Slashdot Mirror
BO2K cracked
Ford writes "The BBC is reporting that Internet Security Systems has "decoded the protocols and encryption algorithms of Back Orifice 2000 (BO2K) within 24 hours" of it's release. Microsoft has only issued only a warning, refusing to admit that there might be security vulnerabilities in WinNT.
" The security agencies interviewed in the article are claiming that BO2k is child's play, and that they've already detection systems in place. I'm just waiting for the Defcon response to their claims.
Just tried Back Orifice 2000, cool stuff!
Is this one of the new features of NT 2000 ?
:)
I'm simply amazed that ISS could figure out the XOR and 3DES encryption included with BO2K.
I would have figured reading and understanding C source code was a bit out of their league.
Maybe they had some help.
-foo
geezz, silly media
1) cDc released the source
2) They stated that the default source only includes XOR and DES encryption
3) there is a plug in interface, so you can add whatever encryption you want relativley easily
4) Microsoft has too many "undocumented features" in there OS's
They call it a stupid child play in one sentence and an extremely dangerous thing in the next, i.e. everybody should still rush and buy their antivirus products...
Sounds like they've found the ideal way to both piss off the (cr)hackers and to fool the customers.
How would you solve this little problem of Trojan Horse vulnerability? Even Linux is susceptible, given a decent utility or application program to hide in that needs to be installed as root.
I can only think of one way to do it: Have the user be unable to run as a superuser entirely. To install something at root level, say a device driver, the driver install would need to be signed by a master DH key, or the OS wouldn't take it.
Frankly, this scares me. Being unable to master ones own machine? Why, that smacks of Microsoft!
Logic will indicate that if source code is provided, the encryption algorithm is there to be decrypted.
"But Graham Cluley, senior technology consultant with Sophos, said: "No-one got hit by it a year ago and we think it's going to be a complete non-issue now."
Maybe I'm being naive here but there are probably still systems that have BO sitting around somewhere just 'cos the users don't know they've been infected.
And for the more experienced users - it's a matter of pride for machine and personal hygiene that you don't mention to someone 'I have BO' or 'I had BO'.
Perhaps I've misread that paragraph - who knows - but the number hit certainly was not 0.
What with this and this company having the source code for it to write a detector with:-
Senior Technical Consultant doesn't seem that hard a job for that company.
-----------------------------------------
'Where do the omnipresent go on holiday?'
-----------------------------------------
All the self-proclaimed experts at ZDNET are always trying to show how secure NT is, and how Microsoft always responds to problems. Pure bullshit.
Whenever a security flaw or bug has been found in Windows, Microsoft has ALWAYS downplayed or outright denied it. ActiveX was shown to be a huge security hole, and microsoft responded with FUD, lies and bullshit. The SMB password block was sliced and diced with ease and Microsoft responded with silence.
But hey, the ZDNEtters will just cover the bullshit with whipped cream and Windows fanatics will continue to gush about how Bill Gates is so 'brilliant'.
Yay, another sad attempt to discredit cDc while making a big deal out of BO2K in the same breath. cDc's CDs were NOT infected with CIH, what happened was that some smart guy took his CD and decided to burn copies at DEFCON, and HE was infected with CIH. Perhaps if the media actually tried to get their facts right and stopped editorializing their supposedly objective news, I'd start taking them seriously.
You're overlooking how it manages to call a thread from another process and tunnel into it to hide itself. That's a serious problem all by itself. Please go back and do some research next time before you open your mouth.
Windows 2000/NT5 will come with a telnet server out of the box on all versions. Lots of neat WSH scripts too (someone told me a leaked internal build have a version of vi with it)
It's not anything new of course but a step in the right direction
What this whole debacle shows is that the so-called security experts have disabled a trojan horse, instead of pushing to have the bugs and holes the trojan EXPLOITS fixed.
Interesting philosophy. It ensures that the 'antivirus community' and other self-proclaimed experts will continue to have a cash flow.
I thought the whole point of Back Orifice was to showcase the insecurities in Windows, and to hopefully get Microsoft to address them. Disabling the trojan and NOT addressing the security problems is akin to sweeping the whole thing under the rug. Or, it's like addressing the hole in the side of the boat with a bucket. Patch the hole, you have no NEED for the bucket (but that would mean no more 'antivirus community').
--an anonymous Frobozz
Instead of killing, how about getting off your ass and looking around. There have been plenty of telnetd programs for NT around for years.
Yeah, right, let's give up on networking entirely. Not only that, turn off the computer, disconnect its power supply, and lock it in a bank vault.
Saying things like "taking computers off the network is the only reliable way to make them secure" is just refusing to address the issue.
I'm unimpressed by the whole issue. This program is more like PC Anywhere than a virus. If someone gets infected with this stuff it's most likely because the end user is nieve, not because their NT software sucks. God knows there's plenty of holes in MS's work...this isn't one of them.
Telnet servers have been available forever for NT (as is just about every other UNIX type tool). Indeed Windows 2000 Server includes a secure telnet server and Terminal Server.
Check out www.thirdpig.com. They have a version of linux with security granted to processes running instead of users.
"On the other hand, with NT, as soon as any user runs the trojan, the machine is wide open with full administrator rights for the cracker."
Is this anti-Microsoft "FUD"? I've yet to see anywhere that this product achieves a higher security than the installing user, and if it did it would be an OS hole and would be patched pronto.
You can get telnet for NT. And a bash or csh prompt as well. Just purchase and bolt on the third party POSIX API called Interix. For awhile I was leaving an NT box at home connected to the 'net through my Earthlink home account, and using Telnet and FTP to access it from work. Interix also comes with GCC, and if you buy the expensive version, the Exceed X server, an X11 implementation, and Motif. I've run X apps on my NT box from an X desktop on my Linux box.
Unless the NT user is running 'that shell script' with Administrator access, it wouldn't happen. (lots of people run NT everyday with Administator access)
You're supposed to be the hacker. You tell us.
In NT the cracker only gets the access of the user who ran the trojan. It's possible to run NT at a non-administrator level. Sadly, many users aren't aware of that.
What Back Orfice is really accomplishing is that the IS people at many companies are getting a clue now and locking down their NT workstations. An unfortunate here at my place of work who runs NT can't even install a Quicktime player now, because he doesn't have Administrator access to the machine on his desk. Thanks, BackOffice authors, you're making the world a friendlier place.
BO2K does some--interesting things which compromise the security of the machine, but as the article very rightly points out, it depends on user (un)knowingly running the program on the target machine. And as several other people have pointed out already, one could make a similar program for a UNIX box. So what is the cDc asking Microsoft to fix? Dumbass users? If they created a remote security exploit, that would be far more intriguing.
It says that youths can hack together trojans, and that if they can get inexperienced users to run them, they can gain illegal access to computer systems.
Can minors sue anybody?
I can see all the virus writers surfacing all over the place to claim ownership of their little critters, in order to sue their victims. Not.
It would be fun to witness, though.
That is probably EXACTLY what the company wants to do. When you take away the profit motive, you loose your BEST ally for controling and manipulating people. The next best idea is to play on peoples egos and emotions.
One way you could interpret this statement is that it is in the interest of Microsoft's customers for Microsoft to protect the integrity of their technology.
Bet you never thought of that possiblity.
I know a 30 year old who contributed to the cDc
when he was in high school in Lubbock. See 'Scarfing' article in cDc archives.
'Course it's silly, but he's still a hacker and
now on to much bigger projects than scarfing!
-kabloie
i dunno, ISS may have accomplilshed something major here. However, we must ask the question: How well does cDc comment their source code?
.do when compiled!
While i have not yet seen the source code myself, and thus have no way of knowing for sure, if it is badly commented then ISS may have had to have had experts spend upward of twenty minutes looking at the source code to figure out what it will
So stop laughing
I say we email as many writers as possible to get them to do some research on how pervasive BO really is.
Its a giant undisclosed secret about how many BO servers there are out there.
Call up some ISPs, get some numbers and then publish it. Win yourself a journalism award!
BO2K is largely a non-issue (well, until people start installing it on random web servers as a payload for IIS buffer overflows, but since Microsoft products are so secure and all NT web servers have up-to-date service packs and patches, that's impossible, right? Right?)
The real hack is that cDc managed to get practically everyone in security and tech media as worked up about it as they did through what's essentially a product announcement. That they did it with no advertising budget is even more impressive. Heck, anyone who can get a major media to put out a serious story about something called 'back orifice' is doing well in my books.
It's funny, but I almost suspect that the whole thing was a big plot to generate more beer money by having more media folk show up at Defcon...
c. [cpb -at- acm =dot= org]
That's just the first 1024 (or some number around there) ports. Anything above that can be opened by a user.
that was the most FUD-filled dribble I've seen in years. you've got a quarter tank of knowledge and an overflow of arrogance making statements like that.
in many respects, NT's security architecture (ACLs on everything, non-root daemons, no setUID, etc.) is STRONGER than Linux.
NT is a memory protected OS....
where standard procedure is to run it in your corp user account...
You do not need to run daemons via inetd.
Anyways, this isn't the point of the conversation! The point is not to discuss the technical issues of a similar utility but to discuss the fact it can be done at all and if such a utility constitutes the title "security hole."
I vote no.
What point - that if some idiot runs an unknown program on his NT machine it could be dangerous? Wow - revolutionary.
How many idiots out there still use 'xhost' based X authentication? Yeah - Unix is and has been a paragon of security these last 25+ years (I'm being as sarcastic as possible).
I'm sure there will be a clause or two to allow for the reverse engineering of 'harmful' software. The question is, isn't MS software synonomous with harmful? Heh, they're all hypocrites I tell you...
In short, maybe for you...but, I see it as a LOT more than "just a tool"
Hmmm. What about the C2 security rating? There are real Un*x systems with this rating. Only a company like Mindcrap can claim to do this with NT, and the witnesses must consume LSD.
/ bgates.jpg
And that LANMAN backwards compat. is a real NT security feature, too. (for the impaired, this is sarcasm)
http://www.attrition.org/gallery/other/mugshots
Here at the local community college the computer lab is populated by 50% PCs and 50% Macs. The PCs used to run 95 but h4x0rz kept messing 'em up. So now they run NT workstation. So I wanted to take advantage of the school's fast net connection and zip drives on every machine to download IE with everything (150MB). Go to MS site. Download, not IE, but a 500K app that downloads IE (and uploads God knows what about your PC to MS). Tried to run app. No go. Some shit about 'illegal access' or 'not enough rights' or whatever the fuck the error was I don't care (how is typing on a keyboard 'illegal'? Is US and local law codified into OSes now?). Went to a mac, EZ download. No problems. I suppose this is MS's fault on their IE download site. But why does MS need superuser rights on people's machines just to download IE, and there's no other way to get IE from MS without running their app. What's up with that?When making machines secure makes them useless for real work, your security is fucked up.However, other students doing ordinary things have also run up against NT stubbornness and the security is prevent work from getting done. Guess what? The school is getting ready to toss NT out into the dumpster. Way to go MS.
Modify the PATH= in the .bashrc to put ~/bin as the first directory and drop a wrapper for su in their bin directory. Instant root access. The moral of the story: don't run code you don't trust. You are an idiot to think your operating system can protect you from stupidity.
Elvis Costello's keyboard player uses NT? :-)
Or just have the program not only be a telnet daemon but also watch the keyboard buffer scanning for 'su' until it finds the password... then store it accessable to the user account that telnet is running from.
It's really not too hard to subvert any OS if you've got the user's help.
hitchhiker
What exactly would this service pack do? Not allow programs to listen on incoming ports? Disable them from running in the background? How about issue advisories against Laplink and PC Anywhere while they are at it.
And if you don't believe there are any trojans for linux, I've got a program I'd like you to run...
Righto. Packets with 4 byte length followed by
that length data are tagged BO2K. The Xor
encryption is apparently sent such that
key is easy to pick too. Src mods will
make that moot...
And you're what.. 16 years old?
.. and most others.. seem to think they are 14 years old or so. ;)
:-) And that they likely don't actually release the really nasty stuff.
Wake up and smell the coffee, friend. The cDc is a lot more savvy than you imagine, since you
Go to defcon. Meet 'em. Then talk about them. You might be surprised to find out that they are being silly on purpose.
Unless the linux user is running that shell script as root, it wouldn't happen.
Unless the NT user is running the back orifice installer as Administrator, it wouldn't happen.
Understand the point now? There's no security hole in NT here.
Back Orifice exposes no security holes in NT. It relies on "social engineering" to infect a machine - that is, to get a naive user to run an untrustworthy executable. Any general purpose OS is vulnerable to this sort of exploit, including all Unix variants.
The whole point of Back Orifice is to give its creators publicity. And it looks like we're all falling for it.
setuid Quake has numerous problems. I don't know if they have all been addressed but do not make anything from idsoftware setuid without restricting access to only a trusted group of users (like the other poster said). Search through the Bugtraq archives on securityfocus.com and you will find several problems with Quake. Basically, any user could read any file on the system or execute code as root.
Sorry, but I see nothing at all wrong with this quote. The "flaw" Back Orifice uses is to get the naive user to run untrusted code. There's nothing Microsoft can do to fix this. They're saying that if there was a bug or security hole here that they could fix, they would fix it. But there's no bug here. This same exploit would work against Linux or any other Unix.
If(When) a program like BO2K becomes available affecting linux, how quickly would the code be edited to stop such a thing, Trojan Horse or not? Very quickly, I say!
Sorry, but linux has no magical defense against trojan horses. No operating system that lets users run arbitrary programs does (Hint: that's every general purpose OS in the world today).
Oh, and if MS is "too busy with it's head shoved up it's rear end to notice" than how come they noticed this thing and commented on it? I think it's someone else who has misplaced their head.
Since you seem to have totally missed the above AC's point, let me translate.
ISS pointed out some holes in BO2K which make it easy to detect. Since BO2K is open source, it is easy to fix those holes. ISS just made BO2K stronger.
I love open source.
You can start a thread of another program from your program, stick your program into it
Yeah, because on Unix it's absolutly impossible to modify argv[] to mess with the process table.... hehe. For anyone who doesn't believe me, watch all those sendmail processes on a busy mail server.
That speech is pretty funny too. The best thing about all this publicity is it will make the job of a legitimate hacker (not as in justified, but as in corporate espionage or an ex-employee bent on vengeance) that much harder because now everyone will know not to open attachments, virus scanners will be updated, etc...
What exactly would this service pack do?
How about:
Allowing the equivalent of "su" so users aren't always logged in as admin.
Throwing out the innefectual user based security model in favor of an application based security model with certificates for new applications from trusted vendors, and a sand box model for applications from unknown vendors.
Nah, just ignoring the problem is better. Besides, I like the look inside my box -- why would I need to look out side of it?
Contributors to a discussion on the Slashdot Weblog pointed out that the code had been made simple to analyse anyway as it was "open source" and the hackers had made their point.
NO NO NO! He's not understanding the facts! AHHH!
Um, maybe you better read up on argv[] modification under Unix. Also, any program running as root under Unix has full read/write access to any process. *BSD is slightly more secure becuase of system security levels but you are grasping for straws trying to claim that having full unrestricted access on Linux is somehow less dangerous than having full unrestricted access on NT.
Memory protection? It steals the memory that an administrator level program uses, and sets itself up as a mean trojan. I know this is going on deaf ears, but seriously, there is
a) no "fix" to BO unless microsoft fixes the problems
b) BO isn't just going to die no matter what. There is signifigant interest in something like this. ergo people will code for it
c) it's not all a bad thing. I actually wouldn't mind administering a network with it. It's kinda like network administrator for the mac, on crack
d) Microsoft doesn't "do" security - it wants to be compatible more than it wants to be secure
e) Microsoft split from the standard OS, unix, and messed up royally. If they did a good job of re-implementing the time tested functionalilty of UNIX, then I would be fine with them, and pay the user licence fees for NT
f) The code is a mess. It just feels good to code for UNIX, and somewhat the Mac(although the newer stuff screws it up) because they are clean interfaces. No spagetti code, thank you.
My understanding was that even if a regular user on the box installed BO2K, the client could use it to gain Administrator access.
That's different from someone running a malicious program as root.
From what I understand, the network traffic can be encrypted and the port numbers are configurable; so, this thing could be setup to behave like https:// and could initiate from the inside net. The IDS (intrusion detection system), application level/layer 4 filtering folks are going to have a field day. Nailing BO2K down is going to be like nailing invisiable jellow to a titanium wall with styrofoam nails using a 20lb sledgehammer. I'll put my money on Network Flight Recorder to come out with a solution first based upon typical https:// transaction patterns.
They have a point? I Don't particularly understand the point of Back Orifice getting all this press saying it exploits security holes in Windows...I mean...It's just like getting someone who has root on a unix server to run some dumb program that has a huge backdoor, and that's been done before.
http://www.ntk.net/doh/options.html
(Thanks Virulent Memes)
BO2K doesn't take advantage of any security holes in NT. It runs as a system service that accepts connections and allows the client to perform a myriad of both benign and unbenign tasks on the host machine. Of course, it has decent legitimate uses for system administrators but it is being presented in a viral fashion from a group who's objective is clearly to pull the wool over the collective eyes of the uneducated computer user and media. If CDC was truly interested in "helping" they would cease this childish, "me too" Microsoft bashing and provide the community with something new and insightful. I'm sure they're having all sorts of little rallies and pep-talks with one and other about how they're "showing some control" when they're just showing their own contempt for the rest of us professionals that know better. I am, quite frankly, offended that CDC assumes we're all so naive to believe that they're doing us a favor.
To get straight to the meat of my post: this (BO2K) is not exposing any security hole. BO2K could be written for *NIX, BeOS, MacOS, etc.
People seem to generally miss the most important detail of all: the only practical way to truly lock down any OS is to remove it from the network entirely and allow zero points of entry.
In Linux the cracker would only get the access of the user who ran the trojan.
Sure it's possible that a Linux newbie might log in as root all the time. But what does a linux newbie have to loose anyway? The real threat is in the corporate environment, where the users are not going to be logged in as root ever. And most employees are much less likely to screw around like that on a Unix system at work anyway.
With Linux, while the threat of a trojan is there, the possible damage is much less severe, because of the limited rights of the user.
On the other hand, with NT, as soon as any user runs the trojan, the machine is wide open with full administrator rights for the cracker.
Yes, okay - I can agree with that.
My point was that BO does not show Windows NT to be especially bad at security - BO could have been for any platform.
But we agree, and this has been discussed enough, so I will stop here.
--
BO is a trojan horse. If you can get a user to run an executeable, you have him fscked. If I send someone a Linux executeable which modifies his login script to start a telnet server (modified to not require a login, of course) on some non standard (>1024) port, he has his account wide open. Anything he can do, you can log in and do as well. Is this a security flaw of Linux?
You cannot prevent users from doing such things, under any OS. As such I think Microsoft is right that this is not really a security problem in Windows.
Now, I do not know if BO gives administrator rights to the invader. If it does, then *that* would be a security problem. But letting people install programs is not.
Of course, you could make users unable to run programs from $HOME at all, but that would be unacceptable in many circumstances.
--
That's not the point either. The encryption algorithm was not meant to be strong. The only reason you'd want a strong encryption algorithm is if you wanted to use BO2K as a legitimate remote administration tool. Needless to say, that's not the real intended purpose. As a backdoor to somebody's machine, the strength of its encryption algorithm is completely irrelevant.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
VNC for BeOS (currently only the client) is in BeWare. Seems to work alright...I use it to talk to several windows boxen on my internal network.
You could also use Unix groups for what they're intended to be used. Create a group for local users ("local" is a good name), add yourself to it, do: "chown root qwcl; chgrp local qwcl", and set the bits so that only members of that group can launch the program ("chmod 4110 qwcl").
The speech sounds interesting, but only the parts that I can understand.
I would call giving every user root access a *big* security hole. (of course that doesn't apply as much with Windows NT, but...) Also, I'm sure BO2000 *is* a better remote administration tool than anything Microsoft has ever offered since XENIX. I would kill for telnet to Windows machines... (but then I'd want a *useful* CLI... :)
pb Reply or e-mail; don't vaguely moderate.
Yay, more ports to scan! ;)
But seriously, I've seen W2000 Beta 3, and I'm not impressed. It's bloated, and it crashes more than NT ever should have. And that's saying something.
pb Reply or e-mail; don't vaguely moderate.
No joke. Sounds like a dead end situation to me - you bear all the responsibility, but have no power to remedy the situation? And the people who can remedy the situation have no responsibility? How is anyone supposed to accomplish anything that way? :)
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
But it's not in Microsoft's interest (at least from their point of view) to protect anything but their bottom line. If it won't hit them in the pocketbook, they're not going to care. So basically they're saying "Fixing these bugs we won't admit to wouldn't be profitable to us, so we're not going to admit to the fact they exist."
How about that?
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
Or, rather, try to run Powerpoint as a user after installing it as an admin.
--
Ben Kosse
Remember Ed Curry!
All programs run with your rights. They effectively setuid to the user. This is *BAD* (and inherently insecure).
Eros is immune to these flaws (which also affect all Unix systems).
--
Ben Kosse
Remember Ed Curry!
Go download it.
--
Ben Kosse
Remember Ed Curry!
I haven't laughed so much since zipexplorer came out. ISS have wonderful marketing spin, I mean, how difficult is it to 'crack' things when you've source (as other people have pointed out). Come on Kris, I wasn't born yesterday.
I'm now waiting for a modified zipexplorer that includes the BO2K client, then we can all go back to installing proper email servers on our lans.
M-Sexchange no product has never been so well named
Martin
I don't know why so many people have posted about it being possible to e-mail a trojan telnet server to a machine, running on an unnamed port. Most forms of Unix still use the olde, quaint "remote" programs, such as rlogin, which leaves the nasty hole offered by .rhosts. That would seem to be a far deadlier security hole than the prospect of running a complete server.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
password.. salt.. hahahah (-:
You really don't even have the most basic understanding of the word "server", do you?
Good points, and I'm glad to read an informed view on this.
I think more people should do more research then reading zdnet and news.com on this subject. There are a lot of stupid posts above this one from people armed with disinformation. Quite simply, alot of them are missing the point.
Anyone who wasn't there to hear the introduction first hand, you should check out the 41 minute MP3 of it. It's a lot more interesting then most product announcements. Here is a link to a page containing the mp3. Pay particular to the cheers from the crowd every time they mention something stupid in Windows that contributed to the program.
Things like "remote threads". Seriously. You can start a thread of another program from your program, stick your program into it, and what do you know, explorer.exe is now also running rc5des.
For a good laugh, listen to the undocumented Win32 call used in the 95/98 client.
Discrediting BO2K is almost as dangerous as BO2K itself. You can't just scan for port 31337. BO2K doesn't have a default port, you have to put something in yourself. You can't just look on netstat for open TCP connections. BO2K can transport over ICMP. You can't look for a signature to the file, adding a random x=x; into it will change it.
Sure, you say, but how many script kiddies will go changing source code? A valid point, as most script kiddies can't tell a semicolon from a mouse. However, cDc has also released (surely not coincidence) a "pkzip-lite" style program that compresses/encrypts executables to random keys. File signatures are probobly the weakest form of "integrity verification" and that I"ve ever seen. As far as watching for network transmission signatures, you'd be amazed how easy it is to write around that. The important part is that your method not need be good! All it needs to be is 1 bit different. Insert an extra byte into a header. Write a silly wrapper to make it look like http data, or a real audio stream.
The biggest factor in this is the software's open source license, which allows all this and more to happen. BO2K is merely the first variation. Stopping it is ineffective.
The last big part is the spreading issue. True, the clearest way to infect a computer is to send it as an email attachment. A quick modification to happy99.exe would really spice things up. IIS servers are still easy targets on the real world. You won't get www3.microsoft.com, but you will probobly get www.joesfishingshack.com or similar. Imagine if someone combines a custom BO2K with a virus that is reasonably good at spreading itself.
Thats what I think, at least.
Squash
ISS (or fill in the blank with your favorite Internet Security company) said they "cracked" the encryption.
Yay!
But what wasn't mentioned was that the only way that they can find if BO2K is on the computer...
is when it's on the computer. They can only find the "encrypted" stream when the connection to the victim computer is already in progress.
So... they'll sell you their services to fix BO2K.. but only if you've already got it. There is no pre-emptive fix.
Which reaffirms the point that BO is meant as a means to rub Microsoft's nose in the fact that their products suck. If they wanted to be bastards, they could have kept the source to themselves.
J.
damned vulpine http://sb.drtwister.com/
J.
damned vulpine http://sb.drtwister.com/
Without knowing the specific motives or history, the idea was most likely not to provide a strong cipher -- encipherment isn't inherently necessary anyway for this kind of thing.
Or, they wanted to limit the potential for ITAR violations -- so that crackers could avoid breaking export law while busy breaking other ones.
Or, they wanted a deliberately weak cipher so that people would latch on and improve those parts -- maybe write a tight win32 IDEA lib.
Or, they realized that encipherment isn't an especially important part of BO2K anyway, since its emissions can be detected easily enough whether enciphered or not, so casual over-shoulder encryption was adequate.
Or, they wanted their counterparts in the virus/security communities to waste time on the encryption stuff, as the counterparts indeed seem to have done.
It would, in any case, be nice if those whose job it becomes to counter BO2K had taken the opportunity to note why BO2K exists, rather than to inflate their egos in a comical misassumption.
Uhh huh, sure. What would they do? Release a Service Pack? Offer a "free" upgrade? I think MicroSoft is too busy with it's head shoved up it's rear end to notice. If(When) a program like BO2K becomes available affecting linux, how quickly would the code be edited to stop such a thing, Trojan Horse or not? Very quickly, I say!
--
Dave Brooks (db@amorphous.org)
http://www.amorphous.org
Unless the linux user is running that shell script as root, it wouldn't happen.
-Richard, barbarian geek.
-Richard
Have you checked out VNC? It was actually designed for remote access, and I know there is a windows server and I am almost positive there is a Be client [maybe BeDepot, it isn't up on the vnc download site](though it will work in a java-enabled browser, anyways). It might be a better solution with all the coding taken care of for you.
Or, like me, they give themselves Administrator rights on their user accounts.
Why? Because I can't 'su' to Administrator to do administrative tasks. I would have to log myself out, log in as Admin., and then log back in as myself. That's idiotic, and it's the difference between being fully multi-user and Windows NoThanks.
And even if I did leave myself as a regular user, I would still need to have write access to the Windows\System (or is it System32? I forget, but it doesn't make much difference) directory in order to run M$ Office (note: RUN, not 'install')! This too is idiotic.
DFL
Never send a human to do a machine's job.
>Crackers often reason that
>they are performing a service
>in breaking into Websites and
>networks because they expose security flaws.
Oh so true...The best way to fully be safe from a "virus" is to be immune to it and what better way to be immune to it than to have recovered from an attack of the "virus".
I think Microsoft should start paying these people...maybe then they would release a safer W2K.
If water were beans, I'd be 70% beans.
This is, IMO, the one lie that more than any other keeps Windows in control of the OS market. People's only exposure is to an OS that runs everything as root and requires users to buy new anti-virus software every month, so they imagine that's the way things have to be.
Not so. Linux and *nix are fundamentally more secure than Windows, because they make adequate use of the hardware security feature known as memory protection. When a Linux user runs a program downloaded from who-knows-where, s/he runs it as non-root. (except maybe "make install", which is a weak point, IMHO) In contrast, W98 doesn't even try to be secure, and even under NT, users typically run every process with administrator privilege.
Wow, that must have been a HUGE difficulty, considering the source is available (get it at this site)
"ISS cracking abilities are viewed as childs play!"
DrWatt
...
Hmmm, Netcraft seems to be down at the mo ... but telnet on :80 says 'apache 1.3 (Unix).'
Interesting, because it definitely USED to be IIS / NT. No, really, it was !!
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
www.bbc.com is on SunOS. This is Boston Business Computing.
www.bbc.co.uk is on ... Solaris / Apache. I was wrong ...
But the point remains the same ... the same Netcraft app shows a bunch of high profile large corporations running IIS / NT ... even Windows 98 ?!?! (Gillette) ... so these must all be easy meat for crackers, right ? ... and then all their MIS people would be fired, and replaced with Unix hackers ...
I'm no fan of NT OR IIS -- I'm just saying that it's not impossible to make them reasonably secure.
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe
Ok the easiest way to have it installed is via a user running it from email. Remember that NT has been a victim of the good old buffer overflow exploit of late as well.
I have heard of BO being installed via the outlook exploit under 95. Ok so even if this was done under NT then you still get user rights. However what if I installed it on someones IIS server using the recent buffer overflow exploit, or again using the ftp exploit. These will give me access under the user System.
Again these have been patched, but I would be very suprised indeed if the last buffer overflow for a service runnning under NT had been found.
Ice Tiger
"Because we are not employing at entry level, offshoring will kill our industry stone dead."
Erm no this is not true, remember what one reads in a paper must be true. :)
BTW I suppose BO2K might be installable via an activex component, another secure microsoft feature. Oh yes before anyone points out about signatures and such, dodgy activex coponents have been used in the past by legitimate developers and then they get signed under that developers id.
