Full Disclosure mailing list archives
RE: DCOM RPC exploit (dcom.c)
From: "Schmehl, Paul L" <pauls () utdallas edu>
Date: Tue, 29 Jul 2003 10:33:47 -0500
-----Original Message----- From: Nick FitzGerald [mailto:nick () virus-l demon co uk] Sent: Tuesday, July 29, 2003 9:01 AM To: full-disclosure () lists netsys com Subject: RE: [Full-disclosure] DCOM RPC exploit (dcom.c)... I'd be surprised if any organisation exists (outside of the military) that insistson knowingthe MAC addresses of machines before they get connected to the network. (In our case we monitor MAC addresses instead aswe can thenspot network problems).Bzzzzt -- wrong. Some small, medium and large corporates do this. Some .edus even do it.
Actually, we do it at UTD and have for some time now. (See, I told you I wasn't talking about myself.) You could hard code an IP on your box and get Internet connectivity, but you couldn't connect to any UTD services. And when you got caught, you'd lose your network privileges until the hearing, and then you *might* lose your job as well. We *routinely* remove network access for boxes that are unpatched or infected with viruses or worms. We were also one of the first edus to implement extension blocking, and I can't even print some of the things that were said to me about that. Suffice it to say that "idiot" was one of the nicer words used. Of course, everybody's doing it now...... Nick, while I agree with you that we (IT) have to be at the forefront of forging change (and trust me, I fight these battles daily and refuse to back down), I also think there's needs to be more tolerance in "the security community" toward the people that are in the field, doing the work. Many would like to do better, but their hands are tied by unenlightened upper management. You have to learn how to play the politics to your advantage to win the battles. If I approached folks here the way some in this list approach others on the list, I not only wouldn't have made the progress that I've made, I'd be unemployed as well. (And to answer a question asked in a different thread, no, I'm not an admin, not in the sense that was probably meant. I admin some security machines and maintain things like the IDSes, AV infrastructure, etc., but I'm not an admin by job title.) Paul Schmehl (pauls () utdallas edu) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- RE: DCOM RPC exploit (dcom.c), (continued)
- RE: DCOM RPC exploit (dcom.c) Ron DuFresne (Jul 28)
- RE: DCOM RPC exploit (dcom.c) Admin GSecur (Jul 28)
- RE: DCOM RPC exploit (dcom.c) Nick FitzGerald (Jul 28)
- RE: DCOM RPC exploit (dcom.c) Thiago Campos (Jul 28)
- RE: DCOM RPC exploit (dcom.c) John . Airey (Jul 29)
- RE: DCOM RPC exploit (dcom.c) Nick FitzGerald (Jul 29)
- RE: DCOM RPC exploit (dcom.c) Schmehl, Paul L (Jul 29)
- Re: DCOM RPC exploit (dcom.c) Robert Banniza (Jul 29)
- Re: DCOM RPC exploit (dcom.c) Preston Newton (Jul 30)
- RE: DCOM RPC exploit (dcom.c) Ron DuFresne (Jul 29)
- Re: DCOM RPC exploit (dcom.c) Robert Banniza (Jul 29)
- RE: DCOM RPC exploit (dcom.c) Schmehl, Paul L (Jul 29)
- Re: DCOM RPC exploit (dcom.c) Kain (Jul 29)
- RE: DCOM RPC exploit (dcom.c) Myers, Marvin (Jul 29)
- RE: DCOM RPC exploit (dcom.c) Schmehl, Paul L (Jul 29)
- SV: DCOM RPC exploit (dcom.c) Peter Kruse (Jul 29)
- Re: DCOM RPC exploit (dcom.c) Knud Erik Højgaard (Jul 29)
- RE: DCOM RPC exploit (dcom.c) Andy Wood (Jul 29)
- RE: DCOM RPC exploit (dcom.c) Tom H (Jul 29)
- DCOM RPC - DEVESTATING IN SCOPE morning_wood (Jul 30)
- RE: DCOM RPC exploit (dcom.c) Mortis (Jul 30)
- SV: DCOM RPC exploit (dcom.c) Peter Kruse (Jul 29)