X-Acknowledge-To: <JFORD@UA1VM>
Newsgroups: bit.listserv.novell
Date:         Fri, 21 Aug 1992 10:55:09 CDT
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         James Ford <JFORD@UA1VM.BITNET>
Subject:      Netware and Viruses
X-cc:         donp@novell.com, brian@novell.com, janetp@novell.com

I recently read some interesting information on Netware and Viruses on
Virus-L and Risks Digest.  There were several entries for each newsletter,
but those non-novell related were deleted to save bandwidth.  Comments
anyone?

------------------------------------------------------------------------
VIRUS-L Digest   Wednesday, 19 Aug 1992    Volume 5 : Issue 141

Today's Topics:

Netware and viruses - some new results (PC)
------------------------------

Date:    Wed, 19 Aug 92 08:06:46 -0500
From:    cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
Subject: Netware and viruses - some new results (PC)

At QUT, we have set up an experimental network to test viruses in
networked environments, and the first results have just come in -
unbelievable!

I will be talking about this at length at the Virus Bulletin
conference in a few weeks, but I though Virus-L readers would like to
hear a bit before that.

Test 1: Exhaustive test of netware preotection setting on files and
directories against common viruses.

Result: Only 3 of the 15 bits provide any protection - Execute ONLY?
NO GOOD!!!  Read ONLY? NO GOOD!!!

Result: Novell manuals are completely backwards in their depiction of
the rights granted through inheritance!!!  If you follow the manual,
you get wiped out!

Test 2: Exhaustive testing of Unix based server - still underway Test
3: Same for OS/2 LAN Manager - to be reported at conference Other
tests?  Let me know what you want to know, and I will try to do it
ASAP

Conclusion: It is almost impossible to manage netware for safety
against viruses, but it is probably possible if you are a GOOD ENOUGH
sys admin.  More conclusions to follow as they come available.

FC

--------------------------------------------------------------------------
RISKS-LIST: RISKS-FORUM Digest  Thursday 20 August 1992  Volume 13 : Issue 74

        FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS
   ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

  Contents:
Novell Netware protection? (Fred Cohen)
------------------------------

Date: Wed, 19 Aug 92 8:28:12 EST
From: cohen@fitmail.fit.qut.edu.au (Mr Fred Cohen)
Subject: Novell Netware protection?

I have been doing exhaustive tests on Novell Netware protection, and I cannot
believe these people can sell their product on the basis that it is the most
secure.  If it is, we are in big trouble!!

"Read Only" files are successfully infected by DOS viruses!
"Directory protection" works exactly the opposite of how the manual claims!
                IN 3 DIFFERENT PLACES!!!
Several protection bits work from a MacIntosh, but not from DOS machines!!
        What kind of network protection doesn't work when the user uses a
        different machine to login?!?  Protection based in the user's machine
        and not on the server!!!

A shareware product successfully gathers passwords from the net as they are
        entered by the users!  For $35 I can get every password on your network
        (if I choose to pay the shareware licensing fees to be honest about it)
Passwords can be ANYTHING - including nothing at all!  The supervisor password
        on our network is empty, so anyone on the net can login with no password
        (we are physically isolated - but how about some password controls!)
So-called Execute Only protection does not prevent companion viruses from
        working, and prevents the sys admin from verifying program integrity,
        prevents backup and restore of execute-only files, and thus is a great
        hindrance to protection!

This was the results of the first 2 DAYS of experiments!  If we can find this
many problems in 2 days (while not explicitly trying to look for these kinds of
holes), I can't imagine anyone claiming this system to be the best available
security.  But who knows?  In the next few days we will be looking at Unix
based servers!  FC

------------------------------