Slashdot Mirror
Back Orifice 2000 on CNN.COM
LLatson writes "CNN.COM is running an article about Sir Distic
releasing Back Orifice 2000. Sounds like this
time it will run on NT..." Comments on why this
is being done, as well as a source release and a few
changes to the 2k system.
There is no telling what some people will love.
"Be nice, veer left, and never stop thinking" Iain Banks - Walking On Glass
Nay, for two reasons:
1. On UNIX systems telneting and trying to log in as root will not work
2. Telnet has security measures and can be disabled by the server at will.
Suddenly, the hairy finger of a familiar monkey tapped me on the shoulder. It was time.--G. T.
...and M$ still hasn't dealt with the security issues! I doubt making a new & improved BackOrifice is going to get them to patch things up.
(I've got no idea of the code in NT, but my guess is that in order to patch these security holes, a complete rewrite would be necessary.)
BO is hyped, but its not bullshit. The programming model is similiar to VNC and PCA, but the delivery is vastly different. BO is a stealth product designed to lurk and attack, this is precisely why 12 year old kids are getting excited. And if BO version 2 users can change ports/protocols on their own, detection will be difficult and those 12 year olds will certainly be excited about something.
Nothing happend to the guy who wrote teh CIH virus, beacuse he didn't ever distribute it, he just showed it to some frends, and I guess it "got out" on its own
as for the mellisa virus writer, well since he uploaded it himself (and it had the same GUID as the 'samples' on his virus writing site, and he did it from his home phone) he acted in a wonton act of distruction.
_
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
a little off-topic, and no doubt well-known, but this is what folk did in the olden days.
I know that this is mostly a 'me too' type of reply, but Tweety Fish has made an excellent point.
We all remember the stink that went up after Farmer and Venema (sp?) released SATAN. (COPS before that)
Anyone out there remember Asmodeus?
Any sysadmins here ever use a rootkit on their boxen to see what it did, and what to watch for? Without port scanners there wouldn't be firewalls, and without sniffers there wouldn't be encryption.
I know tfish is looking even farther than the benefits of reacting to a security threat. And a good thing too. Something like BO, designed to have such a low activity signature as to be undetectable by a casual user, is a huge accomplishment for a Windows product.
There are benefits for network admin tools, from having the BO code available. And if M$ doesn't learn, at least the rest of us will.
-- What you do today will cost you a day of your life.
Really, who will be nice enough to break into my system and send me an endearingly personal email telling me how to plug my security holes? Not gonna happen- whoever finds the holes will exploit them to the fullest and fuck me over.
Frankly, I prefer not to have any uninvited guests.
A witty saying proves you are wittier than the next guy.
Just to be clear, I'm not a member of the CDC. Nonetheless, your responses aren't great.
0: Microsoft SUX!!! (0 because it's the _true_ motivation for all of the following arguments) Response: Yeah whatever. Nobody likes M$, but millions of us rely on their products in our homes and our workplaces. Some of us don't have a choice in the matter. If you want us to use something else, make something better.
While its true that many don't have a choice in the OS used in their office, or by default because they're unable to install another, there are still lots of better, or at least different choices out there. Your crack about 'make something better' is probably the most succinct description of the motivation behind hacking, and all it's produced, that I've ever seen.
1: It's just an administration tool. Response: [snip] If this is just a tool why not create a shortcut on the desktop called 'Uninstall Back Orifice'?
One reason is to protect the administration tool. The network admin at my company is constantly telling people to enable Norton Antivirus; every time she has to clean their system manually, in fact.
You're right that BO is more than an administration tool: it's a political point that, for all the damage and heartache, is a valid point. See your reponse about leaving your house unlocked...
2: It's MS' fault for having the security holes in the first place. Response: [snip] If I leave my door unlocked that doesn't make it my fault when you steal my things. You're still the criminal.
I'm still a criminal, and you're still stupid for having left your door unlocked. Moreover, your home insurance won't cover you because you left your door unlocked; if you won't take known security measures to protect yourself, then you bear part of the blame.
3: MS wouldn't fix the holes if we didn't exploit them. Response: If you're so concerned about MS fixing their security holes, why not give them an advance copy of the software so they can attempt to fix them _before_ all the jackass kids exploit them?
My understanding of the release of the first BO is that Microsoft was offered an advance copy, and turned it down, while denying there was any security problem at all. Microsoft is a business, and what a business can get away with, it will. It's as simple as that, and if you disagree, you've never had the privilege of riding a cubicle in corporate America.
4: We're helping the community by bringing these problems to the attention of the public. Response: Clearly the only community CDC is concerned with is the script-kiddie community. Their program is extremely destructive to the common user and is most effective when used against inexperienced users. All they have done for the community is reinforce the atmosphere of distrust that pervades the internet today.
All they've done is force people to confront the problem. They've made a deliberate public showing of it because it wasn't to impress the script kiddies, it was to force a resolution to the issue. Yes, people may suffer because of it, but it takes a hard lesson sometimes. As for the atmosphere of distrust, which is better: suspicion all around or blissful ignorance?
Anyone who loves or hates any language, platform, or manufacturer, doesn't know what they're talking about.
Some friends of mine thought that it would be cool to setup a redhat box with at their school district. Zipity fast line and an administrator who was interested in samba made it seem both fun and possible.
So the machine sat there and was played with, and various stuff. Then some script kiddie found his way in. With a 'Rewt' kit and some time all of a sudden the machine no longer was under the control of my friends but someone who was creative enough to pick a uid of 420.
The point: Even a linux box can be filled with security holes and even on a linux box something like bo can run (port 31337 now allows anyone to telnet in and doesn't even require a login for root access).
I don't really mind people developing these root kits or bo or whatever exploits they care to come up with, but I don't like people screwing around with other peoples machines as these exploits invariably lead to. Now that my friends know about the various holes they are ready to reinstall and start patching holes, but if the machine were something serious they'd be screwed.
With various holes know, we (the comunity of computer users, and the comunity in general) should make sure that they are fixed. As well we should make sure that these exploits are not exploited by the corporations or anyone else.
peace
watch out for the conspirisy of tall men
Doesn't the insertion of a kernel module require root access?
-rozzin.
If cDc is sincerely concerned with M$ security they would have given M$ and the public suggestions on how to fix the problem but instead they release this dumb program to show that it could be done. I find cDc's analogy quite funny in a sense that it is flawed and no one in the right mind would formulate the same analogy.
I do not even know why they are making such a big deal out of this. It is the same as the original Back Orifice + NT capabilities which requires that the infected program be run by Administrator. One could say that this could be done the same for UNIX or BeOS provided that the "Super User" is the one who will be running the infected program. Most large corporations are very careful about running unsupported software (i.e. stuff that's downloaded from the internet) anyway so I doubt this would make a big impact to most people. I see the target of Back Orifice 2k as Warez kiddies who probably didn't pay for their WinNT licenses anyway.
So if you release BO2K under GPL, does this mean that if you infect someone's machine then you have to offer to give them the source :^)
GNU and Linux -- Oh no, Mr. Bill!
"Making it publicly available and open-source means that nothing is 'hidden' and there are no surprises waiting in store. "
In the hours,days,weeks and months to come as we see dozens (possibly hundreds) of slight variations, total modifications and custom built worms come out of that source code I doubt you will still believe that.
This program is a serious threat to NT security. As others have pointed out the problem isnt so much that NT is "insecure" (though ther are definitly problems in that department), its that the users and quite a few of its admistrators are just plain dumb wher security is concerned. And as I heard someone say in a previous thread: All it will take is one stupid user/admin to compremise the entire network. It will just make the process easy. Really easy.
Of course, yes all of this and more is possible on a unix system. The difference is unix is a diverse set of operating systems. Porting code to different Unices takes time and some skill. BO2k will run flawlessly on any target machine making it extremly easy for anyone to use (no coding experiance required) and therfor that much more dangerous.
However I dont think Its all bad. Its just like any other peice of software: It can be used for bad things or for good things. Dont blame it on the software or the authors (anyone who says writting software is in itself 'evil' is a total dope) - blame it on the assholes that actually use it maliciously.
And hey: If you THAT worried about it take that WinNT CD and chuck it out the window. Order a copy of Linux, FreeBSD or Solaris7 and put that PC to real use.
Does the Back Orifice server require any kind of password, or is this an option you set?
I thought it was just something you embed into an exe or something and get unknowing people to run it, at which point it would silently install itself into the system. Then you could use the client to track down people who had installed it, and use their machines.
At least that's what I gather from the bits and pieces I've seen about it.
So if you install this on your network, what's stopping people on the outside from controling your machines?
Uh, no.
If you are the admin of a corporate PC running NT, you tell the user, if you touch this program intentionally your boss will hear about it, and they leave it alone.
No stealth required.
There are so many messages here who just take it
for granted that NT is insecure. NT has a solid
security architecture that is more fine-grained
than that of Linux. This means it COULD be better.
The real problem is that MS Office is designed for
a single user and requires you to have the equivalent
of ROOT access to run it (OK, I'm exaggerating and
I've never had office on my computer so I wouldn't
know, but disprove me). You could do exactly the
same with Linux (pop up a box in netscape, make the user type their password, mail it home), only that a user has less rights on Linux.
I see your point. If we engineered cows to be resistant to e.coli then we'd have a "more secure" cow. So in effect the problem actually does and does not already exist depending on your perspective. However it isn't a problem until e. coli shows up. Heh, I guess what I said could also be more amusingly applied to humans. We've got lots of design flaws, look at the "common cold!" (I'm joking here)
Who would've thought we could use cows as an analogy for OS secuity designs?
Sure, a security problem is a security problem only if someone decides to exploit it.
In my world, people exercise reasonable measures to protect their valuables. The measures of protection are proportional to the worth of the object/valuables. That's why banks have vaults and safety deposit boxes.
If Microsoft is going to claim that their operating systems are secure, I don't think they're the victim when people realize that their doors are wide open. The victims are the people who rely on Microsoft products for security. Microsoft should take responsability for their marketing claims and engineering blunders.
If BO's main purpose is remote administration, what's the point of having all the stealth features then? Why does it go through such great lengths to hide itself from the user of the machine it's run on if it's something that they supposedly would want running?
Yeah the punks who made that just sat on it after showing it on CNN. Punks!
That is what a company I was working for did. Put some software called System32 on the machines both NT an 95 and screwed around with the employees. Stupid kids making this stuff and releasing it.
If you can peer into the Win95 spool, you should be able to see what the WinPrinter is being sent.
Could this be used to reverse engineer drivers for these ugly things?
I heard of that one. It gave you a shell on NT and would even push it thru a firewall or something. Interesting program. Do you know the URL?
Whoooeee! The stuff people come up with!
/. at -1, I'd never get to read all these absorbing and fascinating insights into the world!
Just imagine, if I wasn't surfing
(LOL!)
--
- Sean
It's a fine line between trolling and karma-whoring... and I think I just crossed it.
- Sean
You are right, modifying system calls cannot make something undetectable... This module overwrites a kernel data structure instead. It does however redirect specific system calls to hide files and processes and has a nice patch to setuid() and execve().
They do it becasue they can. Most irritating.
:-)
I won't say first, even though i am.
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
What are you talking about? This is certainly
not the only way to "prevent things like this".
First, all trojans take advantage of capabilities
offered by the systems they infect. Kernel trojans
take advantage of device drivers and context
switching code. In this respect, all operating
system functionality is subject to misuse by
malicious code (such as BO2K). Obviously, this
is not the problem that needs to be "fixed".
Next, the issue being discussed with respect to
trojans that affect OS kernels is detectability.
It simply is HARDER to detect a well-written NT
trojan. The security community does not have
the detailed information about the NT OS internals
needed to develop good detection schemes for
kernel trojans.
This stands in stark contrast to Linux trojans,
which must in some manner be based on and affect
the operation of the Linux kernel. The difference
here is that the effect of a Linux kernel trojan
is made measurable by the amount of information
publically available on the Linux kernel.
Unlike NT.
Finally, the point you're making ("the only fix
is to remove the functionality") is completely
bogus. The problem is that NT is configured and
used in a way that makes the distribution of BO
and it's siblings trivial. That is not a hard
problem to solve. "Don't run unverified code
inside of mail attachments". "Don't run programs
you get from suspicious sources." "MD5 binaries
you distribute to the public."
This isn't rocket science.
If you want us to use something else, make something better.
I believe that there has ALWAYS been something better. The mac was better than win 3.1, people were just too cheap to pay the extra money for one. You get what you pay for.
1: It's just an administration tool.
If this is just a tool why not create a shortcut on the desktop called 'Uninstall Back Orifice'?
Because if you are a network system admin, you don't really want people changing the software on their machines. Especially removing the program that you use to take care of said machines. To that end, if your client is scriptable, then you could run periodic, scheduled checks on all of your MS workstations to check for unwanted system changes. Thats a great and wonderfull thing.
2: It's MS' fault for having the security holes in the first place. There may be defects in the product, but that gives you no right to write a program whose primary purpose is to punish those who use it.
My responce: bull. If you want to give BO a purpose other than that stated, then it is perhaps a good argument for designing/using systems with security in mind. At least if you value your privacy and data. If BO didn't expose the basic flaws in such designs some other program would. It's only a matter of time. By releasing BO very publicly, both the users and the engineers of those systems get a good reason for using a better design. The idea is not to punish users, but to convince them that they need to demand better design from their vendors. Let me say that again: If such a program were not released publicly, then it would be released quietly. If it were done in that manner, then consumers would not worry about their systems, and continue to live in a deluded blissful belief that they were safe. The design would not improve.
3: MS wouldn't fix the holes if we didn't exploit them. Response: If you're so concerned about MS fixing their security holes, why not give them an advance copy of the software so they can attempt to fix them _before_ all the jackass kids exploit them?
First, when was the last time that MS fixed anything that wasn't demanded of them. If a problem exists, but isn't being exploited, they usually ignore it untill it is being exploited. Second, and most unfortunate is that these problems are inherent to the design of Windows. I don't think that MS could "fix" them if they wanted to. It would break too much existing software. BO is written with standard Win32 api calls. What's that? Yes, Microsoft DESIGNED WINDOWS TO ALLOW PROGRAMS TO DO THIS.
All they have done for the community is reinforce the atmosphere of distrust that pervades the internet today.
Who do you trust?
No, I'm not a member of cDc. I don't know if they want new members. I have, however, been very pleased with BO. I gained 100% access to my own place of business's network without any physical access. By doing so, I made the argument that security in the office was of prime importance. It held water, and we took some steps to make our Windows machines more secure. That's right, BO had exactly it's described effect. Is that so surprizing?
I don't know about you guys, but i love this program. It's a fine example of how shi**y Win9x is and should only give MS a reason to make a real product. I nice web based linux control panel would be fun though.
I tried doing a search for it but, system32 turns out to be a common word related to windoze so i haven't found it yet. it had some kind of management that tracked installed copies that i remember.
"Groups of (mostly teenaged) hackers... release nasty computer bugs..."
;)
Looks like Micros~1 has some serious competition from cDc.
Geeky modern art T-shirts
Good. Then you shouldn't mind if I store 3 tons of dynamite in my garage.
While few people here wouldn't like to see Microsoft get a come-uppance, this sounds like the most incredibly juvenile, wise-ass way to do it. While these twits never mention preferring Linux to Windows, maybe someone should forward them the advocacy FAQ anyway.
"Excuse me, but you realize, of course, that you're just helping to make Windows `better' in the long run?"
Has anyone ever heard of a major user or someone in a business setting abandoning Windows mainly over security/virus fears?
It doesn't hide processes. man kill(1).
I'm sure comparable problems exist in the
manner it hides files.
MS Office 97 doesn't quite need Administrator/root, but it does require write access to a few files in \WINNT\SYSTEM32 and much of it's program directory, as well as in odd places in the Registry.
MS Office and other poorly designed programs (Netscape) are one big reason the default permissions on NT4 are so loose. The problem isn't really the OS, it's how the installer sets everything up. That and most workstation users logon as a local adminstrator.
(As a side note Microsoft has taken alot of blows on this from those familiar with unix, as well as their own user community. I'd expect Windows/Office 2000 to be much better in this respect. Win2000 beta appears to ship much tighter, and then includes some scripts to loosen things for compatiblity with certain apps.)
--
Business. Numbers. Money. People. Computer World.
Management would love to have this. They could see what your doing with your time. Right down to the keystrokes.
Actually, if this does what it claims then management should really be worried about security. But noone will do anything until its too late.
PS.
I saw this article a few days ago and tried to submit it, but slashdot wasn't responding
Steven Rostedt
-- Nevermind
I always just used system32 for that. it had nt support at the first release.
I'm a sysadmin for a large Us Gov't agency. As such, my machines are a prime target for external attacks. So I can understand the concern for creating tools that "ordinary people" (ie: script kiddies) can use without any real technical knowlege. Keeping up with this kind of stuff can certainly add to my already overloaded schedule. But to be honest, the kind of threat this creates is not my biggest fear.
My biggest fear is the unpublished exploit. Published security holes get fixed. History has shown a tendancy with Vendors to ignore security issues until they become politically embarassing. This leads to vulnerabilities in my system(s) that I am unaware of and, consequently, can be exploited without my knowlege.
Lets not kid ourselves here... people with malicious intent WILL share their knowlege with others of the same inclination. At the same time, they're less likely to take steps towards patching the hole they are taking advantage of.
By bringing security issues to the public eye, people like the cDc are helping ensure the security of our environments improve. It may be additional work to keep up with these improvements. However, I don't know about your environment, buy mine demands a hell of a lot of hassle whenever one of our machines is compromised.
You can password protect BO.
The cDc'd would have an even worse time claiming this as a remote admin tool if this wasn't so.
-
I am ODiV, hear me type.
Smaller, nimbler, faster, easily customizable... This sounds like the perfect replacement for SMS Remote Control. Now I just need to sell my boss on the idea...
--Shoeboy
The big trouble with the Center for Disease Control analogy is that that CDC is a government agency with a public trust to uphold. Similarly, the AMA would like people to think they are a responsible, trustworthy and benign organization. In either case there would be a betrayal of trust.
The Cult of the Dead Cow has no such responsibilities, and no trust is betrayed. If you really want a tainted meat analogye, compare them with ecoterrorists, poisoning meat to prove that McDonalds doesn't follow proper hygiene procedures. Even that's not a great analogy, since the cDc's programs don't have the potential loss of life that a meat poisoning scheme would.
----
Open mind, insert foot.
I feel better knowing that at least these wholes will be known publicly and raise some sense of awareness rather than in a closed private environment where exploitation could continue unfettered. These wholes exist, the fact that the wholes are present is irritating, knowing how to monitor and defend against such programs/wholes is one spin off of releasing such an exploit. If back orifice had not been so wide spread the first time around, would there be as many countermeasures now?
I'm a coward.
If a cracker tool can be done, I shure prefer that it's done in front of every one eyes like cDc is doing. If BO 2000 weren't created by the cDc it would probable be done by another cracker. Shure, now every kid can use it, but we know what they can do. The most dangerous tool is the one that is not visible.
--
"take the red pill and you stay in wonderland and I'll show you how deep the rabitt hole goes"
[]'s Victor Bogado da Silva Lins
^[:wq
The article makes an interesting analogy, claiming that CDC releasing BO in order to force MS to clean up is the equivalent of the American Medical Association polluting meat with e. coli to force a cleanup by meat suppliers. However, the article ignores the point that the government has created channels by which the meat suppliers can be regulated, and that nature provides regular e. coli outbreaks to check on our precautions. Since the only oversight on MS is the market, and there is no such thing as a "natural" security problem, problems must be highlighted by human groups like the CDC, and the market must be manipulated in order to get a response.
Anyway, that's my two cents- I'd love to find the author's email to let him know, but I can't find it. Any clue?
-Luge
IAAL,BIANLY
I use Micros~1 Internet Exploder... EVERY URL I've ever visited is in a humungous file THAT CANNOT BE DELETED. Actually, I've two of 'em. One can be removed by specifying a new cache folder and re-booting (yawn)... but the other- I'm stuck with. I DO NOT want my boss to come and read a file which shows hundreds of www.filthytosser.com addresses...
If I "surf" at lunch-time or after hours, that's MY business. But why the FUNK do I have to MANUALLY 1) clear history 2) clear cache 3) clear Recent Documents, etc 4) Hope for the best
after each session?!!! B***ards.
spying on everything that an employee does on his/her PC.
Spying on employees using their personal computers is one thing but you are going to have a hard time convincing people it is wrong for a company to keep track of how their computers are used on their time.
If any company actually tries to use BO to monitor hundreds and hundreds of people... well, good luck.
..unpatched security holes in Windows 95, 98, and NT that allow unpriviledged users..
Unpriviledged users? In Win9x? Sure...
Also, I might be wrong here but BO2k does not spread itself (but it could though).
By your logic, Microsoft should come out with security patches for Laplink and Pc Anywhere! Of course there just as many "un-informed" people who leave those set for public access as people who add accounts on their unix boxes without passwords.
Here's a great security advisory: starting IIS and changing the webroot to C:\ can allow remote users to get your files. I guess microsoft should issue a patch to block the webroot from being changed to c:\!
Now for a real exploit.. Send messages to every linux user you know but encode the message with the remote pine exploit. Have it download a small script that will put ~/bin as the first directory in their PATH and download a trojan 'su' program to their bin/ directory. The next time they su, it will mail you the password. Now THAT is an exploit! This could be done entirely in perl for cross-platform exploitability.
See the obvious difference here? For BO to run, it requires a specific user action. This pine exploit (there is just about one for every version) runs WITHOUT user action. Just reading a message which results in downloading code and executing it is a bad thing(tm).
Note: The pine 4.10-1 rpm with redhat is patched with this patch which prevents actual execution but other distributions may not be so lucky.
> ensuring that 99% of all successful NT attacks will have the uniform signature of a BO2K installation to accompany them...
You forget, mon ami, that cDc is releasing the source. That means that people are free to modify the program as they desire (a phonomenon very familiar to us of the Free Software/Open Source persuasion).
Who's to say what "signature" these modified BO2K variants will have? Who's to say how identifiable they will be?
--
- Sean
It's a fine line between trolling and karma-whoring... and I think I just crossed it.
- Sean
it...
First off all this does is give script kiddies who don't know better thinking he's a hax0r (did I spell that right?:) This we could do without. I think if your going to do it you can at least learn what your doing.
Second if they do release the source code (which I doubt) it may spawn hybrids, but it will also allow someone to kill it off. After I could just infect my machine with my version which doesn't do anything except listen.
Third. This doesn't prove how lax security is on windoze, all it proves is that you shouldn't run software you don't know it's origins. It just punishes the stupid.
I have been infected twice with BO, after the first time I got my machine totally sorted out. I haven't been infected since and if I do get infected I know pretty quickly (I knew straight off the second time).
Also it's amazing how stupid some script kiddies are. I've had numerous port scans while on the net, most of the BO related ones the script kiddie has infected themselves or doesn't know enough about the net to protect thier connection. And any who are protected I just report anyway (that gets the remaining kiddies). All that leaves is the professionals (who should know better:)
Well I remember people putting system32 on some boxes. They used a combination of exploits to get it installed and running as administrator. Wasn't that hard as I recall.
Win98 is NOT enterprise ready, NT is. No one in their right mind would run 98 in a corporate network environment, for exactly that reason.
However NT is common place, and our users run NT boxes setup up in such a way as to make it impossible for them to install applications, or create services etc. Added to that, our email servers scan all mail for nasty executables, and has quite happily thrown out every copy of melissa sent into our organisation, and I expect the same to be true of this.
The security hole is not in the OS it's in the admins & users!! If you had a linux box setup as loosely as some people have their NT boxes, it would be just as easy to crack. But seeing as 99% of the kids writing this stuff are Linux advocates and M$ haters, they ain't gonna spend time trying to make Linux look bad are they???
oh, i think it stands for window's hole == whole?
Correct metaphor: if you bought someone a gun, show them how to use it, and they shoot themself.
Microsoft frequently makes claims as to the security of their products without making any efforts to actually prove it to the security community. An example of this is the virtual private network scheme - the algorithm and implementation is untested, untried, and unproven. If one uses it, one must take MS's word as to its efficacy.
MS compounds the error of their ways by placing the blame on the cracker/hacker who exploits their security holes. If you wish to continue with the gun metaphor, perhaps this would be analogous to a claim that guns don't kill people, people kill people.
--
There is no premature anti-fascism. -Ernest Hemingway
Apparently some of you are under the impression
that the security community is some sort of
professional organization, like the IEEE, that
you have to obtain membership from to participate.
You are wrong. What we know about security in
1999 is 90% the result of independant research
work done by people trying to find new ways to
break into computer systems.
The security community is aware of stack overflow
vulnerabilities in large part due to a successful
attack on the Internet that happened in the 80s.
The relevance of the attack on modern Unix systems
was underscored by the 8lgm (with the Sendmail
8.6.12 advisory), a group that did nothing but
post exploit code for new security problems they
discovered. And immense code audits that Linux
and 4.4BSD went through to overflows were the
direct result of Mudge and Aleph One posting
detailed "how-to-write-an-exploit" cookbooks for
hackers.
Nobody of any repute in the security community
criticizes any of these people for what they've
done. To do so would be silly; we know that our
software would be less secure without these
people, as well as we know that crackers had
access to the information long before we did.
The entire security community is BASED on the
concept of PEER REVIEW, where anonymous strangers
(preferably scruffy college kids, for theatric
effect) scour published code and design documents
and find flaws. We wouldn't have Blowfish and
IDEA if it weren't for Biham and Shamir ripping
up DES.
cDc is following along in the same tradition,
and it's a tradition that we need to ensure is
maintained. Nobody is doing the security community
any favors by attempting to villify Sir Dystik.
It is incredibly important that we not set a
precedent for shooting the messenger.
No doubt whatsoever? Then I suppose you wouldn't mind placing a wager on that? Meet me at Defcon before Saturday 2:00pm and we will make a bet. Bring money.
That was one of the big reasons I used system32 was because they gave source.
The good side is that after being hacked by BO stupid users who actually actuvate dubious files will learn. and if they won't - they deserve it.
The good side is that equally stupid user i.e. the crackers will actualy feel sooooo smart.
The good point of that is that sooner or later they will be caught, thats the punishment for stupid hackers.
Ballerinas have fins that you'll never find
I don't think that exploits like this have so much to do with tha fact that Win NT is a crappy operating system but with that fact that it is closed source. If NT was open-source underjust about any meaning of the term we wouldn't just see an exploit like back orifice published, we would see both the exploit and a fix published. Why? because no cracker wants his system to be cracked by another cracker using his own crack.
Yeah I remember system32 was pretty small too, but it just gave a command prompt or let you run stuff remotely thru a webpage it would d/l. I just wish they would have put that keystroke capture in system32.
It is incredibly that so many people don't even understand what is going on before they open there mouths, I am in no way saining that MS products are secure.
But this is not a security hole, it is a remote administration program that has to be installed. It doesn't matter what the OS is, if you install a program that was written to give remote admin capabilities, then you have given people that ability.
How does this constitue a security hole on M$ part. It sound more like a security hole in the person using the computer. I can remote admin many differnt OS's does that make them insecure also.
People please think, think before you speak, or politicians will take that away from you also.
Aren't you running into trouble with the enclosed encription routines when BO is exported?
Maybe it would be worth releasing an Open Source version without encryption (and maybe without the 'invisibility' feature).
That way, people could use the code for 'friendly' purposes, and it would be more difficult to create a modified (and hence more difficult to detect) malign version of BO.
The binary version would provide for enough headaches for M$
"This 'security' risk is nothing specific to the Windows world."
The security risk *is* specific to the Windows world. BO/BO2K can be installed by any user, priviledged or not.
To do the same on a Unix-based system, one would need either root access or a poorly configured system (ie. you need to somehow trick a priviledged user into running it for you).
"Any mildly compitant [sic] sys admin would know not to run random files on the server, so as long as the admin isn't dumb, the system is secure."
Thanks for emphasising my point. Your problem is that under Windows, anyone can install BO, not simply the system administrator.
Aside from that, any problems that are discovered in an open-source Unix-based OS have patches released within *hours*. Contrast this with MS's responses to past issues, and come to your own conclusions.
"Designing this program to comprimise [sic] a system that isn't designed to be secure is ridiculous."
I couldn't agree more. But Microsoft claims that its "enterprise-ready" OS *is* secure. Your ridicule should be directed at MS.
Looks like I misunderstood you, and you misunderstood me.
> If somebody is kind enough to alert me of my system insecurity, I will gladly reciprocate the gesture with my boot up their ass.
I infered either:
1 - the cDc releasing bo and telling you that windows has a problem...
2 - A user who catches a security hole _and reports it_
But still... You'd rather not know possible security problems?
-
I am ODiV, hear me type.
cDc hasn't invented anything. The source code
is meaningless to the research community as a
document of any new problems.
cDc probably hasn't done anything in the code
for BO2K that wasn't already documented in MSDN.
The source code probably will not convey any
new revelations to the computer underground.
BO2K is not a new concept. The equivalent has
probably been floating around the computer
underground for ages. The idea is simply much
better documented now, and MS has a very
compelling reason to address the issue directly.
It is a fairly well-accepted tenet of the
security community that whenever you hear about
new source code being released, you should assume
it HAS been released to the underground for
quite some time beforehand. What makes you think
that BO2K, or something much worse, hasn't been
available to modify by crackers for years?
This same logic could be applied to Aleph One's
"Smashing the Stack" paper (the harbinger of
31336 different stack overflow exploits). With
the benefit of hindsight, we see that the result
of this exploit cookbook (which was, by the way,
far more dangerous than BO2K source code, given
that it [and it's immediate antecedants] DID
contain revelations to the computer underground)
was the almost complete eradication of stack
overflows from Linux and 4.4BSD.
On a lesser scale, the release of the rootkit
trojans had the same effect for the Unix security
community --- you'd have a hard time hiding the
original rootkit on even a naievely administrated
network these days.
BO2K will have the same effect on NT.
If it has a legitamite purpose, then MS can't really just "ban" it. :-) They might have to actually fix the security holes.
If all anologies are flawed, then aren't all flaws analogies? Or, wait a minute...
Cthulhu. Yeah right.
I think I'll have to have my girlfriend help me. Apparently I have trouble finding g-spots.
The old BO was easily "exploitable" by people who didn't install it. BO2000 seems to address this issue.
On the other hand, PC Anywhere is easily "exploitable" by people who didn't install it, too.
I do have to disagree with it's "a decent system." I've administered both NT and *nix boxes, and it's just night and day.
Please read this, then think again if they really make great GUIs.
I agree that UNIX distros need work to secure them out of the box, the problem is microsoft has no security model for 98/95. NT can be made much more secure with some work; however, I wont allow our firewall to be built on one for a few reasons.
1) Patches releases take to long
2) Stability
3) The UNIX os's have been around for 30 years and poked at longer.
4) Go ahead install that service pack on your critical NT system I dare you.
5) automation.
Microsoft aggravates my tourettes syndrome.
Its my hope the cDc would release a BO and BO2000 "detector and eliminator" and copyright the hell out of it. This way you're not only exposing MS' security flaws, but you're also protecting the people who might be exploited by them.
:)
you'd also make a shitload of money
(well, after the first BO came out a lot of companys came out with free fixes)
what's really insidious though, is that beacuse the source is open, its posible to modify it just enogh to evade detection....
_
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
It doesn't run invisibly. The process has to be listed among running processes. I assume it won't be the same as the prior version of BO and be something like BOSERVER.EXE. But, if you know you're machine well, and you know NT, you can tell something is up just by looking at the processes list in task manager. Which any knowledgeable NT user does on a regular basis. :)
It's all irrelevant anyway. If you're on the net, and you're not security conscious, it's your own damn fault if you end up with a virus, trojan or worm. You'd have no one to blame but yourself.
When it comes down to it, security really doesn't have a lot to do with operating system. It's the administrator. Windows 95 isn't that hard to secure...and NT is even easier. Linux isn't secure out of the box, but it can be made so. Not wholly secure of course, that's impossible, but this kind of kiddie script garbage is easily avoided with any operating system.
Don't turn this into a security issue...because it isn't. If you could get it onto a machine without the operator causing it in some way (running an unkwnown exe, sharing the hard drive over TCP/IP, etc), it's their fault, not the OS.
Sorry for babbling
Bill
"Win98 is NOT enterprise ready, NT is. No one in their right mind would run 98 in a corporate network environment, for exactly that reason."
Funny then that M$ only uses Win9x clients in their benchmarks, not NT.
Their argument is just that Win9x is the "corporate standard" for clients, not NT.
(And yes, I know that Samba is much faster with NT clients than with Win9x, in contrast to NT)
I think what he ment was that with the source available, it would be simple for somone with resonable skils to hack up a custom version that can avoid virus detection (infact I plan on doing this :P)
_
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
Do you have a link?
Agreed...
$ diff -u VNC_OR_SOME_GOOD_REMOTE_CONTROL_PROG BO2K
- bloat
+ speed
- tell the user you installed it
I never understood why people thought BO was a security exploit. It's a quiet remote control app. The fact that people have coded silent installers is not a security hole, either. I could probably, in a couple hours, write a little proggie to silently install VNC on someone's computer. Or any other remote control app for that matter (VNC would be easy because it's GPL'd).
-Cheetah
Okay, you people are misunderstanding the point of analogies. If I say something like "Ted Kennedy's mouth is to words as a sphincter is to shit," I'm not comparing Ted Kennedy's mouth or his words to either sphincters or shit.
In an analogy A:B=C:D, there is no implied relationship between individual elements (such as A and C or A and D or even A and B); rather, the relationship between A and B is said to be equivalent or nearly equivalent to that of C and D, even if A(B) has absolutely nothing to do with C(D). Nothing more is implied.
Kyle
NP: Gamma Ray, Sigh No More
--
Kyle R. Rose, MIT LCS
[ home ]
Is it going to have yet another backdoor going to cDc?
;)
Now lets get realistic for a second. If it were worth anything more then a new script kiddie tool why not bring it out at PC expo as opposed to DefCon? Program something good for a change. And I don't mean that in the sense that the program sucks. You know damn well it's intentions are for the losers who wouldn't know how to hack a chicken with an ax point blank. Think of all the data thats going to be destroyed when some 14 year old loser download it and sweeps subnets because his little high school hoe just dumped him and now he wants to DELTREE your whole damn pc.
