to DOS!

Bill Stout

Dominique Brezinski wrote:
> 
> Boys, boys, this thread is getting mighty boring. 

Actually, the thread is pretty much dead. However - for reasons unknown
- the list has continued to re-distribute old messages. In some cases,
they have been several days old. Hmmm.
At 16:36 7/31/97 -0500, you wrote:
>Naturally for this to work you will have to have a Telnet or RCMD 
>server installed on the remote PC. We use the RCMD and it works well. 
> You can get if from the ResKit. Anyone have other packages that work 
>better?

There is a utility called "sc" that I think ships with SQL server that will
do this remotely. I think there is one in the resource kit as well.

If you want to write one, it is really only a dozen lines of code or so -
open the service control manager, open the service, tell it to start or
stop, give the user the results and close your handles.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

The reason the KB article doesn't say anything about Win95 and other
down level clients is because it has no effect their abilities to
connect to servers.

If you apply the fix, and set the registry, NT client won't send LM auth
(with two levels as options -- don't send it to NT servers, and don't
send it to any server). NT servers still accept LM auth.

> ----------
> From: Vlad Mott[SMTP:VladimirMott@fairisaac.com]
> Reply To: Vlad Mott
> Sent: Thursday, July 31, 1997 5:10 PM
> To: 'NTSEC mailing list'
> Subject: [NTSEC] LM hash fix, NT and win95
> 
> Can someone please tell me:
> If I install the post-sp3 LanMan hash fix on every NT Server in my
> domain (including PDC and BDC's), will Win95 clients still be able to
> login to the domain, run login scripts, and connect to shared folders
> on
> the NT servers?
> Microsoft's KB article that accompanies the LanMan hash fix (Q147706)
> is
> marvelously unclear on what affect it will have on down-level clients.
> 
> Thanks!
> Vlad Mott
> 
> 
> > -----Original Message-----
> > From: David LeBlanc [SMTP:dleblanc@iss.net]
> > Sent: Saturday, July 26, 1997 3:49 PM
> > To: Who cares what the hell goes into a Gecos field anyway!;
> > ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca
> > Cc: Paul Leach
> > Subject: Re: [NTSEC] Windows NT rantings from the l0pht
> > 
> > At 10:20 7/24/97 -0400, Who cares what the hell goes into a Gecos
> > field
> > anyway! wrote:
> > 
> > >4. The LM-hash fix works great if you don't have anything but NT
> > machines
> > >on your network. If you want to continue being "productive" with
> your
> > >win95 machines it is my understanding that you "do it insecurely"
> or
> > >you are S.O.L.
> > 
> > [snip-a-lot]
> > 
> > >Since installing the LM-fix precludes continued use of windows 95
> > machines
> > >in regards to talking to NT machines, it is still a moot point as
> to
> > >how tough or well done the NT hash might or might not be.
> > 
> > If I'm not mistaken, the patch keeps NT from -sending- the LM
> hashes,
> > not
> > from accepting them. This would mean that only the Win95 boxes
> would
> > be
> > sending LM hashes in the first place, and your network will still
> > function.
> > The only place I can see getting things hosed up would be if you
> had
> > a
> > Win95 machine acting as a server, which isn't something I'd
> recommend
> > in a
> > secure environment (to put it quite mildly). 
> > 
> > Also, I could have missed something, but I'm not sure Win95 was ever
> > patched against the downgrade attack, so I think you can still
> badger
> > it
> > into sending clear-text. Why waste CPU time cracking even the LM
> > hashes
> > when you can just read clear-text?
> > 
> > IMHO, MS ought to make a patch to Win95 that will let it send the NT
> > style
> > hashes, not allow itself to be downgraded, and we will be better
> off.
> > Personally, I feel Win95 isn't something you want around if you care
> > much
> > about security, and that a pure NT network is a MUCH better idea,
> but
> > I
> > can't even seem to exterminate all the Win95 boxes HERE, sooo...
> > (Hmmm -
> > maybe I should set the patch on all of the NT boxes, and if it works
> > like
> > you think... nah - the other admin will kill me - slowly)
> > 
> > If you do need to crack the NT style hashes, then it is a bit more
> > difficult. Another point is that if you've installed a sniffer on
> my
> > network, then you've already accomplished a very significant breach
> -
> > I'm
> > owned somehow or another. Unless you've got some sort of network
> > running
> > nothing but ssh, once you get a sniffer going, I'm fairly well
> > screwed. It
> > is also the case that on all of the really secure networks I'm aware
> > of,
> > they use a completely switched network, and you can only sniff
> > yourself
> > (hope you've bathed lately...).
> > 
> > 
> > -----------------------------------------------------------
> > David LeBlanc | Voice: (770)395-0150 x138
> > Internet Security Systems, Inc. | Fax: (404)395-1972
> > 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> > Suite 660 | www: http://www.iss.net/
> > Atlanta, GA 30328 |
> 
This is slightly off topic. One of the guys where I work discovered that
those
MS upgrade software packages will install without having the software in
place.
When the window came up asking him what drive to scan for presence of the
product to be upgraded, he chose the CDROM drive itself, viola! Instant
upgrade! He did this first through a shared CDROM on another machine,
another guy repeated it with a local CDROM with identical results. 

Conversely, he discovered that once you do an upgrade, a registry setting
is set, so that even if you install the full version, it still behaves like
an upgrade, an annoying little quirk.

Cordially yours, 
William Ferguson

quango@wavefront.com
I would have to say the consultants should be the one telling the
corporations whether they should ban or not. I personally dont think MS
is any worse than Novell or UN*X, their problems just get advertised
alot more. And I especially dont see a problem with office 97 security
wise...

-jjs

>-----Original Message-----
>From: kgibbs@best.com [SMTP:kgibbs@best.com]
>Sent: Friday, August 01, 1997 1:56 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Migration concerns to new MS Products?
>
>
>As a security consultant, I've run into several large corporations who
>have banned upgrading to new MS products until they are tested and
>approved by management. This included Office '97, MS Internet Explorer
>4.0, NT 5.0 (when released), and other new products that are released.
>
>Is anyone else associated with this list having the same issues in their
>organization? Can anyone comment on the process they are having to go
>through to assure management that these applications warrent upgrade and
>are safe to use? 
>
>Kelly Gibbs
>
>
On Thursday, July 31, 1997 21:56, Paul Warren wrote:
> "...Microsoft claims the problem is in the Workstation SID and NT 5 will
> need to have a unique workstation SID because it will use this via Kerberos
> to connect the workstation to an NT 5 server or to upgrade to workstation
> NT 5."

Isn't it time Intel finally implements a hardware ID in each CPU? Aside from 
being able to track stolen/copied/relabeled CPUs this stupid question of
identifying a machine could be solved easily. Why can 100 ethernet hardware 
manufacturers assign unique ID's to all interfaces but Intel, being monopolist, 
can't label their CPUs?

Nils
-- 
Cornelis van der Laan, Trados Corporation
EMail: nils@trados.com
At 22:55 7/31/97 -0700, you wrote:
>
>As a security consultant, I've run into several large corporations who
>have banned upgrading to new MS products until they are tested and
>approved by management. This included Office '97, MS Internet Explorer
>4.0, NT 5.0 (when released), and other new products that are released.
>
>Is anyone else associated with this list having the same issues in their
>organization? Can anyone comment on the process they are having to go
>through to assure management that these applications warrent upgrade and
>are safe to use? 

We generally keep very up to date here, but I have seen places that were
very conservative about upgrades. The problem I see from a security
standpoint is that the _only_ way to stay secure from the OS standpoint is
to keep current with patches. There are patches for NT 4.0 that just don't
exist on 3.51 (AFAIK).

What I've found useful is to identify the early adopters in an organization
who are typically your more advanced users, and use them as guinea pigs.
Give them the new stuff and see if the smoke leaks out. If everything
looks ok, give it to a few more.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

> "...As has been noted in other responses to this issue, Microsoft has an
> article (Q162001) available both on their Web site as well as in Technet
> that explains the problem with "cloning" NT. The MACHINE SID is created as
> soon as the first GUI portion of the install begins. Any users created in

My understanding is that the SID CAN be created during the first GUI
portion of installation but does not have to be. During the first GUI
portion of installation, setup asks what the name of the computer should
be and wheather it should join a workgroup or domain. If you select
domain, then it contacts the PDC and creates a SID, but if you select
workgroup (just for the cloning portion), this problem shouldn't arise.
This is the interpretation that I have heard.
I recieved an message concerning this from someone who has gone through
Micosoft's training course. In this course, Microsoft themselves said
that is okay to clone the machine as long as the machine has never
connected to the domain. Can anyone confirm this?

 -Bart
 Pola@cns.uni.edu
 CNS Windows NT Administrator

> the LOCAL user database have a unique ID based on the SID and then the
> equivalent of 1 then 2 then 3, for the first three local users. (Since
> ADMINISTRATOR is always the first user created, it will be 1). 
> 
> Therefore the problem is that in a cloned environment (not just Ghost) the
> ADMINSTRATOR SID is duplicated throughtout your environment. Anyone who
> logs on locally (not onto the domain) can attach to the C$ (hidden share
> for the C: Drive) of any other cloned machine, because that machine
> believes the person attaching is it's own administrator. Passwords do not
> have to match, as you have already been validated by your local machine.
> Thus you have FULL ACCESS to all directly attached resources on all other
> cloned machines.
> 
> I hope this clarifies what the security issue really is."
> 
> 
> "...Microsoft claims the problem is in the Workstation SID and NT 5 will
> need to have a unique workstation SID because it will use this via Kerberos
> to connect the workstation to an NT 5 server or to upgrade to workstation
> NT 5."
> 
> --------------------
> 
> Any further "constructive" comments on the security risks associated with
> duplicate Workstation SID's???
> 
> Regards,
> 
> 
> Paul Warren.
> 
> 
> _____________________________________________________________________
> 
> Paul Warren - Network Analyst | http://www.its.unimelb.edu.au:801/
> ITS - Networks & Communications | E-mail: P.Warren@its.unimelb.EDU.AU
> **The University of Melbourne** | Phone: 9344 4136 Fax: 9347 4803
> _____________________________________________________________________
> "The only place where success comes before work is in a dictionary!"
> 
> 

Hi,

Surely you jest!!!

1. Later products are at least as likely to improve security as to expose 
security vulnerabilities (albeit after some patches maybe)
2. The biggest security threat is company policies and actual practices 
(such as writing down passwords on the sides of monitors)
3. Staying where you are on software, just for the sake of it, is not 
really a thoughtful strategy (from the security viewpoint, unless where you 
are has excellent security).

There are probably many other points that could be made, but I would think 
that the best strategy would be to evaluate products from the security and 
other viewpoints (e.g. functionality) and then make a decision based on a 
business case.

No products released (by anyone) can be guaranteed bug free - I remember 
IBM saying in the early 70's that their OS had an estimated 1000 bugs 
(strange thing for them to say), but they were not aware of any.

Most people stay away from the bleeding edge of product release.

Products warrant upgrading when you can justify it in a business case, 
which would include risk assessment, support, functionality, cost etc etc

Seems to me, if you are having troubles, then suggest sending the managers 
on a management course (nothing to do with software!).

Just my opinions.....

Les

On Friday, August 01, 1997 3:56 PM, kgibbs@best.com [SMTP:kgibbs@best.com] 
wrote:
>
> As a security consultant, I've run into several large corporations who
> have banned upgrading to new MS products until they are tested and
> approved by management. This included Office '97, MS Internet Explorer
> 4.0, NT 5.0 (when released), and other new products that are released.
>
> Is anyone else associated with this list having the same issues in their
> organization? Can anyone comment on the process they are having to go
> through to assure management that these applications warrent upgrade and
> are safe to use?
>
> Kelly Gibbs
>
> 
The NT4.0 Resource kit Supplement 2 has a utility to do that.

Don

-----Original Message-----
From: Jules Campbell [SMTP:jsoup@pobox.com]
Sent: Friday, August 01, 1997 1:33 AM
To: 'david pederzoli'; ntsecurity@iss.net
Subject: RE: [NTSEC] Need utitlity to assign user right from command line

Yes!! This is correct.
I was refering to USER RIGHTS e.g. "logon locally" NOT ACL.
from this point in time, no one has said thier is a command line program to do this. 

Jules 


>>Logon to the domain, start user manager and add the user's global group
(domain) to the local PowerUsers group.<<

One warning about power users... We thought it would be a good idea to put 
"domain users" in the local power users group on all our NT workstations. 
It would be a convenient way to let any of our users logon to any NTW 
machine with enough local rights to get their work done.

There is a problem with doing this that didn't occur to us at first, 
however. Not only can power users create shares locally, but they can also 
create them remotely if they have server manager, shareui, netwatcher, etc. 
Since putting domain users in power users makes everyone a power user on 
all the workstations, any user can remotely create a share on any other 
user's machine, then connect to it. They can share C:\, for instance.

Don

lupkuen@pacific.net.sg wrote:
> 
> Hi,
> 
> I have some questions regarding security of Microsoft RAS.
> 
> Remote Access Service using MS_CHAP
> -----------------------------------
> 
> |-----------| |-------| |-------| |-----------|
> | NT Client |-----| modem |----------| modem |-----| NT Server |
> | | |-------| |-------| | as RAS |
> |-----------| |-----------|
> 
> 1) NT client calls NT Server RAS and negotiate. Assume MS_CHAP is used.
> 
> 2) NT Server sends 16 byte challenge (nonce) to NT client.
> 
> 3) NT client replied with his encrypted password and nonce, then encrypt
> the encrypted password together with nonce and send to NT Server.
> 
> 4) NT Server encrypt the user 's encrypted password from User Account
> database together with nonce.
> 
> 5) If the values match, NT Server checks if the NT client has RAS logon
> permissions.
> 
> 6) If NT client has permission, it will be authenticated and allow to
> access the RAS and network.
> 
> Questions
> ---------
> 1. Is the above steps correct for MS_CHAP?
> 
> 2. How was DES used ? Which key is used to encrypt ?
> 
> 3. Which password was used ? NT or LAN MANAGER password.
> 
> 4. Why DES is used instead of MD5 for MS_CHAP because RFC defined MD5 as
> the algorithm.
> 
> Please advise or point to some sites that have the answers already.
> 
> Thanks
> Lup Kuen

For those who feel they haven't been TECHNICALLY CHALLENGED OF LATE! 

Lets add a little more complexity to this interesting question.

1. Replace the modem direct connection with conducting the above
scenario via Internet (either dialin(SLIP/PPP) or direct IP connection),
thus all client<-->server interaction (NETBIOS/NETBEUI) would be assumed
to be IP encapsulated.
2. Further, once all initial handshaking and how-to-do's (I&A) are
completed, can a trusted encrypted tunnel of some be setup to enable the
client to perform some sort of remote diagnostic checking of the NT
Server station? 
3. What would encompass thorough remote diagnostic checking from a
purist/sec. admin. point of view? What kind of tools are available to
accomplish? Are there inherent or built in NT Server utilities to
accomplish, Service pack, addons, or 3rd party solutions?
4. Could NT Server System Administration be performed remotely through
this same route? If so, what kind of things would be most important to 
an administrator besides health checks and physically related things? 
Are there any tools available to do this?
5. If that isn't enough, lets say our intelligent network people have
installed MS Mail ontop of the Server and use it synomously with a Mail
GW? (My opinion is: this is incrediably unreliable, and irresponsible. 
If NT instability isn't enough, lets make it also work as a (Store &
Forward) MS Mail GW/MTA so that it can be brought to its nee's every
time its disk capacity is consumed by email+attachments waiting to be
released to destination???
6. Maybe I am out of my realm here, but I think not! Can someone set
me straight on the dilema I have presented on top of the initial problem
set???
Look forward to the dialogue
...chris


Sorry for my insistence, some of You kindly told me the key for the registry
that prevents the modem hanging up between user sessions. I lost the folder
where I did save Your mail. Could You please tell me one more time what key
should I to add to the registry?

Thanks in advance

Victor Vega

On Bill Stout, Bill Stout[SMTP:stoutb@pios.com] wrote:
> Here's a question purely out of curiosity. (Low priority). Is there any
> way with an NT system, for a program to access otherwise locked files?
> 
> If I use pagefile.sys as an example, I don't see an obvious point in time
> where it is unlocked, and available to a program. Except for the time you
> manually change which disk you paged to... Hmm. I answered that one...
> Note to myself: New possible exploit - Pagefile.sys containing security
> information accessible after changing pagefile location.
> 
> O.K., except for stopping the process which locks a file, is there a way for
> a program to read a currently locked file?
> 
> Bill Stout
> 

Bill, just on the point with the pagefile - there is a key that can be
set to avoid leaving data in the pagefile on shutdown. This can help
minimise exposure due to information left in the pagefile.

HKLM/System/CurrentControlSet/Control/Session Manager/Memory Manager/
ClearPageFileAtShutdown : REG_DWORD
0 or 1


Steve
-- 
Steve McInerney
(Stephen.McInerney@dsb.defence.gov.au)
"Why stop now just when I'm hating it?"
 - Marvin the Paranoid Android


I just wrote this kind of utility yesterday, for our own needs.

It's a command-line utility to start and stop remote services. It
handles dependencies or dependent services.

