From: padgett@tccslr.dnet.mmc.com (A. Padgett Peterson)
Newsgroups: comp.virus
Subject: Re: NetWare and viruses - some new results (PC)
Date: 10 Sep 92 03:55:39 GMT

>From:    bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
>
>By "exhaustive test" he means exhaustive test. He has generated 256
>directories will all possible combinations of access rights and has
>tried to infect the files in them.

In fact, I have found that only a very small number of the 256
possible combinations prevent possible infection (believe it is 24 but
CREATE is confusing the issue. If you have CREATE you can infect a
directory unless you also have READ in which case you must also have
WRITE unless you are a MacIntosh...). Please note that I include those
cases that a virus *could* be written to exploit (such as MODIFY and
where a file is known to be in a directory that cannot be searched).

>> 4. A virus which has Read, Write and File Scan rights, can infect
>> target files.  Therfore careful consideration should be given to use
>> of the Write right.

Unfortunately, many users (and some applications) become very unhappy
if they do not have WRITE right in their own directories. This was the
problem I had with one LAN last year, the custom MAIL facility
demanded WRITE right to itself. JERUSALEM spread like mad.

>And, if the user is given the right to modify the rights, the virus
>could do so as well and to set the Write right, even if it is not
>initially set. A more exact configuration that prevents virus
>infection can be found in Dr. Cohen's paper.

Specifically, you must have NOT SUPERVISOR AND NOT WRITE AND NOT
MODIFY AND (NOT CREATE OR READ). (Boolean math in ASCII is difficult).

>Correct. What Dr. Cohen has actually observed is that the "default"
>configurations and even those configurations that are usually
>considered "secure" do not actually prevent a virus attack. It -IS-
>possible to set the right in a way that will stop viruses, it is just
>not easy to figure out how exactly.

Not really difficult once the rules of RIGHTS and INHERITANCE are
understood, see above.

>I encourage you to read Dr. Cohen's paper. Unfortunately, he refused
>to make it available in electronical form, so you should refer to the
>proceedings of the 2nd Virus Bulletin Conference.

Unfortunately typical. I actually held his book in my hand for nearly 15
seconds before it was snatched away.

>His basic theory is that it is very difficult to figure out how to
>manage the NetWare rights in a way that will stop virus attacks.

Not difficult at all, just what is required is unlikely to be palatable
to users. One of the difficulties is that unlike UNIX or a Mainframe 
where a process may take on rights denied to the user as a function of 
the owner (see ROOT), under PC Netware, a user must have all rights 
required by a process. Hence to pass mail, EVERYONE *must* have CREATE 
right to all MAIL subdirectories (see boolean above).

>P.S. I don't have the paper handy right now. We (the VTC-Hamburg) are
>planning to repeat the tests, in order to verify the results.
>Unfortunately, we can repeat only the Novell Netware tests (since we
>don't have a Unix-based DOS server) and only for version 2.15. :-(

Our testing has been done so far on version 3.11 (386 server) - there is
a Sun server but the owner is not stupid enough to let me play with it - yet.

I hope in the near future to convert my den closet to Novell so that some
nastier testing can be done.

Incidently, we have also been testing both Intel's LANPROTECT and 
McAfee's NETSHIELD and I would consider both to be a good version 1.0 
but IMHO some cleaning up needs to be done (example: client FROG is 
infected with SUNDAY. On logging into server SUNDAY tries to infect 
LOGIN.EXE but lacks WRITE right {I love that}. No alarm is raised at 
the failed attempt (default). On reaching his home directory SUNDAY 
infects MAPMEM on request. Both products then notify FROG that MAPMEM 
is infected and deny access. Neither warns FROG that *he* may be the  
source. FROG then calls SUPERVISOR over to report that there is an 
infected file on the server and...)

Again IMHO, what is really required is a layered defense (where have we
heard that before ?) 1) Integrity TSR active on CLIENT to ensure cleanliness
                     2) Check of CLIENT on login to verify cleanliness
                     3) Monitor for attempted illegal activity by CLIENT
                     4) Scanner for legal file transfers and on exceptions 
                        reported by 1-3.

NETSHIELD and LANPROTECT accomplish item 4 only. Of course it could be
said that other products exist for the other three items e.g. McAfee's
VSHIELD for item 1 and Intel's LPSCAN for item 2 but I like one-stop
approachs. Of course IMHO both products are good enough that they are 
worth a little prodding to make them great.

				Warmly,
					Padgett

BTW thanks to all of those who responded, I have enough LAN adapter cards now.