Newsgroups: bit.listserv.novell
Date:         Wed, 30 Sep 1992 09:15:00 LCL
Reply-To:     Novell LAN Interest Group <NOVELL@SUVM.BITNET>
From:         "(DKEARNS)" <DKEARNS.TCC@KLAVEN.TCI.COM>
Subject:      FWD: Posting of NetWare security hacks.

Mark Medici writes:

> As I've written in previous messages, it is clearly necessary that
> bona-fide NetWare administrators have access to the same tools as
> hackers do to determine the security of the LAN.
No, we don't need copies of the software, simply an indications of the form
that the hack takes.

> Even if Novell was able to notify
> 100% of its customers of the vulnerabilities, and provide fixes that
> totally resolved the problem, this is no guarantee that individual
> NetWare system administrators would implement the solutions.

You can't protect people from themselves! If people choose to be ignorant,
its a choice you have to allow them to make. That's why there are security
auditors.

> The only effective way to audit the security of NetWare servers is for
> a trusted person (or group of persons) to have the tools available to
> hackers.  In this way, the auditor, security officer, or primary
> NetWare LAN administrator can use the tools from a central and
> convenient location to confirm that all known security vulnerabilities
> are resolved on all servers.

Stretching this analogy, is the "only effective way" to test the new trauma
center to beat up some people and see if it can handle their problems? A
person knowledgeable in NetWare security could spend a day examining your
system and tell you if it was secure or not without having to run hackers
tools.

> It seems that many people who read these forums are opposed to posting
> of hacking programs.  I can see the point of their arguments.  While I
> am not adamently against this policy, I also am concerned at the
> damage that can result due to the lag time between the posting of the
> hacking program and the availability and implementation of effective
> counter-measures.
Exactly!  You can't allow free distribution of the hack until you
understand the steps needed to combat it.

> Further, with Novell
> as the distributor, it could impose reasonable restrictions on the
> availability, such as requiring the sysadmin be a CNA or CNE.

Sorry, but there's nothing sacrosanct abount CN? status. It means you can
read books and take tests. That's all.
There is no ethics requirement.

> Finally, Novell could require the signing of a non-disclosure
> agreement to help stay-off any secondary distribution from this
> service.
"non-disclosure" agreements are the laughing stock of the industry. They
mean nothing.

> What I believe is called for at this time is:
>
>    1.)	Some indication from Novell of its opinion on this topic,
> 	including whether it sees any possibility of providing such
> 	a service;
>
>    2.)	A reasonable and intelligent discussion between the partic-
>         ipants of these forums (UseNet's comp.sys.novell and Syracuse
>         University's NOVELL listserver list) of the value of such a
> 	service, and alternatives if Novell is unwilling or unable to
> 	provide the same.
>

I believe this list has already taken the right approach. No posting of
hacks, but a free discussion of them, their methods and the safeguards
needed.

-dave

+--------------------------------------------------------------+
| Dave Kearns                 |                                |
| Director, Info Services     | dkearns@klaven.tci.com         |
| Thomas-Conrad Corp.         | dkearns@tcc [MHS via NHUB]     |
| 1908-R Kramer Lane          | dkearns@tcc [MHS via CSERVE]   |
| Austin, TX 78758            | 76704,62 [CompuServe]          |
| (512) 836-1935              |                                |
|"There is nothing so inefficient as doing efficiently that    |
| which shouldn't be done at all."                             |
+--------------------------------------------------------------+
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU