From: gary@sci34hub.sci.com (Gary Heston)
Subject: Re: Hack.exe
Reply-To: gary@sci34hub.sci.com (Gary Heston)
Organization: SCI Systems, Inc., Huntsville, Al.
Date: Mon, 23 Nov 1992 15:19:58 GMT

In article <1992Nov21.110530.22022@novell.com> donp@novell.com (don provan) writes:
>In article <7212@news.duke.edu> low00001@bullnext.mc.duke.edu (Richard Low) writes:
>>Ah, but as Eric J. Schwertfeger pointed out in his follow up posting,  
>>physicall access to a server is the determining factor.  Even if the console  
>>is secured, I can kill the power (and probably some files) to bring the  
>>server down.  Then all I need is a boot floppy with SERVER.EXE and my set  
>>password NLM on it and I can do my thing.

Actually, you don't even need SERVER.EXE on the floppy; once you've 
booted off the floppy, you can run it off the hard drive. The AUTOEXEC.NCF
is what you need to intercept/modify.

>Isn't this just a characteristic of your hardware purchase?  I mean,
>all you're saying is that you can get control of your machine before
>NetWare does.  It's hard to fault NetWare for not doing something
>before it gets control.

Not the hardware purchase, but the installation. No matter what fancy
hardware you buy, if it's set out in the middle of an open area, it's 
not secure. *Access* to the hardware is the concern; not anything the
OS does. I don't think anyone is faulting NetWare for not being able to
do anything about this; just trying to avoid giving inexperienced users
and admins a false sense of security. The security aspects of NetWare
are only protection against attacks through the wire, and they seem to
be fairly adequate for that. A very determined intruder will eventually
get through, but the average bozo will be stopped.

>I don't know if any PC manufactures have done this, but it wouldn't be
>too hard to prevent this type of attack.  Most PCs nowadays have a
>CMOS configuration switch to force booting off the hard disk.  Just
>require a password to change CMOS, and then without the password the
>server should be unstoppable, shouldn't it?

I've seen some BIOS implementations that have a programmable boot 
sequence, that will allow the hard drive to be selected as the first
choice. There are also boot passwords, although I haven't seen one
for simply changing the CMOS.

The problem that arises here is: what do you do when it's *necessary*
to break in? I've seen several "help, the supervisor quit/got fired and
nobody has the password" requests; if you make the server/NOS combination
impenetrable, how can this be recovered from? Or, if SERVER.EXE gets
damaged, and hangs the server on attempting to boot? These situations
are remidied by booting from a floppy, and using a password NLM (or
reinstalling damaged files).

I don't expect NetWare to protect from physical attacks; that's effectively
impossible to do and still have a usable server.

>Once you get this far, the direct break-ins would tend to be physical.
>There's no end of physical escalation, so i tend not to worry about it
>myself.  Even with solid software protection, "all" the enemy has to
>do is open up the box, remove the hard disk, and put it in a machine
>that's more "friendly".  Put a lock on the case, and the enemy has to
>pick, pry, or burn it open.  Lock it in a room, he breaks into the
>room...and the building!  Heck, put armed guards around it...he
>*kills* them.  Ad infinitum.

Yes; I've read a posting describing a gutted server (drives, boards,
NICs, etc. pulled and carried out in a sports bag). I've heard of a
similar incident with a non-networked system. 

There are limits to physical security; however, a locked room will 
deter the overwhelming majority of attacks. Because someone might 
kill an armed guard to steal a copy of Windows 3.1 off the server
doesn't mean it's pointless to implement *any* physical security. 
Rather than "not to worry about it", I'll make a reasonable attempt to
secure the hardware, inside a locked room if possible, a locked cabinet,
or *something*. No security system is impenetrable; if someone wants
in, they'll get in. I just need to make it not worth their while.

>This reminds me of Craig Everhart's axiom: *Never* put anything into a
>computer or a network that you don't want anyone else to see.  Too bad
>his advice isn't practical, even if it is sage.

Better yet, embed the computer in concrete and drop it in the Mariannas
Trench. I don't know of anyone that wants to go under several thousand
feet of water to crack a server.

About as practical....

-- 
Gary Heston    SCI Systems, Inc.  gary@sci34hub.sci.com   site admin
The Chairman of the Board and the CFO speak for SCI. I'm neither.
"Data sheet: HSN-3000 Nuclear Event Detector. The [NED] senses the gamma
radiation pulse [from a] nuclear weapon." As if we wouldn't notice...
Newsgroups: comp.sys.novell