Ice Tiger
"Because we are not employing at entry level, offshoring will kill our industry stone dead."
I thought this was the legal basis for the whole software industry. The software companies take no responsibility for their products at all, yet at the same time the end user has no rights that would resemble ownership of the product: can't modify, limited use, etc. Seems like a double whammy to me.
Aw crap! Now I sound like an open source advocate!
Scuttlemonkey is a troll
...source that is, :)
signal, noise, to me it's all the same.
the orginal BO include telnet functionality (a bit sketch tho) not sure about bo2k yet...
signal, noise, to me it's all the same.
I'm may be a lowly temp, but i do a lot of user support/configs. To me the og ob was _very_ useful (at times) I only hope bo2k is better and more stable. Although I don't think anyone else (sysadmin) around here would agree :)
signal, noise, to me it's all the same.
Ok, I'm seeing alot of disinfo about BO2K here. So let's address a few right here: 1. Breaking BO2K's Crypto: Of course he broke BO2K's crypto - the Generic, straight from the 'box' crypto is XOR encryption - which is simple to 'break'. That said, inseide the US, you can download a plug-in that will allow BO2K to use 3DES. Sophos did not crack 3DES. Even if he did, the plugin architecture allows a programmer to add any encryption scheme they wish, and BO2K will use it fore all of it's transfers. 2. Detecting of BO2K Well - to detect BO2K in one configuration, all IIS had to do is look at the threads, and it will show up. This could be what they are discussing as easily detectable. However it is also possible to get BO2K to hide quite effectivly by having it hop between threads, and use whatever ports it wants to. IIS could also be referring to the fact that BO2K uses the same registry key every time - and it does so on purpose which leads into point 3.. 3. BO2K is a virus BO2K is not a virus. Not even remotly. At worst it's a Trojan, but it is no more a Trojan then other packages like say PC Anywhere (and another one that I can not remember the name of - it starts with an S) Interestingly, some other 'remote admin' packages can also be installed over the net, or given as a 'trojan', or even be run as a hidden process. BO2K has many of the same features as similar packages, and has the same ability to be used for admin, as well as cracking. 4. BO2K is bad BO2K is what you make of it. It's a tool. it can be used in many ways - some bad, some good. It really has some very useful features. Those features again can be used as you see fit. I am not affiliated with the cdc, these views come from seeing their presentation of BO2K at defcon.
- The unexamined life is not worth leading -
1. Breaking BO2K's Crypto:
Of course he broke BO2K's crypto - the Generic, straight from the 'box' crypto is XOR encryption - which is simple to 'break'. That said, inseide the US, you can download a plug-in that will allow BO2K to use 3DES. Sophos did not crack 3DES. Even if he did, the plugin architecture allows a programmer to add any encryption scheme they wish, and BO2K will use it fore all of it's transfers.
2. Detecting of BO2K
Well - to detect BO2K in one configuration, all IIS had to do is look at the threads, and it will show up. This could be what they are discussing as easily detectable. However it is also possible to get BO2K to hide quite effectivly by having it hop between threads, and use whatever ports it wants to. IIS could also be referring to the fact that BO2K uses the same registry key every time - and it does so on purpose which leads into point 3....
3. BO2K is a virus
BO2K is not a virus. Not even remotly. At worst it's a Trojan, but it is no more a Trojan then other packages like say PC Anywhere (and another one that I can not remember the name of - it starts with an S) Interestingly, some other 'remote admin' packages can also be installed over the net, or given as a 'trojan', or even be run as a hidden process. BO2K has many of the same features as similar packages, and has the same ability to be used for admin, as well as cracking.
4. BO2K is bad
BO2K is what you make of it. It's a tool. it can be used in many ways - some bad, some good. It really has some very useful features. Those features again can be used as you see fit.
I am not affiliated with the cdc, these views come from seeing their presentation of BO2K at defcon.
- The unexamined life is not worth leading -
couldn't be bothered writing 'su' and then a lengthy password every time he wants to play Quake
chmod 1777You'll probably want to do the same for the "hipnotic" and "rogue" directories, and make similar wrappers for the other quake binaries. Shame on id for not writing a better installation script.
couldn't be bothered writing 'su' and then a lengthy password every time he wants to play Quake
chmod 1777cat >/usr/local/bin/squake <<EOF
#!/bin/sh
cd
exec
EOF
chmod 755
You'll probably want to do the same for the "hipnotic" and "rogue" directories, and make similar wrappers for the other quake binaries. Shame on id for not writing a better installation script.
(Sorry about the first one. I honestly thought the Preview button was on the left, not the right, and clicked Submit too fast.) :(
Just an aside. I was flipping through my video feeds and happened upon Pat Robertson announcing to his techno-illiterate hordes that "hackers" had released a new "virus" this weekend in Las Vegas (Sin City) called "BO2K". Pat seemed to think this was one more confirmation that the sky is falling, or whatever. To be honest, I was too busy laughing my guts out to pay close attention to his rant.
I did find it interesting that the acronym BO2K was never translated for the breathless masses.
Apparently "Back Orifice" is too naughty a phrase for good christians. Or maybe the just don't admit to their existance.
"...they may harpoon us, but they ain't gonna pick us up on no radar screen!"
Woohoo! The world is safe, unless someone manages to get their hands on the source code and come up with a variant.
The report is quite sanctimonious, reflecting Rouland's attitude (I suppose). Dissing crackers in such a manner, though, is just inviting trouble.
They cracked the encryption algorithm that it used. That's different. They probably tried to write their own. Figures, kids think they can come up with their own uncrackable algorithm...
> Now I doubt it would apply to viruses, as you would get nailed to a wall for it.
Of course, if you're already in the slammer for the next 20 you might as well try to drum up some income in case you can't get a job as a security consultant when you get out.
Sheesh, evil *and* a jerk. -- Jade
I guess it wouldn't have mattered in this case, since BO2K is GPL'd, but I wonder: If the software lobbies manages to ram through all their proposed laws that would illegalize reverse engineering, will virus writers be able to sue anti-virus companies that crack their code?
