X-Mailer: ELM [version 2.3 PL11]
Newsgroups: bit.listserv.novell
Date:         Wed, 30 Sep 1992 08:15:30 PDT
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         "(Richard Warner)" <rick@SJSUMCS.SJSU.EDU>
Subject:      Re: Posting of NetWare security hacks.
              "NOVELERR@suvm.acs.syr.EDU" at Sep 30, 92 6:49 am

>
> Folks,

< stuff deleted >

> The only effective way to audit the security of NetWare servers is for
> a trusted person (or group of persons) to have the tools available to
> hackers.  In this way, the auditor, security officer, or primary
> NetWare LAN administrator can use the tools from a central and
> convenient location to confirm that all known security vulnerabilities
> are resolved on all servers.
>
> It seems that many people who read these forums are opposed to posting
> of hacking programs.  I can see the point of their arguments.  While I
> am not adamently against this policy, I also am concerned at the
> damage that can result due to the lag time between the posting of the
> hacking program and the availability and implementation of effective
> counter-measures.  However, I still feel it is of vital importance
> that these tools be available to system administrators.  Some mutually
> agreeable means should be available to fulfill this critical need.

< more stuff deleted >

I agree with you to a point.  But there is an extreme danger in making
this type of information publically and freely available - even to
Netware administrators!  The price of a 5 user license is low enough that
a truly malicious person could purchase a copy just to get on Novell's
approved list if such a policy were implemented.

Making certain security information freely available is an invitation for
people to experiment.  My position on this is not purely 'academic'.  We
had a recent incident where a student read about a Trojan Horse program
for UNIX, copied it, and started it running on 3 UNIX boxes.  I caught
it before any 'damage' was done, but the subequent interviews with the
student and faculty who knew this student made it clear that the student
was merely 'experimenting' to see how this type of program worked.  The
student had an exemplary record and was scheduled to graduate at the
end of this semester; that is now in jeopardy.

The virus researchers have agreed upon a 'protocol' for passing around
viruses and detailed information about viruses so that the 'invitation'
threat is minimized.  A very small and tightly controlled group of
researchers keep this type of information under tight wraps.  I do not
need to know the details of how a virus attacks a machine, I only
need the 'inoculation' and the 'vaccination' to prevent/cure infections.
Perhaps that is the model we should be working on in regards to network
security.

Note that this type of controlled information flow is de rigeur in the
general computer security field.  How much detailed information was
posted about the 'Internet worm'?  The published information was
purposefully general in nature to minimize the danger that anyone else
would be invited to exploit the same or similar security holes.  You
will find the same true if you seek out information on mainframe
security holes.  The feeling is that you post the general information
but not the specific details. [ this can sometimes create problems;  I
have been invited to crack through mainframe security on two occasions
to get information that was important and locked away from everyone,
including the system administrators.  It takes a lot of work to find out
the information needed to break through, and that is the way it should
be. ]

> What I believe is called for at this time is:
>
>    1.)	Some indication from Novell of its opinion on this topic,
> 	including whether it sees any possibility of providing such
> 	a service;
>
>    2.)	A reasonable and intelligent discussion between the partic-
>         ipants of these forums (UseNet's comp.sys.novell and Syracuse
>         University's NOVELL listserver list) of the value of such a
> 	service, and alternatives if Novell is unwilling or unable to
> 	provide the same.
>
> I believe that discussions in this forum would be the most productive,
> but I am willing to summarize and post as necessary to start and keep
> the ball rolling.--
> _________________________________________________________________________
> RUCS     | Mark A. Medici, Systems Programmer III, User Services Division
> User     | Rutgers University Computing Services, New Brunswick, NJ 08903
> Services | [medici@gandalf.rutgers.edu]                    [908-932-2412]
>

+-----------------------+-------------------------------------+
|   Richard M. Warner   |   Internet:  rick@sjsumcs.sjsu.edu  |
|                       | CompuServe:  71121,2257             |
+-----------------------+-------------------------------------+
|  ** DISCLAIMER:  All opinions are strictly my own.  I work  |
|                  hard enough at forming them!               |
+-------------------------------------------------------------+
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU