bugtraq - Re: Database servers on XP and the curious flaw

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3da3d8310511161038x200d4d9bod5f2bd24421f8230@mail.gmail.com>
Date: Wed, 16 Nov 2005 13:38:21 -0500
From: Eliah Kagan <degeneracypressure@...il.com>
To: David Litchfield <davidl@...software.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com,
	dbsec@...elists.org
Subject: Re: Database servers on XP and the curious flaw

David Litchfield wrote:
> Hi Eliah,
>
> >David Litchfield wrote:
> >> Hey all,
> >> I've just put up a paper on a curious flaw that appears when running a
>
> >My intent is not to MS-bash here, but perhaps Microsoft is to blame
> >for not educating people about this issue. (If they had, your paper
> >would be superfluous.)
>
> >Usually if millions of users are insecure because they don't know
> >something, someone is to blame.
>
> To be honest I don't think we're talking millions of people. How many people
> at home run a fully fledged RDBMS on their XP systems? Very few I'd guess.
> Besides, Simple File Sharing is documented so MS are educating those willing
> to seek information.
>
> Cheers,
> David
> http://www.databasesecurity.com/
> http://www.ngssoftware.com/

If I use an insecurely configured database for anything critical, I am
insecure. That's everybody at a company that runs such a server and
has it configured insecurely, every customer of the company who has
personal information stored in the server, etc. I think that amounts
to millions.

However, it is true that by saying that, I made the problem look more
widespread than it actually is, which is bad because it dilutes the
power of the term, "millions of users," so that when the next UPnP or
DCOM comes around, it will be more difficult to raise awareness about
it. For this, I apologize.

What I should say is, "usually, if millions of people are at risk of
having their information security compromised because a few people
don't know something they should, someone is to blame."

The fault is certainly distributed, and it's not all on MS's
shoulders. Come to think of it, if I (putting myself in the shoes of a
clueless network administrator) am running a database server with
simple file sharing enabled and not thinking about security, the fault
is probably mine.

But whoever's fault it is, I hope your paper moves people who don't
have their act together, to get it together.

-Eliah
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/