It can be downloaded at http://www.artech.se/~mlt/remoteservice.zip

CBell@itsinc.com wrote:
> Naturally for this to work you will have to have a Telnet or RCMD
> server installed on the remote PC. We use the RCMD and it works well.
> You can get if from the ResKit. Anyone have other packages that work
> better?
> 
> ----------
> From: Stephen Wiles[SMTP:swiles@empower.com]
> Sent: Saturday, July 26, 1997 4:04 PM
> To: 'John Rutkin'; ntsecurity
> Subject: RE: [NTSEC] Stop/Start Services
> 
> net stop [service] or net start [service]
> 
> > -----Original Message-----
> > From: John Rutkin [SMTP:John.Rutkin@bankerstrust.com]
> > Sent: Thursday, July 24, 1997 3:18 AM
> > To: ntsecurity
> > Subject: [NTSEC] Stop/Start Services
> >
> > Excuse the off topic question..
> >
> > Is there a command line utility that will enable me to stop/start NT
> > services
> > on remote boxes, I obviously have admin rights on all the relevent
> > boxes.
> > Sorry again as this is somewhat off topic.
> >
> > Thanks
> >
> > John Rutkin

-- 
Mats Ljungqvist E-mail: mats.ljungqvist@xsse.se
Software Designer Phone: +46-8-613 86 89
Trading Systems Fax: +46-8-24 63 67
Stockholm Stock Exchange 
SWEDEN Disclaimer: Standard!
On Thu, 31 Jul 1997, Robert Kulp wrote:

> Does anybody know of a product that will allow an NT PDC to use 
> Kerberos authentication for its accounts?
> 
> Example... We currently have Kerberos and NT (and other stuff) on 
> campus, but they all have separate usernames & passwords. What I 
> would like is for the NT DCs to query Kerberos for a password. 
> Specifically, if a Win95/Mac/NT client connects to a server, then the 
> server asks the PDC/BDC to validate the username & password. If the 
> username exists in its SAM, then it would query Kerberos to validate 
> the password, not the SAM. If it validates, then things proceed as 
> usual.
> --Robert

Well there is Kerbnet1.2 package from Cygnus. With this package you can
make your NT serever like master or slave Kereberos(v5) server. There is
also program for obtaining tickets and telnet client with encryption.

http://www.cygnus.com/product/kerbnet-download.html


Your problem can be quazi solved with program from this package called
installgina.exe which after user autentification to PDC contacts Kerberos
server and if password matches, tgt is issued. GINA could be installed 2
ways. 
 1. if authentification to KRB failed but to PDC is OK you can login
 with warning and no ticked issued
 OR
 2. Use /require install option. If one autentification fails you
 can't log in. 

You see it. Problem is when your NT password is different than Kerberos.
You will not login. So Cygnus make password synchrinizer daemon which
propagates NT password to Kerberos database. But watch out! Using this you
give the PDC Administrator admin access to Kerberos database.




--PM

At 02:12 AM 08/06/97 +0000, Warren Milne wrote:
>
>Hello,
>
>Just a simple question - if it is off-topic I will take it elsewhere.
>
>Who belongs to the group everyone on a PDC ? Does this include domain
>users ?
>
>Thank You
>
>Warren Milne

Everyone is the entire universe. If another machine anywhere can
communicate using one of your machines protocols, they are included in
"Everyone" and they are allowed to access everything that "Everyone" has
access to. At the very least it is a good idea to remove "Everyone's"
rights and replace them with "Domain Users." This insures that at a minimum
all users using or connecting to your servers over the network are at least
members of the domain. Also remove Everyone from any and all shares unless
you want the share to be accessible by anyone anywhere on your network.

-Robert


Robert Boyle - Engineer robert@garden.net WAN/VPN/'net Services
Garden Networks: New Jersey's Premier Internet Service Provider
50 Diller Ave. / Newton, NJ 07860 (973)300-9211 8AM-8PM M-F EST
http://www.garden.net Automatic Response: info@garden.net
>Who belongs to the group everyone on a PDC ? Does this include domain
>users ?

My understanding, and the reason I'm sending to the list as well as you is I want to find out if it's correct...

Domain users is also a 'group', for which you maintain a list of whatever users you wish to place in there as you do for any other group on the system.

The group 'everyone' is literally everyone, and as far as I am aware you have no control over it - otherwise it would be pointless calling it 'everyone' ;-) That's why it doesn't even appear in user manager...

It's also a major security problem because it's such a handy 'tool' when you're wrestling with rights. Often, on a complicated system with lots of software installed, an admin who is having trouble with a particular piece of software will grant 'everyone' rights in it's directory, to see if it fixes the problem... it does. Then get gets a phone call, gets diverted, does whatever, and subsequently forgets he's left everyone with full access to somewhere... ;-(

Regards

Bob


Roger Sen Montero wrote:
> 
> We recently implemented ssh as a secure method to login to our machines.
> Unfortunately we did not find a scp (secure cp) for Win95/NT.
> 
> Where can I find one?

I know that it works fine in a Unix-Environment (scp --> secure copy).
Don't know about the NT-copy-commands. 
I suggest to write Mail to Datafellows, the main Distributor of the
ssh-Stuff for Windows or browse the FAQs; find everything on
http://www.datafellows.com/form.a/e-mail.htm

Sorry for just a tip and no real solution.


Bye
-- 
Jens-Uwe Schmidt * jus@ix.heise.de 

 iX * Magazin fuer professionelle Informationstechnik
Verlag Heinz Heise * Helstorfer Str. 7 * 30625 Hannover
 Tel +49 511 5352-375 Fax ...-361
Hi, all....

I found this recently, bought a copy and I thought, since it's an NT/Win85
product, that it might be of interest here. I've tested this and it works
pretty well, especially the executable encryption (you create an encrypted
file that is a self-decrypting executable when the correct password is
given. It's got DES, Triple DES and 256 bit blowfish among other options. I
use it as a substitute for file manager since it has all f/m features plus
the encryption and works the same way. Appologies if you see this also on
BOS.... it's a nice program... just thought I'd spread the word around a bit
(I don't work for these guys, BTW ;-) )

======================

New Technologies, Inc of Gresham, Oregon announces M-Crypt, a cross
platform, networkable file encryption system that supports Windows 3.x,
Windows 95 and Windows NT. M-Crypt's features include a company unique
emergency file recovery system, self-decrypting option for e-mail, and
industrial strength algorithms. Contact New Technologies, (503) 661-6912,
ip@secure-data.com, www.secure-data.com.

======================

----------------------------------------------------------------------
Peter Stephenson, InfoSEC Technologies div. of Sanda International Corp.

 Rochester Hills, MI - (810) 650-2699, (810) 375-2717 fax
 http://www.versalink.com - info@versalink.com
----------------------------------------------------------------------

Hi!
Sounds like your Software (i don't have any experience with it) just
forwards ICMP, not TCP Traffic. You could try a Software called wingate
(i don't know the URL but you'll find a link on
http://internet-security.de --> produkte --> firewall).
If u have any more probs, let me know.
Ben

--
"I'd like to buy OS/2!"
"Oh, have you already finished, playing Windows 95?"



Hi!
Do u use a router to access the services? if yes, you can set up an
IP-Access Table there. If not, you could buy a software for it.
Ben

--
"I'd like to buy OS/2!"
"Oh, have you already finished, playing Windows 95?"




Hi!
Well, first of all you can run Harddisk autodetection in the BIOS to
make sure that the drive is detected properly. Then, you should make
sure that the partition is set up as boot partition in the MBR. for
this, boot with a floppy, run fdisk and set the NT-Root partition as
active. Then try it again.
Ben

--
"I'd like to buy OS/2!"
"Oh, have you already finished, playing Windows 95?"




My interpretation of the KB article is that the fix prevents the sending
of LM-hashes *from* NT machines, but has no effect on what they will
accept as valid. In other words, you should still be able to use your
Win95 machines. There has been some confusion on the list regarding
this, but I believe the documentation is quite clear. Perhaps someone
who has actually tested this will share their experience with the list.

Scott Blake, Corporate Network Manager
NeTegrity, Inc.
blake@security.com

> -----Original Message-----
> From: Vlad Mott [SMTP:VladimirMott@fairisaac.com]
> Sent: Thursday, July 31, 1997 8:11 PM
> To: 'NTSEC mailing list'
> Subject: [NTSEC] LM hash fix, NT and win95
> 
> Can someone please tell me:
> If I install the post-sp3 LanMan hash fix on every NT Server in my
> domain (including PDC and BDC's), will Win95 clients still be able to
> login to the domain, run login scripts, and connect to shared folders
> on
> the NT servers?
> Microsoft's KB article that accompanies the LanMan hash fix (Q147706)
> is
> marvelously unclear on what affect it will have on down-level clients.
> 
> Thanks!
> Vlad Mott
> 
> 
> > -----Original Message-----
> > From: David LeBlanc [SMTP:dleblanc@iss.net]
> > Sent: Saturday, July 26, 1997 3:49 PM
> > To: Who cares what the hell goes into a Gecos field anyway!;
> > ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca
> > Cc: Paul Leach
> > Subject: Re: [NTSEC] Windows NT rantings from the l0pht
> > 
> > At 10:20 7/24/97 -0400, Who cares what the hell goes into a Gecos
> > field
> > anyway! wrote:
> > 
> > >4. The LM-hash fix works great if you don't have anything but NT
> > machines
> > >on your network. If you want to continue being "productive" with
> your
> > >win95 machines it is my understanding that you "do it insecurely"
> or
> > >you are S.O.L.
> > 
> > [snip-a-lot]
> > 
> > >Since installing the LM-fix precludes continued use of windows 95
> > machines
> > >in regards to talking to NT machines, it is still a moot point as
> to
> > >how tough or well done the NT hash might or might not be.
> > 
> > If I'm not mistaken, the patch keeps NT from -sending- the LM
> hashes,
> > not
> > from accepting them. This would mean that only the Win95 boxes
> would
> > be
> > sending LM hashes in the first place, and your network will still
> > function.
> > The only place I can see getting things hosed up would be if you
> had
> > a
> > Win95 machine acting as a server, which isn't something I'd
> recommend
> > in a
> > secure environment (to put it quite mildly). 
> > 
> > Also, I could have missed something, but I'm not sure Win95 was ever
> > patched against the downgrade attack, so I think you can still
> badger
> > it
> > into sending clear-text. Why waste CPU time cracking even the LM
> > hashes
> > when you can just read clear-text?
> > 
> > IMHO, MS ought to make a patch to Win95 that will let it send the NT
> > style
> > hashes, not allow itself to be downgraded, and we will be better
> off.
> > Personally, I feel Win95 isn't something you want around if you care
> > much
> > about security, and that a pure NT network is a MUCH better idea,
> but
> > I
> > can't even seem to exterminate all the Win95 boxes HERE, sooo...
> > (Hmmm -
> > maybe I should set the patch on all of the NT boxes, and if it works
> > like
> > you think... nah - the other admin will kill me - slowly)
> > 
> > If you do need to crack the NT style hashes, then it is a bit more
> > difficult. Another point is that if you've installed a sniffer on
> my
> > network, then you've already accomplished a very significant breach
> -
> > I'm
> > owned somehow or another. Unless you've got some sort of network
> > running
> > nothing but ssh, once you get a sniffer going, I'm fairly well
> > screwed. It
> > is also the case that on all of the really secure networks I'm aware
> > of,
> > they use a completely switched network, and you can only sniff
> > yourself
> > (hope you've bathed lately...).
> > 
> > 
> > -----------------------------------------------------------
> > David LeBlanc | Voice: (770)395-0150 x138
> > Internet Security Systems, Inc. | Fax: (404)395-1972
> > 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> > Suite 660 | www: http://www.iss.net/
> > Atlanta, GA 30328 |
You need to be careful how you install the modem as it might cause a
massive security hole in your IPX/SPX and Netware protocols when
connecting through a Mac system 3 OS
Christopher.Padilla@entex.com wrote:

> Since this is a forum for Windows NT Security you may not get
> many
> responses.
>
> ______________________________ Reply Separator
> _________________________________
> Subject: [NTSEC] Installing a modem in Win95
> Author: C.Toth@keene.k12.nh.us at Internet
> Date: 7/25/97 8:09 PM
>
> does anyone know how to intalla modem that plugs into an ISA slot
> manually (without plug and play) in Win95.
> Chris Toth



Simple -- The group "Everyone" is EXACTLY that, namely EVERYONE. It
even includes users/workstations that have connected to the NT machine
but have not been authenticated.

There is a new group "Authenticated Users" (added with either SP2 or
SP3) that includes only that subset of "Everyone" that have been
authenticated by the server.

So, by deduction, one can surmise that the group "Everyone" does indeed
include "Domain Users" (and "Domain Guests," "Users," "Guests," etc...)

(Y'all please let me know if I've erred in any way here...)

L8R!

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com



> -----Original Message-----
> From: Warren Milne [SMTP:Warren_Milne@westpactrust.co.nz]
> Sent: Tuesday, August 5, 1997 22:13
> To: ntsecurity@iss.net
> Subject: [NTSEC] Group everyone and PDC's
> 
> 
> Hello,
> 
> Just a simple question - if it is off-topic I will take it elsewhere.
> 
> Who belongs to the group everyone on a PDC ? Does this include domain
> users ?
> 
> Thank You
> 
> Warren Milne
> 
Windows NT is being personally used by tons more people than people
using Solaris or UNIX. NT will become a very secure OS in time (when,
who knows?) because of all the hammering on the OS. We don't need
another boring, rung-out OS bash.

To simply state an OS "sucks" is non-constructive and uncalled for. If
you don't like NT,... fine. We won't miss you. You might want to
consider joining a Solaris security mailing list where your "beliefs"
are "secure". 

Windows NT is still a baby. Just wait till he grows-up. 



qp
<_

> -----Original Message-----
> From: Nuno Leitao [SMTP:npll@convex.pt]
> Sent: Wednesday, August 06, 1997 8:41 AM
> To: 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] [Fwd: You may want to see this page]
> 
> On Wed, Jul 30, 1997 at 03:12:53AM -0400, Russ wrote:
> > A list of 18 exploits in 2 years?? 5 of which are IIS specific?? and
> > you're saying this many scares the pants off of Enterprise types,
> give
> > me a break. Like the list for any particular flavor of any other OS
> > isn't as long, or longer, for the same period of time.
> > 
> 
> Well, considering that NT isn't an open system as most UNIX'es are I
> would
> say 18 exploits in 2 years are QUITE a lot... how many would be found
> if the
> source code was avaiable ? Besides, count the number of exploits that
> work
> REMOTELY... an OOB and ICMP bug ? Ridiculous for a comercial, "network
> oriented"
> OS -- lets face it, Microsoft has the worst TCP/IP implementation of
> all.
> Until Micro$oft proves that their network stack is reliable I'll
> just don't
> believe in NT for network services.
> And what about scalability ? NT sucks compared with other OS's like
> Solaris
> for example.
> 
> -- 
> Nuno Leitao (leitao@convex.pt)
> Convex Informatica e Sistemas de Comunicacoes Portugal, Lda.
> Tel.: +351 1 422 10 40, Fax.: +351 1 421 37 87
> PGP public key: "finger -l npll@tejo.convex.pt"
> PGP Key fingerprint = C3 07 7A 52 BB B4 7D 8B 98 85 A5 2B A2 83 71 5B
I have Kerbnet, but it separates the two accounts, NT & Kerberos 
pricipal. It doesn't (that I can tell) allow an NT PDC to query the 
Kerberos DC for the password when a client (95 or Mac) connects. (ie. 
A 95 or Mac machine tries to authenticate with the NT domain. The NT 
domain sees that an account exists, but asks Kerberos if the password 
is correct. If it is, then it procedes as usual. If it does not match,
then it fails because of invalid password.)

That's what I want, but haven't found. BTW, It sounds like NT 5.0 
will do this, but I can't wait that long, and am not sure how 
compliant MS will be with Kerberos v5.
--Robert


On Thu, 07 Aug 1997 16:39:37 -0400 Eric Sites 
wrote:

> Yes try KerbNet from Cygnus... You can even have an NT KDC or NT Slave
> that backsup your UNIX KDC...
> 
> http://www.cygnus.com/product/kerbnet-index.html
> 
> 
> At 09:30 AM 7/31/97 -0500, you wrote:
> >Does anybody know of a product that will allow an NT PDC to use 
> >Kerberos authentication for its accounts?
> >
> >Example... We currently have Kerberos and NT (and other stuff) on 
> >campus, but they all have separate usernames & passwords. What I 
> >would like is for the NT DCs to query Kerberos for a password. 
> >Specifically, if a Win95/Mac/NT client connects to a server, then the 
> >server asks the PDC/BDC to validate the username & password. If the 
> >username exists in its SAM, then it would query Kerberos to validate 
> >the password, not the SAM. If it validates, then things proceed as 
> >usual.
> >--Robert
> >
> >-------------------------+------------------------------------------
> > Robert Kulp | Academic Computing
> > Network Analyst | & Information Services (ACIS)
> > Vanderbilt University | Voice : (615) 343-1612
> > 105 Stevenson Center | Fax : (615) 343-1391
> > Nashville, TN 37240 | Email : Robert.Kulp@Vanderbilt.edu
> >-------------------------+------------------------------------------
> >
> >
> 
> 
> Eric Sites | askSam Systems
> sites@asksam.com | http://www.asksam.com/
> ____________________________________________________________
> You encounter lots of information; why let it go to waste?
> Use askSam Products to Manage it Wisely.

-------------------------+------------------------------------------
 Robert Kulp | Academic Computing
 Network Analyst | & Information Services (ACIS)
 Vanderbilt University | Voice : (615) 343-1612
 105 Stevenson Center | Fax : (615) 343-1391
 Nashville, TN 37240 | Email : Robert.Kulp@Vanderbilt.edu
-------------------------+------------------------------------------

There is no "Everyone" group on a PDC. There is a "Users" local group which 
contains the "Domain Users" global group.

