Slashdot Mirror
cDc Charges MS w/ Distributing Cracker Software
davidr writes "Microsoft's response to Back Orifice 2000 has been to characterize it as a hacker tool instead of a network administration tool, because it can be installed stealthily and used to monitor users without their knowledge. cDc has reponded by pointing out that Microsoft's own tool, SMS,
does the same exact thing! They've called for antivirus software for SMS and challenged Microsoft to recall it. "
Read this one. Its interesting. Having never used SMS (hell,
I haven't really used windows in a year or so) I'll leave
it up to you guys to figure out if this is true.
Support.
If something doesn't work in SMS, at least we can pay for awful tech support from M$. This comforts PHBs, and is why people will continue to buy SMS.
thought it was hacking software. my mistake
It's just the general M$ marketing/FUD campaign rearing it's ugly head again. Anything non-M$ is bad, especially if it exploits programming short-sights on M$'s part. It's also bad because it's not under M$'s control, but it gives control to their own OSes.
The scary thing is that I wouldn't be surprised if there was built into each NT/w2k some back-door sort of thing like this, like a hidden easter-egg sort of back door, enabling M$ to get through any computer directly connected. You'll never know either, because the source is undisclosed. This, coupled with those pentium III ID codes can give them crazy access to what is happening where. Argh, maybe I'm paranoid, but then again I wouldn't be so paranoid if everybody wasn't out to get me.
"In a world without fences, who needs Gates" - somebody from LinuxToday
"In a world without walls, who needs Windows" - another person from LinuxToday
Actually your statement is (somehow) true only for the server part. But the real thing would be to control Win clients with Linux (which SysAdmin likes to run NT anyway).
This seems to me not much more than building the GUI and implementing the commands (i.e. just the calls, not the functionality) on Linux.
Maybe VNC can be hacked to support the display protocol of that BO plugin.
Cheezus, you can't even say "Microsoft®" w/o talking out both sides of your mouth; changing an API is called 'progress', the FACT that it breaks some unfortunate competitor's app is just a side effect (yeah, RIGHT), etc. It's just media spin and posturing for the clueless consumer. In this case PCAnywhere and dozens of other remote control products are also malicious viri that a user should be able to scan for.
Chuck
(AC in the field)
Thats like saying just because MS's products crash my computer, I can write a program to destroy other peoples computers.
I know I'm just going to get a ton of flack for this, so I'm being an anonymous coward...
I have to side with both MS and cDc in their own ways. I agree with cDc that SMS does the same thing and AV vendors should put signatures for it in their software. I agree with MS that BO2K is a malicious program and should be watched for (with the qulifier that so should SMS). My only problem is that BO2K is much more impressive in that there is a "management" client for just about every OS out there. SMS you need NT. That just makes it safer from the start (although, even that could be fixed).
The other point I would like to make is this: When cDc gave out copies of BO2K at DefCon, the CDs they came on had the CIH virus on them. Hmmm, sound like the work of professional "administration" software writers?
Also, now that BO2K is open source, has anyone found all the wonderful back doors? Anyone found a derivitative with back doors? Anyone have the time to find the back doors?
Could you post the url for wintop? I checked google and I can't seem to find it.
There are differances between SMS and BO2K: Bo2k is faster, easier, optimized, and has many more useful features.
Clearly the definition of trojan horse and "remote administration tool" has become blurred. We should reserve the term trojan horse for any program that [only] has potential for abuse. And instead of bad mouthing a peice of software or the people who made it we should bad mouth the people who use it for devious, illegal purposes.
One, cops are mostly not that bright. And two, the ones that are that bright have better things to do with their time than watch defendants walk because of illegally obtained evidence.
I live in SMS land. I disable it. I see no difference in either piece of software. Computers fucking suck. Sysadmins should suck my computer. Most of them are stupid (at least the point and click ones (Nt, Solaris, IRix)).
Why don't you set your PDC to delete your WINNT directory today?
If they even say it doesn't exploit any damn bugs, why the hell are they using BO2k as some kind of demonstration against Microsoft?!
