[Dshield] How secure IS GoToMyPC?

Richard Ginski rginski at co.pinellas.fl.us
Fri Jun 18 18:02:51 GMT 2004


Technology aside, I am not sure whether this concept has been discussed
or not:
 
We don't use it because we don't practice relying on others (a third
party)  for our security. It makes me nervous thinking about trusting
another org (whomever) to ensure secure access (based on acceptable
risk) to our protected network.

Sometimes exaggeration can make a point: No responsible human connects
to the Internet without some protection. The reason? Because we
don't/can't trust all other users on the Internet to implement safe
computing....regardless of their good intentions. Things can happen.  I
think the same principle applies here. You have to protect what is
within your realm and not rely on others for the protection.

Yes, agreements can be put in place, but of course then you have to
ensure they are adhered to and enforced.

We'd prefer not go there and provide our own solutions to our remote
users's needs....not that they (our solutions) are any better from a
security/technological sense. However, _we_ are responsible and
accountable for them.

>>> dshieldlists at versateam.com 6/18/2004 9:55:15 AM >>>
Stephane Grobety wrote:
> There is a built-in file transfer that takes cut-and-paste of files.
> The clipboard is also accessible, making it another channel to
upload
> malicious code in the remote machine.

My point was that a malicious file uploaded by a clueless user (the
more 
likely event) would have a good chance of being intercepted by AV, not

that a malicious user couldn't do all sorts of things to the machine 
once at the console. On the other hand, it's not physical access, so a

locked down machine would make it harder for a malicious (or clueless)

user to mess up the machine. But we all know how often we see a locked

down machine, let alone one that a creative black hat can't get into.

> typical PC not to require much download. Plus, the attacker already
> has local console access: all he needs is privilege escalation.

Exactly my point. Using GoToMyPc removes a layer or eight of
protection, 
but it's not like opening an otherwise secure machine to the Internet 
completely. For example, a disgruntled employee could do a comparable 
amount of damage sitting in front of the machine as through GoToMyPC. A

socially-engineered employee sitting in front of the machine might be 
coerced into installing a back door or keystroke logger or other 
malware. So a GoToMyPC installation with good password discipline is 
somewhat comparable to some sort of good physical control of employees

coming to work in the building. We all know how often either of those 
happens, plus you never know when the employee who is properly 
identified at the front door (or uses a strong password) is going to do

something clueless or malicious. Having other layers of defense to take

care of those situations is critical, and makes it that much harder for

an unauthorized person to do nasty things through GoToMyPC or some
other 
access method.

So instead of saying "it's a security risk" -- what's NOT a security 
risk? -- I'm suggesting more that we analyze and mitigate as many of
the 
real risks as possible, on the theory that some malicious or clueless 
act done through GoToMyPC is probably using an opening that could be 
exploited through another vector.
_______________________________________________
list mailing list
list at lists.dshield.org 
To change your subscription options (or unsubscribe), see:
http://www.dshield.org/mailman/listinfo/list



More information about the list mailing list