Joel

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Warren Milne [SMTP:Warren_Milne@westpactrust.co.nz]
Sent: Tuesday, August 05, 1997 10:13 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Group everyone and PDC's


Hello,

Just a simple question - if it is off-topic I will take it elsewhere.

Who belongs to the group everyone on a PDC ? Does this include domain
users ?

Thank You

Warren Milne

At 09:22 8/2/97 +1000, you wrote:
>Thank you, for the program "Ntrights.exe". However, I don't know all the 
>API names for rights nor does your program say.

Here's the list:

("SeCreateTokenPrivilege")
("SeAssignPrimaryTokenPrivilege")
("SeLockMemoryPrivilege")
("SeIncreaseQuotaPrivilege")
("SeUnsolicitedInputPrivilege")
("SeMachineAccountPrivilege")
("SeTcbPrivilege")
("SeSecurityPrivilege")
("SeTakeOwnershipPrivilege")
("SeLoadDriverPrivilege")
("SeSystemProfilePrivilege")
("SeSystemtimePrivilege")
("SeProfileSingleProcessPrivilege"
("SeIncreaseBasePriorityPrivilege"
("SeCreatePagefilePrivilege")
("SeCreatePermanentPrivilege")
("SeBackupPrivilege")
("SeRestorePrivilege")
("SeShutdownPrivilege")
("SeDebugPrivilege")
("SeAuditPrivilege")
("SeSystemEnvironmentPrivilege")
("SeChangeNotifyPrivilege")



-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Try XCACLS.EXE or CACLS.EXE that come with the resource kit.

Greg...

> -----Original Message-----
> From: Wood, Jeremy, SrA, SAF/AADXO [SMTP:jwood@af.pentagon.mil]
> Sent: Friday, August 01, 1997 8:27 AM
> To: 'ntsecurity@iss.net'
> Subject: Assignment of NT file rights
> 
> Does anyone know of a command line utility for assigning user file and
> directory permissions? I have a need to also set them for all
> subdirectories and files at the same time. Thanks.
> 
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Jeremy A Wood, SrA, USAF
> Network Administrator, SAF/AADXT
> Directorate of Deptartmental Publications
> 
> Ph: (202) 404-2381 
> Email: jwood@af.pentagon.mil
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
At 21:33 8/6/97 +0800, you wrote:
>hello all,
> Today I buy a new Motherboard,asus TX97-E,and an
>intel pentium MMX 200.

That's all very nice but this is a SECURITY mailing list. One hint might
be the word "SECURITY" in the name of the list.

PLEASE do NOT post non-security related items to this list. Take general
questions to comp.os.ms-windows.nt.misc, or related groups.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Is it possible to set up special access file permissions using cacls? Is there
any command line utility that will do it?

I'm trying to set up system ACLs per [SUTTON97] p. 324-329, using a batch file 
and cacls. Some of the directories require non-standard ACLs (list or RWX) or 
RWXD, which is *not* the same as Full). cacls doesn't seem to allow this. Is 
there another command line tool that does? Can it differentiate between the 
access permissions on a directory and the new file acl?

Also, is there a command line tool for taking ownership of a file?

References:

[SUTTON97] Windows NT Security Guide", Stephen Sutton, Addison-Wesly 1997, 
 ISBN 0-201-41969-6


-- 
Mark Lamourine
BBN Planet, 150 CambridgePark Drive, Cambridge, MA 02140, ms 20/1d
mlamouri@bbnplanet.com, Voice: (617) 873-4306, Fax: (617) 873-5508


There is a tool in NT 4.0 Resource Kit called DHCPCMD.EXE that let's you
manage the DHCP Server from the command line.

> -----Original Message-----
> From: Christopher G. Waters [SMTP:cwaters@essent.com]
> Sent: Quarta-feira, 30 de Julho de 1997 16:44
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Determining IP Addresses
> 
> DHCP Manager's Active Lease dialog displays current IP address
> assignments. Is there a way to view this list (querying the active
> lease, in effect) from another computer--one that is NOT running DHCP
> Manager? My NT Workstation, for instance?
> 
> - H2Os -
Boy, I must be doing something wrong!!!!

I only boot my Win95 machine about once a week... my NT boxes are only
booted one per quarter for maintenance!!!!

At 06:55 PM 8/7/97 +0200, Robin.Pollard@ingbank.com wrote:
>David LeBlanc Wrote
>
>> That's a good point. I figure I normally boot NT on average about once
>> every 0.02 days, and it takes 2-3 minutes to get booted and logged in, so
>> that's an average of 0.03 minutes/day. Win95 takes about 1-2 minutes to
>
>Teh Heh 
>
>1 Day = 24 Hours
>0.1 Day = 2.4 Hours
>0.01 Day = .24 Hours
>0.02 Day = .48 Hours
>
>You have to reboot NT every half hour ? Linux looks better all the time !!
>
>Sorry could not resist,
>Robin
>Robin.Pollard@INGBank.com
>
 Joel Oelfke
 Montana PSC
 Joelfke@mt.gov
>taken. I have heard from MS that there has been "no demand" for those
>measures, but in reality, that's...well...you know.

The dollars are not marching off to the numerous add-on products that
would secure W95, at least from an authentication point of view (i.e.
SecurID is not a huge seller, like, say, Doom or Word, or any other
popular program you might want to think of). This means, from an
independent standpoint, your view of what MS is saying is not a true
representation of the market. Fact is, people don't spend money on
security widely enough to warrant the investment in W95 that would be
required to properly, and I say properly, secure it.

So people are "demanding" it, but their not prepared to shell out to get
it (or else they'd all be buying up SecurID tokens and ACE servers like
mad and my stock in Security Dynamics would be going through the roof,
which it isn't).

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

Have a look in my NTBugtraq archives, where you'll find a batch file
which will install SP3 and all the current hotfixes with a single
reboot, delay, login. It explains how to add hotfixes to this and keep
it current.

http://www.ntbugtraq.com
Subject: Re: 'Batch' install of hotfixes -Reply
Date: Friday, July 25, 1997
Author: John "E.R." Jasen

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

All this wonderful information about GetAdmin not working in foreign
language versions of NT seems to ignore a very simple fact (or maybe its
just that the fact is not apparent to all).

GetAdmin.exe demonstrates a programmatic exploit. The achievement of
placing a given user ID into the Administrators group is irrelevant to
the exploit being demonstrated. Regardless of what the name is,
GetAdmin's core capability works regardless of the language of the box.
It just so happens that the demonstration does not complete itself on
foreign language implementations, but the *exploit* still works.

The *exploit* (now forget the demonstration for a minute) is that it is
able to spawn a thread from a system process. What it does with that
thread is entirely up to any programmer using the exploit code, and is
in no way limited to adding users to the Administrators group. It could,
for example, add a new user and explicitly assign it every right that a
member of the Administrators group has, without ever having to worry
about adding it to the Administrators group.

It could do anything, at all, it wanted to.

So before you think that your foreign language NT implementation is not
affected by this *exploit*, think again, CAUSE YOU ARE AFFECTED.

As Costin said, apply SP3 and the hotfix NOW!!! if you are at all
concerned about security on your NT system in any way, shape, or form.
Without that hot fix, anyone can do anything they want to do on any
machine they have console access to.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

If the service account is a domain account, then the password can be
used to authenticate as that user to netowrk resources (the need for
which is presumably why the service was given a domain account to begin
with). Thus, the password will be used to generate an encryption key and
create ciphertext for challenge/response purposes. Good crrypto hygiene
would thus suggest that the password be changed periodically.

If the service account is a local account, then the above doesn't apply.

> ----------
> From: Steve Sutton[SMTP:ssutton@trustedsystems.com]
> Reply To: Steve Sutton
> Sent: Friday, August 08, 1997 2:22 AM
> To: Jane Marcus
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] service logon password
> 
> > I assume it is good
> > practice to change the service password on some regular basis.
> 
> I can think of no compelling reason to change this password regularly.
> I've never heard of a way to directly log onto a service account.
> Anyway, you could always set a 14-char truly random password then
> forget
> it.
> 
> -- 
> STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
> Phone: (217) 344-0996 1107 S. Orchard Street
> FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
> E-mail: SSutton@TrustedSystems.com 
> WWW: http://www.TrustedSystems.com/
> 
On Thursday, August 07, 1997 9:14 PM, Cornelis van der Laan wrote:
> On Thursday, July 31, 1997 21:56, Paul Warren wrote:
> > "...Microsoft claims the problem is in the Workstation SID and NT 5
will
> > need to have a unique workstation SID because it will use this via
Kerberos
> > to connect the workstation to an NT 5 server or to upgrade to
workstation
> > NT 5."
> 
> Isn't it time Intel finally implements a hardware ID in each CPU?
Aside from 
> being able to track stolen/copied/relabeled CPUs this stupid question
of
> identifying a machine could be solved easily. Why can 100 ethernet
hardware 
> manufacturers assign unique ID's to all interfaces but Intel, being
> monopolist, 
> can't label their CPUs?

Because it doesn't work. Other platforms have had this "feature" and it
turns out to be a major headache for users. If you have a CPU fail, you
want the whole installation to be functionless? Not me, thank you.
Sun's had/have this (hostid), and it was a royal pain to switch boxes
because licensing schemes used this to control software installations.
This doesn't work for the same reason that "dongles" never took off for
software metering: too much hassle.

-Chris
hello Victor,

Edit: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

Add value KeepRasConnections as a type REG_SZ. Set it to 1. 

Guy



 Hello,

 I would like to know if somebody can help me with the following :


 In the unix environment you can make an "suid" executable which can have
 root permissions once it is executed. When starting the executable you 
 do not need to be root, you just need to be in a certain group.

 Is there a means to do this in the Windows NT environment ??



 Regards 
 Wouter_Marien@Paribas.com
Russ wrote:
 
> The dollars are not marching off to the numerous add-on products that
> would secure W95, at least from an authentication point of view (i.e.
> SecurID is not a huge seller, like, say, Doom or Word, or any other
> popular program you might want to think of). This means, from an
> independent standpoint, your view of what MS is saying is not a true
> representation of the market. Fact is, people don't spend money on
> security widely enough to warrant the investment in W95 that would be
> required to properly, and I say properly, secure it.
> 
> So people are "demanding" it, but their not prepared to shell out to get
> it (or else they'd all be buying up SecurID tokens and ACE servers like
> mad and my stock in Security Dynamics would be going through the roof,
> which it isn't).

You are quite correct. However, I don't see why M$ cannot bear part of
that burden. The frequency of upgrades in M$ software is, in my opinion,
a sufficiently lucrative enterprise that Microsoft could knuckle down. I
saw one party post a message indicating that he owned some 300 boxes
with 95 on them. The cost of an NT upgrade for such a network would be
considerable indeed. What M$ is effectively saying is: "Rather than us
spend several million dollars shoring up 95, we would like the public to
pay us many hundreds of millions of dollars to buy NT." Somehow, that
doesn't seem reasonable to me. This is especially so considering the
fact that there are infinitely more offices using 95 than NT. 

Moreover, there will come a time (in the not-so-distant-future) where
the majority of users (American users, at least) will have a static IP.
(Read: most of them will be viable targets for attack, 24-7.)
Presumably, 95 will still be on many of those boxes. I don't think it's
unreasonable for those consumers to expect some level of security.
What's happening here (at least, IMHO) is that M$ is gambling (with
excellent odds) that the average user is not security conscious.
Therefore, a) what they don't know can't hurt them; and b) if they do
know, then they also know that they need to get the NT license. But, I
understand their reasoning perfectly. Paul Leach was kind enough to
explain it to me off the list and I see his point (as I do yours.) I
just feel that this is unreasonable. Many other users I know share that
view. To be fair, however, shoring up the security of top-level box on a
UNIX platform can be quite expensive. (The SunSCreen product line, for
example, could break a bank or two. So, I suppose the only affordable
solution is Linux and either a free firewall - and other security
products - or develop your own.)
I am searching for a tool to delegate administrative tasks. I do not want to
have to set up accounts such as Account Operator, Backup Operator. I want a
simple method to delegate privileges that my users need to do their jobs.

Can you recommend an NT tool and who much will it cost, server, client, etc.?

Thanks in advance,


> Well, considering that NT isn't an open system as most UNIX'es are I
would
>say 18 exploits in 2 years are QUITE a lot... how many would be found
if the
>source code was avaiable ? Besides, count the number of exploits that
work
>REMOTELY... an OOB and ICMP bug ? Ridiculous for a comercial, "network
oriented"

CIAC Bulletin H-56: Solaris 2.x lp Print Service Vulnerability - May 15,
1997
 local users might become root
CIAC Bulletin H-59: Solaris 2.x Buffer - May 27, 1997
 local users might become root
CIAC Bulletin H-69: Vulnerability in getopt (3) - June 16, 1997
 setuid or setgid programs might be exploited to gain root access
CIAC Bulletin H-70: SunOS rpcbind Vulnerability - June 4, 1997
 attacker can gain unauthorized access
CIAC Bulletin H-71: Vulnerability in the at(1) program - June 12, 1997
 user can execute arbitrary commands as root
CIAC Bulletin H-72: SunOS eeprom Vulnerability - June 26, 1997
 over-write eeprom values while running, could be used to gain root
through setgid
CIAC Bulletin H-73: SunOS chkey Vulnerability - June 26, 1997
 vulnerability in program to change D/H public/private key pairs that
could result in root through setuid.
CIAC Bulletin H-75: Solaris Solstice AdminSuite Vulnerabilities - June
30, 1997
 all kinds of problems
CIAC Bulletin H-83: Solaris ping Vulnerability (update H-18) - July 18,
1997
 DoS, system panics
CIAC Bulletin H-89: SunOS, Solaris talkd Buffer Overrun Vulnerability -
July 25, 1997
 remotely execute arbitrary commands as root
CIAC Bulletin H-90: SunOS, Solaris NIS+ Vulnerability - July 31, 1997
 non-privileged users might become root

So let's see, that's 11 exploits that all might result in users gaining
root privilege that they should not have, and in only the last 2.5
months, and all with a single OS that is supposed to be commercial,
"network oriented", and mature!!

I would, respectfully, ask that those of you who read this list and
would like to tell us, who use NT, that we're foolish for doing so,
please consider your positions carefully. No operating system is mature,
none are free of vulnerabilities, and none have perfected their IP
stacks.

It would certainly seem that UNIX is far more prone to NT's
GetAdmin-type exploits (allowing an exploit to gain root privilege) than
NT itself is, but let's just agree to accept that this may well be
because enough exploration along the lines of GetAdmin has not yet been
done in NT.

Neither are perfect. Source code may have helped in uncovering the
issues in Solaris, or they may have been uncovered by Sun itself. The
fact remains that the exploits existed in released code for an
undetermined amount of time before being revealed. Same is true of NT.
There are something like 35 different Universities which have the source
code for Windows NT and have been in a position to uncover similar flaws
in NT for some time.

Best or worst, this list is about discussing NT Security.
Be specific in your claims against NT Security.
Don't use sweeping generalizations when trying to make a point.
Don't think any of us are looking for another OS.
Save your religious opinions for church.
Accept that we all, regardless of OS, are currently running with an
embedded flaw in our system which would permit root/Administrator access
(and always will).

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html


Do you need to start accepting major credit cards and/or
checks by fax/net at your business? We can now issue credit 
card merchant accounts for small, home operated, and
internet businesses with very little up-front cost. 
With your permission I can give you complete details.
Just reply to this message with "more info" or click on 
mailto:ccard@ascella.net and type "more info".
Have a great day! 

Removes please click: mailto:ccard@ascella.net and type 
"remove" in the subject line 




On Fri, 8 Aug 1997, Russ wrote:

> So people are "demanding" it, but their not prepared to shell out to get
> it (or else they'd all be buying up SecurID tokens and ACE servers like
> mad and my stock in Security Dynamics would be going through the roof,
> which it isn't).

That assumes that it's a great deal cheaper to write a broken 
authentication scheme than one that works. I'm not buying that argument 
totally. The dicipline, design properties, and processes needed to do 
something correctly in many cases offset the costs customer support, 
maintenance, and bug fixes. 95 could have been designed better, could 
have been implemented better, and could have even been sold with 3rd 
party authentication hooks already hooked in. The whole "money isn't 
there" thing depends totally on how you spin it. If MS had spent 1/100th 
of what they did advertising Win95 for something like Win95++, and had 
the 3rd party guys add the code it would sell. Oh wait, that'd be 
admitting that they didn't do something right.... 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

On Sat, 9 Aug 1997, Russ wrote:

> Accept that we all, regardless of OS, are currently running with an
> embedded flaw in our system which would permit root/Administrator access
> (and always will).

This isn't a valid assumption in 100% of the cases. 99% perhaps, but not 
100%. At the higher levels, a TCB is your friend. 

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Hi all !

Princeton Software Technologies would like to announce the 
availability of "LogCaster NT", a new realtime event log 
monitoring tool for Windows NT systems. Currently, 
"LogCaster NT" is in beta and we are looking for a few 
good men and women willing to participate in a beta test 
program and give us feedback. 

The only requirement to be eligible for the beta test program
is for your site to have at least 5 NT systems where you will
deploy the software so that the test can be meaningful.
If you would like to apply for the beta, please send us email
at pst@logcaster.com with "LogCaster NT Beta Test Program"
in the subject line. The first 10 applicants will receive a free
10 seats license pack for their site.

If you're not interested in the beta test program and simply
want to try out "LogCaster NT", you can find it at 
http://www.logcaster.com .

We also would like to mention the fact that "LogCaster NT" is 
*FREE* for non-profit organizations.

Thank you,
Regards.


Princeton Software Technologies, Inc.
WWW: http://www.logcaster.com
Email: pst@logcaster.com


Princeton Software Technologies, Inc.
WWW: http://www.logcaster.com
Email: pst@logcaster.com



It is very easy to log on as a service account:-) All you need is the user
name and password and it is just like a regular logon. Changing the
password can have unpredictable results with some programs. IMHO it would
be good to have a really strong password and if yo want to change the PW
you should reinstall the software to avoid unpredictable results.
Mitchell Cohen

At 04:22 AM 8/8/97 -0500, Steve Sutton wrote:
>> I assume it is good
>> practice to change the service password on some regular basis.
>
>I can think of no compelling reason to change this password regularly.
>I've never heard of a way to directly log onto a service account.
>Anyway, you could always set a 14-char truly random password then forget
>it.
>
>-- 
>STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
> Phone: (217) 344-0996 1107 S. Orchard Street
> FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
> E-mail: SSutton@TrustedSystems.com 
> WWW: http://www.TrustedSystems.com/
>
>
Phone 212-722-7953 Fax 212-427-1169
e-mail mitch@kewling.com 
Imagination is more important than knowledge.....
Knowledge is limited.....
Imagination is not....... Albert Einstein, (1879-1955)
Jeeeeeez, let's GIVE IT A REST!!!

If NT was that bad, nobody would be using it.

Try this math (remember that he said "0.02 days," not "0.02 day":

Reboot every:
1.00 days = 24 hours
0.10 days = 240 hours (or 10 days)
0.01 days = 2400 hours (or 100 days)

Therefore: a reboot every 0.02 days is 1200 hours, or 50 days.

I get about the same results, or better. So do my customers, some of
whom have been running the server for six to nine MONTHS (or longer)
without having to reboot. (After it runs that long, I generally will
bounce it just to make sure the boot sector still works. :-)

Folks -- We're talking about an OPERATING SYSTEM here, not politics or
religion or sex. As a consultant, I try to give my customers the best
solution within the confines of their intended usage and available
budget. If that's Solaris or HP-UX, so be it. If it's an AS/400 or an
ES/9000, so be it. If it's NT Server or NetWare or LANtastic, and it
meets their needs, that's what I'll recommend.

Personally, I've found NT to be quite reliable, if not abused. We ran
some cost-benefit analyses and found it to be substantially less
expensive (in our environments, namely small- and medium-sized
businesses) than NetWare. For most of what we do, UNIX or MVS or VMS is
absolutely NOT an alternative because the customers do not have either
the budget or staff to support them.

Personally, I find this list very useful. As its title states, though,
it is for discussion of NT SECURITY, not NT vs. UNIX (or LINUX or AIX,
etc.) I really wish I could filter all the opinion and banter from this
list; it would make reading it SO much easier and less time consuming!

(Gee, I feel better now...)

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com



> -----Original Message-----
> From: Robin.Pollard@ingbank.com [SMTP:Robin.Pollard@ingbank.com]
> Sent: Thursday, August 7, 1997 12:56
> To: abraymond; owner-ntsecurity
> Cc: ntsecurity
> Subject: Re: [NTSEC] RE: Windows NT rantings from the l0pht
> 
> David LeBlanc Wrote
> 
> > That's a good point. I figure I normally boot NT on average about
> once
> > every 0.02 days, and it takes 2-3 minutes to get booted and logged
> in, so
> > that's an average of 0.03 minutes/day. Win95 takes about 1-2
> minutes to
> 
> Teh Heh 
> 
> 1 Day = 24 Hours
> 0.1 Day = 2.4 Hours
> 0.01 Day = .24 Hours
> 0.02 Day = .48 Hours
> 
> You have to reboot NT every half hour ? Linux looks better all the
> time !!
> 
> Sorry could not resist,
> Robin
> Robin.Pollard@INGBank.com
Joel,

What version of NT are you running? My 3.51 and 4.0 (SP3) systems
(workstations, servers, PDC's and BDC's) certainly DO have the BUILTIN
group "Everyone" (as has every other flavor if NT that I've ever seen).

The way that I understand it, "Everyone" is there, you can't delete it,
you can't change its contents, and it includes EVERYONE, even
non-authenticated users.

Comments, anyone?

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com



> -----Original Message-----
> From: Joel W. Barrett [SMTP:jbarrett@rpm.com]
> Sent: Friday, August 8, 1997 09:34
> To: 'Warren Milne'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Group everyone and PDC's
> 
> There is no "Everyone" group on a PDC. There is a "Users" local group
> which 
> contains the "Domain Users" global group.
> 
> Joel
> 
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!
> 
> 
> 
> -----Original Message-----
> From: Warren Milne [SMTP:Warren_Milne@westpactrust.co.nz]
> Sent: Tuesday, August 05, 1997 10:13 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Group everyone and PDC's
> 
> 
> Hello,
> 
> Just a simple question - if it is off-topic I will take it elsewhere.
> 
> Who belongs to the group everyone on a PDC ? Does this include domain
> users ?
> 
> Thank You
> 
> Warren Milne
Mark,

Check out the Security Manager for NT at
http://home.t-online.de/home/wispro/secumgr.htm for a really nice (and
affordable) program that should meet your needs. Although I found it a
bit obtuse at first, it really is very convenient to use.

If you cannot find the site, holler and I'll send more info.

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com



> -----Original Message-----
> From: Mark Lamourine [SMTP:mlamouri@bbnplanet.com]
> Sent: Friday, August 8, 1997 13:16
> To: ntsecurity@iss.net
> Subject: [NTSEC] Special Access using cacls?
> 
> Is it possible to set up special access file permissions using cacls?
> Is there
> any command line utility that will do it?
> 
> I'm trying to set up system ACLs per [SUTTON97] p. 324-329, using a
> batch file 
> and cacls. Some of the directories require non-standard ACLs (list or
> RWX) or 
> RWXD, which is *not* the same as Full). cacls doesn't seem to allow
> this. Is 
> there another command line tool that does? Can it differentiate
> between the 
> access permissions on a directory and the new file acl?
> 
> Also, is there a command line tool for taking ownership of a file?
> 
> References:
> 
> [SUTTON97] Windows NT Security Guide", Stephen Sutton, Addison-Wesly
> 1997, 
> ISBN 0-201-41969-6
> 
> 
> -- 
> Mark Lamourine
> BBN Planet, 150 CambridgePark Drive, Cambridge, MA 02140, ms 20/1d
> mlamouri@bbnplanet.com, Voice: (617) 873-4306, Fax: (617) 873-5508
> 
I am searching for a tool to delegate administrative tasks. I do not want to
have to set up accounts such as Account Operator, Backup Operator. I want a
simple method to delegate privileges that my users need to do their jobs.

Can you recommend an NT tool and who much will it cost, server, client, etc.?

Thanks in advance,


I was always under the impression that to disable the password save box
the easiest way is to disable password caching on the machine via
policies...

-----------------------------------------------------------
Joshua J. Soliz,MCSE
jsoliz@dpai.com
Network Engineer
DeCarlo, Paternite, And Associates, Inc.
http://www.dpai.com


>-----Original Message-----
>From: Wadzinski, Tom IS [SMTP:Tom.Wadzinski@heitman.com]
>Sent: Tuesday, July 29, 1997 3:19 PM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] question: DisableSavePassword
>
>I have been trying to find a way in RAS on NT Wkstn 4.0 to disallow my
>users from being to save their dial up password(which would then
>automate the dialup process) by selecting "Save password". Using the
>NTREGMON utility, I found that RAS is looking in the registry for
>HKLM\SYSTEM\CurrentControlSet\Services\RasMan\Parameters\DisableSavePass
>word value(which doesn't exist).
>I then found that adding this value to the Parameters key with a Hex
>value of 1 caused the Save Password box to disappear. 
>
>This works great if I use the regular Start->Accessories->Dial-Up
>Networking method to dial but it causes a problem dialing from the
>command line: I get a rasphone.exe Dr.Watson application error when I
>try to dial using the rasphone -d method(The same thing will
>happen when I try to right click on the RAS taskbar icon and try to dial
>something). I need to be able to use the command line rasphone.exe for
>a script(the other command-line app RasDIAL.exe won't work for my needs
>becuase it doesn't allow after dial scripts) so now I'm stuck.
>
>Question is: Is there any other way to disable a user from being able to
>save their RAS password?
>Also: Can anyone tell more about the DisableSavePassword value? Is this
>the generally used method to disable Save Password.
>
>
>Tom Wadzinski
According to an AS/400 consultant I worked with at one of my client
sites, NO IBM AS/400 has EVER been hacked. I laughed in his face... :D


-----------------------------------------------------------
Joshua J. Soliz,MCSE
jsoliz@dpai.com
Network Engineer
DeCarlo, Paternite, And Associates, Inc.
http://www.dpai.com


>-----Original Message-----
>From: ColeMaddox [SMTP:cole@techtrain.com]
>Sent: Thursday, July 31, 1997 9:52 AM
>To: ntsecurity@iss.net
>Subject: RE: [NTSEC] RE: Windows NT rantings from the l0pht
>
>Forgive me for my ignorance, but is there a system in the world that has 
>not been attacked and hacked? Every operating system has holes that the 
>designers and programmers don't conceived of when creating the program. 
> Granted, Microsoft is not perfect despite the advertisements, and there 
>are holes with lanman passwords etc, but those exploits exist so that 
>Microsoft can continue to work OS's that admins refuse to upgrade. 
> Microsoft probably should have seen this coming when they created windows, 
>but at the same time, we should have seen the Internet worm as well...i.e. 
>hindsight is 20/20. Let he hackers hack NT; that will help make this 
>relatively young Os just as strong as Unix is today, but please, this 
>Microsoft bashing, while it seems to be our favorite past-time, is just 
>wasting bandwidth.
>
>That having been said, I'll let the flaming begin.
>
> Cole
>
>Cole@TechTrain.com
>
How do I disable POSIX?

-----------------------------------------------------------
Joshua J. Soliz,MCSE
jsoliz@dpai.com
Network Engineer
DeCarlo, Paternite, And Associates, Inc.
http://www.dpai.com


>-----Original Message-----
>From: David LeBlanc [SMTP:dleblanc@iss.net]
>Sent: Wednesday, July 23, 1997 12:40 PM
>To: Paul Leach; 'Andreas Kostyrka'
>Cc: ntsecurity@iss.net
>Subject: RE: [NTSEC] Win95 sec
>
>At 15:59 7/22/97 -0700, Paul Leach wrote:
> 
>>> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
>
>>> Consider WRITE priviledges to the system directory, which probably
>>> you
>>> can't even disable, because some popular apps depend upon it? 
>>> Now ask your local Unix administrator, if (s)he would consider
>>> chmod o+w /bin /usr/bin /usr/local/bin /usr/lib /lib ...
>>> Installing systemwide application must limited to the Administrator.
> 
>>First: Suppose only admins could write to the system directory. If the
>>user has physical access to their own machine, then they can still
>>install apps without being admin -- by booting from floppy, or taking
>>the hard disk out and putting it into their home machine -- its all just
>>a question of how much work it is, and I think there are lots of users
>>with the requisite skills in this era of nearly unbiquitous home PCs.
>
>Yes, but that is really a different issue. I can restrict physical access
>with $10 worth of hardware - devices to padlock cases do exist. We can't
>excuse file system insecurity by calling on physical security issues. Let's
>just assume that we want to raise the barrier to the level where physical
>access is required.
>
>>Second: by default, NT _does not_ let anyone except admins overwrite or
>>delete existing system files. Since apps that are run through the GUI
>>are run via absolute paths, adding files is not by itself sufficient to
>>insert a trojan.
>
>This isn't exactly true, AFAIK, the default permissions on %systemroot% are
>"Everyone:F". If I'm not mistaken, this allows ANY user to take ownership
>and change permissions of ANY file object below that point. For that
>matter, %systemroot%\profiles are also "everyone:F", which allows ANY user
>to say delete an entire profile tree and replace it with one infested with
>trojans of their choice. If I'm missing something here, please correct me.
>I'm quite sure that if these directories had "everyone:C" that we wouldn't
>have that problem.
>
>Furthermore, if POSIX is enabled, a user can create a file named
>"critical.dll", and the system will find it before it finds "CRITICAL.DLL".
>It might be a good idea to name ALL files which NT installs below
>%systemroot% in lower case, and if you want to reduce the potential for
>mischief disable POSIX.
>
>>> So, before complaining, that I've categorized NT as an insecure OS
>>> (it's by far superior to Win95, but that's it), please explain me
>>> how you do prevent trojan horse attacks on a system where every user
>>> may
>>> write to public directories? *wonder*
> 
>>If you're _really_ worried about a user installing a trojan horse on
>>that user's personal workstation, you're out of luck (unless you want to
>>buy one of those expensive PC-vault things that prevent the user from
>>getting into the case, or put all the PCs in a locked room and run long
>>keyboard, mouse, and monitor cables, or other esoteric solutions --
>>i.e., unless you physically secure the machine.)
>
>Let's work from the assumption that physical access would be detected, and
>try to see if we can secure the OS from someone who cannot boot another OS,
>and has access to the network, the keyboard, and removable media.
>
>>These aren't things you can do for most user's workstations. But they
>>can and should be done for servers and admins' workstations, in most
>>normal office type environments.
>
>I completely agree with this - but the fact still remains that the apps
>people are making our jobs a LOT more difficult. This is understandable in
>the context of people who think in terms of Win95. It is hard enough to
>secure a workstation in some sort of reasonable manner without the apps
>wanting to write to the system tree. Nearly _every_ app vendor which I'm
>aware of does this, so I'm not just picking on your apps group. The apps
>vendors aren't dumb - they just aren't used to thinking in terms of security.
>
>-----------------------------------------------------------
>David LeBlanc | Voice: (770)395-0150 x138
>Internet Security Systems, Inc. | Fax: (404)395-1972
>41 Perimeter Center East | E-Mail: dleblanc@iss.net 
>Suite 660 | www: http://www.iss.net/
>Atlanta, GA 30328 |
>
Yes, there's a utility in the NT resource kit that can do this. Get the NT4.0 supplement 2 version.

Don

-----Original Message-----
From: Wouter MARIEN [SMTP:Wouter_MARIEN@paribas.com]
Sent: Friday, August 08, 1997 2:51 AM
To: 'ntsecurity@iss.net.'
Subject: Re: [NTSEC] SAM database list



 Hello,

 I would like to know if somebody can help me with the following :


 In the unix environment you can make an "suid" executable which can have
 root permissions once it is executed. When starting the executable you 
 do not need to be root, you just need to be in a certain group.

 Is there a means to do this in the Windows NT environment ??



 Regards 
 Wouter_Marien@Paribas.com
>Does anybody know of a product that will allow an NT PDC to use
>Kerberos authentication for its accounts?
>

NT v5.0 supposedly but in the meantime may I suggest looking up your fellow
academics at Carnegie Mellon Univ. in Pittsburgh PA? The entire campus
uses Kerb authentication (albeit not stock MIT but instead the AFS flavor)
on all NT, Macintosh, and Unix boxen in public clusters. Computing
Services (a division of Academic Computing) wrote the software themselves.
I don't know if they are willing to release it to the world or not. Sure
would be nice though... You can probably find suitable points of contact
on the computing Services' website. I don't have my browser up but you can
start at www.cmu.edu and go from there.

Disclaimer: I am no longer associated with the University, having once been
an undergrad and an ex-exployee of the Computer Operations group. My
statements do not reflect their policies on anything.

Windows95: noun. 32-bit extensions and a graphical shell for a 16-bit
 patch to an 8-bit operating system originally coded for a 4-bit
 microprocessor, written by a 2-bit company that can't stand 1 bit of
 competition.


A couple of questions regarding NT Server, RAS, Remote capabilities:

1. Would like to hear opinions regarding using NT Server and RAS
functioning as a central modem pool?
2. Is it a good idea to run a mail host ontop of NT Server box?
3. a. What things are important to me if I am going to perform NT
Server Systems Administration?
 b. Can I effectively do these important system admin. tasks remotely
over the internet rather than via a LAN or console? If so, what have
been your experiences with encryption, encapsulation, security risks,
and most importantly -- what are some tool enablers to accomplish these
functions?
 c. What things are important to me if I am going to perform NT
Remote Diagnostics and what tools are available to accomplish? Also,
this would be done via Internet.
4. I appreciate any and all pertinent suggestions and comments on these
issues and would be happy to engage further.
Thanks...chris
Mark,

CACLS doesn't do the job, as you observed. I've taken to writing my own
version of CACLS that does the sort of thing one wants. It's a LOT
harder than one would imagine! Which is probably why CACLS doesn't do
it. One of the problems is that there are several ways directory ACE's
can be stored in the ACL, and a tool that needs to set the directory and
file default sets independently (like File Manager) has to be able to
sort them all out.

I'm not sure what we're going to do with these tools, but if you'd like
to try them out I'll send you a copy when we finish up the testing.

PS: Please let me know how your experiences go with setting up your
directories. I've been revisiting this issue lately on a government
contract and always like to have more feedback. I'm afraid it's still a
bit of a black art.

Hope you enjoyed the book.
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
At 00:53 11.08.97 -0500, Steve Sutton wrote:
>Mark,
>
>CACLS doesn't do the job, as you observed. 

XCACLS might do it, it is in Supplement One of the NT 4.0 Server Resource
Kit. I'll paste the output of XCACLS /?

