January 2004 - NANOG - lists.nanog.org

RE: MS is vulnerable
by Gregory Hicks 29 Jan '04

29 Jan '04

(Setting Reply-to: nanog-offtopic(a)lists.blank.org ....) > From: "Matthew Kaufman" <matthew(a)eeph.com> > Date: Thu, 29 Jan 2004 09:31:58 -0800 > > > This MS v Unix debate is a very interesting discussion. > > To some of you. To others of us, it is a long-dead horse. > > > However, I'd like to take a moment to inject my observations. > > I'd like the NANOG list to be restricted to Network Operations > issues, or at the very least, Network Operations plus the politics and > ranting thereof. And this is why we have the nanog offtopic list at nanog-offtopic(a)lists.blank.org >From a previous message In March 2003: > This seems like an apropos point to remind people of the existance of > nanog-offtopic(a)lists.blank.org. All of the friendly bickering with > the people you know and love and/or loathe; 100% less of the > annoying-of-Susan and people-looking-for-operational-content. > > To subscribe, drop a line to nanog-offtopic-subscribe(a)lists.blank.org. Regards, Gregory Hicks ------------------------------------------------------------------- Gregory Hicks | Principal Systems Engineer Cadence Design Systems | Direct: 408.576.3609 555 River Oaks Pkwy M/S 6B1 | Fax: 408.894.3400 San Jose, CA 95134 | Internet: ghicks(a)cadence.com "The trouble with doing anything right the first time is that nobody appreciates how difficult it was." When a team of dedicated individuals makes a commitment to act as one... the sky's the limit. Just because "We've always done it that way" is not necessarily a good reason to continue to do so... Grace Hopper, Rear Admiral, United States Navy

1 0

Re: MS is vulnerable
by Michael.Dillon＠radianz.com 29 Jan '04

29 Jan '04

>Microsoft software is inherently less safe than Linux/*BSD software. >This is because Microsoft has favored usability over security. >This is because the market has responded better to that tradeoff. >This is because your mom doesn't want to have to hire a technical >consultant to manage her IT infrastructure when all she wants to do is get >email pictures of her grandkids. Let me see, have I got this right? Apple software is inherently less safe than Linux/*BSD software. This is because Apple has favored usability over security. This is because the market has responded better to that tradeoff. This is because your mom doesn't want to have to hire a technical consultant to manage her IT infrastructure when all she wants to do is get email pictures of her grandkids. Hmmm... The last three statements make perfect sense but that first one just doesn't seem right. Could it be that ease-of-use has nothing whatsoever to do with security? --Michael Dillon

3 2

Control. (was Re: MS is vulnerable)
by Jamie Reid 29 Jan '04

29 Jan '04

While acknowledging that I am falling for a troll does not excuse the act itself, I would like to float an idea I think is useful. If you look at security as control, then you can measure it as the ratio of controls to features. That is, for N in/egress points there are X active policy enforcement gateways. Similarly, for all functions in a peice of software, there are X configurable controls of their inputs and outputs and en/disabled-state. The reason we have "security" vulnerabilities is that we are building (or evolving) systems that lack adequate controls relative to the sheer volume of their features. While access to source-code does not guarantee that the user will exercise their control over the software, it does provide more granular control than say, a config file, or a clickity-click-configurator. The idea behind commercial software is that it is a service in which responsibility for control is maintained by the vendor, with a few options available to the user to customize. Open source provides total control to the user, limited only by their skills or access to information. Now, whether this control I am talking about is applicable to "security" as we understand it, I will leave that to the reader, but I would speculate that this simile could allow for something like cybernetics to be applied to evaluating the security of complex systems, and possibly offer more practical solutions than the political economy of security that characterizes alot of research in the field. Best, -j -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> <doug(a)nanog.con.com> 01/29/04 09:26am >>> Microsoft software is inherently less safe than Linux/*BSD software. This is because Microsoft has favored usability over security. This is because the market has responded better to that tradeoff. This is because your mom doesn't want to have to hire a technical consultant to manage her IT infrastructure when all she wants to do is get email pictures of her grandkids. doug

1 0

Subject: Re: MS is vulnerable
by J. Oquendo 29 Jan '04

29 Jan '04

>Microsoft software is inherently less safe than Linux/*BSD software. >This is because Microsoft has favored usability over security. >This is because the market has responded better to that tradeoff. >This is because your mom doesn't want to have to hire a technical >consultant to manage her IT infrastructure when all she wants to do is get >email pictures of her grandkids. // /Let me see, have I got this right? /Apple software is inherently less safe than Linux/*BSD software. /This is because Apple has favored usability over security. /This is because the market has responded better to that tradeoff. /This is because your mom doesn't want to have to hire a technical /consultant to manage her IT infrastructure when all she wants to do is get /email pictures of her grandkids. / /Hmmm... / /The last three statements make perfect sense but that first /one just doesn't seem right. Could it be that ease-of-use /has nothing whatsoever to do with security? / /--Michael Dillon What I gathered was TSR80's are making a comback for their ease of use This is because Tandy/Radio Shack is the last bastion of hope This is perhaps because people like that retro feeling This is because your ex girlfriend suggested you buy this (TSR80) so she won't have to hire a technical consultant to have her pictures removed from www.revengeworld.com or www.mobog.com being webcams and TSR's are a no no. J. Oquendo =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ Quis custodiet ipsos custodes? - Juvenal J. Oquendo GPG Key ID 0x51F9D78D Fingerprint 2A48 BA18 1851 4C99 CA22 0619 DB63 F2F7 51F9 D78D http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x51F9D78D sil @ politrix . org http://www.politrix.org sil @ infiltrated . net http://www.infiltrated.net

1 0

RE: in case nobody else noticed it, there was a mail worm released today
by Michel Py 29 Jan '04

29 Jan '04

In-line... > Christopher Bird wrote: > Please pardon my ignorance, but I am > *mightily* confused. >>> Vivien M. wrote: >>> and ISTR one patch for Outlook 2000 that blocked >>> your ability to save executables was released) >> Michel Py wrote: >> It default in Outlook XP and Outlook 2003, which >> has prompted large numbers of persons to download >> Winzip, which as not stopped worms to be >> propagated as you pointed out. > Christopher Bird wrote: > The bit I don't get is how a zip file is created > such that launching it invokes winzip and then > executes the malware. When I open a normal .zip > file, winzip opens a pane that shows me the > contents. After that I can extract a file or I > can "doubleclick" on a file to open it - which if > it is executable will cause it to execute. I > haven't seen a case where simply opening a zip > archive causes execution of something in its > contents unless it is a self extracting archive > in which case it unzips and executes, but doesn't > have the .zip suffix. The point is, if the user opens the zip file in the first place, and if the file name it contains does not look suspicious, the user _will_ also double-click on the file within the winzip window, which extracts the file in a temp folder _and_ executes it. > Sam Stickland wrote: > I don't think that was the point Michael was trying to > make. I believe he meant that MS stopped the ability to > _even_ save executables attached to emails to disk in > some forms of Outlook, Yes. If you send me an .exe file, I can _not_ save it nor execute it. Outlook deletes the attachment, and now Exchange 2003 deletes it on the server as well before it even has a chance to get to Outlook. > but this did nothing to stop the spread of viruses. > People simply sent executables as zipped files, which > people then had to extract to run. Dispite the fact > that an external program has to be used to get to to > the executable, people still run them. Exactly. Actually, there are faster ways to send executable files without zipping them: rename the file as .txt, and put a little note in the email saying that the .txt file is in reality an .exe and must be renamed. Don't even need Winzip. Voila. This latest worm is all about social engineering; remember: some users still fall for the hoaxes that claim Norton or McAffee does not detect a virus and instructs to delete a system file. Gee, some even fall for that herbal stuff that promises to put a foot in their pants. Given the number of people that have fallen for the "Microsoft update" and the "7-bit ascii" we are seing these days, they would rename the file and run it if they believe they have to do it. Three years ago, I opened an .exe that contained a virus. At lunch with my colleagues, we discussed the Florida ballots. In the evening, I receive an email from one of my co-workers whose subject was "Florida ballots" containing an .exe file; given that the "saddam.exe" he sent before was rather entertaining, I executed it. The anti-virus signature was not available yet, busted. Social engineering it is. The bottom line is this: no matter what safeguards you put in the system, and no matter how many times you instruct users to be careful opening attachments, the one and only thing that make users think is when they open a worm and get screwed/lose data/look stupid. Michel.

1 0

RE: Don't Panic II (Re: updated root hints file)
by McBurnett, Jim 29 Jan '04

29 Jan '04

I wonder if Someone from Microsoft is here and will add this to an update for the Active Directory DNS that will most likely be the user of the old addresses in 5 years..... FROM: Bill >I wonder how many systems will _still_ be trying to get to b.root-servers.net >at the old address in 5 or even 10 years.

1 0

Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 29 Jan '04

29 Jan '04

>>> >>> >>> >>> : They rate of it is quite surprising. By the description, the trick >>> / >>> : method of infection does not seem all that different than past worms >>> : viri. Makes me wonder how many people in a room would reach into >>their >>> : purse/pocket on hearing, "Wallet inspector" >>> >>> >>> Every single person that still opens these damn attachments! :-( >IN WINDOWS! So? Had the virii been an application compiled for RedHat and everyone ran RedHat instead of Windows and they downloaded it using Evolution and double clicked on it, it would suddenly be RH's fault instead of MIcrosoft's? Or is it sendmail's fault because it was listening on port 25 and allowed the worm to connect to it? Newsflash: Even those using Netscape Mail, Lotus Notes, etc. on the PC were still potentially infected due to the nesting of the virii. The worm was not spread through any vulnerability in the operating system, unlike NIMDA/SQLSlammer/etc. This worm was propogated through pure user stupidity, and that'll follow any operating system that Dell/Gateway pre-installs for them. If everyone wants to flame MS, at least do it in a way that doesn't show your own ignorance. -Dave

12 12

RE: in case nobody else noticed it, there was a mail worm released today
by Michel Py 29 Jan '04

29 Jan '04

> Vivien M. wrote: > Someone made the argument to me privately that the > problem is that MS lets you run attachments from > Outlook, while other clients would require you to > save the files to disk. That's not a solution: if > these people are like my parents used to be, they'd > dutifully save the attachment, open up a file > manager, and open it up to see the "cool new > screensaver" their best friend sent them ("hey, > even if it's a virus, I have an antivirus" is the > usual excuse). Sure, that's three steps instead of > one, but for as long as the HUMAN behind the > keyboard wants to open the attachments, whether it > takes two clicks or fifty keystrokes, that >attachment will get open. Indeed. I remember the good old days when I was working with an OS called Flex, which was designed mainly for S-100 machines running the 6809 processor (ISTR that it was a competitor to something called OS/9). Anyway, when one wanted to delete a file or do something like that, it asked "are you sure" and your had to type "y" and then it asked "are you really sure" and you had to type "y" again. After a while our brains rewired our fingers so whenever the "y" key was required it was hit twice in a row, which eventually led to new words (spell check was unknown at the time) such as yyankee, honeyy, new-yyorker, and so on. We ended up hacking the kernel so it did not ask twice.... > and ISTR one patch for Outlook 2000 that blocked > your ability to save executables was released) It default in Outlook XP and Outlook 2003, which has prompted large numbers of persons to download Winzip, which as not stopped worms to be propagated as you pointed out. Michel.

3 2

Re: Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 29 Jan '04

29 Jan '04

> > > -----Original Message----- > From: owner-nanog(a)merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of > james > Sent: Wednesday, January 28, 2004 4:02 PM > To: nanog(a)merit.edu > Subject: Re: Misplaced flamewar... WAS: RE: in case nobody else noticed > it, there was a mail worm released today > > > > : What's that got to do with today? > > > I might be reaching here, but I understand some people never upgrade or > patch. True, but that happens regardless of the OS. I'm sure if we looked really hard we could find some ancient versions of bind & or sendmail (complete with open relays (speak of old bad defaults...)

1 0

Re: Misplaced flamewar... WAS: RE: in case nobody else noticed it, there was a mail worm released today
by Dave Temkin 28 Jan '04

28 Jan '04

>>: Also, for reference to other people - the preview pane does *not* >>allow >>: the execution of attachments unless they're double-clicked on and >>: acknowledged. Again - we're not talking about another OS or Outlook >>: exploit, only a stupid user exploit. >The "feature" has been fixed but it **did** at one point run apps. >James Edwards >Routing and Security Administrator >jamesh(a)cybermesa.com >At the Santa Fe Office: Internet at Cyber Mesa >Store hours: 9-6 Monday through Friday >505-988-9200 SIP:1(747)669-1965 Right, and at multiple points bind and sendmail allowed the execution of code from remote systems without the system owner interacting at all. What's that got to do with today? -- David Temkin

2 1