Sheesh, evil *and* a jerk. -- Jade
Actually,I think the oldest cDc member (in age, not membership) is someting over 60.
..
The youngest is 20.
And there's everything in between. For the most part the cDc guys are yer average white twenty-somethings (go figure)
I don't think it's right to lump all of them together as teenagers with delusions of grandeur, sure, some sort of fit that description (the ones that claim the hacker profile...) but the original guys aren't REALLY like that at all.
They are just some weird guys who released wizardry docs as text files when they were in Jr. High. oh, and some other stuff about rabbits.
Personally I prefer the text file aspect of cDc, the hacker part is a bit silly.
Screw this shit, I've had it/I ain't no mister cool./I'm a pig, I'm a dog/Excuse me if I drool./stm
Below is my summary of the article....
Sophos cracked BO2K. Errr wrote a detector for it. We don't know the difference though. But they figured out the protocols and encryption schemes. Ohhh buzzwords.
Those nasty cDc'ers didn't like Rouland and he showed them. He asked for a copy which is completely sensible as he's a good guy, but they don't like him. We won't mention that he wanted a copy before everyone else.
We think this will allow them to control other computers. But we aren't sure what control it gives you, so we'll just blather on. Oh and insult them. They're kids. They are even infected.
But not to worry any one M$ is right on top of it. They even issued gasp a warning.
Its a toy but ISS warned the program could easily be used to delete files, reconfigure machines, steal passwords and redirect network traffic, without a user or administrator's knowledge.
Isn't it amazing what toys can do now.
Pardon the sarcasm.
-cpd
One bookmark:
k .asp
http://www.microsoft.com/security/bulletins/bo2
Kaa
Kaa
Kaa's Law: In any sufficiently large group of people most are idiots.
The shell script would have to be run as root though, otherwise it wouldn't be able to edit /etc/inetd.conf. inetd also needs to be restarted for the change to take effect.
I suggest if anyone is really worried about it that you get yourself a copy of tripwire and figure out how to use it properly.
Need Free Juniper/NetScreen Support? JuniperForum
>>would-be hackers, or crackers as they are more >>accurately known
Atleast the writers of the article got this right.
(First Post)
You're right ... I never thought of that ....
So MS is kinda like an HMO: YOU buy the product, you allegedly benefit from the product, and it is COMPLETELY YOUR RESPONSIBILITY to do ALL the checking and qualifying of the integrity of the product (so that WHEN things go awry, YOU'RE responsible to represent your OWN interests). the product vendor has too wide of a userbase to care about your lone satisfaction ....
Is this what you mean ? Again, not an easy joke, but a request for elaboration and clarification ...
"He who questions training trains himself at asking questions." - The Sphinx, Mystery Men (1999)
"Trojan horse software doesn't target technology, it targets the user. If BackOrifice did in fact exploit security vulnerabilities in Windows or Windows NT, Microsoft would promptly fix the vulnerability, and BackOrifice would be stopped."
Does this mean (as we knew all along) that Microsoft is more interested in maintaining the integrity of their technology than the interests of their users?
Sounds like a really easy joke here, but I'm interested how else I could interpret this statement. Please reply if you know ....
"He who questions training trains himself at asking questions." - The Sphinx, Mystery Men (1999)
if you ftp to www.bbc.co.uk you get:
Connected to www.bbc.net.uk.
220 www2.thny.bbc.co.uk FTP server (SunOS 5.6) ready.
Pretty easy when they give you the source. Sheesh. Next thing you know they'll "decode" how OpenBSD implements IPSec.
I rather think the Cult's point is still made.
To me, this is more serious than the BO2k release itself. Denial of any problems makes it very hard to solve them.
(I'd love to go into the 'you shouldn't even be able to install such tools under a proper or well-protected OS' thread, but then I'm not really feeling like Mr. Unix Snob this particular morning.)
-fester
ps.. SECOND POST.. MUAHAHAHA *spak*
-'fester
just one real quick question: How much does it cost to get "Premier" Alert Service?
Seems along the normal lines of "We are not responsible for our software " (read the EULA). "We can do nothing about stupid users" "Windows is prefect, nope, no holes here."
Where is the "officially endorsed, M$ branded" NT remote admin. program? Anybody give me a link...
+&x
OK, i forgot to add this part:
"..and trick this clueless linux newbie
into running the shell script as root"
Do you think the Linux newbie, who most likely is spending 98% of his uptime being logged in as root because he couldn't be bothered writing 'su' and then a lengthy password every time he wants to play Quake, would even bother thinking about the possibility of being trojaned?
And anyway, the shell script could at least add a telnet daemon which allows password-less logins to the *user* account, to the user's crontab.
-- close but no sig
There's been "rootkits" available for most flavours of UN*X for as long as I can remember. If running a "undetectable remote administration service" constitutes a security hole in the OS, I guess the only OS that does not contain such a security hole must be something along the lines of DOS 1.0.
Writing a "Back Orifice Linux Edition" isn't exactly hard. Create a shell script or something similar, mail it to someone who have just installed Linux at his home PC, trick him into running it, and what-do-you-know, the shell script might just add a telnet daemon (suitably UUEncoded in the shell script) which runs at port 31337 and allows root logins without a password to his inetd.conf. Does this mean that Linux has a security flaw?
-- close but no sig
And which division of MS do you work for ? /.) most of the anti-social lamers seem to be part of this side of the fight, I have to disagree with the terrorist type tactics some of them use, but overall they are pretty amusing. I am sorry if it seemed I was ranting, oh and back to the original question, which MS division did you say you worked for ?
After the original release of BO and the way MS downplayed it, and now BO2k, it doesn't really matter if they are "a bunch of sad teenagers with serious delusions of grandeur" now does it. they've even released it under the GPL, for God's sake! which means it will be mutated and changed in ways that MS and the "anti-viral community" cannot even begin to keep up with. Yes Linux has security flaws, and they are fixed usually within 24 hours of being reported. The effect this could have is frightening, however I think that most of us out here that still have to use MS product are aware of the security threats and take precautions to minimize the risk. Linux is easier to lock down than NT and any sysadmin worth his salt is the only one who even knows the root password. It is much harder to hack a root password from a user account on Linux than it is to send someone an e-greeting card with BO attached. I don't think this is being overplayed by Linux advocates, I do know for a fact it is being played down to the point of being dangerous by MS advocates. The cDc is forcing MS to notice them and by doing that they just might be able to force MS to fix some flaws in their OS. IMHO this is a "Good Thing" I don't think any of the Linux users that have a decent IQ are getting cocky about NT, the fact is, it is less secure, more unstable, and frankly uglier than Linux. (OK uglier is an opinion not a fact) Oh and from the looks of it (just look around on
It only takes a few minutes browsing the cDc website to discover that they are basically a bunch of sad teenagers with serious delusions of grandeur. The sheer pretentiousness of this whole Back Orifice nonsense is truly something to behold - they've even released it under the GPL, for God's sake!
However, it's important for Linux users not to get too cocky about Window's security flaws, for it's only a matter of time before trojan horses start appearing on Linux. Remember that running a program as root makes your system just as vulnerable as any Windows platform. I'm sure there are plenty of anti-social lamers with a grudge against the Linux community who could certainly write something similar, if they haven't done so already.
-- briggers Remove blinkers to email me.
Completely true. Only, it's an old virus called "Good Times". Tell all your friends. ;)
Not quite, any nontrivial cryptosystem should be able to old up when it's underlying logic is examined. If that were not the case, we would all be walking around with hardware crypto-devices that explode when we tamper with them... and we dont do that... right? :)
I think that we are getting off-topic a bit.. ISS claimed to have figured out BO2K's crypto. I personally think that this is true. But it is irrelevant. What is important is wether or not they are capable of monitoring the connection between the client and the server for any and all keys known or unknown. I do not think this is true.
As for their analysis of the network traffic between the client and the server. That is trivial. Anyone with five spare minutes and tcpdump can do that. What is important is to recognize that this is all for nought. When was the last time that anyone took a look at how commercial IDS work? When was the last time that someone put together some programs that try to confuse IDS sensors by fragmenting packets, munging flags, tossing around impossible rst's, and sending packets slightly out-of order (but with good seq's)? I personally question ISS's (and all IDS vendors) ability to stand up to this test..
-jcw
Sure, I have some bias against big corporate "Information Security" shops. Especially ones where former hackers kick back in their leather chairs in Brooks Brothers suits, fly with AMEX corporate, and bill more bartabs to clients than the sparse meals that I (no longer in infosec) am used to now. This aside, here are some facts about the biz that may be of some relevance.
;) ) and know that 90% of the cio's dont talk to their hardcore engineers.
:)
1) The customer has the money.
Because of this, companies like ISS want to maintain a good relationship with their customers. If this means duping some CIO's into thinking that their "engineers" shit marble... then so be it. I know some people at ISS and I feel terrible about being so g/d damn angry at them (iss, not my associates)... unfortuatly, however, this is the way that it is.
2) The customer runs MS operating systems.
This is a whole different rant. The customer had some security with just the win9x being vulnerable.. now bo2k runs on NT and that is bad.
3) The customer likes being able to sleep at night...
Exactly, so what do we do to keep that happening and keep them as a customer??? We hype up some findings about some new threat and toss in some buzz words (fuzz words
I am still FUMING about the "we dont hire hackers" comment that Mr. Klaus said in an interview with someone (infoweek? I forget). I wont even talk about EY's "Extreme Hacking"... the hacking that is extreme "But has no nose rings".... well not since I left them, anyway....
Bitter, Tired, and wanting OUT of the industry forever..
-johnny waters... freak, hacker, and future bondage store owner
What ISS did was pretty trivial. The "detection" system simply looks at the properties of the network connection. When testing IDS systems at a client site, I found that certain systems, which I can not elaborate on, could not "see" connections if certain operations were carried out on the packets that make up the connection prior to their transission. This effectivly serves as verification of of Timothy Newsham and Thom Ptacek's excellent paper on problems with IDS software. :)
Here is the URL, thus absolving me from being accused of inventing this idea myself
http://www.nai.com/media/ps/nai_labs/ids.ps
Enjoy
-johnny waters, former Information Security Professional (Being a Dillitante is not so bad)
This story PROVES that cDc (Cult of the Dead Cow) is smarter than Microsoft. cDc made it open source, so if people point out problems (for example the encryption) they will be fixed. But Microsoft REFUSES to update or let Windows be updated. Therefore BO2K will evolve while windows remains static and vulnerable to these attacks.
Another thing, its not that big a threat if u are aware of what u are download and whom u are downloading it from. be open-minded, just because it is infamous for "hacking" u can use it for your business. its free and its better than any remote administration tool i have ever seen.
i would like to salute cDc on their wonderful product.
This story by Julian Borger, in today's Guardian (UK newspaper) contains the following:
"True to the hacker's word, anyone curious enough to log into the cult's website will find his or her computer automatically infected with a virus."
How true is this?
I find it really amusing, that such a group claims to be founded in 1984 - and they still, after 15 years, don't have anything better to do than write trojan horses? Writing that kind of stuff is something I would believe about 14-15 old kids do, so a little calculation - they formed cDc about the same minute they were born.. Quite an impressive achievement!
--
It has to work - rfc1925
Microsoft SMS (or Systems Management Software) is the product that MS endorses and brands for a remote admin program.
Sucks like shit, but its a product.
B
If BO2k is 'childs play' does that say much about the security of MS OS's ?
I just think it's funny that Mickeysoft denies that there might be any security flaws with NT. No system (computer or otherwise) is truly secure and NT isn't all that advanced of an OS. In my days as an NT network admin, I've installed countless hotfixes and security patches. There's no denying that NT is closer to wide open than bulletproof, but that doesn't mean that BO exposes any problems with NT itself.