Displays or modifies access control lists (ACLs) of files

XCACLS filename [/T] [/E] [/C] [/G user:perm;spec] [/R user [...]]
 [/P user:perm;spec [...]] [/D user [...]] [/Y]
 filename Displays ACLs.
 /T Changes ACLs of specified files in
 the current directory and all subdirectories.
 /E Edit ACL instead of replacing it.
 /C Continue on access denied errors.
 /G user:perm;spec Grant specified user access rights.
 Perm can be: R Read
 C Change (write)
 F Full control
 P Change Permissions (Special access)
 O Take Ownership (Special access)
 X EXecute (Special access)
 E REad (Special access)
 W Write (Special access)
 D Delete (Special access)
 Spec can be the same as perm and will only be
 applied to a directory. In this case, Perm
 will be used for file inheritence in this
 directory. If not omitted: Spec=Perm. Special
values
 for Spec only:
 T NoT Specified (for file inherit,
 only for dirs valid)
 At least one access right has to follow!
 Entries between ';' and T will be
ignored!

 /R user Revoke specified user's access rights.
 /P user:perm;spec Replace specified user's access rights.
 for access right specification see /G option
 /D user Deny specified user access.
 /Y Replace user's rights without verify

Wildcards can be used to specify more that one file in a command.
You can specify more than one user in a command.
You can combine access rights.


 \^o^o/
 ,^ ( ..)
---------------oOOo--| \ \--oOOo----------------------------
 '''' \ `^--^ ''''
Donald van de Weyer \ \ \
 ^--^
e-mail: donald@demag.rwth-aachen.de
talk: donald@donald.demag.rwth-aachen.de
WWW: http://users.demag.rwth-aachen.de/donald/
PGP: send a mail with subject: "get public key"
 PGP 5.0 mail preferred

 .oo0O O0oo.
 ( ) ( )
------------------\ (-----) /---------------------------------
 \_)___(_/
 ^\ |___|
 \ `^^^__ /
 `------/
At 12:12 10.08.97 -0700, Christopher S. Long wrote:
>A couple of questions regarding NT Server, RAS, Remote capabilities:
>1. Would like to hear opinions regarding using NT Server and RAS
>functioning as a central modem pool?

I have no expirience for large installations. With 5-8 users it works fine.

>2. Is it a good idea to run a mail host ontop of NT Server box?

We run MailSite 2.0.x from Rockliffe and are very happy with it
(www.rockliffe.com)

>3. a. What things are important to me if I am going to perform NT
>Server Systems Administration?

Willingness to learn, having some good books.

> b. Can I effectively do these important system admin. tasks remotely
>over the internet rather than via a LAN or console? If so, what have
>been your experiences with encryption, encapsulation, security risks,
>and most importantly -- what are some tool enablers to accomplish these
>functions?

A really nice tool is the WebAdmin application in the NT 4.0 Server
Resource Kit. If you only need the tools and not the book, just buy
Supplement 2 (http://mspress.microsoft.com/MSPRESS/BOOKS/DES/1358.htm).

> c. What things are important to me if I am going to perform NT
>Remote Diagnostics and what tools are available to accomplish? Also,
>this would be done via Internet.

Since the Internet is only a network, you can do anything you would do with
a normal network. The only limits I see are speed (get a good provider) and
security (deploy PPTP).


>4. I appreciate any and all pertinent suggestions and comments on these
>issues and would be happy to engage further.

Good luck, Donald


 \^o^o/
 ,^ ( ..)
---------------oOOo--| \ \--oOOo----------------------------
 '''' \ `^--^ ''''
Donald van de Weyer \ \ \
 ^--^
e-mail: donald@demag.rwth-aachen.de
talk: donald@donald.demag.rwth-aachen.de
WWW: http://users.demag.rwth-aachen.de/donald/
PGP: send a mail with subject: "get public key"
 PGP 5.0 mail preferred

 .oo0O O0oo.
 ( ) ( )
------------------\ (-----) /---------------------------------
 \_)___(_/
 ^\ |___|
 \ `^^^__ /
 `------/
Hi,
You can use the resource utility for C2 security to disable Posix and OS2
subsystems in a gui. It takes care of all of the little dependencies.
Good Luck,
Mitch


At 07:17 PM 8/9/97 -0400, Joshua Soliz wrote:
>How do I disable POSIX?
>
>-----------------------------------------------------------
>Joshua J. Soliz,MCSE
>jsoliz@dpai.com
>Network Engineer
>DeCarlo, Paternite, And Associates, Inc.
>http://www.dpai.com
>
>
>>-----Original Message-----
>>From: David LeBlanc [SMTP:dleblanc@iss.net]
>>Sent: Wednesday, July 23, 1997 12:40 PM
>>To: Paul Leach; 'Andreas Kostyrka'
>>Cc: ntsecurity@iss.net
>>Subject: RE: [NTSEC] Win95 sec
>>
>>At 15:59 7/22/97 -0700, Paul Leach wrote:
>> 
>>>> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
>>
>>>> Consider WRITE priviledges to the system directory, which probably
>>>> you
>>>> can't even disable, because some popular apps depend upon it? 
>>>> Now ask your local Unix administrator, if (s)he would consider
>>>> chmod o+w /bin /usr/bin /usr/local/bin /usr/lib /lib ...
>>>> Installing systemwide application must limited to the Administrator.
>> 
>>>First: Suppose only admins could write to the system directory. If the
>>>user has physical access to their own machine, then they can still
>>>install apps without being admin -- by booting from floppy, or taking
>>>the hard disk out and putting it into their home machine -- its all just
>>>a question of how much work it is, and I think there are lots of users
>>>with the requisite skills in this era of nearly unbiquitous home PCs.
>>
>>Yes, but that is really a different issue. I can restrict physical access
>>with $10 worth of hardware - devices to padlock cases do exist. We can't
>>excuse file system insecurity by calling on physical security issues. Let's
>>just assume that we want to raise the barrier to the level where physical
>>access is required.
>>
>>>Second: by default, NT _does not_ let anyone except admins overwrite or
>>>delete existing system files. Since apps that are run through the GUI
>>>are run via absolute paths, adding files is not by itself sufficient to
>>>insert a trojan.
>>
>>This isn't exactly true, AFAIK, the default permissions on %systemroot% are
>>"Everyone:F". If I'm not mistaken, this allows ANY user to take ownership
>>and change permissions of ANY file object below that point. For that
>>matter, %systemroot%\profiles are also "everyone:F", which allows ANY user
>>to say delete an entire profile tree and replace it with one infested with
>>trojans of their choice. If I'm missing something here, please correct me.
>>I'm quite sure that if these directories had "everyone:C" that we wouldn't
>>have that problem.
>>
>>Furthermore, if POSIX is enabled, a user can create a file named
>>"critical.dll", and the system will find it before it finds "CRITICAL.DLL".
>>It might be a good idea to name ALL files which NT installs below
>>%systemroot% in lower case, and if you want to reduce the potential for
>>mischief disable POSIX.
>>
>>>> So, before complaining, that I've categorized NT as an insecure OS
>>>> (it's by far superior to Win95, but that's it), please explain me
>>>> how you do prevent trojan horse attacks on a system where every user
>>>> may
>>>> write to public directories? *wonder*
>> 
>>>If you're _really_ worried about a user installing a trojan horse on
>>>that user's personal workstation, you're out of luck (unless you want to
>>>buy one of those expensive PC-vault things that prevent the user from
>>>getting into the case, or put all the PCs in a locked room and run long
>>>keyboard, mouse, and monitor cables, or other esoteric solutions --
>>>i.e., unless you physically secure the machine.)
>>
>>Let's work from the assumption that physical access would be detected, and
>>try to see if we can secure the OS from someone who cannot boot another OS,
>>and has access to the network, the keyboard, and removable media.
>>
>>>These aren't things you can do for most user's workstations. But they
>>>can and should be done for servers and admins' workstations, in most
>>>normal office type environments.
>>
>>I completely agree with this - but the fact still remains that the apps
>>people are making our jobs a LOT more difficult. This is understandable in
>>the context of people who think in terms of Win95. It is hard enough to
>>secure a workstation in some sort of reasonable manner without the apps
>>wanting to write to the system tree. Nearly _every_ app vendor which I'm
>>aware of does this, so I'm not just picking on your apps group. The apps
>>vendors aren't dumb - they just aren't used to thinking in terms of
security.
>>
>>-----------------------------------------------------------
>>David LeBlanc | Voice: (770)395-0150 x138
>>Internet Security Systems, Inc. | Fax: (404)395-1972
>>41 Perimeter Center East | E-Mail: dleblanc@iss.net 
>>Suite 660 | www: http://www.iss.net/
>>Atlanta, GA 30328 |
>>
>
>
Phone 212-722-7953 Fax 212-427-1169
e-mail mitch@kewling.com 
Imagination is more important than knowledge.....
Knowledge is limited.....
Imagination is not....... Albert Einstein, (1879-1955)
----------
> Von: Christopher S. Long 
> An: ntsecurity@iss.net
> Betreff: [NTSEC] Remote capabilities of NT 3.51/4.0 Server
> Datum: Sonntag, 10. August 1997 21:12
> 
> A couple of questions regarding NT Server, RAS, Remote capabilities:
> 
> 1. Would like to hear opinions regarding using NT Server and RAS
> functioning as a central modem pool?

We use the rocket 8-port com-card with 8 ELSA hybrid (IDSN/V.34) external
modems on a
NT 3.51 system.
It works pretty well: Lotus Notes, Fileaccess, NT Administration, Cisco
Telnet,
PCXWARE X-Server for RS/6000 access, Internet trough Firewall, SNA-Server
client, etc.

We use the redialing feature to increase the security.

If you´ve to handle more than 10 lines it is better to use a MPR (multi
protocol router).

Another good idea is the winframe enterprise server of citrix. It´s a
multiuser NT 3.7 
system (i.e enhanced NT 3.51 + multiuser features).

With the winframe technology (ICA protocol) you can run the applikctions on
the server, only the graphical output, mouse and keyboard is used on the
client.
It works very well with 64Kbit (28.800 works too).

The RAS client needs only the winframe client (one disk) to acces
all apps on the winframe server.

A i386 with 8 MB RAM and a modem can be used as RAS client !!!

more infos on www.citrix.com.

> 2. Is it a good idea to run a mail host ontop of NT Server box?

We use Lotus Domino as internal, fax, SMTP server on NT 4.0 

> 3. a. What things are important to me if I am going to perform NT
> Server Systems Administration?

Use technet + resourcekit incl. dokumentation.

Jens Peschke
Network and firewall administrator
SSK Hannover
Hannover, Germany
At 08:04 PM 08/08/97 -0400, Russ wrote:
>The *exploit* (now forget the demonstration for a minute) is that it is
>able to spawn a thread from a system process. What it does with that
>thread is entirely up to any programmer using the exploit code, and is
>in no way limited to adding users to the Administrators group. It could,
>for example, add a new user and explicitly assign it every right that a
>member of the Administrators group has, without ever having to worry
>about adding it to the Administrators group.
>It could do anything, at all, it wanted to.

>As Costin said, apply SP3 and the hotfix NOW!!! if you are at all
>concerned about security on your NT system in any way, shape, or form.
>Without that hot fix, anyone can do anything they want to do on any
>machine they have console access to.

Wait a second... Couldn't a user with ftp access to a webserver's
scripts/cgi directory simply run the program (or maybe rewrite the program
to work in that environment.) Many web server programs do run as system by
default. Even IIS for which you may specify a username and password only
uses that for file system permissions, but it still runs under the system
account. How real a vulnerability is this? Esp when ftp sessions are
unencrypted and passwords to an executable directory could easily be
captured by sniffing the wire. Thoughts anyone?

-Robert

btw- I think this applies only to FTP servers that use NT's SAM... (IIS
FTP, WarFTp, etc...) Otherwise you would need a preexisting account's name
and password on the server or domain.


Robert Boyle - Engineer robert@garden.net WAN/VPN/'net Services
Garden Networks: New Jersey's Premier Internet Service Provider
50 Diller Ave. / Newton, NJ 07860 (973)300-9211 8AM-8PM M-F EST
http://www.garden.net Automatic Response: info@garden.net
Correct me if im wrong, but Purdue is still on a T1? Im on a 28.8 and I
dont concern myself with the size of the articles, just the content. It
will get to my box sometime.

-former PU student, friend of GHG <--- the MAN :D

-jjs

>-----Original Message-----
>From: Matt Simmons [SMTP:simmonmt@cs.purdue.edu]
>Sent: Friday, July 18, 1997 9:46 PM
>To: Ryan Russell/SYBASE
>Cc: ntsecurity
>Subject: Re: [NTSEC] Re: ntsecurity-digest V2 #588
>
>Why does everybody insist on quoting the entire ~1000 line digest when
>following up to this thread? I counted about 33k of useless quoted
>material Ryan Russell's response. Paul Leach, Jose Palacio, and Tom
>Schipper have done the same. We'll conservatively estimate 30k of
>useless material in each post, for a total of 120k of nothing.
>Multiply that by the my guess at the number of subscribers: 1485 (see [1])
>and you end up with over 174M. Does this seem excessive to anyone?
>
>Matt
>
>Footnotes: 
>[1] The following command was applied on a directory containing 3232
> ntsecurity messages, with the first one in mid-April. Granted,
> this only counts posters, but it serves to establish a lower
> bound.
>
> grep '^From:' Mail/ntsecurity/* |sort - |uniq |wc -l
>
>-- 
>The difference between a bug and | 
>a feature is documentation. | Matt Simmons
> -- Ben Duncan | simmonmt@acm.org
> bend@ali.intop.net |
I know im late on this thread, and I wont comment on user password
cracking ethics, but to answer your upgrade question, You SHOULDNT have
to make anyone change passwords to get the software installed. I just
did a 100+ user upgrade of Inoculan and IE3 and I didnt have to change
ANYONES password. I have seen a zillion networks and I know enough
about MS's architecture to know how to do this (as a good consultant
should). Soon I will be upgrading the same 100 users to Exchange 5.0
and Office 97, I dont plan on anyone losing/changing their passwords
then either. Also, it was much easier to install the above mentioned
software on NT machines than 95.

Just my Two Pesos...

-----------------------------------------------------------
Joshua J. Soliz,MCSE
jsoliz@dpai.com
Network Engineer
DeCarlo, Paternite, And Associates, Inc.
http://www.dpai.com


>-----Original Message-----
>From: Melczer, David [SMTP:DMelczer@WLRK.com]
>Sent: Saturday, July 26, 1997 11:41 AM
>To: 'ntsecurity@iss.net'; 'Frank Knobbe'
>Subject: RE: [NTSEC] PWDUMP problems...
>
>I think we're missing the point here...
>
>The question is not "is this ethical or legal"...the question is "is
>PWDUMP limited to the size of the output file, and how does one get
>around those size limitations, if any?"
>
>Sorry to start a way-off-topic thread. That wasn't my intention.
>Getting a quick hack of the PW just seemed like the easiest solution
>since our users are required to change passwords every two weeks, and at
>the rate of software upgrades, we were looking at bothering them quite a
>bit. 
>
>-David Melczer
>
>>----------
>>From: Frank Knobbe[SMTP:FKnobbe@BellSouth.net]
>>Sent: Thursday, July 24, 1997 1:36 AM
>>To: Victor Nardo; ntsecurity@iss.net
>>Subject: RE: [NTSEC] PWDUMP problems...
>>
>>-----BEGIN PGP SIGNED MESSAGE-----
>>
>>On 20 Jul 97 at 22:27, Victor Nardo wrote about: RE: [NTSEC] PWDUMP
>>problems...
>>
>>> [...]
>>> Based on my understanding that the company already has the legal
>>> right (someone correct me if they have a different understanding) to
>>> view email sent/received under an account issued by the company, it
>>> seems to follow that a password is also the property of the company.
>>> While it sets a bad corporate image, in the eyes of the employee,
>>> to hold their passwords, it is probably within their rights to do
>>> so. If I am recalling the C2 specification correctly, one reason to
>>> have each password known only by the account holder is to ensure the
>>> objects generated/owned by that person are indeed his own. The
>>> employee who is aware of a password policy and who is accused of
>>> violating corporate policy based on evidence generated from a
>>> computer system can probably legally argue that since he wasn't the
>>> only person to know his account password, it cannot be proven that
>>> he/she actually violated the policy/law in question (since someone
>>> else could have used his/her password and done the evil deed in
>>> question).
>>
>>So it is a matter of self-protection that the password is only known
>>to the user. Interesting, never thought of that...
>>
>>> It seems that the absence of a written corporate computing usage /
>>> awareness policy leads to this dilemma. As an administrator, I can
>>> recover passwords on an as need basis, but with the understanding
>>> that the employee/user will have to be informed of this, as he will
>>> become aware of it the next time he logs on to the system anyways.
>>
>>Not necessarily. You can recover the password, move over to another
>>system, and plunk the same password down, without the user knowing
>>that the system changed.
>>
>>> [...]
>>> This would put users on the alert that anything they do not want
>>> shared to corporate superiors should not be left on their systems
>>> and also give the company immediate grounds for termination or legal
>>> recourse should they turn something up in violation in their policy.
>>
>>Company policy, if present, hold the right for actions should the user
>>be in violation with the terms. However, that is independent of the
>>password issue. The password can be known to admins, but is not
>>required. Doesn't matter how many people know a users password, the
>>user still has the responsibility of his system, and the software
>>thereon.
>>
>>> [...]
>>> But for the person who wants to encrypt material on their PC's, what
>>> are you going to do w/o a password? What are you going to do to keep
>>> a person from holding such information?
>>
>>I guess the user could encrypt his ZIP archive of pirated software, or
>>whatever is in violation with the user agreement, independent from the
>>network and its passwords. The data should be safe on his PC, but he
>>may be asked by a judge to provide the key/password to gain access to
>>the data. Well, maybe not immediately a judge, maybe the
>>supervisor/manager will be able to exact enough force on the user so
>>that he hands over anything suspicious.
>>
>>Security is a game of trust and deceit, ethics and perversion. In
>>other words really interesting...
>>
>>
>>
>>Regards,
>>Frank
>>
>>
>>
>>-----BEGIN PGP SIGNATURE-----
>>Version: 2.6.2
>>
>>iQCVAwUBM9bbgcZP3ocmY5AlAQHFrAP/XsSGvJZKL8jW2LrImPgzUKTeVzq3i8p+
>>BBtT8pJfYL52TgPbZt3uYjcuZipx39I5/3sOjhH0dsWeRm4Yi54Jb4d8FNcex2Ui
>>JLb5F7PEdgEBLH6KbLYrXmIrPLZSgxmYz65lrWOQQ+Zwz1elSNgXJQjn1OjhQxyB
>>mavmiFqBp9k=
>>=hF1I
>>-----END PGP SIGNATURE-----
>>-----BEGIN SPAM WARNING-----
>>
>>WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
>>VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
>>AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
>>THIS WILL DISABLE FURTHER CORRESPONDENCE.
>>PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
>>THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
>>EMAIL LIST.
>>
>>-----END SPAM WARNING-----
>>
I dont mean to sound like a jerk, but you should have had an updated
rdisk AND an updated disk set floppy BEFORE you re-installed NT. If
these measures would have been taken you should have been fine. I do
however understand your frustration as I ran into almost the same
problem when I first starting using NT. Have never run into the problem
since.