You and I both know the true purpose behind BO is just a slap in the face to Microcrap and a way to intrude networks and nothing more.
...by the way whats up to the l0pht section of you guys...
Want Root?
This release will be GPL'd so we can all hack away and take a look at some Windows internals. That sounds exciting to me!!!!!
And what I was saying is that the analogies presented thus far were NOT equivalent. Thank you for clearing that up.
Man, some of you just aren't getting it.
BO was made to be just barely dangerous enough to cause a stink and get press attention. It's not about 'hacking', it's about politics and pressing an issue. It could have been a LOT worse, but making "scary hacker appz" was not the point.
CDC predates "script-kiddies" by about, oh, a dozen years. There's an agenda going on here, and I think you'd be well-served to look at the broader picture. All of those guys are at least in their mid '20s, ranging up through their '40s.
Watch what happens at Defcon on Saturday during their presentation. A lot of this should become more clear.
I am not a Windows NT fan (nor do I play one on TV), but I admin about 60 Windows machines as workstations at work. What I have noticed is the absolute lack of knowledge that a lot of these users have. In Win9x, there are no levels of admin/poweruser/domain user/guest. People are encouraged everywhere you turn to run this neato exe from a web site with a "~" in the URL. Screen savers that have an install instead of just a .scr file are a perfect example.
:) Take care.
But that's only part of the problem. Mass production of MCSEs isnt helping.
I've been admining NT and Linux for quite a while now, but I decided to enroll in (ugh...I know...shaddup) MCSE school to learn the little details I would need to throw back out at the test to be "certified". It was pretty depressing. In the ENTIRE NT wks and svr sections, I only recall seeing "dont stay logged in as the Admin" once. It was never stated in class. I was one of two people in the class who had even installed NT. (They give you a 120 day eval) Several people didnt have computers.
IF you are going to use NT as an important server, you should really set it up with strictly what you need, service pack it as best you can, lock the console, and never log in locally unless there is a problem. I have gone to way too many places seeing people using the server as their workstation logged in as Administrator with IE4 and Outlook (with Word as the editor) both open having no idea what that can do. Getting your hands on people to run your servers intelligently (or for God's sake learn yourself) is the best plan if you must use NT. Dont use IT staffing firms. And the most important rule: If the NT machine matters to you, dont put it on the Internet. If you must put it on the internet, dont browse from it and DAMNIT, DISABLE netbios on the nic that is facing the internet. These cant solve all problems, but it's all you can really do.
This is not taught to the people who really really want to be an admin in MCSE school. People arent learning. I have no idea what the solution to this is. I can make all the noise I want about it, but someone always knows better.
It is pretty silly to see this as some massive threat. IP Masqing or proxying or whatever should stop this from happening to you unless someone makes one that opens control outbound actively to a predefined host instead of passively waiting for a connection. People were scanning clients on IRC for PC-Anywhere connections to look for blank passwords. Why is cDc worse? Open netbios shares, buggy Windows ftp servers, etc are much more of a problem for the people willing to have MS products directly on the Internet, but again, that's user error and they probably didnt know.
Maybe I'm way off track here, but I dunno. Just thought I'd ramble
-True Dork
Ban open-source software for the public? What are you, some kind of M$ neo-nazi or something? Yes, some hackers will open-source their software to their hacker pals will make even nastier versions.
What about open source OS's? *nix? You are saying that in order to make open-sourcing illegal, you would completely obliderate an operating system which has out-performed the current most-used operating system of windows?
~Gawyn~
Yes, you are right. The only possible way this could be an exploit is maybe if it was combined with the IIS hole. (but does that leave you at Administrator level?) Any OS which allows itself to run user supplied data will have this "feature". Linux, NT, and other multi-user OS's are a little more immune because a normal user can't (or shouldn't...) be able to run programs which affect other users. Once you get root/Adminstrator access however, all bets are off!
I don't care who writes the software I use as long as it is secure and I have access to the source. If Microsoft wrote a secure OS which I could have access to the source, I would not hesitate to run it. The security and freedom offered by an OS is what is important, not who wrote it. This is why I currently run Linux and am looking into FreeBSD.
If BO2K alerts people to the poor security model of Windows, that's good. If the only way to get Microsoft to address and fix the security issues of their product is to hit them in the face with a pie once in a while, then do it.
This 'security' risk is nothing specific to the Windows world. It is not that hard to do the exact same thing on Unix. (There are several programs availble to do this on Linux and BSD...)
Any mildly compitant sys admin would know not to run random files on the server, so as long as the admin isn't dumb, the system is secure.
WinNT is just as secure, if not more secure, than most Unix systems. I see hundreds of new exploits for Unix systems every week, but much fewer available for NT.
I obtained a copy of BO 2000, and I was unable to get it to run on NT. I tried it on 3 seperate NT systems including 2 copies of Workstation, and 1 of Server. It gave me the same illegal operation on all three systems.
It did, however, copy it's key to the registry, and move itself to the WinNT directory. Each time I started up, however, I got a blue screen with the error, and after I hit enter, the system booted normally.
I have a feeling that BO 2000 *may* run on NT, but I couldn't get it to work.
BO 2000 ran great on Win98, and 95... and there are some nice improvements.
I personally think that BO is dumb. Designing this program to comprimise a system that isn't designed to be secure is rediculous. It simply shows the childish tendancies of many hackers.
The biggest security hole with Windows is that it is too easy to run programs that open security holes. It is too difficult to protect a system when your executables are read/write by users and executables have so much control over resources. It's too easy to attach trojan horses to e-mails (aka Melissa).
/usr tree from the user!
I was shocked when many of my NT programs did not run or gave warning/error messages when I protected their directories (i.e. \Program Files) as read only. Unix has it right in this department--protecting the
The issue is not whether MS Win products have security holes; they do. It is a commonly accepted fact. The point is that by releasing Back Orifice and Back Orifice 2000, you're (cDc) opening up anyone unlucky enough to run an attached executable or any other method of delivery crackers may design to a complete loss of privacy and control of their computer to anyone who knows just enough.
Its one thing to code this from scratch, run it from a command line, and analyze packets etc. Its an entirely different issue to slap a GUI interface on it, make it self installing, completely user friendly, *and* make it completely hidden from the victim. Not anyone can code or decipher IP packets, but when its so easy to take control and access someone's computer, you're letting the wrong kind of people into the toybox.
Conclusion: BO and BO2000 will not hurt MS. MS will release a patch (maybe) and move on to another software product (definitely). BO and BO2000 will simply hurt the people who use MS.
Its my hope the cDc would release a BO and BO2000 "detector and eliminator" and copyright the hell out of it. This way you're not only exposing MS' security flaws, but you're also protecting the people who might be exploited by them.
Microsoft is good at making interfaces that appear user friendly. They will claim that they can automatically configure XYZ, and then fail half-way through the process. They offer no details on why it failed
The fact that it takes them 4 revisions to get it right (four revisions they make us pay for)NT 4 is right? (Ok I know the first version of NT was labeled NT 3.1, so 4 should be only 2 or 3)
Of all the comments I've ever posted, this is definately one of them
Wait a sec...
In your post you said both
"WinNT is just as secure, if not more secure, than most Unix systems."
and
"I personally think that BO is dumb. Designing this program to comprimise a system that isn't designed to be secure is rediculous."
Is it just me or do your statements conflict with one another?
-Chris Andreasen
How about adding a little bit like needing the user to click a button to say "Yes, you may come in?" Perhaps even making and none of the secret accessing as default. Then you would have a decent argument against all the antivirus companies that will mark it as a trojan, which you know they will.
If you had a comprehensive remote control application that ran unobtrusively and efficiently on any win32 system, was released absolutely free and open source, and came with a comprehensive SDK for developing your own modules, plugins and clients for whatever platform you choose to use for administration, and it was released by somebody more "respectable" than us louts at the Cult of the Dead Cow, would you call it a threat?
Would you agree Virtual Network Computing (http://www.uk.research.att.com/vnc) goes at least some way towards meeting that goal? Without including the stealth features and self promotional posturing as our self-appointed security watchdogs?
You guys in CDC are obviously good programmers. If you're serious about protecting security, I hope you expand to probing other OS's too and not just concentrate on the Gates-bashing which too many here have an obsession about.
Eagles may soar, but weasels don't get sucked into jet engines.
Hey, I heard cDc is being courted with SHOE ENDORSEMENTS from both Adidas and Vans?!?!?!
WTF? I remember reading their freaky stories about people having sex with rabbits in the 5th grade. Now this. Crazy.
If I worked for Microsoft, I would post something like the above comment. I would downplay it before it came out, (typical FUD), and then I would scare people into thinking that their machines would crash if they used it intentionally.
Perhaps you don't actually work for MS, but I can see them trying to use this tactic. It will be a fun war to watch...
>available - so I doubt there will be any back
>doors (and if there are any - they will likely
>be caught rather quickly)
Just make sure you compile from the sources and don't just take a binary copy!
I also heard there was a backdoor in the original BO. Has anyone confirmed this? What info did it actually send?
--McFly
McFly777
- - -
"What do people mean when they say the computer went down on them?" -Marilyn Pittman
It's worse! The poll doesn't even have a "neither" option! You can't even pick a non-threatning (news making) option... :-(
Look at the poll results. Do far most people thing BO2K will either help or both help & harm.
These trojans, that exploit 'features' in the Win32 API, point to some serious shit. I hate Windows and all its familiy members. Not just because I think MS products are crap (I do - for many reasons), but because people are going to get hurt in using these systems. Now, I don't like that, but it seems necessary. If BO-like trojans keep on infecting networks, then maybe, *maybe*, MS will wise up and improve their OS-es.
Now I can hear people screaming "But people shouldn't get hurt!!!!" - ah, says me, MS should not have produced this crap in the first place. The people who stand to lose most are people like me. If a network gets compromised (or the computer of an employee), who gets the blame? That's right. Yours truely.
I segement my networks. I install filtering software (go linux/freebsd/etc!) *INSIDE* my networks. This allows me (and my fellow admins) to monitor the traffic easily and also quickly find out who has been stupid enough to allow their machine to be trojaned and educate them. No direct traffic is allowed to the internet. (Well, expect for my connections.. I have to play Quake, right?) But my users are protected for their own stupidity (yes, that's how I think about most people) and this safeguards our corporate integrity as well.
Bottom line folks...
Security does not end at your firewall. Monitor your internal traffic! It is very, very important. This also allows you to catch 'hackers' (ok, crackers) inside your own network. If you think that you have none, you are probably mistaken. Almost every joe I know has tried some Windows 'Hacking' Tool inside his work network. (Not only mine).
Remember, if things go wrong, *you* get the blame.
** Anonymous for obvious reasons.
Maybe that says something about you NT admin skills, because there's a whole lot of NT admins out there who love (well, like) NT, and it doesn't crash as often as a lot of people have reported around here.
Just an observation: It is hard to find a Windows NT zealot. It is far too easy to find a Linux zealot. The anti-Microsoft rhetoric (propoganda?) seen on places like /. is really an embarrassment to the Linux community.
Exactly!
In my opinion, the cDc isn't so much against the code of Microsoft, but against the organization of Microsoft. The code sucks, but there's a reason...
BO simply brings to light all the problems. If they were really problems in Windows code, they would be fixed by now. Instead, it's a problem in the way Microsfot HANDLES its code.
Personally, I'm all for the cDc releasing a program to remove BO. (Of course, hacked versions couldn't be removed on account of this). But a simple effort to help users clear up the mess will do alot to help allieviate the negative response the unenlightened give it.
"You know, Hobbes, some days even my lucky rocketship underpants don't help" -- Calvin
Microsoft's original response to Back Orifice says in part:
"Back Orifice" does not expose or exploit any security issue regarding Windows, Windows NT, or the Microsoft BackOffice suite of products.
