full-disclosure - M$ - so what should they do?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200406220817.12643.dhill+fulldisc@cricalix.net>
From: dhill+fulldisc at cricalix.net (Duncan Hill)
Subject: M$ - so what should they do?

On Tuesday 22 June 2004 07:31, Aditya, ALD [ Aditya Lalit Deshmukh ] might 
have typed:

> CON and NULL should stay but COM, AUX and LPT should go away. i had a
> server in which the script kiddes got into the ftp server and made a COM1
> folder on ntfs. had been a pain in neck to rename that folder - had to use
> linux with ntfs support!

If memory serves, 2K+ has a POSIX toolset that lets you remove those 
privileged files.  I know I tested it once, just to make sure it would work 
(though the server never got compromised).  I don't think NT4 did though.