Why don't they just call it remote admin software?? Why all the talk about "making MS listen" and such!!
Come to think of it, why even bother using the Back Orifice name? It has nothing to do with MS other than the fact that it runs on their OS.
This sounds like they were releasing a product, and then are replying to MS because they are accusing their product of being malicious.
Thats right! And you can buck-o. Just don't /use/ it for evil purposes and you won't get in trouble.
BTW, you missed the whole point. This article is about how Microsoft slams any company/organization that does something it doesn't like, even if it THEY do it THEMSELVES! There is no legality issues involved.
Admins can only restrict access to your local machine only if you're using NT and have NTFS, otherwise, if 9X is installed, it's simply a matter of modifying an ini, deleting some file, or doing a dos regedit.
SMS allows remote controlling of other computers. But in order to do this, the client has to be running the Remote Control program, which sits on the taskbar and blinks very clearly when someone is controlling your computer. This isn't exactly stealth. The person could easily close out the program which resides unhidden on the taskbar like a minimized program. There is also a line in autoexec.bat you need (something like SMS_SETUP=NT) which could be taken out. The client uses this line to report to the SMS server its unique identification which is used to remotely access the computer.
Same way that billions dollars of software is found. "On the Net".. Therefor your logic is flawed.
"Linux/FreeBSD/NetBSD/OpenBSD are free, therefor they must be used for kiddy scripting because Solaris/AIX/SCO/etc are commerical and no one can afford $3,000+ for an OS!"
=) Sorry..Just explanding on others viewpoints.
We need only look to animals to understand this phenomenon. It is the ritualistic king of the hill. ...), and claiming
In terms of the analogy, let's go with billy goats. They wander in herds. And think of Microsoft as
being a pack of unsavory billy goats, at the top of the mountain. They are big goats, and
genetically they are becoming more and more superior (through inbreeding
more of the terrain around them.
Okay kid, before you get too carried away with your analogy, please do yourself a favor. Go to the bookshelf (or bookstore if you have an inadequately supplied bookshelf), find any book on population genetics, and look up "inbreeding depression" in the index. Then, go to the pages referenced to find out what "inbreeding depression" actually is.
Yep, that's right. Inbreeding reduces fitness. It does NOT lead to "genetic superiority," as you surmise.
Both cDc and M$ are missing the point here. BO2K and SMS are both tools; they can be used for useful, productive work, or they can be used maliciously.
If I use a hammer to build a house, then it's a productivity tool. If I use it to smash someone's skull, it's malicious.
A tool (program, whatever) has no inherent moral value. It's not the tool itself, it the use of it that matters.
It has been determined that the popular "SSH" program available on most UNIX systems is a potential security hazard. Users connecting to this program can gain access priviliges identical to what they would have at the console with no audiovisual warnings being presented to the unsuspecting user sitting at the computer. This program, presented as an innocuous remote administration tool, is clearly actually a way for malicious hackers to take control of a system. We urge anti-virus programs to begin including signatures of the program in their databases.
Daniel
Undetectable remote control is useful, when
- you are suspecting an employee using his machine
for criminal acts, watching/downloading porns
and not being productive in any way
- you hold computer classes, especially during
a test. You can use it to help or find out
whether they are cheating
- you need to actually configure a machine while
someone is currently working on it
Provided that your are a sys-admin or in a similar
position.
AGGH!! MONTHS OF WORK RUINED BY SMS!!
Those fucking hacker bastards! They have to be stopped! I paid good money for a virus scanner and it never detected it!! Sons of bitches, all of them!!
That's it! I will pay up to $1000 for a professional tool that will detect SMS as the goddamned virus it is and give me an option to uninstall it! If such a tool existed I would deploy it across my entire enterprise, even gladly paying a license for each machine. Our work is too important to allow those hackers at Microsoft to fuck it up with their SMS hacker tools.
I can't work like this anymore. Our business could be ruined if malicious users continue to exploit our systems using SMS! What is wrong with the world here?
I hereby call on all anti-virus software vendors to detect SMS components and warn me about them. BO2k is small peanuts, they've known about SMS for years now yet haven't done a goddamned thing about it.
The atrocities must end here!!
What thing with blizzard?
alright folks,
Here's EXACTLY why BO2K is dangerous and fun and all that is the genre of sex-drugs-and-rock&roll.
http://altern.org/bo2kfun/best.html
A good rule of thumb is no electric potential, no danger... be sure to unplug the microphone and camera when not in "use"; keep hands away from
rotating machinery; wear eye protection when device is in motion.
They were grabbing certain non-blizzard registry keys when you attempted to connect to the battle.net service using a CD-key already in use.
Sure, there's a legitimate use for this.
You've actually caught a cracker in the midst of doing something nefarious on your network. You want to preserve evidence of his crack-in-progress, while preventing any further damage.
The best way to do this is to pull the plug. Assuming NTFS will survive an unclean shutdown, which it usually^Woften^Wsometimes will. Hence, a "remote kill switch."
Cool! ;)
How do we get some of those kinds of judges here in the states
You need stealth mode for your remote control software because your users are stupid and will kill it off if it's showing. Then when their system breaks and you try to dial in, you find you can't.
You have to remember that in the corporate world, system users are usually not particularly computer savvy and most often you have to spend more time defending the system from its users than you do defending the system from outside attacks.
Quite obviously Microsoft has some security geniuses working there. Like the ones that came up with MS Bob. Which will, if you get the password wrong thre times, helpfully offer to let you change it, as you've obviously forgotten it.
SMS doesn't mutate itself like a virus and isn't distributed and promoted as an open source hacker tool. Despite similarities, there is a BIG difference.
Obviously, the packaging, intended purpose, and the complexity of SMS make it unsuitable for use in cracking.
Arguing that SMS and BO2k are the same is unsound and ridiculous.
The only reliable way of seeing if someone is monitoring you is to run a network snooper on some other machine on the same non-switched subnet as your machine.
Actually you can do a 'netstat -a' in Win9x prompt and show listening sockets.
Bwaaaahaaahaa
LOL
the Feds already had a similar product before the cDc released BO last year. They called it DIRT (yeah, that's some spiffy acronym I cannot remember). I doubt that they use it anymore, though. If the suspect that they are watching is careful enough to spot DIRT, they know that law enforcement is watching them. If, OTOH, the suspect finds BO/BO2K, they may dismiss it as the attack of a script kiddie....
You've got the source code to BO2K... why not take the features you don't like out? Then you have a tool.
As you know, crackers already can make back doors, with or without BO2K.
Open horse software. Beware of geeks bearing gifs.
If MS is paying people to post stuff like that on /., they should at least get someone intelligent...
You're accusing BO2K of not being bloated enough?! That really reminds me of the recent article in Slate by that MS ex-coder.
"Scanning" and"open over the internet" is just buzzword-juggling. You can set a password (there HAS to be one as a default, according to the cDc press release), so others can't get in. And without internet connectivity, the whole thing loses a lot of its functionality.
I found it at this:
2 /
http://skyscraper.fortunecity.com/backstrain/87
It's some kind of cracker site
Those who think that the Feds don't like to gather evidence they can't use in court obviously have not heard White Knight (cDc member and private investigator) talk at past Defcons. He has proof of the FBI's using illegal wiretaps in a case he was on in FL. Check out the Real Audio of his talk @ Defcon 2
http://www.defcon.org/html/defcon-2.html
Apparently the feds frequently gather stuff that is inadmissible in court (wire tapes without a warrant) as they try to learn about the meeting places/habits of suspects. If they learn of an illegal event about to occur, and know where it is happening, they can set up surveillance equipment there in advance. If the crime happens, *that* will be admissible, and they don't have to say how they knew to have cameras/microphones in that location.
1. Remote administration in a business environment.
2. Alerting Microsoft of security issues with Windoze (fucking people's computers)
3. Fucking people's computers.
4. I am a script kiddie, so I will fuck the computers and then get arrested.
5. Promotion of quality open source software (while fucking up computers with your personalized version of BO2K).
6. Since I am such a nice person, I will send a personalized email to all the people I snare with BO2K telling them how to make windows more secure and the rules of safety on the internet. Wait...that is too much work. It would be more amusing to just fuck them and giggle inanely afterwards.
7. Tastes like chicken, err, dead cow...
8. No worries, everything will BO2K.
Use w3mail/agora
So when I
* put BO2k in a nice box (packaging),
* sell it as a professional remote admin tool (intended purpose) and
*add 5Meg of zeros to the binary (complexity=bloat)
would it then be a serious tool?
Oh yes, I know, that's just unsound and ridiculous...
No the point is that SMS is installed and authorized by the System adminstrators who have all legal rights to do so whereas the BO2K is not an administration tool and is installed without authorization.
Also SMS's remote control facility can be turned off by the user to prevent the admin from connecting.
I know this because I worked on the SMS team for 3.5 years from well before 1.0 shipped to a year before 2.0 shipped. They were very concerned about admins using the software to do things the user did not want them to do.
You don't. The PC you use at work likely isn't yours, do your job on it and don't screw with it.
"Tool of control" Oh please. What a bullshit us vs. them mentality.
Sorry, but he has a point here:
Very simply: if you do not own the machine you are running, why do you expect to have total control over it? You don't OWN IT. If you drove a van for a delivery company would you expect to be able to take it to Best Buy and have a stereo installed? Or have it painted a different color?
I run the network here at our company and I shudder to think about this mentality. For starters I would be VERY pissed if I found users disabling SMS.
I use SMS 2.0 for software distribution, and software and hardware auditing. We here in corporate MIS have to fight a constant battle with users doing such dumb things as installing illegal software on their machines (we the company end up being culpable for this action). I have even had users trying to install soundcards in their machines!
I for one am VERY happy that Norton AntiVirus identifies Back Orfice as a trojan.. Makes my life easier.
Where is the Linux "lockup" command?
startx
What you will hear from lawyers if there were a slander case against M$ is that the cDc proclaimed BO 1 as proof that the Windows world was totally insecure and could be comprimised with a relativly simple trojan horse. The cDc called upon M$ to admit their product was insecure. This paints BO as a tool to infultrate, not monitor and defend. Comparing uses and features is meaningless, preception is the only thing that matters, legaly. It's a matter of public policy, not law.
So there are two 'tools', one expensive and requiring a bit more setup than the other. The other free with a few (mis?)features that
could be used maliciously.
What's the difference?
The expensive one is more to set up and thus more
*likely* (not certain!) to be known by the
'victim'.
The expensive one doesn't have all the (mis)features (hunting, etc),
and there is concept of support with the pricy one.
Both *can* be used for Good.
Both *can* be used for Evil.
Fire can cook our food.
Fire can burn our houses.
Yes, more people will have the free one, and of
those some (or many) will be malicious.
More arson is done with matches than with flamethrowers. Go fig.
Is the Big Idea that anything with _potential_ for
malicious use must be made expensive so as to
dissuade folks from Evil as they will have too
much invested?
This would be effective, but is it the Right Thing?
-
Rifles aren't inherently evil (let's not start a gun-control flamewar here), but they can be used
.22, they were designed for different purposes but an inventive enough terrorist can manage to use the .22 instead in a pinch.
for evil purposes. Same principle with BO2K.
Like an AK-47 vs. a
SMS also requires you to login into the SMS Client software (MS-SQL Database) in which you need to have been granted access to remote control feautes before you remote control. I gues you could setup your own SMS database and MS-SQL server and join the computer to that domain (not NT domain, Micro$oft loves to call a lot of different things a domain). Next time the user logins he will see sms.cmd(bat) kick off though.
It's funny because it's true. Ahahaha.
[Actually, Outlook can't crash NT. But it's still funny because most Linux nerds _think_ it's true!]
Thanks for a rational thought. How many times have you seen "for educational purposes only" used to legitimize an act or material that is clearly not meant for the public good. I got hacked by a script-kiddie. He's now computerless and lucky he's not of the age of majority otherwise we'd have prosecuted the hell out of him. Angry? Yup. Why? I've got a business to run and people who masquerade themselves (be they MS or cDc) as saints doing us a favor with all their "helpful" tools are a pain in the ass.
There was no point to his actions, there remains no point to his actions, and I'm convinced that as soon as the cops give him back his PC he'll be a nuisance to someone else.
The upside is we patched the holes. Jolly good for us; we took hours that could've made the company profitable and pissed them away on some juvenile halfwit.
At some point all this crap will cease to be amusing. I wonder how many of those out there who think h/cracking is "cool" have had their families bankrupted and spent some time with truly undesirable people.
Just my $0.02 (or perhaps more). These losers piss me off.
Let's not shoot ourselves in the foot by jumping on the bandwagon of every anti-m$ attack that comes up, no matter how valid or invalid. Doing so just makes Linux users like like whiners with who will criticize just for the sake of it.
BO uses more than just the stealth technology that hides itself from the person who's station is being "administrated". It also has the "convenient feature" of attaching itself to the executable of your (or somebody elses) choice and installing itself covertly. The difference between this and a virus is difficult to find IMHO.
I think us Linux advocates should be careful of who we associate ourselves with, lest we be tarred with the same brush.
of course that's just my opinion; yada, yada, yada...
Watch out for your logon script executing a program that puts SMS back onto your box. Most SMS installations had the client installed that way in the first place.
Sorry about the anony - I forgot my passwd - it's in the mail.
Yeah like those punks that wrote system32. Also if there was a way to define least privledges in windows it could be made secure but, that won't happen cause you would have to get a software company to write it and they would fold before release. Punks.
Lightman
Mr. Potato head, backdoors (trojans) aren't secrets!
Well unless you use xdm (which makes it inconvenient if you want to drop into the console easily) to run X on a linux box any passworded screensaver (Xlock/xscreensaver etc) can be bypassed with control-alt-backspace, which kills the whole X session and drops you into the users shell. Even if you disable control-alt-backspace ("dont zap" in XF86Config) you can still switch VCs to the one where X was started and suspend/kill it gaining access to the users shell.
Of course I would be delighted to be proven wrong on this.
Ethan (too lazy to create account)
You forget easily, I see
[ms_techie] hello. this is Microsoft tech support, how may I help you?
[clueless] yea, hi. I'm having problems with a some of your software...
[ms_techie] yea, ok...
[clueless] yea...well, I'm having a problem with SMS...it seems to cause the machines to lock up
[ms_techie] ok...
[clueless] any suggestions?
[ms_techie] yea, wipe the hard drive and reinstall.
[clueless] but will that solve it? this was a fresh install of NT as it was...
[ms_techie] it might...dunno, just try it
[clueless] ok...
*click*
*after spending hours reinstalling and configuring*
[clueless] ok, here goes...lets see if this works
*crash!*
[clueless] OH BEEEEPPPP BEEP BEEPPP BEEEEEEEP!!!
The wonders of Microsoft Tech Support Ladies and Gentlemen...
Oh but there's more...you payed $1,000+ for it, PLUS you spent an additional amount for the extremely helpful [sarcasm] tech support you were given by "ms_techie"
I'm sure you feel your money was well spent though, I mean after all...you probably learned something about installing NT that you didn't know before, and that in and of itself is worth the $1,000+ you payed
Okay, feel free to flame me, I deserve it.
My stupid question:
What IS SMS?
(No, I honestly don't know, I have better things to do than keep up with M$'s latest release)
i was reading 2600 (for entertainment, dont tell me you have never read it) and one of the letters mentioned an admin who uses BO for remote administration. the editors expressed that they thought that this was a bad idea and the admin was lazy, the point is he was using it for a legitamitely.
you made some good points
;-) The last one is going to replace our p90 Linux box that currently serves as an email server, dns, applications server (netscape) for our Unix users, NFS, and Samba (a p90 can do all that??? damn!! heh)
now from what you said, it sounds like you are a MS advocate (your tone suggests this) however, you in many ways pointed out many flaws in Windows (all the virii for instance)
Go to almost any hacker web board and you will see how almost all of them are trying to break into Unix systems (much to my amusment) and are NOT trying to break into NT, as you suggested.