VNC isn't bad... because of it's model, it tends to be bandwidth intensive and pretty slow. Back Orifice 2000 is a much more efficient (if less pretty) model for networked remote admin.
As far as turning to other OS's, well, that's a possibility. This is sure a hell of a lot of fun, though, and *nix users, at least, tend to already know what their system is doing at any given time ( or at least, they can figure it out), and thus don't need the particular variety of help the cDc has been providing.
"respectable"
Respectable is too subjective, I would think that the only difference between CDC members and me is; my thin veneer of ass kissing.
(No I don't crack, but my open source idealogy is in quiet contrast to the Luddite mentality of my employer.)
"Back Orifice 2000 is a tremendously useful tool for any administrator."
Agreed, I admin about 100 NT worksations, this could be a great tool.
"The Cult of the Dead Cow isn't just about scaring people into wanting real security. We want computers to be fully under the command of the people who use them, not the vendors who sell them."
I tire of Closed Software trying to take control away, instead of enabling me. Why is closed software always aimed at the lowest common denominator?
I am glad to see BO2000 and CDC is around.
"Think of it as evolution in action."
Keep in mind that the admin has to launch the client app. Just because the bug is out there dosen't mean there's no way around catching it. Just be wary of who has access to the NT deck, and don't launch any forign programs; I always thought that was the first 2 rules for being an admin. I can understand why everyone got so uptight with the older BO; beginner and intermediate Windows users are usually fond of funny little .exe programs that show a virtual puppy run across the screen or something. It goes to show how gullible some people are. But that should be a diffrent story for admins. I seriously doubt that any self-respecting network administrator will run a 40k .exe file to watch a few pixels do a dance...
Although it could always be a Freudian version of euphanasia. Who's to say?
-DeltaCrash
Correct me if I am wrong, but wasn't BO just a service (daemon)? And won't BO2K be just a service? In other words, in order to be installed, the user has to have enough rights to install a service. Under Windows 9x this is everyone. Under Windows NT this would be Administrators and Server Operators(?).
So where is the security hole in the OS? Seems to me it is a human security issue, something that affects every OS!!!
There are/were several sites that sprung up after BO's release claiming to rid your system of BO.r entVersion\RunOnce or RunServicesOnce or RonOnceEx. A more insidious user would change the default settings and most likely would not send you a pop-up stating he likes your porn collection.
If BO is run with its defaults unchanged, the executable shows up in the Registry under the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Cur
...Sorry but the cult requires me to curse you house etc... nothing personal, dont worry the pain only lasts for eternity... :)
La mayyitan ma qadirun yatabaqqa sarmadi Fa idha yaji' al-shudhdhadh fa-l-maut qad yantahi. Ph'nglui mglw'nafh Cthulhu R'lyeh wgah'nagl fhtagn. Zi Dingir Ana Kanpa, Zi Dingir Kia Kanpa
nmarshall
#include "standard_disclaimer.h"
R.U. SIRIUS: THE ONLY POSSIBLE RESPONSE
nmarshall
The law is that which it boldly asserted and plausibly maintained..
--Colonel Burr 1783
Nothing else seems to catch the attention as
a release of a backdoor.
I say as long as cDc are having fun....
...and allowing us to have a little to....
Then by all means, target anything and everything.
This is supposed to be fun right.
It was written somewhere that Microsoft was keeping "a close eye" on Back Orifice 2000. Could it be that they are somehow connected and can get a hold of pre-release coppies? I bet so, and I also bet that immediately after this thing is released at DefCon, that Microsoft will be ready with a quick counter as well as bug fixes and news releases, etc.
But still, isn't that unethical of them?
Calling out bogus battery capacity claims.
No process can run invisibly on NT. Period. Either it shows up as a device driver, a service or a process.
If you bothered to actually learn NT you'd know how to find out what's going on inside it.
cDc's not funny. They're a bunch of attention seeking people who are, I gotta give them credit for this, pretty good at getting media's attention (but media is pretty much a bunch of clueless morons).
-Filur
A modified Linux kernel is easy to detect, but
not with "md5". Read the source code. md5 does
an open() on the target file. It is trivially
easy to hook open() in the kernel, detect attempts
to read "vmlinuz", and return the original file
instead of the modified one.
Poof. Perfect looking signature and you didn't
even have to cryptanalyze MD5. What a break!
If the program still works than wouldent that suggest that Microsoft hasent done enough to fix the problems, and the sorce code will help them fix the problems but also allow people to exploit more.
Peace, Freedom and Linux for all
Please note that the Melissa virus got much media hype, as Back Oriface barely got a chortle. The media hype therefore begat public histeria, which therefore begat Big Brother's attempt to show the aformentioned histerical public that they knew what the hell they were doing.
Now, the fault lies with who? Microsloth, who makes products which resembles a piece of swiss cheese; or the person or group who exploits those holes?
Oh, by the way:
Note that MS really hasn't done much about the Back Oriface problem! They know it's there; hell, they even made the comment, and I quote,
"That vulnerability is completely theoretical."
Now then, if it's theoretical, WHY DOES THE EXPLOIT WORK?!? Perhaps it's a marketing ploy-
"Windows 2000 is completely unaffected by Back Oriface, created by evil, dangerous, and nazi computer hackers!"
Can you see it too, or is it time to take my medication?
I like the instant poll that they had on the CNN
site -- just how many of the type of folk that
can't separate hackers from crackers are going
to say that Back Orifice helps provoke security
enhancements? They are practically feeding the
"right" (never-question-microsoft) answer through
the poll. Hopefully, the results won't come back to haunt us...
Maybe that says something about you NT admin skills, because there's a whole lot of NT admins out there who love (well, like) NT, and it doesn't crash as often as a lot of people have reported around here.
Unix itself isn't open source. The free BSD variants (Net/Open/FreeBSD) and Linux are, Solaris sorta-kinda-maybe is, and the others I know of are not.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
Oh yeah, NT is such a horrible OS... C'mon, get real. It's a decent system and, even if it weren't, the "holes" in the Windows system that these crackers are exploiting aren't really holes at all.
BackOrifice is nothing more than a version of pcAnywhere that runs invisibly (more or less). This could actually be a decent remote administration tool if it weren't built to be used covertly.
And as for their claims that it's all to promote good security - Bullshit. It's such an ego-trip for them to think that people are worried about apps that *they* wrote. The fact of the matter is that their software doesn't do anything spectacular or innovative - it's just destructive. Olivetti Labs in England wrote something very similar under the name of VNC. It's for remote control of PCs. No one talks about them being at the forefront of security because they're doing it for the usefulness of the program, not the publicity.
The Cult of the Dead Cow (JESUS! What a friggin script-kid name!!) should all be shot.
Of course, that's just my opinion - I could be wrong.
...or psychotic.
If you're actually serious and in a position of authority, you scare the hell out of me
I dunno. This thing plagued our college campus for a few months until we got it under control. Our network is NT on a UNIX backbone.
I agree with the CNN article: this cult's motives don't make any sense; it's like a cult from the automobile industry who steals cars to make everyone get car alarms. It does much more harm than good. This is a negative way of getting attention to network security, not a positive way.
Exactly. A good example is Linux.
dirt has never been able to deliver on most of its promises- and the author is a charlatan.
Even in the original Back Orifice you could specify a port and password. While you cannot mask out certain IPs (which you should be doing at a firewall/gateway anyhow), strong encryption and authentication are probably a better solution for protecting your BO installs from unauthorized users.
Jesus. Yeah right :)
BO2K doesn't exploit bugs in the OS so much that it exploits the gullability of the users USING that OS. Windows 95/98/NT give a user practically full control over their machine. If I want to delete any file on my hard drive, you can bet that there won't be many things to stop me. If I want to upgrade my drivers so I can play a certain game, the OS won't be complaining about it. And if a friend sends me a cool program and I try to run it, then the OS will let it run. And no matter what that program does, the OS will let it do it.
In many cases, its more technilogically difficult to install BO2K than it would be to install a backdoor under a *nix based OS. If there are any known exploits on a *nix box (and usually there is), then someone could install a backdoor from remote. They could safely sit at their own computer halfway around the world and install their backdoor. BO2K requires access to the physical computer itself, or at the very least, access to a server where programs the user might run may be located at.
This means, ultimately, that a user HAS to be duped into executing a program. You can debate until the sun goes dead about the malicious intentions of the author, until the user actually installs the program on their computer, it won't work. This is the problem with giving a user too much control over their system when they aren't experienced enough to know how to avoid doing anything stupid.
So microsoft needs to fix this problem. How exactly would they go about fixing it? They could release a version of the operating system specifically aimed toward the clueless user, which severely limits the access a user can have to their own system. This could actually be useful in corporate environments, but your average home user might not want to go through several extensive security checks so they can upgrade their mouse driver. This kinda goes against the
whole PNP philosophy.
Perhaps a community written pamphlet, maybe 20 pages long that computer vendors could distribute with new computers, modems, and ISP's could send to all new customers, might be useful toward solving a lot of these problems. It could explain basic online ettiquite, how to properly conduct one-self in newsgroups, how to avoid the pedophiles online without sacrificing freedom. How to avoid spam, and basic rules about never running programs that people send you, not to forward chain letters, and maybe even touch some of those controversial subjects like how to properly monitor your children's internet activity without excessively invading their privacy at the same time. If such a booklet could be reproduced for free by the vendors for practically nothing, then perhaps a lot of these problems could be addressed without the need of virus scanners, censors, extreme security measures, or new laws that only infringe on the rights of law abiding citizens.
Just an idea.
-Restil
Play with my webcams and lights here
These people are just in it for the attention. You first have to install the trojan to even get it to work, which in no way proves that Windows has security issues (it does, but this isn't the way to prove it). If you've downloaded and installed the trojan without knowing it, tough break. Don't blame Windows, it's your own dumb-ass fault.
It's a tool kind of like a gun. You can do positive things(Hunt for food) or negative things(slaghter people). It really depends on how you use it. You could easily use this for remote administration or for destroying entire networks of data. It's all up to you.
You don't exist. Go away. --SysVinit Halt
You're a psycho.
Seriously.
It's people like you that make the Linux community look like a bunch of slobbering, idiotic, cultish clowns.
But the pids are hidden from /proc. You could go through and kill all pids which aren't listed but that is somewhat dangerous. I haven't chased down the source to kill (/bin/kill and the bash built-in kill are different) but I suspect they check for the pid before sending the kill signal. Patching those wouldn't be too difficult but what has to be patched next?
This whole issue is sortof like the Java applet vs. ActiveX controls. By design, Java protects your system from malicious applets (except for implementation bugs which can be fixed) but offers nowhere near the functionality of ActiveX. Every additional feature in an OS increases the potential for abuse.
I've read that the Melissa virus was first posted to alt.sex or some such news group. The author posted a Microsoft Word (or was it excel?) document. He did not execute it! The people who downloaded it executed it (sometimes without knowing it).
IMO, there is still room to argue that the post to USENET of the virus is protected speech. Not that you could ever find a jury that could understand the technicalities involved.
Taking your AK-47 analogy, he didn't go shouting it off in public, but he did leave a loaded one laying around in a public place.
"What is Microsoft doing about BO2K? Microsoft is closely monitoring the situation, and is committed to helping customers have a safe, enjoyable computing experience.
I don't understand why they don't just fix their Swiss Cheese Security Model ;) It's probably a bit late to post this, but it's very funny (at least I thought so)
Thats right, its open source!!! haha, windows sucks...
Opinionated Law Student Strikes Again!
"What is Microsoft doing about BO2K? Microsoft is closely monitoring the situationand is committed to helping customers have a safe, enjoyable computing experience."
(Read: MicroSoft isn't doing a damn thing about BO2K. We may have a few guys a DEFCON scouting around. It dosen't matter anyway, we already have your cash.)
Simpler terms: HA HA SUCKERS! YOU BOUGHT OUR PRODUCT NOW YOU'RE STUCK WITH IT!
You learn to weed through MicroBS gradually. It's a talent I guess.
It's odd; Win95 came out with all these new little features, and it was toted as bug free. Next Win98 comes out and it says it's "Improved". Again, the MicroBS- Improved means that something needed fixed in the older version. In other terms:
"Oops- there were some bugs in our bug free software, but instead of fixing them for free, we'll just make you pay again, fix the old bugs, and put some new ones in."
Please note that other OSes do this too, but they arn't as bug ridden or as hyped as the Windows brand. Now a new question is posed- why use a highly flawed OS? Can I get an amen for *nix and MacOS?
-DC
The correct analogy in this case would be the AMA infecting cattle with E. coli to make cattle owners produce cattle that are resistant to that bacteria. I'm not surprised he used an incorrect analogy: the right one would undermine the "popular" opinion that virii and hackers are universally bad, instead of good for flagrantly (and typically non-destructively) exploiting security flaws and shoddy programming.
Kyle
NP: Arkhe, S/T
--
Kyle R. Rose, MIT LCS
[ home ]
The whole OSS movement won't change for one trojan horse. In fact, it wouldn't change for 100.
Anyway, there's nothing to say that its not beneficial. I'm sure the code would be educational.
Just as a side note here, there are no current members of cDc who are teenagers. Yes, ladies and gentlemen, we are all adults. We all work for a living, pay our taxes, avoid breaking laws and live our lives the way we please within those boundries. Now, even though this isn't the right thread, I'm typing here now.
I will be using BO2K on my machines at the place that I work. I will do so with the permission and support of my CFO. The reason for this is simple. Using BO2K I can fix most common problems with my user's machines without having to leave my desk. I can tune in to a user's machine and see what they are doing wrong, and help them fix things. This saves me time and energy, and my time is valuable. The less time I have to spend monkeying around with users machines, the more time I can spend writing code.
Oh, as for privacy: I have a plug-in that I wrote that pops up a little flashing light in the corner of the screen everytime I'm monitoring someone's system. They know when I'm doing it, they also know I only do it when they need help and everyone is happy.
Did I mention that BO2k isn't a Trojan? It can be used maliciously in a trojan-like way, but the same could be said for any other product in this class.
obscure images/cDc obscure@cultdeadcow.com www.cultdeadcow.com
"remove nospam for e-mail"
:P
You have to remove the dot after "nospam" as well.
Exposing cows to E Coli is adding something to the lab that wasn't there.
Exploiting inherent weaknesses of a program is simply doing something with the material you already were presented with that someone else hasn't yet thought of.
In other words, reworking the genetic material that is already there.
It's pointing out the flaws and begging them to be fixed!
Whole must equal hole.
An aquaintance of mine who worked at a security auditing firm, upon hearing that a major client wanted to switch from NT to Unix decided to provide a demonstration of Window's security failings.
He sent an email message to a windows machine on their network that without even being opened installed back orfice on the machine using a known buffer overflow. Now that was cute.
You're absolutely right. I don't mind at all if you keep 3 tons of dynamite in your basement. None of my business, and I don't care.
If you try to use that dynamite to blow up something that doesn't belong to you, on the other hand...
The cDc is not installing this. It *is* available, but using the idea that if they didn't write it and make it *obviously* available, then someone would do it silently or such that it would take a while for everyone else to figure it out.
Why is anyone concerned, anyway? When I ran NT, I kept this off my machine (and other annoying trojans) by following simple security proceedures. Things that most people should follow.
My computers have never had a virus. I have been handed one floppy with material on it that I needed that was infected. And I found it right away and removed it.
Because I'm lucky? No, because I am reasonably cautious. I never trust my semi-skilled boss to be virus free. I never trust those "run this little program. It's cute." emails.
As for the argument as to why cDc released it; If MS doesn't care about the quality of their product (which they are only in as such it keeps their image good and makes them money) then their customers must be made aware.
I don't expect this to sway anyone. It seems most people are very biased into their opinions on MS and their win products. I really don't much care except to say that use the tool that fits and that is comfortable (in that order).
Ciao!
The Doctor What (KF6VNC)
that'll make it a real pain in the arse
Dirt is law enforcement's version of back orfice. Perhaps these security inadequacies are Microsoft's favor to law enforcement for certain priviliges?
1 1614,00.html
http://www.pcworld.com/pcwtoday/article/0,1510,
I think this is just giving the power that law enforcement has had for a while to the people and showing them how much freedom they're giving up.
... BO2K (kinda rolls of the tounge, don't it?) is more pro-WinNT that anti. The people working on it know a lot about the OS and therefore have spent quite a bit of time with it. In the short term it makes M$ look bad, but in the long term it actually improves their product. (That is _if_ they do anything to plug up the holes.)
What's even sadder is that this could all be avoided if M$ was as open as Linux and there was an open envionment for users to say something like "Hey, you gotta problem here, thought you'd like to know." and get a responce. That's not the way it works.
I guess the way I view it is yes, the ethics of giving 'fire' to script kiddeez is somewhat questionable, but as with Melissa and every other stupid hole in M$ software who's more to blame? The person pointing out the way to a wide open back door, or M$ telling everone not to worry, they're getting the most secure system around? Let me tell you that as someone who unfortunately has to put up with an NT network at present, it's a bit disturbing when I read about a hole in NT and see a link to an exploit _days_ before I'm notified by Micro$oft's security mailing list that there's even a problem, and then all they ever do is play it down and point out how rare it is and what little threat it is to my system.
Personally, I say more power to cDc. Somebody has to speak up and sometimes it takes some punk wiping out a network with a keystroke to get the right people to listen. All's fair in code and war. If it's not CNN it looks like somebodies already doing that. Maybe this time they'll learn.
Yes, and we are saying that the relationship between A and B is NOT equivelent to the relationship between C and D. You are understood. Others simply disagree.
Actually, NT has many exploits to get Administrator privileges from a simple user account. BO2k probably uses those instead of popping up a window asking to be run by the Administrator :)
Imagine and IS department making this part of their standard workstation build? They could claim that it is for remote administration but could also use it for spying on everything that an employee does on his/her PC. Granted, users shouldn't be doing anything questionable in the first place but still, there are some things that should be kept private.
If you a systems admin, and worth a crap, then you have plenty of free time and make good money, shut up and actually do some work.
I find BO to be most usefull in the remote management of my computer.
Having at one time or another had shoutcasts/ftp servers/webservers and anything else going, BO provided a really easy way to run/shut-down/reconfigure these...
The only thing I was worried about was that the server might provide a back door (go figure?) for the cDc... anyone know about that?
- I am ODiV, hear me type.
I'd really like to get a copy of this to try it out as an admin tool. (PCAnywhere can be a real hassle.) If I can use it to admin NT and 9x boxen from *nix boxen, even a little bit, I'll be real happy.
One of the great things about open sourcing it is that if there's something missing that I want (can I restrict access to certain IPs?), there's a decent chance I can add it.
I disagree. CODC releases BO to point out security holes. Their whole philosphy with BO is "someone else should fix the security holes". Their efforts could be more productively focused towards providing software to make systems MORE secure, not less (incidentally making them some bucks in the process). The security specialists can't churn out protection software as fast as the trojans (or virii, or whatever) can be released and proliferate, leaving us (system admins) stuck in the danger zone. This is just going to create one more headache for me that I won't be able to do anything about.
Doesn't it make more sense to have them (CODC et. al.) on our side instead of on the bad guys'?
"Tell me doctor, with all of your defenses, are there any provisions for an attack by killer bees?"
Wrong answer. cDc tried telling Microsoft about the flaws they've found. Microsoft chose not to respond. cDc decided that wasn't good enough. I think it's perfectly legitimate to release an exploit (especially when the individual exploits that make up BO have been around for some time, just not necessarily all in one package). It makes people aware that there actually IS a problem. Of course, Microsoft would have people believe that BO introduces the bugs, and that their software is bug-free. That's not the case, though - the bugs are already there, this software just exploits them. Also, as others have said, it's more plain bad design than it is just bugs.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
"...and quite a few of its admistrators are just plain dumb wher security is concerned"
Well it's certainly nice to know that MSCE="getting your moneys worth" especially with this new revelation.
Most detractors of the policy of the cult of the dead cow releasing back orifice label the practice as irresponsible, and juvenile. Yet what is the alternative? If cDc had quietly said to ms, "Hey look, we know how to exploit these holes in your OS, please remedy the situation," it would end there. The easy holes would be fixed, but the rest would remain open because only a small group of people knew about them. MS would try to sweep it under the carpet.
Given how widespread Windows is, this is really pretty scary. The information that was restricted to a few individuals wouldn't remain that way, and soon many crackers would know how to do what they please with a Windows box. Eventually, the public would catch on.
Compare this to the current scenario where the public is informed right at the start. This presumably should force ms into action. Seems like a better solution to me.
Thanks for letting us all in on your ignorance, though. Of course, if you haven't been applying the necessary fixes for the past couple of years, I could root your little Linux box at will.
Cheers,
ZicoKnows@hotmail.com,
who knows that most Slashdotters will believe it anyway
There is already a perl front end on freshmeat called "boscript". It looks a little out of date, but it would be easy to make a CGI interface from this.
It's even easier to do the same in a un*x/X-window environment. All you need is the magic cookie of your victim, and then you can make the X-server believes you're that very same guy, so you have every right he has.
I've seen all that stuff (remote mouse/kbd control punching holes in windows, locking remotely the terminal with a jigsaw puzzle) 7 or 8 years ago.
All you need is access to the right file...All you need is a careless or inexperienced user. You can type commands through someone else tty if he let it 'mesg y' (at least it was true a few years back).
I'm not an M$ follower, but Un*x systems generally need some admin work before achieving a decent level of security. It's just the same for M$ products. They can be decently secure, but it still requires some work, as the default behaviors are sometimes insane (Autolaunching whatever you received in your mailbox can be quite dangerous...).
Even the strongest castle is vulnerable to intrusion if you leave the main gate open and all the guards are dead-drunk...
It's good to know that the CDC has updated their
remote administration tools in time for W2K. These guys are really on the ball.
Well, this just goes to show how open source is not good.
People with bad motives are encouraged to distribute source
to dangerous programs like this one to gain attention and prestige
in a crowd of hackers and crackers who should have better
things to do with their time.
Aren't there laws against exporting dangerous products - that might
include source code to programs like this one. Actually a lot of open
source is dangerous in the hands of the wrong people - people
with bad motivations or merely incompetent people. For example,
so many Linux users setting up servers and internet domains
causing all kinds of headaches for ISP's.
Perhaps source code (to all programs) should be restricted as
to its distribution - only to certified software engineers approved
by some kind of industry standards committee. Anyone else
caught distributing source code would be subject to seizure of
the contrband and heavy fines, etc. Computers seem to be
dangerous tools in the hands of the wrong people - all this puts
national security at risk!
What is the difference, really, between open source and warez.
People worked hard to develop software and don't always like to
see their work made available at no cost to freeloaders. Those who
choose to freely distribute their own source code usually have
a hidden agenda - to do harm or unfairly comptete with companies
and individuals struggling to protect their intellectual property
and their livelihoods.
It's time to clean up this industry and put these hackers and
crackers out of business, along with their internet site which
distribute such "open source" software.
