RE: DCOM RPC exploit (dcom.c)

["Schmehl, Paul L" <pauls () utdallas edu>]

> -----Original Message-----
> From: Nick FitzGerald [mailto:nick () virus-l demon co uk] 
> Sent: Tuesday, July 29, 2003 9:01 AM
> To: full-disclosure () lists netsys com
> Subject: RE: [Full-disclosure] DCOM RPC exploit (dcom.c)
>
> > ...  I'd be surprised if any
> > organisation exists (outside of the military) that insists 
> on knowing 
> > the MAC addresses of machines before they get connected to the 
> > network. (In our case we monitor MAC addresses instead as 
> we can then 
> > spot network problems).
>
> Bzzzzt -- wrong.
>
> Some small, medium and large corporates do this.  Some .edus even do 
> it.

Actually, we do it at UTD and have for some time now.  (See, I told you
I wasn't talking about myself.)  You could hard code an IP on your box
and get Internet connectivity, but you couldn't connect to any UTD
services.  And when you got caught, you'd lose your network privileges
until the hearing, and then you *might* lose your job as well.  We
*routinely* remove network access for boxes that are unpatched or
infected with viruses or worms.

We were also one of the first edus to implement extension blocking, and
I can't even print some of the things that were said to me about that.
Suffice it to say that "idiot" was one of the nicer words used.  Of
course, everybody's doing it now......

Nick, while I agree with you that we (IT) have to be at the forefront of
forging change (and trust me, I fight these battles daily and refuse to
back down), I also think there's needs to be more tolerance in "the
security community" toward the people that are in the field, doing the
work.  Many would like to do better, but their hands are tied by
unenlightened upper management.  You have to learn how to play the
politics to your advantage to win the battles.  If I approached folks
here the way some in this list approach others on the list, I not only
wouldn't have made the progress that I've made, I'd be unemployed as
well.

(And to answer a question asked in a different thread, no, I'm not an
admin, not in the sense that was probably meant.  I admin some security
machines and maintain things like the IDSes, AV infrastructure, etc.,
but I'm not an admin by job title.)

Paul Schmehl (pauls () utdallas edu)
Adjunct Information Security Officer
The University of Texas at Dallas
AVIEN Founding Member
http://www.utdallas.edu/~pauls/ 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html