From: rfranken@mcs213i.cs.umr.edu (Richard Brett Frankenberger)
Subject: Re: Leak in Novell
Date: Wed, 30 Sep 1992 00:13:53 GMT
Organization: University of Missouri - Rolla

In article <vermeulen.4.0@rulwinw.LeidenUniv.nl> vermeulen@rulwinw.LeidenUniv.nl (Hans Vermeulen) writes:
>
>As the writers of the program HACK.EXE (Novell fix: SECURE.ZIP) we would
>like to say the following: it is hardware independent, it will work on
>any type of hardware as long as IPX has been loaded. We have tried it on
>our Ethernet and Token-Ring networks. The fix by Novell solves part of
>the problem: it prevents a simple user from acquiring additional rights,
>but at the same time it disconnects the workstation the supervisor is
>working on ....
>
>Hans Vermeulen.
>
>Mr W.A. van Spronsen
>email: vspronsen@rulwinw.leidenuniv.nl

This appears to indicate that the program is NOT going into promiscous mode and
monitoring packets over the network wire to get information required to
emulate a workstation attached as supervisor.  (If it were, it would almost
certainly be hardware dependant.  Also, IBM Token-Ring cards CANNOT be
placed in promiscous mode without hardware modification (although you could
find out the address of a supervisor workstation and set the TR cards MAC
address to the address of the supervisor workstation, and maybe you could
get it to insert without checking for duplicate addressed (I don't know if
that can be done with software or not - I know how to get an TR card with a
duplicate MAC address on a ring, but it involves letting the card insert on
a different ring first and then moving the cable))).
 
So, assuming that this method does not invole monitoring the network, and
that it likely doesn't involve changing the MAC address (which would likely
also make it hardware dependant), does anyone have any idea how it works?
I'm not interesting in seeing HACK.EXE posted (I don't see anything wrong
with posting it, I just don't have any use for it), but I would like details
on how it works so that I can determine for myself exactly what the risk to
my servers is (Novell says that I can fix everything with an NLM, but Novell
also told me I had a secure operating system (and essentially it is - most 
loopholes are design flaws - KNOCK.EXE being one exception) in the first place).
It appears to me that this program gets the connection number and MAC address
of a SUPERVISOR connection (not difficult - just use the same calls that
USERLIST /A uses), and with that information sends a packet to the server
that looks like tit came from the SUPERVISOR workstation (although 
apparently not 100% just like it, as Novell's new security NLM can detect
the problem).  I'm curious specifically (1) What information the hacking 
workstation must have to get in (is Connection number and MAC address
sufficient), and (2) Does the hacking workstation HAVE to change its MAC
address to the MAC address of the SUPERVISOR workstation (or can it send
a packet from its MAC address with a FROM field in the IPX frame with the
Supervisors MAC address).  I tend to think the answers are, respectively,
YES and NO, as at appears the program works with only IPX calls (because he
said it only requires that IPX be loaded, and implied that it will work
over topoligies other than E-Net and TR (but that it had only been tested on
those two).  (But I could VERY EASILY be wrong - I don't have any of this
information because too many people here seem to believe that telling System
Administrators will let all the Hacker/Crackers in on the secret, never mind
that many of them probably already have HACK.EXE and are happily hacking into 
our servers already.  Novell did well in releasing its NLM, but I still would
like to know exactly what the problem is that I am fixing.  When I take my car
into the garage, I don't say fix it, then leave and come back when its done, I
also ask exactly what was wrong.  This is NOT intended as a flame, and I 
respect everyone's opinion, but I think this information would benefit
everyone.)    

As for the suggestion that we discuss this and future security breaches with  
Novell, maybe it will work (I have no experience ever dealing directly with
Novell), but I would imagine that discussing it on the net gets much better
results.  (If I call up and say I've found a hole, they may say No, its
nothing, it won't work, don't worry about it, but if I post NEWHACK.EXE to the
net and hundreds of system administrators (and granted, some hacker/crackers
also) download it and see for themselves that IT DOES WORK, Novell HAS to
respond.  Same as asking a politician about some scandelous subject, he simply
denys it and moves on ... write a well-documented article about it in a
Newspaper, and he has to respond).
 
     - Brett   (rfranken@cs.umr.edu)