Hacker hacks computer A /usr/src/linux.bak /usr/src/linux and copies kernel config from linux.bak /usr/src/linux /boot /usr/src/linux and moved real source dir 'linux.bak' back to 'linux'
Hacker moves old kernel source tree to
Hacker unpacks kernel tarball to
Hacker applys backdoor patch to new kernel sources in
Hacker compiles kernel and installs it in
Hacker _REMOVES_ kernel source directory
Mallicous code binary kernel image not as sources. User cant detect backdoor by reading the sources becoz they have never been modified. The only way to find the backdoor is to use 'strings' 'e/grep' or 'truss' on the binary kernel image to try to locate the new syscalls, a wery hard job becoz he dont know what strings to search for.
Back orifice is a very nice remote administration tool. If it wasn't deliberately created to run silently and stealthily, they could probably have sold it for several hundred dollars a pop, and never made headlines anywhere (just made lots of money).
However, I take exception to your flagrant disragard for reality in your blind M$ bashing. I'm not a MS lover... far from it. I think their server tools are crashy, buggy crap. But their GUI end is better than any competing interface, even very pretty ones like beOS.
Microsoft, if you fault them everywhere else, is extremely good at making user friendly interfaces. You may complain about their inability to ship bug free products, their brain dead patch and upgrade methodology, their incompitent server technology, their flagrant monopolistic tactics... but you cannot fault their ability to make useful, usable graphical interfaces, and their continuation at the head of usability. (I admit I have a pet peeve when it comes to usability... I worship Jacob Neilson)
Microsoft created, on their own (ignoring their original theft of Apple's basic paradigm) most of the graphical widgets and design standards we live with today, even in Linux. It's no mistake that KDE and Gnome have a distinct resemblance to Windows... Windows has an excellent GUI.
Microsoft has a habit of releasing crappy products for versions 1, 2 and 3, and finally in versions 4+ they generally start sucking less and less until they really don't suck much at all (though, by then they are major bloatware also). The fact that it takes them 4 revisions to get it right (four revisions they make us pay for) is unacceptible, but once they do get it right, they do a pretty good job.
I guess I don't have a particular reason to bash on your post... it's not like it really really bugs me, I read and enjoy /. every day, and this is the first post such as this I've made.
The Raven
"I will trust Google to 'do no evil' until the founders no longer run it." Hello Alphabet.
yeah, it does... heh, boss walked in as I posted, and well, no proofing it... sorry for that extreme err.
2: It's MS' fault for having the security holes in the first place.
...
If I leave my door unlocked that doesn't make it my fault when you steal my things. You're still the criminal.
IMHO, this is more accurate:
"If I pay big bucks for a good security door/lock, but any thief can still break in easily, then the guy that sold me the door is the criminal. And the thief, of course. Everyone but me."
And now, imagine who are the guys that sell doors, who the thieves...
Pako
>>It should be noted that PC World Online has no >>independent confirmation that new Back Orifice >>2000 program actually lives up to the claims of >>Cult of the Dead Cow.
It should be legally mandated that any article speaking of upcoming Microsoft products carry a disclaimer similar to this.
.02
Brian Seppanen
Minister of Information and Propaganda
Area 54 The Secret Government Disco Labs Provo
And if you're running Windows, you get the whole hole.
For those who believe that Back Orifice 2000 is some malicious tool that may or may not cause untold havoc for win32 consider this:
If you had a comprehensive remote control application that ran unobtrusively and efficiently on any win32 system, was released absolutely free and open source, and came with a comprehensive SDK for developing your own modules, plugins and clients for whatever platform you choose to use for administration, and it was released by somebody more "respectable" than us louts at the Cult of the Dead Cow, would you call it a threat?
Back Orifice 2000 is a tremendously useful tool for any administrator, and will only become more valuable as hackers around the world (please note that I understand that word, and I do mean hackers) modify and extend it. Managing windows networks is a far easier and richer experience when you have something like BO2K to work with. Is it a mixed blessing? Possibly so. But the best way to make BO2K work for you is to use it, and understand it.
The Cult of the Dead Cow isn't just about scaring people into wanting real security. We want computers to be fully under the command of the people who use them, not the vendors who sell them. One way to make that happen is by convincing major vendors that they need to tighten up their products and make SURE that customers understand how to keep themselves secure, and that the products help them do that. The other way is by letting those same users get at the functional guts of the systems they use, without the layers of obfuscation and abstraction that characterize a modern operating system. Hopefully, BO2K will achieve both these goals.
Back Orifice 2000. Show some control.
There are *nix based controls, actually. I authored "gspot" myself, from the original *nix sources. It was kinda fun, though I get less respect from some of my co-workers. There's at least one other graphical control for Linux, too.
If you want gspot, you can find it on freshmeat.
BackOrifice is nothing more than a version of pcAnywhere that runs invisibly (more or less).
key words, "runs invisibly". now, explane why is it so damn diffaclt for NT to tell me whats going on inside? with linux this isnt a problem i can telnet in and ask it what running and unless someone has "fixed" top or ps i know whats running and whats not.
yea it maybe a ego-trip, but then most all of my programing is an ego-trip ie it is just damn kewl to tell a computer what to do and have it do it, and it is even better when other people find my program useful.
also try reading some of cDc's essays, they dont just hack, errr crack... some of their writing is just damn funny!
ps: Jesus can't save you out here, Cthulhu has eaten him...
nmarshall
#include "standard_disclaimer.h"
R.U. SIRIUS: THE ONLY POSSIBLE RESPONSE
nmarshall
The law is that which it boldly asserted and plausibly maintained..
--Colonel Burr 1783
Anyone know if the encryption between the client and server will be any better?
This sig is false.
The script kiddies are going to love this. I'm on a cable modem and run a Perl script called booby (see http://members.home.com/lazyx/booby which emulates BO. It's interesting to see how many script kiddies try hacking in without knowing everything they do is emulated and being logged. Most of the kiddies I see don't really know what they're doing, but I've seen some pretty malicious people out there.
The potential of this program is fairly large. If someone made an installer that would search out other systems on the LAN and install it on them as well this could be a nightmare (shudder) for Micro$oft shops. One more reason to not use M$ products.
Of course *NIX can be vulnerable as well to this type of trojan horse. The user security of *NIX may be better, but security is only as good as the user using it. The main difference, I believe, is that *NIX users are a lot more knowlegable about their systems and are much less likely to download and install software of questionable origins.
This post is encrypted twice with ROT-13. Documenting or attempting to crack this encryption is illegal.
A more apropos analogy would be that of the CDC (Ctr for Disease Ctrl) periodically releasing new and mutant strains of diseases into municipal drinking water to make sure that major hospitals are making their patients immune to illness in general, rather than innoculating them against many specific strains of many specific diseases.
All that the Clan of the Deceased Cattle is demonstrating - however effectively - is that M$ doesn't make the best mousetrap. But then who does?
-- What you do today will cost you a day of your life.
dident=didn't
:-)
wouldent=wouldn't
hasent=hasn't
there, got my anal nit-picking done for the day all at once!
(moderators, please demote this into the basement)
It should be noted that PC World Online has no independent confirmation that new Back Orifice 2000 program actually lives up to the claims of Cult of the Dead Cow.
Hmmm, if the author is running NT then perhaps one of you cDc chaps would be good enough to give him a quick demo? *grin*
Found it at this URL:2 .html
http://www.cultdeadcow.com/tools/bo2k/pr1999070
This sig is false.
Much love to the sysadmins of the world, but what you said is exactly true, and it contradicts your whole point. (Or is it your hole point ?) Guys like CODC and various nefarious virologists, trojan writers and so on CAN churn out security exploints for Windows at a phenomenal rate simply because there is so MUCH in Windows to exploit ! And to attempt to use their powers for good, as you suggest, is also futile. To make a third-party security program for Windows is to applying a bandaid to a cancer patient. The problems are inside, in the kernel, where your apps can't go, and where they therefore can't help. Sure, it sucks to be a sysadmin in this day and age, if you're in the all-too-common position of being forced to use an inferior OS by some guy in a suit, when doing so only makes your life a living hell and you KNOW better. But BO isn't targeted at chaps like you (and me, for that matter). It's a message addresed to the aforementioned suits, which says roughly "If you allow your ignorance of security issues to put yourself in an avoidable position of being vulnerable, we will exploit you." Less directly, it's a message to Microsoft reading "If you don't get your act together and kick out something that passes for a real Operating System, we will scare away all of your precious customers."
Unfortunately, this war, like any other, has left some innocent casualties, and from the point of view you espouse I would imagine you're one of them. But make no mistake, CODC are the Good Guys, same as Linus and Alan, same as anybody else you care to mention who fights against the woeful status quo of computing. At least, they're the good guys as long as the virtue you uphold is a secure and stable technology infrastructure on which to build a more connected future.
I for one am a patriot to the end.
Close, but even nastier:
.phtml?view&article=p52-18. It modifies system calls to make itself invisible and pretty much undetectable. The #include lines are mangled from the html display. Look at the source if you want to give this a try. It works on 2.0.x but I don't have the guts to try it on a 2.2.x production system.
http://www.phrack.com/search
They are being reactive if something has already been publisized. They would be proactive if the fixed it before that.
--
?
I say let 'em code it. cDc folks code, and go demo the software in front of folks at expos. If they were malicious, they'd keep quiet about it and use it for evil. This is HELPFUL. The emperor has no clothes. If I'm spending about $1000.00 on an operating system and it has easy exploits, I certainly would want to know about them - wouldn't you?
Microsoft does the same type of thing with their office apps and WebTV (OK, so they don't capture keystrokes - YET) but they don't tell you about it. cDc gets a post on CNN.
This is educating the consumer, whether he wants to be or not.
-----
"There are some things we don't want to know about - important things!"
Image for a quick minute what it would be like if the cDc used their programming skills for something positive instead of this lame script kiddie visual basic junk. Great now I have to audit my NT server first thing when I get to work tommorow.
I find the legal disclaimer humorous... A remote administration tool? hah. Thats some funny shit. Oh well thank god I use SuSE and OpenBSD at home.
Want Root?
If you're going to use this philosophy, you must continue on to say that Linux has never addressed the issue and hence must be doing an even worse job.
People, people, people. This program does not point out a single flaw with Microsoft, as much as I would like it to. A program like this could just as easily be written for linux, sco, hell - even openbsd.
About all this program does point out is the gullibility of the Windows user base.
Give a man a match, you keep him warm for an evening.
Light him on fire, he's warm for the rest of his life
Am I the only one who finds it ironic that the Centers for Disease Control and Cult of the Dead Cow have the same acronym?
We're going down, in a spiral to the ground
And how would you fix this problem? By disabling networking in NT or not allowing TCP/IP servers to run and bind to a port. Come on this is a problem that could appear on any server running any operating system attached to the Internet. Even Linux.
I'm disappointed in the author's use of his own opinion in this article. This is supposed to be a hard news story, not an editorial. He does present the Cult of the Dead Cow's explanation for why they write these programs, but then makes an argument agains them directly. He doesn't even bother to get quotes from anyone, but simply makes the argument himself. (He says something about "computer security experts" but doesn't elaborate.) This is just plain bad journalism. I learned not to do that in high school journalism class. I would imagine that someone who works for a major news organization like IDG would know better.
They are on our side. They're trying to get people to see just how utterly insecure Windows products are. If MS would accept responsibility for the flaws in their OS, then something could be done. If MS would take these things seriously and properly secure up their products, then programs like these would no longer be an issue.
;-D)
Besides, it's not like you can take a look at the NT source code and write a patch for the hole. That's one of the greatest advantages of an Open development environment. Things get done to FIX things. They can't patch NT or 98 or anything so they instead point out the problems.