-jjs


>-----Original Message-----
>From: Bob Love [SMTP:bob@raha.com]
>Sent: Monday, August 04, 1997 9:08 PM
>To: ntsecurity@iss.net
>Subject: Re: [NTSEC] NT 4.0 Password Problems
>
>> > Isn't there a utility to compare the registries of two computers??? Or
>at least a utility to dump a registry into a text 
>
>
>> As far as I remember this utility is called 'DumpReg' and you can find
>
>
>Why don't you simply "export" from the "file" menu in regedit?
>
>Meanwhile, I recently lost my 'D' drive, a volume set, when I re-installed
>NT on my C drive. Both are NTFS, C was a 2Gb partition on Drive 1, D was a
>volume set of 5 x 2Gb on the other half of drive 0, plus drives 1 and 2.
>
>I have given up trying to figure why this happened. To make matters worse,
>in restoring my ERD to try to fix the problem I accidentally made the
>machine think it was a PDC again so it, and the temporary PDC, clashed and
>crashed horribly.
>
>I had another BDC which I persuaded to become a PDC by forcing it to via a
>standalone server (the only one which could access 'server manager' because
>there was no PDC) so in the end I gave up. Both of the 'dead' PDCs now
>refused to run the netlogon service, so server manager thought they were
>both 'workstations'. It was a horrible mess, so in the end I started from
>scratch and reinstalled / restored backup.
>
>Subsequently, I have been looking into why my server refused to restore the
>'D' partition from the ERD. It is clear to me, now, that RDisk does NOT
>save partition information on the ERD, and that this must be done manually
>from Disk Administrator. Disk Administrator, however, says it will restore
>partition information from an ERD and mentions nothing about RDISK not
>saving it for you (in the 'help' text).
>
>I can't see why 2 PDCs can't fight it out and decide (or ask) which should
>be the 'real' one. I can figure even less how I lost my D drive by
>re-installing NT on C.... now, if I try to save my partition information,
>Disk Admin tells me there's "not enough space on the floppy". A blank
>floppy. A subsequent attempt at saving to another floppy, just in case the
>first blank was faulty, Disk Admin now says the registry is corrupt and it
>can't save the information. I am now afraid to re-boot the machine in case
>D disappears again. Otherwise, the machine is working perfectly, but I am
>very nervous.
>
>Can anyone offer any assistance on how I can save my partition information
>*without* using disk admin?
>
>Regards
>
>Bob
>I dont mean to sound like a jerk, but you should have had an updated
>rdisk AND an updated disk set floppy BEFORE you re-installed NT. If
>these measures would have been taken you should have been fine. I do
>however understand your frustration as I ran into almost the same
>problem when I first starting using NT. Have never run into the problem
>since.

First of all, I had TWO copies made from RDISK. THERE is nothing, anywhere, to suggest that it is necessary to also create a disk-set floppy. What the &^%$ is an "Emergency Repair Disk" if 1) It does NOT hold your partition information and 2) It does NOT hold this information despite the fact that disk administrator suggests that it does - "Please insert a disk (which may be the emergency repair disk) onto which you have saved your partition information"

So I lost a few hours sleep and had to restore a backup, big deal... I just thought I'd post the happenings as a warning to others, who may be as (understandably) unaware as I was of this problem.

No, what really makes me angry is even now that I know about it there's nothing I can do to protect myself, except create more work for myself doing even more frequent backups, because Disk Administrator now helpfully tells me there's not enough room on a floppy for my disk configuration information. Nice. Real nice.

That one almost makes me as angry as the fact that re-installing NT ON IT'S OWN PARTITION managed to nuke a completely seperate partition. Even nicer.

And now I'd better shut up, because this is nothing whatsoever to do with security, unless you consider losing everything as much a security issue as someone being able to ping your server to death... I do... ;-)

Regards

Bob


>what the fuck is this shit and why the fuck is it doing in my mailbox?

Your command of the English language is most impressive, please forward me the address of your kindergarten teacher so I know not to send my kids there.

If you wish to cross swords, I suggest you sharpen your wit. Otherwise, keep childish comments out of this forum.


On 8 Aug 97 at 20:04, Russ wrote:

> It
> could, for example, add a new user and explicitly assign it every
> right that a member of the Administrators group has, without ever
> having to worry about adding it to the Administrators group.

I tried this with NT3.51 some time ago - giving a user all rights 
with usermgr but not making him a member of the admins group. In the 
result he was not able to do all an admin can do - seems you MUST be 
a member of admins to do certain things.

Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/
>Wait a second... Couldn't a user with ftp access to a webserver's
>scripts/cgi directory simply run the program (or maybe rewrite the
>program to work in that environment.)

First of all, I'm going to refer to the exploit demonstrated by GetAdmin
as the "NtAddAtom" exploit, just so people don't confuse my statements
with claims of what the program GETADMIN.EXE can do.

I think what you're really trying to say is that it might be possible to
invoke the NtAddAtom exploit remotely, via the network, and the answer
is a definite YES!

As always, if you can get an executable to execute on the remote machine
(regardless of how you got the executable there, and regardless of how
you invoked it), then it will run locally in some context. Since the
NtAddAtom exploit allows you to have some running privileged process
spawn a thread, it could subsequently do anything it wanted.

The particular exploit is fixed by the GetAdmin hotfix, but be aware
that there is an on-going effort to discover every piece of code which
might be exploited in a similar fashion. Hopefully Microsoft will keep
us up-to-date on the progress of this. I know NTBugtraq would appreciate
getting regular updates.

> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list: http://www.ntbugtraq.com
> 
Pavel Martak wrote:

> 
> Well there is Kerbnet1.2 package from Cygnus. With this package you can
> make your NT serever like master or slave Kereberos(v5) server. There is
> also program for obtaining tickets and telnet client with encryption.
> 
> http://www.cygnus.com/product/kerbnet-download.html

Yes, Kerbnet looks very very good!
Unfortunately, in June I received an e-mail from Cygnus (Scott Petry)
saying that they were planning to exit the Kerberos business. However,
they would release the sources and binaries to the Internet community.

Best regards

Steen


--

Steen Larsen

SITA R&D Nice, France | @ Home
E-mail: steen.larsen@nce.sita.int | E-mail: steen@who.net
Phone : +33 4 92.96.63.67 | GSM Mobile: +33 6 09090568
Fax : +33 4 92.96.64.92 | or (Danish) +45 40512486

Disclaimer: This letter may reflect my personal opinion.
 
 "Liberty lies in the rights of that person whose views
 you find most odious" - John Stuart Mill
Robert Kulp wrote:
> 
> I have Kerbnet, but it separates the two accounts, NT & Kerberos
> pricipal. It doesn't (that I can tell) allow an NT PDC to query the
> Kerberos DC for the password when a client (95 or Mac) connects. (ie.
> A 95 or Mac machine tries to authenticate with the NT domain. The NT
> domain sees that an account exists, but asks Kerberos if the password
> is correct. If it is, then it procedes as usual. If it does not match,
> then it fails because of invalid password.)
> 
> That's what I want, but haven't found. BTW, It sounds like NT 5.0
> will do this, but I can't wait that long, and am not sure how
> compliant MS will be with Kerberos v5.
I guess that the Kerberos authorisation field is going to be the
problem as Kerberos hasn't got a standard solution for this.

Has anybody seen any specification on how MS wants to use the
Kerbeors authorisation field? Will it be DCE compatible?

Best regards

Steen


--

Steen Larsen

SITA R&D Nice, France | @ Home
E-mail: steen.larsen@nce.sita.int | E-mail: steen@who.net
Phone : +33 4 92.96.63.67 | GSM Mobile: +33 6 09090568
Fax : +33 4 92.96.64.92 | or (Danish) +45 40512486

Disclaimer: This letter may reflect my personal opinion.
 
 "Liberty lies in the rights of that person whose views
 you find most odious" - John Stuart Mill
On Sat, 9 Aug 1997, NT Security wrote:
> Reboot every:
> 1.00 days = 24 hours
> 0.10 days = 240 hours (or 10 days)
> 0.01 days = 2400 hours (or 100 days)

Uhm, you don't seem to have very good math skills.

24 * 1.00 = 24 (24.0 hours)
24 * 0.10 = 2.40 (2.40 hours)
24 * 0.01 = .240 (.240 hours)


 -al
___________________________________________________________
Alexander N. Spitzer * * * * Network Security Alert Systems
-----------------------------------------------------------
MailTo:aspitzer@nsas.com Web :http://www.nsas.com
Pager :aspitzer-pager@nsas.com (first 80 chars of message)
-----------------------------------------------------------
 My address MAY NOT be used for UNSOLICITED email.
-----------------------------------------------------------

Hi Oscar,
 we use the EA product from Mission Critical software. It
provides a more granular approach to user/group administration.

Chance.

> -----Original Message-----
> From: Oscar [SMTP:oscarp@worldnet.att.net]
> Sent: Saturday, August 09, 1997 6:10 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Product for NT Delegation of Administration
> 
> I am searching for a tool to delegate administrative tasks. I do not
> want to
> have to set up accounts such as Account Operator, Backup Operator. I
> want a
> simple method to delegate privileges that my users need to do their
> jobs.
> 
> Can you recommend an NT tool and who much will it cost, server,
> client, etc.?
> 
> Thanks in advance,
> 
Hello,

I'am setting up a primary domain server and I wondered if it is possible to
configure the server to create duplicate logfiles ? So I not only have the
logfiles at \winnt\system32\config but also at another place on the disk.

This strategy proved to be very useful in the past to trace hackers who
adjusted or deleted the logfiles

I apologize for my bad English. It is still under construction




Organisation : I.T.B
Name : S.J.Ypma (programmer)
E-mail : mailto:ypma@rulf54.leidenuniv.nl


 \\\___///
 \\ - - //
 ( @ @ )
 +----------------------------oOOo-(_)-oOOo--------------+
 | |
 | If you are going to walk on thin ice, |
 | you might as wel dance |
 | |
 | |
 | |
 +-----------------------------------Oooo----------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)



Out DTAM (Premiere Tech. Account Manager) from Microsoft was here a few
weeks ago when we showed him these event log errors. He picked up the
red phone and called an engineer in redmond. The engineer informed him
that this is an open issue and they're working on fixing it. In the
meantime, we need not worry that a few hundred of our nt 4.0
workstations are generating this snmp based error.

Chance.

> -----Original Message-----
> From: Bjørn Arne Pedersen [SMTP:bap@aaku.no]
> Sent: Wednesday, July 30, 1997 6:34 AM
> To: 'NT Security'
> Subject: [NTSEC] Strange event log
> 
> Hi there NT Gurus!
> 
> 
> I hope somebody can help me to understand an strange logging in my
> event
> log. The reson I start wondering about this, is the time of the day
> (Night), when NO one uses this server.
> 
> EventID 4005
> Source: perfctrs
> 
> Load of INETMIB1.DLL failed. Make sure the DLL file is in the PATH.
> WIN32 Error number is returned in the data. 
> 
> As far as I can understand, it is a module for performance monitoring,
> but I don't have any active performance monitors at the moment.
> 
> What cind of DLL is INETMIB1, and why is it loaded in the middle of
> the
> night. For the record, the server was not restartet at this point.
> 
> 
> 
> Regards
> 
> Bjørn Arne
On Mon, 11 Aug 1997, Bob Love wrote:
> And now I'd better shut up, because this is nothing whatsoever to do with
> security, unless you consider losing everything as much a security issue as
> someone being able to ping your server to death... I do... ;-)

Confidentiality, Integrity, Availability.

You mentioned two out of three, so I'd consider it pretty relevant.

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346


Oops, I should learn to read :-) I have been following this thread since it 
has taken off and have gleaned a lot of information so far. Currently, I'm 
using a small program that I wrote to manage remote services via telnet 
to a homegrown "Service Controller Service", but may be comming up with 
other interesting ideas...

Chris Mulcahy
cmulcahy@omnisource.com

____________________Reply Separator____________________
Subject: RE: [NTSEC] Stop/Start Services
Author: PC:jsoliz@dpai.com
Date: 8/11/97 12:12 PM

This does NOT work on remote servers. It only works for the local
machine...

-jjs

>-----Original Message-----
>From: cmulcahy@omnisource.com [SMTP:cmulcahy@omnisource.com]
>Sent: Friday, July 25, 1997 1:49 PM
>To: ntsecurity@iss.net
>Subject: Re:[NTSEC] Stop/Start Services
>
>net stop 
>net start 
>
>hth
>Chris Mulcahy
>cmulcahy@omnisource.com
>
>____________________Reply Separator____________________
>Subject: [NTSEC] Stop/Start Services
>Author: PC:John.Rutkin@bankerstrust.com
>Date: 7/25/97 9:33 AM
>
>Excuse the off topic question..
>
>Is there a command line utility that will enable me to stop/start NT services
>on remote boxes, I obviously have admin rights on all the relevent boxes.
>Sorry again as this is somewhat off topic.
>
>Thanks
>
>John Rutkin
>
> << File: MSGCC.RTF >> 

 

At 00:56 8/3/97 +0100, you wrote:

>And one thing that massively increases the real costs of keeping
>an NT machine secure (particularly if starting from a fresh install)
>is the time needed to download and apply the growing number of hot-fixes.

Something MS might want to consider would be making a catch-all patch kit
that has all post-SP[whatever] patches, so you can just apply the latest
complete service pack, then one other and be completely up to date.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Would duplicates really help? As the log is being changed by the native
application, it also changes the duplicate.

Why not instead audit any access to the log files though NT auditing?

Later..boB...
Bob Toth
Director of Enterprise Technologies @ PC DOCS, Inc.
bobt@pcdocs.com

>-----Original Message-----
>From: Sjoerd [SMTP:ypma@rulsfb.LeidenUniv.nl]
>Sent: Monday, August 11, 1997 10:59 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Creating duplicate logs.
>
>Hello,
>
>I'am setting up a primary domain server and I wondered if it is possible to
>configure the server to create duplicate logfiles ? So I not only have the
>logfiles at \winnt\system32\config but also at another place on the disk.
>
>This strategy proved to be very useful in the past to trace hackers who
>adjusted or deleted the logfiles
>
>I apologize for my bad English. It is still under construction
>
>
>
>
>Organisation : I.T.B
>Name : S.J.Ypma (programmer)
>E-mail : mailto:ypma@rulf54.leidenuniv.nl
>
>
> \\\___///
> \\ - - //
> ( @ @ )
> +----------------------------oOOo-(_)-oOOo--------------+
> | |
> | If you are going to walk on thin ice, |
> | you might as wel dance |
> | |
> | |
> | |
> +-----------------------------------Oooo----------------+
> oooO ( )
> ( ) ) /
> \ ( (_/
> \_)
>
>
>
You can do that now with the current hotfix.exe. Just create a new
hotfix.inf to put in the new fixes and go. I have one here that I keep
updated. You can have it automatically prompt you to install the
hotfixes after the service pack is installed, or just run hotfix.exe by
itself and do only the fixes.

Jason

> -----Original Message-----
> From: David LeBlanc [SMTP:dleblanc@iss.net]
> Sent: Monday, August 11, 1997 1:46 PM
> To: Bob Tinsley
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] RE: Windows NT rantings from the l0pht
> 
> At 00:56 8/3/97 +0100, you wrote:
> 
> >And one thing that massively increases the real costs of keeping
> >an NT machine secure (particularly if starting from a fresh install)
> >is the time needed to download and apply the growing number of
> hot-fixes.
> 
> Something MS might want to consider would be making a catch-all patch
> kit
> that has all post-SP[whatever] patches, so you can just apply the
> latest
> complete service pack, then one other and be completely up to date.
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
I can see where this would be advantageous, but it's probably better not
to fix this. The unfortunate truth is that the HotFixes occasionally
break more than they fix. Being able to back them out singly and apply
them singly is a requirement. Being up-to-date isn't always desirable.


I make a local copy of all the HotFixes as they are released and make
Repair Disks before applying the fixes and keep it around so I can back
out easily. If I had thousands (or even hundreds) of machines this kind
of conservatism would be impractical, I suspect. Much easier to only
worry about critical systems and let the masses wallow in insecurity --
rather like NT v. Win95, when you think about it, but that's another
thread.

-s

Scott Blake, Corporate Network Manager
NeTegrity, Inc.
blake@security.com

> -----Original Message-----
> From: David LeBlanc [SMTP:dleblanc@iss.net]
> Sent: Monday, August 11, 1997 1:46 PM
> To: Bob Tinsley
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] RE: Windows NT rantings from the l0pht
> 
> At 00:56 8/3/97 +0100, you wrote:
> 
> >And one thing that massively increases the real costs of keeping
> >an NT machine secure (particularly if starting from a fresh install)
> >is the time needed to download and apply the growing number of
> hot-fixes.
> 
> Something MS might want to consider would be making a catch-all patch
> kit
> that has all post-SP[whatever] patches, so you can just apply the
> latest
> complete service pack, then one other and be completely up to date.
> 
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
Check out the rcmd.exe in the NT Server Resource Kit. It provided remote
command line access to any server or workstation running this service.

This would allow you issue the commands below for a remote server.

Regards,
John


>Delivered-To: nt-out-link@iss.net
>Delivered-To: nt-out@iss.net
>Illegal-Object: Syntax error in Message-Id: address found on
gateway.aaiate.com:
> Message-Id: 
> ^-Extraneous program text
>From: Chris Mulcahy 
>Date: Mon, 11 Aug 1997 12:24:09 -0500
>To: ntsecurity@iss.net
>Subject: Re:RE: [NTSEC] Stop/Start Services
>Sender: owner-ntsecurity@iss.net
>Reply-To: Chris Mulcahy 
>X-Loop: ntsecurity
>X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to
majordomo@iss.net
>X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
>
>Oops, I should learn to read :-) I have been following this thread since it 
>has taken off and have gleaned a lot of information so far. Currently, I'm 
>using a small program that I wrote to manage remote services via telnet 
>to a homegrown "Service Controller Service", but may be comming up with 
>other interesting ideas...
>
>Chris Mulcahy
>cmulcahy@omnisource.com
>
>____________________Reply Separator____________________
>Subject: RE: [NTSEC] Stop/Start Services
>Author: PC:jsoliz@dpai.com
>Date: 8/11/97 12:12 PM
>
>This does NOT work on remote servers. It only works for the local
>machine...
>
>-jjs
>
>>-----Original Message-----
>>From: cmulcahy@omnisource.com [SMTP:cmulcahy@omnisource.com]
>>Sent: Friday, July 25, 1997 1:49 PM
>>To: ntsecurity@iss.net
>>Subject: Re:[NTSEC] Stop/Start Services
>>
>>net stop 
>>net start 
>>
>>hth
>>Chris Mulcahy
>>cmulcahy@omnisource.com
>>
>>____________________Reply Separator____________________
>>Subject: [NTSEC] Stop/Start Services
>>Author: PC:John.Rutkin@bankerstrust.com
>>Date: 7/25/97 9:33 AM
>>
>>Excuse the off topic question..
>>
>>Is there a command line utility that will enable me to stop/start NT
services
>>on remote boxes, I obviously have admin rights on all the relevent boxes.
>>Sorry again as this is somewhat off topic.
>>
>>Thanks
>>
>>John Rutkin
>>
>> << File: MSGCC.RTF >> 
>
> 
>
>
********************************************************************
John Freymann j.freymann@aaiate.com
INS Department (847)821-3347
Advantest America, Inc. (847)634-2552 FAX


This email address may not be added to any commercial mail list with out my
permission. Violation of my privacy with advertising or SPAM will result
in a suit for a MINIMUM of $500 damages/incident, $1500 for repeats.
US Code Title 47, Sec.227(b)(1)(C), Sec.227(a)(2)(B)
********************************************************************

Russ wrote:
> 
> 
> The particular exploit is fixed by the GetAdmin hotfix, but be aware
> that there is an on-going effort to discover every piece of code which
> might be exploited in a similar fashion. 

Hi everyone,

This is my final report on vulnerable functions in the WindowsNT kernel.

After the first hotfix released by Microsoft the number of function that
were
vulnerable was quite high. That was also demonstrated in my CR4 program.

However, AFTER the second hotfix from Microsoft, (dated July 15) I was
unable to found even a single function to write to memory over
0x80000000.
However, there are still many READS which can be used to crash the
system with the
nice BSOD. For 10 different examples you might want to see 

http://www.gecad.ro/~craiu/cr5-14.zip

containing the 10 exploit programs. 
To get the sources for cr5..cr14, e-mail me. (I want to keep the track
of the sources)
I have personally searched the 0..65535 space (even that the interesting
ones are
located in 0-0xD2, 0x1000-0x11F1 range) and found nothing to WRITE the 
memory over 0x80000000. That doesn't means there are no vulnerable
functions.
(I only used as input params in the 0-0xffffffff range with a 0x1000
increase
factor, who knows, maybe I missed the magic value)


Finally, if anyone has other results (especially functions able to write
over
0x80000000) please share your info with us.
And yes, Microsoft was notified about all the 10 vulnerable functions.
-- 


bye,
c0s

Costin RAIU, Data Security Expert

E-MAIL : BUSINESS mailto:craiu@gecad.ro, PERSONAL craiu@usa.net
WWW : http://www.gecad.ro/~craiu/
PGP Key : http://www.gecad.ro/~craiu/craiu.asc (or from WWW.PGP.COM)
KeyID : 2048/DD35A295 Costin RAIU 
Key fingerprint = FD 14 2A 90 64 41 58 9A 6B 34 47 D8 C5 E2 F4 5C


As I am new to this list, I in advance ask forgiveness in case I am
slightly off the direct subject. Perhaps someone may be able to steer me
in the right direction if there is a more appropriate list elsewhere.

We are currently using an NT client/server setup with X.25 dialup
communications to connect 38 law enforcement agencies scattered over
portions of 3 states. We are looking for a way to cut our recurring
costs to a minimum and are wondering about doing away with the X.25 in
lieu of a "virtual intranet" over the internet. My first reading of the
PPTP is that it is supposed to be fairly secure. My understanding is
that it encrypts your data (including passwords), encapsulates it
within packets which are then routed over the net via TCP/IP, and then
uses our "in house" IP addresses (which are in the encapsulation) to
pass through the firewall rather than the exterior addresses used by the
agencies and their local provider for transmission. Seems like this
would give the appearance of our own private net with cutting the comm
costs down to the T1 circuit coming into the server. Each agency could
simply pay their local provider their $19.95/month for standard net
access instead of the per min X.25 rate. I would like to know if I am at
least in the right ballpark before we start spending $ researching a
wrong direction.

My questions to the group are:
1) Does anyone know secure this protocol really is?
2) Am I correctly reading the usage of PPTP?
3) Does anyone see an obvious glitch that I am overlooking? Seems too
good to be true as advertised.
4) What does PPTP cost in terms of data transmission speed?

Thanks
 ** Mike **

Det. Mike Stephan voice (318) 473-6738
Rapides Sheriff's Dept fax (318) 449-5457
CID - Intel rpso@centuryinter.net
Alexandria, La.



 Hello,
 
 There has been some discussion about working around SIDs at our 
 University. Basically, Ghost or other applications used to be very 
 popular -- NT has thrown a wrench into the system with SID.
 
 Someone was able to speak directly to Microsoft and this appears to be 
 the final answer. (Sorry, it was forwarded to me without names). Any 
 thoughts?
 
 ====================================
 
 Quoting From the Ghost Users' Manual:
 
 "Avoiding problems with the SID (Security Identifier)
 
 The solution to this problem relies on the way the WinNT workstation 
 and the WinNT server assign the workstation a SID. It is not until the 
 workstation first connects to the NT Server that the SID is assigned. 
 Up to that point it is in a "waiting to be assigned" state. Therefore, 
 the source NT workstation must be cloned (copied to a disk image file 
 or to a destination disk) before the NT workstation makes it's first 
 official NT connection to the NT Server. 
 
 ====================================
 
 This is absolutely untrue. The machine SID is created when
 Windows NT is first installed. The SID is created early in GUI setup. 
 If you were to use this method to install Windows NT on a large number 
 of machines, you would end up with all of the computers having the 
 same SID. The SID is *not* modified when the computer is attached to a 
 network as claimed by Binary Research.
 
 The NT4 Resource kit has a utility to display and compare the SIDs of 
 2 machines. Check out getsid.exe
 
 When a machine is installed, it is given a domain SID (I don't use the 
 word machine SID since some folks confuse that term with the SID of 
 the machine account (and that's a totally different concept)). For an 
 NT Workstation, NT Member server, or an NT PDC, that SID is computed 
 to contain a statistically unique 96-bit number. For an NT BDC, that 
 SID is identical to the SID from the PDC for the domain. (So feel 
 free to clone BDCs within a domain to your heart's content.)
 
 The domain SID is the prefix of the SIDs of all the user
 accounts and group accounts created on the machine. (That is, the SID 
 of the account is simply the domain SID concatenated with the RID of 
 the account.) The SID of the account uniquely identifies that 
 account.
 
 So, if two workstations have the same domain SID, the first
 account generated (and so forth) on each workstation represents (100%) 
 the same principal (e.g., the same user). The would be unfathomable 
 if you said you wanted to clone NT PDCs.
 
 For workstations (and member servers), we are lured into a sense of 
 false security by the fact that the SID of an account should never 
 leave the machine (e.g., I can't put the SID of an account on machine 
 A onto machine B via any existing UI and even if I did (by calling the 
 API myself) such a SID couldn't be used to grant the account on 
 machine A any access to resources on machine B).
 
 But wait, what about removable media? What if I wrote removable media 
 on machine A and caried that media to machine B? If I didn't clone 
 the machines, that'd just work. However, if I had cloned the 
 machines, and A\Bob had the same account SID a
 B\Fred, and a file on the removable media granted read access to 
 A\Bob, the B\Fred would have read access to the file. Bummer.
 
 There are lots of premutations of the above. Also you will encounter 
 problems when the machines attempt to join a domain. The problems are 
 random in nature.
 
 Beyond that, MS reserves the right to make the failure even more 
 spectacular in the future. One future example might be, when you 
 upgrade to NT 5.0 the machine SID must be unique to be
 inserted into the Directory Services tree. Not an unreasonable 
 expectation.
The netsvc.exe command-line utility in the Windows NT Resource Kit can
start, stop, pause, continue, query, and list services on remote systems.


>Subject: [NTSEC] Stop/Start Services
>Author: PC:John.Rutkin@bankerstrust.com
>Date: 7/25/97 9:33 AM
>
>Excuse the off topic question..
>
>Is there a command line utility that will enable me to stop/start NT services
>on remote boxes, I obviously have admin rights on all the relevent boxes.
>Sorry again as this is somewhat off topic.
>
>Thanks
>
>John Rutkin

Scott' comment is right on. Hotfixes can't get as much testing as
releases and service packs and still be timely. That's why we recommend
only applying ones for problems you know you have.

Once you've decided that you want to apply a set of hotfixes, making a
.cmd file to do so without rebooting in between is a convenient way to
automate the process.

> ----------
> From: Scott Blake[SMTP:blake@netegrity.com]
> Reply To: Scott Blake
> Sent: Monday, August 11, 1997 11:28 AM
> To: David LeBlanc; Bob Tinsley
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] RE: Windows NT rantings from the l0pht
> 
> I can see where this would be advantageous, but it's probably better
> not
> to fix this. The unfortunate truth is that the HotFixes occasionally
> break more than they fix. Being able to back them out singly and
> apply
> them singly is a requirement. Being up-to-date isn't always
> desirable.
> 
> 
> 
PPTP uses RAS encryption, which is RC4 with 40- and 128-bit versions
available. As near as I have been able to glean, the encryption uses a
hash of the user's password, and is therefore dependent on the password
being long and random. Otherwise an eavesdropper can brute-force guess
the password. This encryption encrypts (obfuscates) the data and does
not provide explicit integrity protection. However, encrypting encoded
information like this provides a measure of integrity also, since a
penetrator can't reasonably produce false data that decryptes to the
correct fields. Mutual authentication is essentiallly ensured because
both host and client must know the password. However, there is no replay
protection. 
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
Vanek, Jim states:
> 
> Windows NT is being personally used by tons more people than people
> using Solaris or UNIX. NT will become a very secure OS in time (when,
> who knows?) because of all the hammering on the OS. We don't need
> another boring, rung-out OS bash.

I agree that OS ``bashing'' is s waste of time,i but perhaps you like to 
qualify your statement above with some actual numbers. Remember that some
UNIX hosts can/do have thousands of concurrent users.

> To simply state an OS "sucks" is non-constructive and uncalled for. If

actually, I think he was stating that the scalabilty of NT sucked compared
to some other OSes like Solaris. I think even Microsoft would have a 
difficulty time with that point. After all SUN Solaris systems do scale 
quite a bit further (64 way) than NT systems at the moment. Other vendors
solutions are going even further (ie. SGI).

> > And what about scalability ? NT sucks compared with other OS's like
> > Solaris
> > for example.


-- 
Doug Torre voice 716-645-3004
ddt@acsu.buffalo.edu fax 716-645-5972
University at Buffalo http://www.acsu.buffalo.edu/~ddt 
On Thu, 7 Aug 1997, Cornelis van der Laan wrote:

> Isn't it time Intel finally implements a hardware ID in each CPU? Aside from 
> being able to track stolen/copied/relabeled CPUs this stupid question of
> identifying a machine could be solved easily. Why can 100 ethernet hardware 
> manufacturers assign unique ID's to all interfaces but Intel, being monopolist, 
> can't label their CPUs?

Bad idea to have software key in on that. what happens when you throw out
your outdated motherboard and get a better one? You'll have to
re-register every piece of software and reinstall it, etc..

Better idea: Why doesn't Microsoft finally create a program that will let
you regenerate a new random SID, rename the machine, and change it's IP
address configs from the command line? Would solve all the problems in
one fell swoop for those doing mass install rollouts.

Any reason why a machine's SID can't be altered, and any keys that depend
on that SID be altered too?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
..\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
<--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
../|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
======================= http://www.sundernet.com ==========================

I'm not sure what this guy was smoking, but lots of AS/400's have been
hacked. Security is a function of implementation. If you enable dial in
and don't change the QSECOFR or other "Q" account passwords, the system
will be hacked:-) Having said that, vendors still have a responsibility
to develop operating systems that can be implemented securely. Buffer
overflows anonomous logins and mystery ports etc all make it very hard
to implemtent a system securely. If done right, we might not say all
operating systems have flaws, we might say, all implementations have
flaws :-). And sometimes those flaws are on purpose, especially when you
measure the value of what you are trying to protect vs the cost of
protecting it.

Joshua Soliz wrote:

> According to an AS/400 consultant I worked with at one of my client
> sites, NO IBM AS/400 has EVER been hacked. I laughed in his face...
> :D

> ----------------------------------------------------------
> Joshua J. Soliz,MCSE
> jsoliz@dpai.com
> Network Engineer
> DeCarlo, Paternite, And Associates, Inc.
> http://www.dpai.com
>
> >-----Original Message-----
> >From: ColeMaddox [SMTP:cole@techtrain.com]
> >Sent: Thursday, July 31, 1997 9:52 AM
> >To: ntsecurity@iss.net
> >Subject: RE: [NTSEC] RE: Windows NT rantings from the l0pht
> >
> >Forgive me for my ignorance, but is there a system in the world that
> has
> >not been attacked and hacked? Every operating system has holes that
> the
> >designers and programmers don't conceived of when creating the
> program.
> > Granted, Microsoft is not perfect despite the advertisements, and
> there
> >are holes with lanman passwords etc, but those exploits exist so that
>
> >Microsoft can continue to work OS's that admins refuse to upgrade.
> > Microsoft probably should have seen this coming when they created
> windows,
> >but at the same time, we should have seen the Internet worm as
> well...i.e.
> >hindsight is 20/20. Let he hackers hack NT; that will help make this
>
> >relatively young Os just as strong as Unix is today, but please, this
>
> >Microsoft bashing, while it seems to be our favorite past-time, is
> just
> >wasting bandwidth.
> >
> >That having been said, I'll let the flaming begin.
> >
> > Cole
> >
> >Cole@TechTrain.com
> >



I'm not sure what this guy was smoking, but lots of AS/400's have been
hacked. Security is a function of implementation. If you enable dial in
and don't change the QSECOFR or other "Q" account passwords, the system
will be hacked:-) Having said that, vendors still have a responsibility
to develop operating systems that can be implemented securely. Buffer
overflows anonomous logins and mystery ports etc all make it very hard
to implemtent a system securely. If done right, we might not say all
operating systems have flaws, we might say, all implementations have
flaws :-). And sometimes those flaws are on purpose, especially when you
measure the value of what you are trying to protect vsthe cost of
protecting it.

