Re: DCOM Exploit MS03-026 attack vectors

["Jeremiah Cornelius" <jeremiah () nur net>]

    <snip>

> > Because 9 times out of 10 port 135 is blocked by some sort of firewall,
> > whilst port 80 is not blocked on a web server.
>
> Not telecommuters on dial-up IP's and Blue-Toothed into the net thru
> their Ericsson phones, and surfing from the airport and WIFI cafes of the
> world.
    </snip>

Bluetooth phones as modems!  I have been calling on this issue for some
time, and generally received a dismissive response from System
Administrators and IT management.  No one wants the work load or
responsibility this entails.  I suppose that if you don't acknowledge the
problem's existence, you can't be faulted for lack of due care!  If they
keep their heads in the sand long enough, somebody is  going to find out
what Ostrich meat tastes like...

As this technology becomes more prevalent over the next 2 years or so, you
can kiss your idea of perimeter goodbye.  A better argument for 'defence in
depth' and 'crunchy centers' could not be made.  All hosts should be handled
as if they were accessible from untrusted segments - they soon will be, if
they are not already.

This is just the technology we already have on hand.  Remote, mobile, FAST
communications technologies are springing up like weeds.  Bluetooth scanning
is inherently more problematic than looking for a rogue WiFi AP.  The
technology is mobile, VERY short range/low power, and has legitimate
business use on multi-function devices.  You can't expect to wrap your
building in a Faraday cage -  there is no way to gatekeep this.  It will
have to be a condition we adapt ourselves to deal with.  Begin with hardened
hosts.  Even marketroid laptops.  Ultimately, something like mutual host
authentication/authorization is going to be needed everywhere on the
inside - but it's obviously not a cure-all.  If my laptop is a router for my
phone, which is a router for kiddeez...  Kiddee is authed to my server.

It's gonna' be a fun ride, and the best is yet to come!

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html