From: brian@jaguar.cs.utah.edu (Brian Sturgill)
Subject: Re: Tidbits about Windows for Workgroups.
Organization: University of Utah CS Dept
Date: Tue, 10 Nov 92 22:14:04 GMT

In article <1992Nov10.195902.25670@cbnewsl.cb.att.com> flink@cbnewsl.cb.att.com (charles.w.flink..ii) writes:
>In article <1992Nov9.061034.10748@fcom.cc.utah.edu> brian@jaguar.cs.utah.edu (Brian Sturgill) writes:
>....
>>Network DDE
>>
>>Customers have wanted the ability to work together on common projects
>>over the network for some time, and Windows for Workgroups takes them a
>>step closer with Network DDE and the Clipbook Viewer.  Previously, the
>>Dynamic Data Exchange (DDE) protocol allowed users to share information
>>between applications on the same machine.  We wanted Windows for
>>Workgroups to extend this idea and allow users to share information
>>across the network.
>....
>>amazing -- existing applications could establish links over the network
>>with no modifications.  Using the Clipbook Viewer for setting up links,
>>users can take advantage of basic Network Object Linking and Embedding
>>(OLE) functionality.
>....
>>Brian
>>-- 
>>C. Brian Sturgill                   I strongly encourage you to mail your copy
>>University of Utah                     of Ross Perot's:  "United We Stand
>>Center for Software Science            How we can take back our country",
>>brian@cs.utah.edu; CIS: 70363,1373        to President-elect Clinton.
>
>Brian...
>
>I'd be interested in hearing a discussion of the security issues re network
>DDE/OLE.  I too share a good deal of enthusiasm for the power of these tools,
>but I am reminded of old Mainframe vrs UNIX systems arguments of years past:
>"UNIX is powerful/programmable/extensible/easy to network...." vrs "Yea, and
>you can shoot yourself in the foot with it too!"  As UNIX systems have migrated
>into the mainstream, many convenient and powerful "features" have come to be
>called "holes" and customers (DoD customers at least) have required these
>"holes" be plugged.  (E.g. ".sh" and ".pi" directives in troff, similar
>escapes in vi (and other editors), "current directory must be last in PATH",
>and many more obscure and/or significant examples could be listed.)
>
>Note: please lets not waste bandwidth on UNIX vrs NT or such foolishness.
>And Alistair, I know NT is going for a C2 rating.  The question is simple:
>
>1) if I receive email containing an embedded OLE/DDE link, could it be a
>   Trojan Horse?
>	- with who's rights/privileges is access computed
>	- do I even KNOW something was accessed/executed

Well it depends on how you want to think about it.  The a OLE/DDE is just
a link, and will execute an app on your local system, so from that standpoint
it cannot.  On the other hand if the app has a scripting/macro language
(for example Excel, Word, etc), then obviously a trojan horse could be
inserted that would not necessarily be detected by the invoking user.
But this holds true in any e-mail environment.  The same thing would
be true for spread-sheets that were passed amongst users of a spreadsheet
on a mainframe.
In other words, the problem here is that what is being passed is a program
written in the form of a macro and obviously if the user that receives this
"macro program", executes the program by opening it, then the user
is running a foreign program that has the privilege level of that user.

Now another question might be do we know who the mail comes from (i.e. can
we trust that a mail message that appears to come from "Brian" really came
from Brian)?  Well Windows for Workgroups is not a secure system, so the
answer there is an obvious no. On NT?  Well you need to define what
portions of the hardware/software system you trust and those that you don't.
I would suspect that under NT, IF YOU TRUST YOUR LOCAL NET WIRE TO BE SECURE,
and if all stations on that wire are running an NT-class OS, then yes, but
then I doubt anything has really been said here.
This holds true for all local area nets.  Further if you trust your local
wire, the I'm not sure why you cannot run Windows for Workgroups as well
as I cannot conceive of being able to trust your local wire without assuming
that someone could put such a system on it, as in any place I know of, this
could be done on the sly.
Any mail coming in remotely would of course be a threat, but again why is
this different on a "mainframe"?

Even your Unix example of the .sh and .pi macros are not indicative of a
difference between Unix and mainframes in terms of security.  Have you
not heard of REXX trojan horses on mainframes?  This is the same problem.
Likewise with the PATH problem.  Mainframes allow aliasing of commands...
all you have to do to cause the trojan to be run instead is to insert
an alias that runs the trojan first.
Further Windows for Workgroups has not increased the problem... the
same problems exist for documents sent via diskette.

In truth the questions you present are not really different for the mainframe
they are just generally not asked there as the functionality often doesn't
exist on mainframes.
As quick as you get two mainframes exchanging mail over a compromisable
channel (e.g. ethernet, phone lines) then all the questions you ask
are just as applicable.
In the end, the only way you can really be sure is to use encryption, and
even this is reasonably easy to bypass (it's reasonably easy to capture
keys when they are entered, also people have a nasty tendency to record
keys or use stupid ones).  If you're careful then encryption can
drastically reduce the odds of subversion, but it is painful in practice,
and thus will likely only be used when it's essential.

>
>2) does anybody care?  ...or shouldn't they?
>	- interested in opinions

Lots of people care, a few silly ones even run around claiming to have
answers.  The only answer I've seen is that you balance security with
ease-of-use and hope.  Really only hardware-level fast data encrypted
channels will have any hope of solving the identity problem, and the
FBI seems bound and determined not to let this happen. (If it's
breakable by the FBI, then you can bet that it is breakable by anybody
that cares).  For more info I suggest you look through back issues of
comp.risks.

>
>-Chuck  (c.flink@att.com)

Brian
-- 
C. Brian Sturgill                   I strongly encourage you to mail your copy
University of Utah                     of Ross Perot's:  "United We Stand
Center for Software Science            How we can take back our country",
brian@cs.utah.edu; CIS: 70363,1373        to President-elect Clinton.
Newsgroups: comp.os.ms-windows.advocacy,comp.sys.mac.advocacy