full-disclosure - DCOM Exploit MS03-026 attack vectors

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <00ba01c3585f$81ebaf70$9302a8c0@Constant>
From: jeremiah at nur.net (Jeremiah Cornelius)
Subject: DCOM Exploit MS03-026 attack vectors

    <snip>

> > Because 9 times out of 10 port 135 is blocked by some sort of firewall,
> > whilst port 80 is not blocked on a web server.
>
> Not telecommuters on dial-up IP's and Blue-Toothed into the net thru
> their Ericsson phones, and surfing from the airport and WIFI cafes of the
> world.
    </snip>

Bluetooth phones as modems!  I have been calling on this issue for some
time, and generally received a dismissive response from System
Administrators and IT management.  No one wants the work load or
responsibility this entails.  I suppose that if you don't acknowledge the
problem's existence, you can't be faulted for lack of due care!  If they
keep their heads in the sand long enough, somebody is  going to find out
what Ostrich meat tastes like...

As this technology becomes more prevalent over the next 2 years or so, you
can kiss your idea of perimeter goodbye.  A better argument for 'defence in
depth' and 'crunchy centers' could not be made.  All hosts should be handled
as if they were accessible from untrusted segments - they soon will be, if
they are not already.

This is just the technology we already have on hand.  Remote, mobile, FAST
communications technologies are springing up like weeds.  Bluetooth scanning
is inherently more problematic than looking for a rogue WiFi AP.  The
technology is mobile, VERY short range/low power, and has legitimate
business use on multi-function devices.  You can't expect to wrap your
building in a Faraday cage -  there is no way to gatekeep this.  It will
have to be a condition we adapt ourselves to deal with.  Begin with hardened
hosts.  Even marketroid laptops.  Ultimately, something like mutual host
authentication/authorization is going to be needed everywhere on the
inside - but it's obviously not a cure-all.  If my laptop is a router for my
phone, which is a router for kiddeez...  Kiddee is authed to my server.

It's gonna' be a fun ride, and the best is yet to come!