From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Newsgroups: comp.virus
Subject: Re: NetWare and viruses - some new results (PC)
Date: 7 Sep 92 20:56:38 GMT

kev@inel.gov (Kevin Hemsley) writes:

> I'm not sure what you mean by exhaustive test, but I think that if you

By "exhaustive test" he means exhaustive test. He has generated 256
directories will all possible combinations of access rights and has
tried to infect the files in them.

> 1. There is a clear distinction between NetWare RIGHTS and ATTRIBUTES.

Problem is, the distinction does not seem to be very clearly described
(or at least emphasized) in the docs, since lots of people are
confusing those two terms.

> can access and what the user is allowed to do with them.  Rights
> Security supersedes attribute security, in that a user must first be
> given access to a directory, subdirectory or file before attributes
> can be defined for each.

Correct. It is indeed so. Unfortunately, the manual says exactly the
opposite.

> 4. A virus which has Read, Write and File Scan rights, can infect
> target files.  Therfore careful consideration should be given to use
> of the Write right.

And, if the user is given the right to modify the rights, the virus
could do so as well and to set the Write right, even if it is not
initially set. A more exact configuration that prevents virus
infection can be found in Dr. Cohen's paper.

> infection.  The only other attribute which stops viral infection, out
> of the _18_ NetWare attributes is the Execute Only attribute.

The only thing that the ExecuteOnly attribute stops is that it stops
the supervisor from performing proper backups and integrity checks and
therefore detecting the infection. EXE files with ExecuteOnly
attribute set can be trivially infected by a companion virus - if the
rights permit file creation and/or renaming in that directory.

Furthermore, it is possible to use a PATH-companion virus attack,
which will make even the best protected files (i.e., those in
directories with only Read, Open, and FileScan rights set) look like
infected for a particular user. The presence of just one writable
directory (e.g., the user's home directory) is enough for this attack
to succeed.

> However, IMHO, careful assignment of rights will provide a better
> protection against virus propagation than no protection at all.

Correct. What Dr. Cohen has actually observed is that the "default"
configurations and even those configurations that are usually
considered "secure" do not actually prevent a virus attack. It -IS-
possible to set the right in a way that will stop viruses, it is just
not easy to figure out how exactly.

> I encourage Mr. Cohen to redesign his tests with a better
> understanding of Rights and Attributes. 

I encourage you to read Dr. Cohen's paper. Unfortunately, he refused
to make it available in electronical form, so you should refer to the
proceedings of the 2nd Virus Bulletin Conference.

> If your basic theory is to
> prove that NetWare Attributes are not effective against viruses, you
> will essentially be correct, however if your basic theory is that
> NetWare Rights are not effective against viruses, then you will, in
> general, be incorrect.

His basic theory is that it is very difficult to figure out how to
manage the NetWare rights in a way that will stop virus attacks.

> I believe that if you reread the red books, you will find that they
> are correct their description of inheritance.

As already mentioned, the manual says exactly the opposite of what is
the truth. During his speech at the conference, Dr. Cohen presented a
photocopy of the manual page that claims that "attributes take
precedence over rights". The exact page numbers of the manual are
quoted in his paper.

Regards,
Vesselin

P.S. I don't have the paper handy right now. We (the VTC-Hamburg) are
planning to repeat the tests, in order to verify the results.
Unfortunately, we can repeat only the Novell Netware tests (since we
don't have a Unix-based DOS server) and only for version 2.15. :-(
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
** PGP public key available on demand. **    Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany