With Friends Like These...
March 8, 1999
Other articles
by Art Wittmann
|
E-Commerce: Where To Start?,
December 15, 1998
You've Got Mail, Geek,
January 11, 1999
Is 'Network Management' an Oxymoron?,
January 25, 1999
Yo, Server Market! Here Comes Intel,
February 8, 1999
Intel's Adventures in Serial Numbering,
February 22, 1999
|
|
Other Columnists
|
Business to Business
By Brian Walsh
Top of the Stack
By David Willis
|
|
Company Directory
|
|
Browse our directory to get data, starting with a particular company.
|
|
Reader Service
|
|
Allows you to request additional product information from our advertisers.
|
|
Print The Full Article
|
Click Here
|
|
E-mail this URL
|
Click Here
|
|
Buy the Book
|
|
|
By Art Wittmann
A couple of freelance writers are working on a story for us about security auditing and protection. As part of their "research," they decided to see if they could hack into one of our lab networks. It took them only a few hours to successfully break into our Windows NT boxes. And from there, they learned the configuration of our lab networks, the server names and functions, the operating systems we run and most of the passwords on the key accounts on our Microsoft Windows NT, Novell NetWare and Unix servers, as well as a good many of our routers and switches.
 Our lab is not run as a mission-critical production network--it isn't meant to be particularly secure. But we do stay up to date on most service packs and patches for the major operating systems. So, unless you've taken a very active stance on security for your network, you should be worried.
Reusing Passwords? The hacking expertise of these guys is by no means unique. Plenty of people out there can do what they did, and some can do it better. While NT has its fair share of vulnerabilities out of the box, there is a LAN Manager issue that blows the doors wide open. In summary: NT stores password hashes in a format that is hard to crack by brute-force methods, and that's a good thing. However, Microsoft has chosen to maintain compatibility with LAN Manager's password store, and therefore keeps a second hash of passwords. This table isn't so secure. In fact, brute-force methods usually can come up with a few passwords in short order.
Within two hours, our hackers had obtained 5,000 of our 5,045 passwords by brute-forcing them. A few days and millions of keystrokes later, using those same passwords, they owned the entire network. So, do you use the same passwords across all platforms?
The problem is exacerbated for smaller shops where a single crew administers NT, NetWare, Unix and other systems because they tend to use the same administrator password for all systems under the group's management. For very obvious reasons, that's a bad idea. Our lab was no exception, and our hackers quickly infiltrated our NetWare and Unix servers, as well as our Cisco routers.
Instructions for cleaning up this hole in NT are provided in the Microsoft Knowledge Base article Q147706. However, doing so may break applications that still use the LAN Manager hash table. In particular, if you're still using DOS or Windows 3.1, problems are likely. And if you're running OS/2 LAN Manager, implementing Microsoft's fix will break compatibility.
From what I've read about this security hole in the writings from the hacker community, Service Pack 3 contains a number of security fixes that make it harder to crack passwords. These should be implemented, but regardless, LANMan compatibility needs to be disabled if you want your NT server to be secure.
Expect Little Help From Microsoft Of course, Microsoft doesn't promote the fact that a security hole exists or that it can be patched. If you're clever enough to know about it and to ask the right questions, the company will provide a fix. In my opinion, that's something akin to Ford putting a sticky note on the bulletin board outside the CEO's office about a little Pinto gas-tank problem and then claiming that the hazard was adequately publicized.
Finally, you'd think that Windows 2000 would be the perfect place for Microsoft to rid itself of this problem, wouldn't you? Well, just like me, you'd be wrong. It turns out that Microsoft is committed to maintaining LANMan compatibility in Windows 2000 out of the box.
The moral of the story is clear: The onus is on you to protect the integrity of your systems; Microsoft is not going to go out of its way to help you. You must dedicate staff to following the security advisories about all your operating systems--simply looking at the vendor's home pages is not enough. A good many of the hackers out there publicize the security holes they know about. It's my advice that you heed them well.
Send your comments on this column to Art Wittmann at awittmann@nwc.com.
|
REPORTS
ANALYTICS
Follow 