Joshua Soliz wrote:

> According to an AS/400 consultant I worked with at one of my client
> sites, NO IBM AS/400 has EVER been hacked. I laughed in his face...
> :D

> ----------------------------------------------------------
> Joshua J. Soliz,MCSE
> jsoliz@dpai.com
> Network Engineer
> DeCarlo, Paternite, And Associates, Inc.
> http://www.dpai.com
>
> >-----Original Message-----
> >From: ColeMaddox [SMTP:cole@techtrain.com]
> >Sent: Thursday, July 31, 1997 9:52 AM
> >To: ntsecurity@iss.net
> >Subject: RE: [NTSEC] RE: Windows NT rantings from the l0pht
> >
> >Forgive me for my ignorance, but is there a system in the world that
> has
> >not been attacked and hacked? Every operating system has holes that
> the
> >designers and programmers don't conceived of when creating the
> program.
> > Granted, Microsoft is not perfect despite the advertisements, and
> there
> >are holes with lanman passwords etc, but those exploits exist so that
>
> >Microsoft can continue to work OS's that admins refuse to upgrade.
> > Microsoft probably should have seen this coming when they created
> windows,
> >but at the same time, we should have seen the Internet worm as
> well...i.e.
> >hindsight is 20/20. Let he hackers hack NT; that will help make this
>
> >relatively young Os just as strong as Unix is today, but please, this
>
> >Microsoft bashing, while it seems to be our favorite past-time, is
> just
> >wasting bandwidth.
> >
> >That having been said, I'll let the flaming begin.
> >
> > Cole
> >
> >Cole@TechTrain.com
> >





> ----------
> From: Doug Torre[SMTP:ddt@furnari.acsu.buffalo.edu]
> Reply To: Doug Torre
> Sent: Monday, August 11, 1997 1:55 PM
> To: JVanek@hdrinc.com
> Cc: ntsecurity@iss.net; npll@convex.pt
> Subject: Re: [NTSEC] [Fwd: You may want to see this page]
> 
> actually, I think he was stating that the scalabilty of NT sucked
> compared
> to some other OSes like Solaris. I think even Microsoft would have a 
> difficulty time with that point. After all SUN Solaris systems do
> scale 
> quite a bit further (64 way) than NT systems at the moment. Other
> vendors
> solutions are going even further (ie. SGI).
> 
I think that, when "the network is the computer", the maximum number of
processors in an SMP configuration isn't a very good indicator of
scalability. Using loosely coupled smaller configuration SMPs with
automatic replication and failover both scales better and gives higher
availability. And is lots cheaper.

Paul


>The engineer informed him
>that this is an open issue and they're working on fixing it. In the
>meantime, we need not worry that a few hundred of our nt 4.0
>workstations are generating this snmp based error.
 
>> I hope somebody can help me to understand an strange logging in my
>> event
>> log. The reson I start wondering about this, is the time of the day
>> (Night), when NO one uses this server.
>> 
>> EventID 4005
>> Source: perfctrs
>> 
>> Load of INETMIB1.DLL failed. Make sure the DLL file is in the PATH.
>> WIN32 Error number is returned in the data. 

I have seen a couple of issues tied to the SNMP systems that have been resolved by applying Service Pack 2, then reapplying Service Pack 3.

It is my firm belief that SP3 does not contain all of the modules affected by SP2.

Regards,
Andrew Larkin
Managing Consultant
Bytecage Pty Ltd
Australia

>actually, I think he was stating that the scalabilty of NT sucked
compared
>to some other OSes like Solaris. I think even Microsoft would have a 
>difficulty time with that point. After all SUN Solaris systems do
scale 
>quite a bit further (64 way) than NT systems at the moment. Other
vendors
>solutions are going even further (ie. SGI).

I was hoping someone would say this. Oh ye of little insight...;-]

As a former employee of Tandem Computers I'm proud to suggest that you
have a look at http://www.tandem.com/BRFS_WPS/SMX2TBBF/SMX2TBBF.HTM
which basically describes Tandem's real life demonstration of a
massively parallel SQL/MX 2-TERABYTE dB running on 16 clustered,
4x200Mhz PPro Intel servers, each with 512k cache and 512MB RAM. These
were interconnected by Tandem's ServerNet technology which created a
single computer with 64 200Mhz PPro processors and 8GB of RAM. Attached
to that were 16 Synchronix disk arrays containing 480x4.2GB drives
totaling 2.016TB of formatted space.

The dB contained data for 78 weeks of sales of Target stores, covering
140,000 items and more than 600 stores. They then increased the size of
the data 10 times, making a single dB of over 30 billion rows,
considered the largest single dB object ever created (if printed on
paper it would stretch 86,000 miles).

The machines could have been replaced by any commercially available
boxes of varying configurations (i.e. 2 processor) by any vendor.

So next time someone tells you that NT won't scale, think again.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list: http://www.ntbugtraq.com

At 00:53 8/11/97 -0500, you wrote:
>Mark,
>
>CACLS doesn't do the job, as you observed. I've taken to writing my own
>version of CACLS that does the sort of thing one wants. It's a LOT
>harder than one would imagine! Which is probably why CACLS doesn't do
>it. One of the problems is that there are several ways directory ACE's
>can be stored in the ACL, and a tool that needs to set the directory and
>file default sets independently (like File Manager) has to be able to
>sort them all out.

The security APIs are fairly obtuse to begin with, and even though I'm very
proficient with them, I've avoided writing my own cacls. However, xcacls
from the resource kit update 1 _does_ do what we want.


-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Greetings,

Does any one know of a way to copy an entire directory tree from one 
NT server to another server (in the same domain) while maintaining 
all the file and directory permissions. Back in the good old Unix 
days I could just use cpio. Is there way to do this under NT? Or is 
there some utility that I can use to do this. 


TIA,
Mike
Mike Petrusis Tel: (310) 312-1080 Fax: (310) 312-1180 
Acutech Inc. Email: mike@acutech.com http://www.acutech.com
Snail Mail: 11312 Santa Monica Blvd #3, Los Angeles, CA 90025
> 
> As I am new to this list, I in advance ask forgiveness in case I am
> slightly off the direct subject. Perhaps someone may be able to steer me
> in the right direction if there is a more appropriate list elsewhere.
> 

Nope this is quite an appropriate list. :)

> PPTP is that it is supposed to be fairly secure. My understanding is
> that it encrypts your data (including passwords), encapsulates it
> within packets which are then routed over the net via TCP/IP, and then
> uses our "in house" IP addresses (which are in the encapsulation) to
> pass through the firewall rather than the exterior addresses used by the
> agencies and their local provider for transmission. Seems like this
> would give the appearance of our own private net with cutting the comm
> costs down to the T1 circuit coming into the server. Each agency could
> simply pay their local provider their $19.95/month for standard net
> access instead of the per min X.25 rate. I would like to know if I am at
> least in the right ballpark before we start spending $ researching a
> wrong direction.
> 

Pretty much this is correct, just think of it as encrypting anything that
is sent down the PPTP virtual connection.

> My questions to the group are:
> 1) Does anyone know secure this protocol really is?

Well, I would only use it if cost was an issue. I would prefer to use 
something that is a little more suited for the job than an operating system
add-in. For example Alta-Vista Tunnel is a good one. Digital made this
product and for anyone *serious* about doing this type of stuff they
would have much better piece of mind than using Microsofts stuff.
eg: I would not recommend a bank use PPTP as an example....:)

> 2) Am I correctly reading the usage of PPTP?

yep.

> 3) Does anyone see an obvious glitch that I am overlooking? Seems too
> good to be true as advertised.
> 4) What does PPTP cost in terms of data transmission speed?
> 

Not sure about that. AFAIK it is reasonable...anyone?

Matt



A night shift helpdesk user decided to explore the world of NT by
downloading a NT password evaluation program off the net... namely
SCANNTPLUS from ntsecurity.com

Said user downloaded the demo vesion from the web site, intalled it and
ran it. At one point the program cheerfully says that you need admin
rights to run the program. Click ok to get them. you click on ok, the
program tells you you must log in ... then automatically logs you out.
when you log back in again , vollia! You are not in the admin group.

I'm sure this is a well known exploit, but I didn't expect it to come via
a demo package. I found this by my daily security scan looking for users
with admin rights. 

As they said in the cartoon " I dono gwanny, dat putty da look like he
wants to hack my NT box "


I know about the OOB "nuke" thing, and I know there are fixes downloadable from 
Microsoft for NT and Windows 95. But does anybody know anything about a fix for 
the 32-bit-extensions Microsoft TCP/IP stack for those users of the network 
still running Windows 3.11?

Gordon Peterson
http://www.computek.net/public/gep2/
Support the Anti-SPAM Amendment! Join at http://www.cauce.org/

Use scopy from the resource kit
Mitch


At 05:25 PM 8/11/97 -8000, Mike Petrusis wrote:
>Greetings,
>
>Does any one know of a way to copy an entire directory tree from one 
>NT server to another server (in the same domain) while maintaining 
>all the file and directory permissions. Back in the good old Unix 
>days I could just use cpio. Is there way to do this under NT? Or is 
>there some utility that I can use to do this. 
>
>
>TIA,
>Mike
>Mike Petrusis Tel: (310) 312-1080 Fax: (310) 312-1180 
>Acutech Inc. Email: mike@acutech.com http://www.acutech.com
>Snail Mail: 11312 Santa Monica Blvd #3, Los Angeles, CA 90025
>
>
Phone 212-722-7953 Fax 212-427-1169
e-mail mitch@kewling.com 
Imagination is more important than knowledge.....
Knowledge is limited.....
Imagination is not....... Albert Einstein, (1879-1955)
It's funny this topic should come up, as I am in the process right now of
evaluating PPTP for our across the internet communications. My findings
show that the transmission speed is actually surprisingly reasonable! I
mean, I'd no more want to run a 30 MB access database scan over a 28.8k
modem than anyone else, but preliminarily, it looks really good. Using
outlook for instance was about equal to using it on the LAN, and I have it
installed to run off the server!!

At 10:00 AM 8/12/97 EST, Matt Gillard wrote:
>> My questions to the group are:
>> 1) Does anyone know secure this protocol really is?
>
>Well, I would only use it if cost was an issue. I would prefer to use 
>something that is a little more suited for the job than an operating system
>add-in. For example Alta-Vista Tunnel is a good one. Digital made this
>product and for anyone *serious* about doing this type of stuff they
>would have much better piece of mind than using Microsofts stuff.
>eg: I would not recommend a bank use PPTP as an example....:)
>
>> 2) Am I correctly reading the usage of PPTP?
>
>yep.
>
>> 3) Does anyone see an obvious glitch that I am overlooking? Seems too
>> good to be true as advertised.
>> 4) What does PPTP cost in terms of data transmission speed?
>> 
>
>Not sure about that. AFAIK it is reasonable...anyone?

-------------------------------------------
Jiva DeVoe, MCSE
jiva@devware.com
http://www.devware.com
There is a nice little utility in the NT Resource Kit called "SCOPY"
that may meet your needs.

Here is the internal help on it:

SCOPY /?

Copies files and directories to and from NTFS partitions with security
intact.
SCOPY will not copy files to or from FAT, HPFS, or other non-secured
file
systems. SCOPY requires that you have Backup and Restore files User
Rights
on both the source and destination computers.

Parameters must be given in the order specified below.

SCOPY source destination [/o] [/a] [/s]

source Specifies files to copy.
destination Where to copy files to.
/o Copies owner security information.
/a Copies auditing information. Requires that you have
 the Manage Auditing User Right on both the source and
 destination computers.
/s Copies all files in subdirectories.

Hope this helps!

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
DRBivens@AGST.com



> -----Original Message-----
> From: Mike Petrusis [SMTP:mike@acutech.com]
> Sent: Monday, August 11, 1997 13:25
> To: ntsecurity@iss.net
> Subject: [NTSEC] Maintaining permissions while copying directory
> tree 
> 
> Greetings,
> 
> Does any one know of a way to copy an entire directory tree from one 
> NT server to another server (in the same domain) while maintaining 
> all the file and directory permissions. Back in the good old Unix 
> days I could just use cpio. Is there way to do this under NT? Or is 
> there some utility that I can use to do this. 
> 
> 
> TIA,
> Mike
> Mike Petrusis Tel: (310) 312-1080 Fax: (310) 312-1180 
> Acutech Inc. Email: mike@acutech.com http://www.acutech.com
> Snail Mail: 11312 Santa Monica Blvd #3, Los Angeles, CA 90025
Paul,

>I think that, when "the network is the computer", the maximum number of
>processors in an SMP configuration isn't a very good indicator of
>scalability. Using loosely coupled smaller configuration SMPs with
>automatic replication and failover both scales better and gives higher
>availability. And is lots cheaper.
>
However you have to like servernet technology, as when it materlizes for
the common man will give us hot-plugable PPros, and devices connected to
the "Server Bus" not the "SCSI Bus". You will have ultimate failover, like
a set of quads fail, un-plug them and put in a new set. 

The hosts of the future are the PC's of today.

regards:jamie

SCOPY from Reskit

At 05:25 PM 8/11/97 -8000, Mike Petrusis wrote:
>Greetings,
>
>Does any one know of a way to copy an entire directory tree from one 
>NT server to another server (in the same domain) while maintaining 
>all the file and directory permissions. Back in the good old Unix 
>days I could just use cpio. Is there way to do this under NT? Or is 
>there some utility that I can use to do this. 
>
>
>TIA,
>Mike
>Mike Petrusis Tel: (310) 312-1080 Fax: (310) 312-1180 
>Acutech Inc. Email: mike@acutech.com http://www.acutech.com
>Snail Mail: 11312 Santa Monica Blvd #3, Los Angeles, CA 90025
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
At 05:47 PM 8/11/97 -0400, Ray Arachelian wrote:

>Any reason why a machine's SID can't be altered, and any keys that depend
>on that SID be altered too?
>

Only the fact you would have to change all the underlying keys on the
entire NTFS file system, all the security on registry keys, etc....

>=====================================Kaos=Keraunos=Kybernetos==============
>.+.^.+.| Ray Arachelian |Prying open my 3rd eye. So good to see |./|\.
>.\|/..|sunder@sundernet.com|you once again. I thought you were |/\|/\
><--*-->| ------------------ |hiding, and you thought that I had run |\/|\/
>./|\..| "A toast to Odin, |away chasing the tail of dogma. I opened|.\|/.
>.+.v.+.|God of screwdrivers"|my eye and there we were.... |.....
>======================= http://www.sundernet.com ==========================
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
Hi all

I installed a copy of MS ASP ( and Service Pack 1a that come swith ASP
package ) ontop of a fresh Dell server that comes with NT server 4.0 +
Serveice pack 1.0.. but I could not get asp pages to work.. every time I
click on a page ending with .asp, I get a window saying "Document Contains
No Data"

I check the script map, it was clearly stated that :

.asp --> REG_SZ -->c:\winnt\system32\inetsrv\asp\asp.dll , access previledge
--> IUSR_MACHINE = full control, read excecute

So then I proceed with installing Service pack 3.... same problem arises wht
DOCUMENT CONTAINS NO DATA :(

Anyone have similar problem ?



[From Matt Gillard]
> > My questions to the group are:
> > 1) Does anyone know secure this protocol really is?
> 
> Well, I would only use it if cost was an issue. I would prefer to use 
> something that is a little more suited for the job than an operating system
> add-in. For example Alta-Vista Tunnel is a good one. Digital made this
> product and for anyone *serious* about doing this type of stuff they
> would have much better piece of mind than using Microsofts stuff.
> eg: I would not recommend a bank use PPTP as an example....:)

Or sun's domestic-grade "SKIP" product. Which works on NT now, I think.

www.skip.com

I think, for full details.




 Does anyone know of a way to recover/reset a lost/forgotten local
 Administrator password without re-installing?

 There must be a way to get around the security???


 jill.s.treu@jci.com


 
>Does anybody know of a product that will allow an NT PDC to use
>Kerberos authentication for its accounts?

 I haven't used it but this is in my bookmarks file.

 Products Available from Cygnus Solutions -- KerbNet
 http://www.cygnus.com/product/kerbnet-index.html
 
--
Jim Dennis (800) 938-4078 consulting@starshine.org
Proprietor, Starshine Technical Services: http://www.starshine.org
 PGP 1024/2ABF03B1 Jim Dennis 
 Key fingerprint = 2524E3FEF0922A84 A27BDEDB38EBB95A 
I would recommend SmartGate from V-ONE:
http://www.v-one.com/
Remco
-- 
 Een veilig net met PointNet Security Systems bv
 http://www.pointnet.nl/pss
 Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
 PointNet Security Systems maakt deel uit van de PointGroup
 te Alphen a/d Rijn
Quoting gep2@computek.net (gep2@computek.net)
On Subject: [NTSEC] OOB nuking
Date: Mon, Aug 11, 1997 at 08:39:57PM -0500

> I know about the OOB "nuke" thing, and I know there are fixes downloadable from 
> Microsoft for NT and Windows 95. But does anybody know anything about a fix for 
> the 32-bit-extensions Microsoft TCP/IP stack for those users of the network 
> still running Windows 3.11?

 M$ has stated they will not be creating 3.11 fixes unless there 
 is enough demand. So, if you want a fix for the Win 3.11 machines
 whine loudly to M$ ....

-- 
Email: skafte@worldgate.com Voice: +403 413 1910 Fax: +403 421 4929
 #575 Sun Life Place * 10123 99 Street * Edmonton, AB * Canada * T5J 3H1 
-- --
PGP 2.6.2 Key fingerprint = 42 9C 2C A8 4D 2B C9 C4 7D B6 00 B0 50 47 20 97 
http://gras-varg.worldgate.com/~skafte/ http://www.worldgate.com/
-- --
When things can't get any worse, they simplify themselves by getting a whole
lot worse then complicated. A complete and utter disaster is the simplest
thing in the world; it's preventing one that's complex. (Janet Morris)
According to my knowledge, NetLogon uses the 'Workstation Trust Accounts' to establish the secure communications channel.

Does anyone know how these accounts are established, and especially how the passwords are initially exchanged ?

Microsoft's Windows NT Resource Kit describes the establishment of the 'Interdomain Trust Account' and says that a similar process is used for the Workstation Trust Accounts. However, even in this example, the initial password exchange is not "very clearly" documented.

My assumption is that the Workstation sends the (randomly) generated password in clear to the PDC when it joins the domain for the first time, which I think is quite insecure (e.g. LAN sniffing).

Thank you in advance for your cooperation

Sincerely
Panos Dimitriou