NetNews Usenet Archive 1992 #27/NN_1992_27.iso/spool/comp/sys/novell/9654

Text File | 1992-11-19 | 3.8 KB | 69 lines

Newsgroups: comp.sys.novell
Path: sparky!uunet!ornl!rsg1.er.usgs.gov!darwin.sura.net!zaphod.mps.ohio-state.edu!moe.ksu.ksu.edu!usenet-feed.cc.umr.edu!mcs213f.cs.umr.edu!rfranken
From: [e-mail] (Richard Brett Frankenberger)
Subject: Re: Security Patches - How Secure???
References: <[e-mail]> <[e-mail]>
Date: Thu, 19 Nov 1992 16:26:36 GMT
Nntp-Posting-Host: mcs213f.cs.umr.edu
Organization: University of Missouri - Rolla
Sender: [e-mail] (UMR Usenet News Post)
Message-ID: <[e-mail]>
Lines: 56


>    Rather than expend lots of bandwidth on inconclusive results may
>I recommend reading up on Kerberos, part of the MIT Project Athena, as
>a start. There is no 100% guaranteed, foolproof, absolute, "statement",
>way of preventing spoofing or other break-ins; people are deviously clever.
>Don't forget to shred and burn your user's scrap paper, check their picture
>idents, voice prints, telephone lines, leakage of video display signals
>(Tempest qualification) and so on. Certainly never put info on a Unix machine
>because it leaks like a sieve. And watchout for spoof servers (while the real
>ones are unplugged) and bogus backup tapes. Kerberos makes a good try at
>net.security, but it is not without cost and pain. Meanwhile, ordinary users
>are the largest security holes, by far. In other words, if the game is
>security then view the whole situation.
>    Joe D.

Basically, I agree with everything you said.  I was not intending to imply that
forging netware packets is the only loophole to allow someone to gain access to
that which he should not have access to.  In fact, a HACK scheme such as the one
I was inquriring about that requires the wire to be monitored is difficult to
implement, and is certainly not a major security risk.

The servers I manage has none of Novell's patches installed on them.  It isn't
necessary.  (They are 3.11, so they don't have the null password bug).  All the
other things you mention above are indeed much greater security risks, but I
know about them.  I know someone can break into the server room and steal the
server, or someone can pretend to be a server and get passwords when a user
attempts to log on to them.

What I did not know is whether or not wire-monitoring was still a viable way of
forging packets.  Whether it is or not, I am not going to dump NetWare because
it is too insecure.  I am willing to live with such a system; however, I just
wanted to know EXACTLY what my risks are.  As I said, I already know all the
other risks you mentioned, so I am not concerned with them.  I have deemed
them not worth worrying about in my situation.

Now, as to the question of will wire-monitoring allow a packet signature to be
forged.  I will give credit to Novell here ... it now appears that wire-
monitoring will NOT allow a hacker to forge a packet signature.  I have
received an E-Mail reply to my post stating that wire-monitoring will NOT
give a hacker sufficient information to forge a packet signature.  The reply
included sufficient details of the algorithm to at least temporarily convince
me that this is in fact the case (of course, he could be lying, and maybe he
isn't even who he says he is, but I am not that paranoid).  So, it appears that
wire-monitoring is NOT a threat as far as forging a packet and gaining
access.  (Of course, wire-monitoring will continue to allow a user to see any
unencrypted data that goes past).
I realize that this post would not convince me that wire-monitoring is not a
threat (except that I wrote it) because it doesn't say HOW it prevents wire-
monitoring from working.  However, I am not in to quoting other person's private
E-Mail on the net, so I am not going to repeat what he said.  Perhaps he will
post it here ...

      - Brett   ([e-mail])