RE: Messenger service abuse (from inside the network)

["Camp, Mr Tony J." <camptj () centcom mil>]

For this to be effective, the box will need to be physically secured as
well.  Disable CD booting in the BIOS, password protect the BIOS, and put a
padlock on the case (to prevent BIOS reset by jumper).  Otherwise they could
just boot to a certain cd, blank the local admin password, and reset the ACL
on the net command.

-----Original Message-----
From: Shawn Jackson [mailto:sjackson () horizonusa com] 
Sent: Wednesday, December 03, 2003 7:48 PM
To: Alexander Lukyanenko; security-basics () securityfocus com
Subject: RE: Messenger service abuse (from inside the network)



        One account for all those students...*wimper*. You just angered the
Audit gods! I assume they are using the net command for it:

        net SEND /DOMAIN:YOURDOMAIN I-Hax0r-U

        Just ACL the net command to SYSTEM, DOMAIN ADMINS, etc. Make sure
you got everything locked down on the system (gpedit.msc). Also make sure
they aren't installing any software for messenger spamming.

Shawn Jackson
Systems Administrator
Horizon USA
1190 Trademark Dr #107
Reno NV 89521
www.horizonusa.com
 
Email: sjackson () horizonusa com
Phone: (775) 858-2338
       (800) 325-1199 x338

-----Original Message-----
From: Alexander Lukyanenko [mailto:sashman () ua fm] 
Sent: Wednesday, December 03, 2003 11:58 AM
To: security-basics () securityfocus com
Subject: Messenger service abuse (from inside the network)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello list.
I administer a high school network running W2K Pro in an Active Directory
domain.

The problem is that the users abuse the Messenger service by sending some
mischief over the network (furthermore, they even write batch files that
repeatedly flood the domain with same text). Is there a way to prevent this,
except by changing net.exe's ACL on all machines (or beating the offenders
after classes :)? Stopping Messenger service on the workstations is not a
solution, as it is used for sending various administrative messages. All
students share a common AD account (it would be cumbersome to maintain 300+
user accounts, as most of them use the PCs for short periods only).

Best regards
* * * * * * * * * * * * * * *
* Alexander V. Lukyanenko   *
* ma1lt0: sashman ua fm     *
* ICQ#  : 86195208          *
* Phone : +380 44 458 07 23 *
* OpenPGP key ID: 75EC057C  *
* NIC   : SASH4-UANIC       *
* * * * * * * * * * * * * * *
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (MingW32)

iD8DBQE/zkBXlz+8e3XsBXwRAi/VAKCTyRlRA4iAQY6Opbk0w1jYypvYNACdFaUR
kUWN82Zu6d+xu0bMpfQ2GlM=
=cpq+
-----END PGP SIGNATURE-----


------------------------------------------------------------------------
---
------------------------------------------------------------------------
----


---------------------------------------------------------------------------
----------------------------------------------------------------------------

---------------------------------------------------------------------------
----------------------------------------------------------------------------