Microsoft does it again

[mattg at timesucker.ne.client2.attbi.com (Matt Galster)]

It would be a powerfully damning argument if he had used one of the many MS windows to prove his point rather than a third party app.

MEG

Ben Jackson:
> 
> Techincally, if I read it right, it is not Microsoft's fault completely.
> MSFT is definitely at fault for providing a easy conduit for this to
> happen, but isn't the problem with the AV scanner he is telling to run his
> code? All he is doing is feeding some shellcode to a program that is
> running as "root". Running a program with a privliged account that is
> directly accessible to the user like that is bad. 
> 
> (For example, Norton Corp Ed. has a engine running as LocalSystem, but the
> UI is running as the account logged in, IIRC)
> 
> 						~Ben
> 
> --
> /"\	Ben Jackson
> \ /     bejackso at lynx.dac.neu.edu - http://piro.dnsq.org/~bbj
>  X      Member of the ASCII Ribbon Campaign Against HTML Mail
> / \
> 
> 
> 
> On Tue, 6 Aug 2002, Bill Bogstad wrote:
> 
> > 
> > Derek Kramer wrote:
> > On Tue, 6 Aug 2002, Derek D. Martin wrote:
> > >
> > >> If you're relying on Windows privileges to secure your network, you're
> > >> basically screwed.  A whitepater was released today detailing how to
> > >> gain localsystem privileges on any Win32-based platform.  And the
> > >> kicker is, because it takes advantage of a fundamental flaw in the
> > >> design of Windows, it's basically unpatchable, requiring a complete
> > >> overhaul of the Windows messaging system to fix.
> > >> 
> > >> And the best part is, if you're providing terminal services via a
> > >> Citrix server, anyone can own your server, and you'll never be able to
> > >> stop them...
> > >> 
> > >>   http://security.tombom.co.uk/shatter.html
> > >
> > >I read this in detail, and I hate to admit that I agree with Microsoft.   
> > >Once bad people are sitting logged onto your machine, you should already 
> > >considered it compromised, regardless of what techniques the bad person 
> > >has at their disposal.
> > 
> > So a command line overflow exploit in a setuid-root ps binary on a
> > UNIX machine is unimportant because you shouldn't ever let 'bad
> > people' have a login on your machine?  I thought security was about
> > being able to limit the resources that a user could access on a
> > machine even when they had some level of legal access.  You seem to be
> > advocating a security model of 'good' and 'bad' users where 'good
> > users' can do anything and 'bad users' can do nothing.  Maybe you
> > missed the part where this worked via terminal services as well.  You
> > don't need physical access, apparently you only need the equivalent of
> > a UNIX login.  I believe that any operating system vendor who claims
> > that something isn't a security issue because you have to have some
> > level of valid access to exploit it should be condemmed. PERIOD.
> > 
> > 				Bill Bogstad
> > 				bogstad at pobox.com
> > 
> > _______________________________________________
> > Discuss mailing list
> > Discuss at blu.org
> > http://www.blu.org/mailman/listinfo/discuss
> > 
> 
> 
> _______________________________________________
> Discuss mailing list
> Discuss at blu.org
> http://www.blu.org/mailman/listinfo/discuss
>