It's not the greatest way to solve the worlds problems, but sometimes there's just no easy way to fight against Evil(tm)
(And please take the last paragraph with a sense of humor
So you'd rather unknowingly have your system broken into and abused on a regular basis?
-
I am ODiV, hear me type.
Why is anything in this country the way it is? I can only offer an explanation that, b/c this government is so unorganized, inconsistent, and opportunistic (etc, etc, etc, ad infinitum), things happen like that.
I can only wonder if he's got some big $$ deal with this, and maybe somehow, this keeps him in the clear....however, I wouldn't actually know, because I'm not that well versed about the whole situation (besides the article).
Insert mind here.
I don't think it would have as much of an effect on Microsoft's marketing machine if they were "good guys" than what they're doing. With this, they get the publicity (immaturely, but still) and companies are more likely to go, "hey microsoft, how come your little windows deal doesn't stand up to this? we're switching to linux, thanks."
..................................@ @
i dont display scores, and my threshhold is -1. post accordingly.
Discuss
Score: -50, Rant
It's about time! They promised NT support for Back Orifice last year. Well, their exact words were, "Soon." And I think it's just a delicious pun that they call it "Back Orifice 2000."
I'm sorry if anyone finds this offensive, but I consider NT to be inferior. Microsoft typically buys its way into technology, but it never takes the time to make any true advancements of their own: they bully companies into working only with them, and when these companies do, it becomes almost impossible to get software products or device drivers for non-MS platforms. When Microsoft "embraces & extends" they're only taking someone else's work, adding a few functions so it won't work on anything but Windows, and locking up the changes so no one else can make their product compatible with the MS version. They [Microsoft] then engage the marketing machine and have their minions in the trade press hype the crap out of the product; which many of these publications routinely do despite the fact that MS' product is really just a polluted version of a good idea. The point is, I am offended by Microsoft. It is deceitful for them to engage in the practices that they do. The great irony is that they claim to be leading the world away from weak, bug ridden software, when that is in fact what they produce!
I do a dance of joy every time a new virus is announced for Windows. Like Melissa -- I loved the fact that it only infected people using MS email clients. I believe Chernobly served as a point of awakening for many people who have only used Microsoft systems. Despite the belief to the contrary, Windows is just as difficult to install from scratch as some Linux distributions. It's a lot like "The Matrix" when these people who had spent their entire lives in this fabricated reality wake up. When they first run Linux they discover that this whole time they have been mindlessly sleeping in a pool of goo with their brains hooked up to some interface -- they discover they don't have to play by the System's rules: that they have true power.
This tool also provides something interesting. Imagine a remote administration utility so powerful, that you have more control over someone's computer remotely than they have in front of it. NT doesn't even ship with a telnet server! It's ironic what this tool does, because remote administration utilities are EXACTLY what NT is lacking in. And by the way, NT is supposed to be a "Network Operating System;" but an NOS that is susceptible to viruses? Unforgiveable!
So what's the big solution? I want everyone to be able to have the opportunity to write software without getting unfairly squashed. I'd like to see software companies get behind Linux, or at least the standard Unix binary that all the commercial Unix companies are pushing. This includes Microsoft, they can write their software for Linux if they want. If everyone sticks to an open, universal platform then everyone has a fair chance at making it in the computer business. When I originally heard NT was going to be POSIX compliant I thought, "Well great!" But that changed as Microsoft opted for "proprietary" instead of "open," so they could lock MS drones into using MS only products.
So, if the cracker ethic is a means to an end, let it be. Perhaps that is the true evolution of the [computer] species.
what impressed me was the poll, an overwhelming majority felt it would help. ((either help or help and hurt)) What set these guys off was M$'s arrogance. M$ has no incentive to plug the holes, unless competiton forces them to do so. right now M$ has the business community by the balls. The business community has no other alternative for the desktop.
Get used to fending off the efforts of some snot nosed kid with his VisualBasic. He will have free reign, because M$ doesn't care.
I like cdc, I think they are the ninties version of the yippies. Give em hell!!!
that the guy who wrote the Melissa Virus (and the guy who wrote the Chernobyl Virus...etc, etc, etc ad infinitum) is burned at the stake, and every government agency is telling the public how the Melissa virus author (who only exploited yet another security hole in MS shitware) is going to get 10 years in federal prison and like 2 zillion dollars in fines..etc,
meanwhile, sir jerkoff can freely write, release, and boast his backshit 5000 and is somehow viewed as the saint of security...saving the public from hidden MS holes and bugs!!!
dont get me wrong, i dont happen to see any problem with EITHER of these guys...but it pisses me off to no end when our lame-shit big brotherment treats twin-cases like black and white.
bah!!
A year spent in artificial intelligence is enough to make one believe in God.
If somebody is kind enough to alert me of my system insecurity, I will gladly reciprocate the gesture with my boot up their ass.
A witty saying proves you are wittier than the next guy.
according to the author of the article, we should just accept the fact that there are tons of security holes in windows, and instead of releasing a program that will allow the masses to be exploited, and force MS to fix some of the problems, we should let Windows users be attacked one by one, letting MS continue to write poor operating systems.
While I agree that anyone that uses BO just to cause trouble really isn't helping any, I think the fact that the program exists should make bug fixes be released faster. Raising comsumer awareness is a good thing.
Also, it's hardly like infecting cattle with a disease. The security holes are already there...BO just takes advantage of them.
Mystery meat = mad cow meat...yummy
The thing is, cDc is not INFECTING anyone. To use the cattle analogy, is difficult. They would be saying 'hey we're making Ecoli O157 available to anyone who wants it'. If someone then picks it up, and infects your local dairy farm... well, then you might have a problem.
Good or bad? I dunno. It still requires INSTALLATION onto the target system, which usually has to be achieved via some other exploit or local access or simple social engineering. So BO2K in and of itself is not truly problematic.
Similarily, someone installing a vanilla year-old Linux distro is probably going to find his or her system just as vulnerable. The difference here, is that Un*x boxes already provide a great deal of control from the shell. BO2K simply adds that control to Windows.
- Speed
Ok, I've got to say "me too" to this one. Somebody should moderate this previous post up to 2, at least. The example makes perfect sense.
If they *really* wanted to expose Windows NT's security flaws, they shouldn't have made the released the program to the public--maybe to a news agency, or security council, or whatever is appropriate, but not the public.
<tim><
This problem already does affect Linux. There
are published kernel trojans in Phrack magazine.
The issue is that in normal Linux installations,
the only way to actually use a BO-like tool is
to gain root access to the server first. When that
occurs, the means by which root access was gained
is almost IMMEDIATELY published and resolved.
You would "fix this problem" by ensuring that
users who run applications like mail readers that
have the ability to execute content provided by
untrusted sources would NOT at the same time have
the privileges required to install something like
BO2K.
It's not like BO2K can just point at an arbitrary
NT installation and magically infect it.
So if I substitute FDA approved meat processing plants in place of hospitals in my model...
That brings it closer to the example in the article, and I think that my angle still tracks.
If the (real) CDC taints the fields with new diseases each spring, to check for cattle resistance to the concept of disease rather than a particular one, then how can that be dealt with by the packing plant? They don't know what to fight. And we all know that a computer can only be made truly secure by making it useless. People are the problem, bad design/coding just makes it easier for the bad apple.
The point I was trying to make is that CDC is exploiting newer holes each time. I agree that this is of benefit. It's nice to have someone do your debugging for you (if you're the user or even M$ itself). And if M$ fails to close the hole after it's exposed then poo-poo on them. We have choices - too bad more people don't realize that.
I do, however, take exception to the CDC making the exploit tool available to the prepubescents on AOL. My experience with hackers has been that the good ones, the ones that know what they're doing, don't go around handing guns to children. They'll document it, publicize the weakness, perhaps even provide logic to close the hole; but with their experience comes a sense of responsibility.
Making a skeleton key and leaving it in the key-copy machine is irresponsible.
-- What you do today will cost you a day of your life.
Has the past Back Orifice been neutralized yet?
...etc after win 95. MS just made the space between versions 2 years so people wouldn't notice as much.
I haven't seen anything from MS saying that, so I'm guessing you have to look around for fixes.
cDc should also release a program to remove Back Orifice from systems.
I wonder why the guy put (mostly teenaged) in there. How do you get statistics for such things?
What will MS do when confronted? Probably give a bunch of excuses. They probably won't try to fix any of the holes, or will save those fixes for the next version of Windows that comes out in 2 years. I saw lots of articles predicting that we would have to pay for win96, win 97
If it was Linux, someone who doesn't want their site infected would probably go and look at the BO source and code a fix, and probably patch up some of the security holes. Or, if you were managing a site, you could do it yourself.
With MS, you'd either have to wait for a service pack, or go find a program that removes back orifice but doesn't patch up any of the security holes.
There arn't really any 'wholes' in windows 9x/NT that are being exsploted here. programs like this could be made for linux just as easyly, but they'd have to be run as root, and would probably be much more noticable
in order to get into someones system, you need to get them to run them, as root. since all users on 9x/NT have root acess(well most on NT) it a little easyer, that's the only hole though
_
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
Can anyone name an instance where someone has brought to the attention of Microsoft a fatal security flaw, and Microsoft provided a fix within a month of the notice before the security flaw became known to the internet community?
The fact of the matter is that MS, as most companies, do not want to spend large sums of money to correct security flaws in their product. In fact, the only motivation I can see to make MS correct such a flaw is the concern over market share when hackers shutdown paying customer's NT systems because of those flaws.
Just as pathetic is management not moving to correct a flaw when the fix is available. They only move when actually hit. (With perhaps a few exceptions in the financial industries...)
The analogies given might sound applicable to this situation, but they are really unfair. The reality is that neither MS or customers move to fix a security flaw until it actually affects them. It takes crap like BO2K, and script kiddies to use them, before anything gets done.
Do you guys really think that BO2K exploits new holes in NT to make it a more effective cracking tool? HA! Its just a rewrapped interface that exploits the same old holes in NT that haven't been fixed by MS. Perhaps there is a new twist or two, but I think its pretty disgraceful that the same vulnerabilities exist after one year of widespread notice. Why hasn't MS released patches to Win95, WinNT, Win31, & MSDOS v5 & v3.x to supplant the flawed LANMAN security protocols?
As egregious as it is to clean up after a security break-in or DOA attack, its probably just as bad to leave a company open to covert extraction of their intellectual product. That would be the result of "conscientious" security experts who only informed a software developer of a security hole and never released the information to the public to exploit.
Yes, you probably could use BO as a substitute for VNC/PC Anywhere. But the fact is that it probably doesn't have an option so that it can only be accessed withing your local network. So basically, anybody will be able to find it with a BO client and get into your machine.
Well, I guess if you use IP Masq or Proxy then it probably wouldn't find the other machine, but I wouldn't be willing to even take the chance.
That would be a good thing.
Let's see; coupling the latest NT relative path attacks with a Word macro and BO2K riding on EXPLORER.EXE. Wow. This is EASY and fully exploitable on any network that accepts e-mail. Perhaps we should write a Sendmail->Procmail HOWTO so that Microsoft Word documents are filtered out at the transport level.
The wheel is turning but the hamster is dead.
The wheel is turning, but the hamster is dead.
If they haven't truly fixed the holes released by the original BO, why would they change NOW?
No, if they're watching, its only to allow their marketing people launch pre-emptive FUD when BO2K gets released.
MS learned a long time ago its cheaper to convince your customer that they wanted to use a pile of crap than to make a product that wasn't crap. Competent marketing people are cheaper to implement than paying competent programmers to fix.