From: medici@dorm.rutgers.edu (Mark Medici)
Newsgroups: comp.sys.novell,bit.listserv.novell
Subject: Posting of NetWare security hacks.
Keywords: KNOCK.EXE, HACK.EXE, Novell, Security, Hacks, Crackers, Posting
Date: 30 Sep 92 06:49:33 GMT
Followup-To: comp.sys.novell
Organization: Rutgers Univ., New Brunswick, N.J.

Folks,

Sorry to harp on this subject again.  However, I just had a situation
fall into my lap that serves to further demonstrate the potential
advantage to making available, by some means, the security hacking
tools previously discussed in this forum.

Our University auditors left a message for me today that they require
my assistance in assessing the security and reliability of using
NetWare servers for confidential and sensitive data.  Since I've been
out on vacation for a few days, I haven't yet spoken directly to them.
However, whether they are aware of the recent discussions on this
topic or not, it is my duty to inform them of the security flaws
disclosed here and elsewhere.  Since they are in the preliminary
phases of their overall investigation of Novell security, I am certain
they will be very interested (if not insistant) on gaining access to
some tools to determine whether all known security vulnerabilities
have been closed on mission-critical servers.

As I've written in previous messages, it is clearly necessary that
bona-fide NetWare administrators have access to the same tools as
hackers do to determine the security of the LAN.  While Novell has
been fairly good at quickly reacting to security flaws, this is not a
complete and satisfactory solution.  Even if Novell was able to notify
100% of its customers of the vulnerabilities, and provide fixes that
totally resolved the problem, this is no guarantee that individual
NetWare system administrators would implement the solutions.  With
more than 50 NetWare servers at Rutgers, (and several other sites with
many more), it would be a daunting, if not impossible, task to
personally visit each site and confirm that all appropriate measures
are in place.  In the case of static patches to NetWare 2.x servers,
there is no way to guarantee the security fixes were installed, short
of implementing the patches then regen'ing and reinstalling the NOS in
the presence of an auditor or other authorized official.

The only effective way to audit the security of NetWare servers is for
a trusted person (or group of persons) to have the tools available to
hackers.  In this way, the auditor, security officer, or primary
NetWare LAN administrator can use the tools from a central and
convenient location to confirm that all known security vulnerabilities
are resolved on all servers.

It seems that many people who read these forums are opposed to posting
of hacking programs.  I can see the point of their arguments.  While I
am not adamently against this policy, I also am concerned at the
damage that can result due to the lag time between the posting of the
hacking program and the availability and implementation of effective
counter-measures.  However, I still feel it is of vital importance
that these tools be available to system administrators.  Some mutually
agreeable means should be available to fulfill this critical need.

Novell is in the best position to handle this matter.  With access to
databases of registered NetWare owners and NOS serial numbers,
confirmation of credentials is much simplified.  Further, with Novell
as the distributor, it could impose reasonable restrictions on the
availability, such as requiring the sysadmin be a CNA or CNE.
Finally, Novell could require the signing of a non-disclosure
agreement to help stay-off any secondary distribution from this
service.  While these measures would not stop the undesired spread of
the security-breaking tools through the hacker community, it would
provide a reasonably safe way to get important information into the
hands of those who have a rightful need to know.

However, there are market issues to consider, and Novell may not be
willing to be so forthcoming with information and tools that could
compromise the security of its products and, by extension, its market
share.  While the most secure way of distributing these tools is
through Novell, if it is unwilling, I believe it is crucial that we of
the Internet community come up with an alternative.

What I believe is called for at this time is:

   1.)	Some indication from Novell of its opinion on this topic,
	including whether it sees any possibility of providing such
	a service;

   2.)	A reasonable and intelligent discussion between the partic-
        ipants of these forums (UseNet's comp.sys.novell and Syracuse
        University's NOVELL listserver list) of the value of such a
	service, and alternatives if Novell is unwilling or unable to
	provide the same.

I believe that discussions in this forum would be the most productive,
but I am willing to summarize and post as necessary to start and keep
the ball rolling.-- 
_________________________________________________________________________
RUCS     | Mark A. Medici, Systems Programmer III, User Services Division
User     | Rutgers University Computing Services, New Brunswick, NJ 08903
Services | [medici@gandalf.rutgers.edu]                    [908-932-2412]
Newsgroups: comp.sys.novell