the other point I wanted to make was this:
I just setup 24 new Dell machines that we got this week and distributed 23 of them to users who will be moved of off our ancient Unix servers (2 servers at 50MHz each - we have twin NT servers also, 1 is a quad pro 200 and the other is either a dual p2 450 or else a quad p2 450, I think I was told it was a quad but both servers were setup before my arrival so until I need to open up the cases, I will never know
Anyways...were was I going with this? Oh yeah! I had give a demo to ~20 of those users so they knew how to do some basic (and I mean basic) NT stuff (like creating folders/sub folders, defragging, etc - hard to immagine huh? I dount this is the case for most places but it was still humorous to me)
so your statement about how "everyone can use Windows" isn't so true afterall
no, the "client" is the program that enables the admin to control the "server" software that is on the remote machines
admin --> [pc w/client software]----ethernet line----[pc w/ server software]
Actually I believe we technically live under a representitive republic where many choose to dodge the constitution when it suits them.
That's "liable". "Libel" is a completely different crime, akin to slander.
Every tree and node in the registry is secured via ACL list.
I thought it was traditional to have each iteration create a subdirectory as well as a subprocess, to race the filesystem and the process table and see which fills first.
Doesn't NT need HAL for, um, all its drivers? Is removing it even an option?
Through the wonders of mandellian (sp?) genetics, hemp for industry is bred to be stronger, better, yadda yadda, and you'd have to smoke about a field of it to get high.
Of course, there's specialized breeds for use as a psychoactive drug.
SMS doesn't mutate itself like a virus
You seem to be implying that BO2K mutates itself. It does not.
and isn't distributed and promoted as an open source hacker tool
Linux is a hacker tool. Hacker != cracker.
BO2K is promoted as a serious administration tool. Check the cDc's website if you are in doubt.
Despite similarities, there is a BIG difference.
Absolutely! Here we agree. While SMS is a proprietary closed product. One can audit the BO2K source to know exactly what one has running on her sistem. If one finds bugs, she can fix them. BO2K can be easily extended in functionality by user written plugins. BO2K is obviously the superior choice.
>It all comes down to who cDc is. They probably
>will never be taken as a legitimate
>organization, so their products will be labelled
>as virii/trojans...
And you're saying that M$ is a legitimate organization? I live very close to Redmond, but I still feel they shouldn't be in business anymore.
Well, the equivalent of the Win login would be xdm, so your comparison is not quite approriate.
But essentially X is just another program if started from the console.
Is there a tolock the console? Could this be combined with xlock?
Rombuu, specifically answering his question would have been more helpful than just flaming him.
He doesn't mean HAL as in Hardware Abstraction Layer, he means HAL as in the HAL 2000 artificially intelligent computer of 2001: A Space Odyssey.
If you find the security so problematic, why don't you assist the security and developement of BO2K by at least posting an exploit to rootshell.org, or perhaps bugtraq?
Further it is GPL'd so if you have some semblance on how to fix it, you may consider issuing source code modifications.
As an aside I believe the only crime commited with the cDc's release of BO2K is that they did not get an automated source/bug tracking facilities launched.
BO2K is promoted as a serious administration tool. Check the cDc's website if you are in doubt.
And Windows NT/2000 is promoted as a robust above-the-state-of-the-art enterprise server. Check Microsoft's website if you are in doubt
PURE BUNK!
SMS only has that same functionality IF YOU HAVE A LOGIN/PASSWORD ON THE SQL SERVER DATABASE THAT SMS USES FOR ITS BASIC OPERATION. This basically means that the person doing the remote-controlling is in a position of authority, and not using it for malicious purposes.
It all boils down to system admin procedures, and how well you have your own network governed. If you don't trust an administrator to not maliciously remote control someone's workstation, DON'T GIVE THEM SMS ACCESS VIA THE SQL SERVER. Simple as that.
Karl (karl@weckstrom.com)
I believe "we" live in a variety of different countries with different systems of government, but perhaps you're talking about a different "we", it's difficult to tell whom you mean.
then it isn't breaking and entering if someone comes in
If someone comes in when not invited, especially by specific means that normal people don't use, then he can be shot. It should work the same with computers.
