full-disclosure - DCOM RPC exploit (dcom.c)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: pauls at utdallas.edu (Schmehl, Paul L)
Subject: DCOM RPC exploit  (dcom.c)

> -----Original Message-----
> From: Nick FitzGerald [mailto:nick@...us-l.demon.co.uk] 
> Sent: Tuesday, July 29, 2003 9:01 AM
> To: full-disclosure@...ts.netsys.com
> Subject: RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)
> 
> > ...  I'd be surprised if any
> > organisation exists (outside of the military) that insists 
> on knowing 
> > the MAC addresses of machines before they get connected to the 
> > network. (In our case we monitor MAC addresses instead as 
> we can then 
> > spot network problems).
> 
> Bzzzzt -- wrong.
> 
> Some small, medium and large corporates do this.  Some .edus even do 
> it.

Actually, we do it at UTD and have for some time now.  (See, I told you
I wasn't talking about myself.)  You could hard code an IP on your box
and get Internet connectivity, but you couldn't connect to any UTD
services.  And when you got caught, you'd lose your network privileges
until the hearing, and then you *might* lose your job as well.  We
*routinely* remove network access for boxes that are unpatched or
infected with viruses or worms.

We were also one of the first edus to implement extension blocking, and
I can't even print some of the things that were said to me about that.
Suffice it to say that "idiot" was one of the nicer words used.  Of
course, everybody's doing it now......

Nick, while I agree with you that we (IT) have to be at the forefront of
forging change (and trust me, I fight these battles daily and refuse to
back down), I also think there's needs to be more tolerance in "the
security community" toward the people that are in the field, doing the
work.  Many would like to do better, but their hands are tied by
unenlightened upper management.  You have to learn how to play the
politics to your advantage to win the battles.  If I approached folks
here the way some in this list approach others on the list, I not only
wouldn't have made the progress that I've made, I'd be unemployed as
well.

(And to answer a question asked in a different thread, no, I'm not an
admin, not in the sense that was probably meant.  I admin some security
machines and maintain things like the IDSes, AV infrastructure, etc.,
but I'm not an admin by job title.)

Paul Schmehl (pauls@...allas.edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/