Organization: Universitaet Kaiserlautern, KIT
X-pmrqc:      1
X-mailer:     Pegasus Mail v2.3 (R3).
Newsgroups: bit.listserv.novell
Date:         Fri, 21 Aug 1992 18:47:30 MET
Reply-To:     weber@rhrk.uni-kl.de
From:         "Christoph Weber-Fahr [KIT]" <LISTMAIL@KIT.UNI-KL.DE>
Subject:      Re: Netware and Viruses
X-To:         NOVELL%SUVM.BITNET@rusvm1.rus.uni-stuttgart.de,
              cohen@fitmail.fit.qut.edu.au

Hello,

> From:          James Ford <JFORD%UA1VM.BITNET@rusvm1.rus.uni-stuttgart.de>

> I recently read some interesting information on Netware and Viruses on
> Virus-L and Risks Digest.  There were several entries for each newsletter,
> but those non-novell related were deleted to save bandwidth.  Comments
> anyone?

Thanks for the report - it is always interesting what is said somewhere
about Netware.

> ------------------------------------------------------------------------
[Some References deleted]
> From:    cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
> Subject: Netware and viruses - some new results (PC)
>
> At QUT, we have set up an experimental network to test viruses in
> networked environments, and the first results have just come in -
> unbelievable!
>
> I will be talking about this at length at the Virus Bulletin
> conference in a few weeks, but I though Virus-L readers would like to
> hear a bit before that.
>
> Test 1: Exhaustive test of netware preotection setting on files and
> directories against common viruses.
>
> Result: Only 3 of the 15 bits provide any protection - Execute ONLY?
> NO GOOD!!!  Read ONLY? NO GOOD!!!
>
> Result: Novell manuals are completely backwards in their depiction of
> the rights granted through inheritance!!!  If you follow the manual,
> you get wiped out!

No file can inherit XOnly or Read-Only attributes.
Obviously this guy doesn't know what he is talking about - he even doesn't
understand the difference between rights and attributes. Also I would doubt
the passus on execute-Only - he is the first who reports the ability to
modify an execute-only file. (But of course, given enough knowledge about
Netware Core Protocol someone would be able to write such a program,
because the XOnly Protection must be based in the WS. This would of
imply he had enough rights to change that file. XOnly is more a protection
from copying than from virusses).

> Test 2: Exhaustive testing of Unix based server - still underway Test
> 3: Same for OS/2 LAN Manager - to be reported at conference Other
> tests?  Let me know what you want to know, and I will try to do it
> ASAP
>
> Conclusion: It is almost impossible to manage netware for safety
> against viruses, but it is probably possible if you are a GOOD ENOUGH
                                                            ^^^^^^^^^^^
> sys admin.  More conclusions to follow as they come available.

Let's say averagely skilled and fully informed. This gentleman should be
condemned to read the complete manual. Settin RO flag without removing the
modify etc. rights is bare nonsense.

> From: cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
> Subject: Novell Netware protection?
>
> I have been doing exhaustive tests on Novell Netware protection, and I cannot
> believe these people can sell their product on the basis that it is the most
> secure.  If it is, we are in big trouble!!
>
> "Read Only" files are successfully infected by DOS viruses!

See above.

> "Directory protection" works exactly the opposite of how the manual claims!
>                 IN 3 DIFFERENT PLACES!!!
> Several protection bits work from a MacIntosh, but not from DOS machines!!
>         What kind of network protection doesn't work when the user uses a
>         different machine to login?!?  Protection based in the user's machine
>         and not on the server!!!

Again, he should gain some skills. Protection is working slightly different
on macs and PCs. But of course it is based in the server: Netware for mac
is in fact a "second" server running on the same server-machine. The
differences are in the requirements of the Appletalk Filing Protocol (sp?),
which cannot be mapped 1:1 to the netware security.

> A shareware product successfully gathers passwords from the net as they are
>         entered by the users!  For $35 I can get every password on your
 network
>         (if I choose to pay the shareware licensing fees to be honest about
 it)

This is a known problem - IF you work with unencrypted passwords. This
also applies to every unix telnet and whatever else you like. Conclusion:
don't allow unencrypted password calls. But this is hardly a virus-problem.

> Passwords can be ANYTHING - including nothing at all!  The supervisor password
>         on our network is empty, so anyone on the net can login with no
 password
>         (we are physically isolated - but how about some password controls!)

A matter of configuration. You may require passwords if you like.

> So-called Execute Only protection does not prevent companion viruses from
>         working, and prevents the sys admin from verifying program integrity,
>         prevents backup and restore of execute-only files, and thus is a great
>         hindrance to protection!

I would agree to the hindrance part - the other is yet to be proven.

> This was the results of the first 2 DAYS of experiments!  If we can find this
> many problems in 2 days (while not explicitly trying to look for these kinds
 of
> holes), I can't imagine anyone claiming this system to be the best available
> security.  But who knows?  In the next few days we will be looking at Unix
> based servers!  FC

I hope these people are unix-gurus - this would explain some of their
ignorance regarding Netware - but then the unix tests will have more
significance.

Maybe we should collect a set of hints to configure and run virus-safe
netware and include that to the faq-list.

Regards

Christoph Weber-Fahr


---------------------------------------------------------------------------
  Christoph Weber-Fahr                  |  E-Mail:  weber@rhrk.uni-kl.de
  Universitaet Kaiserslautern,  KIT     |  S-Mail:  Postfach 3049
  Tel. 0631/205-3391                    |           D-6750 Kaiserslautern
---------------------------------------------------------------------------
                       -  My personal opinion only    -
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU