Re: Support the Sasser-author fund started

[Nick FitzGerald <nick () virus-l demon co uk>]

Alexander Schreiber <als () thangorodrim de> to me:

> Sorry, in a networked world, C2 ist just a bad joke.  ...

Well, at least "weak"...

> ...  Keep in mind, that
> you do not get a blank certificate for 'this OS', but the certification
> always is for the full OS/hardware combo. No, you can't purchase the
> hardware for C2 certified NT anymore (not new, anyway). Even so, it was
> a specially patched ...

Really??

I heard it was just a specially prepared machine -- network card, 
floppy drive pulled, much non-default configuratiuon tweaking, etc.

> ...  Windows NT 3.51 that got certified on a (AFAIR)
> specific Compaq machine. It hat no network card (absolutely great - most
> Windows security problems could be avoided by ripping out the network
> cards - too bad that this is unrealistic because it would pretty much
> reduce the usefulness of the machines to almost zero), no floppy drive,
> no printer - the only way to get data in was keyboard & mouse, the only
> way to get data out was the screen. The printer spool system was
> disabled. The Windows system directory was read-only (not allowing your
> users to overwrite the system installation is computer security 101, but
> this _is_ windows, after all) making the installation of MS Office
> (which wants to dump a metric crapload of stuff there), unfortunately,
> impossible.  ...

Hmmm -- you're not another "know it all" user/admin who does not know 
about "setup -a" installs?  (Of course, in a modestly well secured 
Windows system, a user is expected not to be able to install a complex 
piece of s/w like Office, so doing this as admin and getting the 
configuration right is the job of the system admin, not the user...)

BTW, from _extensive_ experience in a university lab setup, the only 
major problem with Office (95) on NT 3.x systems with "proper" ACL'ing 
of user and non-user disk areas was that the $%^&%-ing "wizards" in the 
online help were done by an engine that was hard-coded to write 
temporary files into the system dir and would fail if it could not 
write those files.  (MS tech support had no idea what we were talking 
about when we told them this feature, so widely touted by their sales-
droids in the Office 95 promos, would not work in a "properly secured" 
NT setup and a colleague told me one of then actually told him to "fix" 
the problem by gicing everyone full access to the system dir -- if that 
tech had been talking to me I'd have been talking very strongly with 
his supervisor within a few seconds).  We simply told the lecturers 
(profs in the US) and tutors teaching the classes that used Word to 
_not_ mention wizards nor expect them to work -- thank-you Microsoft!)

> ...  So you had a system where you could log on, play
> minesweeper and log off again. Lots of use, that.

Or, where a competent admin could install and rollout dozens and dozens 
of applications, all appropriately ACL'ed down, after a few days 
training (we even did systems installation rollouts that were entirely 
handsfree after the boot disk login prompts had been answered...).

Or are you talking about NT machines after they had been C2-ed?  Must 
admit, never tried that -- we were interested in practical security, 
not some pie-in-the-sky quasi-military stuff...

> Besides, the C2 stuff is rather tame, things like no object re-use
> (clear all memory and disk blocks before handing them to another use,
> don't re-use user-ids, ...), auditing, identify users (no open system,
> user have to log in - what everybody else was doing for 30 years at this
> time), discretionary access control (think chmod - again, what others
> were doing since probably 30 years then), protected system mode of
> operation (read: your users are not supposed to able to overwrite kernel
> memory at will) which is really old stuff too. So, while the marketing 
> department got a nice spin out of it, everybody with a clue just 
> shrugged and said "So, you've discovered sliced bread too? What an 
> _amazing_ discovery, isn't it?".
>
> Keep in mind that _high_ grade security (things like mandatory access
> control, security labels, security levels (and making sure there is no
> downwriting) and so on) has been understood at this point for quite 
> some time. Some of this work even went back to the time of MULTICS,
> which started life in 1965 and was the first OS to get a B2 rating in
> 1985. And B2 is already really interesting.

Yeah, yeah.  I know all that.  However, note I was responding to a 
rather ill-informed comment along the line "*nix was always better 
because Windows can't <a list of things what NT _could_ do>".

So, while I fully appreciate that C2-ish security is not actually much 
security, it is at or above the level that NT is (was?) capable of and 
thus beyond where most *nix-ish OSes could ever get certified.

Don't get me wrong -- I'm not defending MS' entirely shoddy effort on 
the security side of things, but in many senses MS is clearly no worse 
than that which its traditional loudest critics prefer.

(In fact, IIRC, it was not long after NT's C2 certification was 
announced that the first "userland to Ring-0" privilege escalation in 
NT was publicly disclosed, so the quality of what C2 testing was all 
about was drawn into serious question too...)


-- 
Nick FitzGerald
Computer Virus Consulting Ltd.
Ph/FAX: +64 3 3529854

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html