Newsgroup: it.comp.sicurezza.unix
Titolo: ecco il megabug di NT, c'era da aspettarselo

 
Major Security Hole Discovered in Microsoft's Windows NT Operating System;
CMP's EE Times Exclusive Report Details Microsoft's Latest Woe
   Source: PR Newswire
 
   MANHASSET, N.Y., March 31 /PRNewswire/ via Individual Inc. -- A major
   security flaw has been uncovered in Microsoft Corp.'s (Nasdaq: MSFT)
   flagship network operating system, Windows NT, that could enable a
   user dialing in from a remote location to unscramble encrypted
   information -- including a corporate network's entire registry of user
   passwords -- and display it as plain text, according to an exclusive
   report posted on EE Times Online (
http://www.eet.com
).
 
   The discovery is especially troublesome for the Redmond, Wash.
   software giant because it has tried to position NT as more secure
   network server than alternatives such as Unix.
 
   According to EE Times, a pair of professional security technologists
   wrote the code for the "hack" that found the flaw. The code has been
   verified by several experts and is making the rounds on the Internet
   via an mailing list frequented by skilled hackers with an interest in
   NT-security issues.
 
   The potentially password-cracking code is the third major security
   flaw found in NT in as many months and follows recent revelations of
   security holes in Microsoft's Internet Explorer Web browser. The
   software giant's security technology has come under closer scrutiny by
   the hacking community as NT and Internet Explorer have found broader
   market acceptance.
 
   Mike Nash, Microsoft's Director of Marketing for NT Server,
   acknowledged the security flaw to EE Times without elaborating on a
   possible fix.
 
   "It's good that people are testing our products and the best thing we
   can do is increase the awareness about security to our customers," he
   said. Though presented in the mailing list as a "utility tool" for NT
   systems administrators, the latest hack is capable of much more.
 
   "It's a double-edged sword," Jeremy Allison, principal author of the
   hack's code. "This is a useful utility for migrating users to Unix
   systems from Windows NT, but it can also enable people to see all the
   actual passwords, which until now wasn't possible."
 
   Microsoft's Nash admitted to some of that. "In this case, it is
   possible to break into the system and decrypt passwords," he said.
   "But it requires that you have administrative privilege."
 
   Not so according to Yobie Benjamin, Senior Consulting Architect for
   Emerging Technologies at Cambridge Technology Partners and co-author
   of the code. "All that's missing is intent. If somebody wanted to
   crack an NT server today, for malicious purposes or financial gain,
   the pieces of the puzzle are now all there."
 
   "NT is not as safe as it had been, because of this hack," concluded
   Chris Goggans, Senior Networking Security Engineer at Wheelgroup Inc.
 
   EE Times, published by CMP Media Inc., covers the high tech OEM
   industry. The well-respected weekly delivers news of both business and
   technology to engineers and technical/corporate managers at
   electronics and computer systems manufacturers in the United States.
 
   CMP Media Inc. provides publishing, marketing and information services
   to the broad high-technology spectrum -- the builders, sellers and
   users of technology -- through print and electronic media. All of
   CMP's publications and online products can be accessed through the
   company's TechWeb(R) site on the World Wide Web
   (
http://www.techweb.com
). Print titles include Computer Reseller News,
   InformationWeek and WINDOWS Magazine.
 
   SOURCE CMP Media Inc.
 
   /CONTACT: Steve Rubel of CMP Corporate Communications, 
516-562-7434
 or
   sru...@cmp.com./ (MSFT)
 
   [03-31-97 at 12:30 EST, PR Newswire]
-- 
______________________________________________________________________________
Piero Orsoni:   
ors...@programmers.net
       Unipd: 
pal...@chiara.dei.unipd.it
Linux: 
www.dei.unipd.it/it/linux/pluto
       Magazine:  
www.infomedia.it/login

 wrote:
 >     Major Security Hole Discovered in Microsoft's Windows NT
 > Operating System; CMP's EE Times Exclusive Report Details Microsoft's
 > Latest Woe 
Che pena...... :-)
-- 
Ciao. Pierluigi (mithr...@Lothlorien.it).
|-> e-mail: 
pde...@mbox.vol.it
 / 
pierluig...@giuda.deis.unical.it
 <-|