[Dshield] He thinks he is bulletproof, is he?

Kenneth Coney superc at visuallink.com
Sat Dec 6 19:31:26 GMT 2003


Data encryption/decryption routines, RF transmissions from his keyboard and
PC and fluctuations in his line voltages (i.e., TEMPEST issues), the
background and intentions of the janitor at the local ISP or telephone
switching center, etc. are issues beyond the scope of my query.  It's a
standalone PC (no LAN involved) in a home with decent security so someone
walking in (barring a home invasion or a burglary) and reading the hard
drive isn't an issue for discussion.  Often homes are way more secure than
business locations anyway as access can (with the right homeowner) be way
more controlled.  None of the usual factors (i.e., children, trusted
visitors, etc.) are an issue.  The issue is simply, how safe is his set up
regarding internet surfing?  Is it so safe that others should switch to it,
or are there known vulnerabilities.  Is his DOS browser immune to the RPC
vulnerabilities?  Is there a way of reaching his PC through the connection
with a worm or other malware if he doesn't download strange programs and
his disks are clean?  Does a computer with a DOS browser connection even
have ports (I would tend to think so, if only as a way of handling internal
instruction) or is that strictly a Windows problem?  If he still has ports
when using TCP/IP in a DOS environment with no firewall what is known about
the port vulnerabilities in a DOS environment?
__________________________________________
Subject: RE: [Dshield] He thinks he is bulletproof, is he?
From: "Tom Geairn" <tgeairn at newviewconsulting.com>
Date: Fri, 5 Dec 2003 09:38:24 -0600
To: "General DShield Discussion List" <list at dshield.org>

What about physical security?  Can I walk in and access his computer
without even basic username/password protection?  How is the data stored
on his system?  Secure? Encrypted? Even rudimentary auditing?  I'm
guessing none of these.  Can I pull his FAT formatted hard drive, copy
everything off, and access it all without even the difficulty of ACL
type protection?

What about 'net encryption on the LAN?  My "high security" clients use
IpSec between clients and the print servers to avoid packet inspection
of print jobs...  Does he have a DOS print redirector that supports
this?

Is there any type of security for the proprietary information contained
in the emails or is this user adding yet another opportunity to capture
the text enroute?  I read your/his comments regarding using SSH to
access Pine for mail, but what security exists on the *nix system where
the mail is stored?

Let's face it- even if his system were 100% immune regarding malware
(which it is not, given that DOS was and is not), by not
accessing/storing/using the proprietary information in a standardized
way that IT can predict and secure, this user is compromising the
security of the information.

Lastly, I've noted the comments of several others saying that this user
is a good candidate for Linux.  Why?  What does that add to the picture?
Even if Linux were as static in its development as DOS is now, there
would still be a period of several years where new holes and exploits
would be discovered.  Add to that the fact that other users of this
information are using Windows and now you are forcing IT to manage
security for multiple platforms again (and (g)od knows they have a full
time job just keeping one platform secure!).

-Tom Geairn
NewView Consulting, LLC









More information about the list mailing list