I use XDM all the time. Add the following to passwd:
:-) just a curiosity though, what if one is using Linux on a non-intel computer such as a Apple powermac? AFAIK those do not support any passwords to protect against these attacks (at least OpenFirmware certainly does not protect itself in the least)
xdm::0:0:XDM:/root:/usr/X11R6/bin/xdm
Just type xdm at login: and it comes up.
This is an interesting idea, but does it not open a whole other box of security problems adding a second root user with no passwd? (especially with networked machine)
Don't forget to set a password on LILO so people can't just boot single. Set a configuration password in BIOS and disable booting from floppy and cdrom as well.
but of course
Ethan
vlock is the most common, I have not tried "lockvc" but would either of these do any good for those who run X from thier console session?
what would be nice is if there was a way for xlock/xscreensaver to prevent switching to the original console (from where X was started) this would have to be combined with either the ability to disable Control-alt-Backspace on the fly of just configuring X to ignore that altogether...
Ethan
I do NT admin (both desktop and server) and Outlook can and will hard lock my desktop. This is not a hardware problem because the hardware is on the HCL and has been thoroughly tested, being as the machine did database work without crashing for 6 months or so before I got it.
I mean, he did all sorts of reasonable things to prevent SMS from spreading.
Can you say SATAN? I thought you could. That is considered an essential system administration tool. All that does is scan for potential holes in your network. DOS holes. Openly accessible files. Rootable holes.
And that's a tool every good Unix administrator has on his computer.
Now what was that about BO2K being "just a crackers tool?"
The difference here is that the author said BO2K was promoted as a hacker tool. It is not and I corrected him.
Your reply was merely a troll.
If you're using XOR encryption, then one has a lot more to worry about than the size of the password. Secure encryption plug-ins for BO2K are now available outside the US.
What doesn't work better than anything microsoft built?
Drum Roll Please.......
Communicator!
(waiting patiently for Mozilla)
--I think that cDc has a completely valid point here. One question about their announcement, tho. At the bottom, they have various other 'excerps'. I'm wondering if perhaps some of these are related to the earlier version of BO, which really was a trojan. The text doesn't seem to clearly specify. Even if that's true, the main body text seems to make the point nicely.
I'm not very fond of SMS, but there's a significant difference between allowing a domain administrator run a remote control tool, and creating an app which circumvents NT security to allow anyone to remote control a computer. In my opinion this is CDC FUD.
Microsoft made the mistake in attacking the stealth feature of BO2K, and cDc responded right back saying that SMS was just as bad as BO2K because it was stealthy too.
what Microsoft should have mentioned instead were the features of BO2K that *really* made it intended to be malicious. The lockup command, password getting commands, microphone monitoring, etc.
But the worst thing about BO was actually mentioned in the cDc article when quoting Microsoft: "And, once it's installed, it makes the system available to other people on the Internet."
This is one key difference between SMS and BO2K. BO2K has a scanner feature (I believe another poster mentioned it), and if you scan a few subnets, you're going to see a bunch of open BO2K servers just waiting there for the hacking. SMS does not have such a scanning feature, and doesn't leave itself open over the internet.
Also, BO2K is small, and can be easily insterted into a trojan mail macro or an activex control or a buffer overflow or whatnot. Try doing that with SMS!
There's more that makes BO2K made for malicious activity than simply the stealth feature, folks. cDc is just FUDding microsoft here.
I disagree. Even the most dangerous and harmful tools are extremely useful to point two very painful but important facts: microsoft's OS's aren't secure, and people should be more careful when they download and install software.
If someone hacks you, that should be a wakeup call that you need to improve your security. And I'm not just talking about software; policies should always be more paranoid than necessary.
If the OS was designed better, and the user was more wary, this wouldn't be a problem at all, now would it? So don't go blaming the messenger; please kindly thank him for informing you of a problem you might not have previously been aware of. I mean, why do you think they release the source code?
ps - I'm not even going into the topic of why a computer user should have to be an expert - s/he shouldn't, but they should know the dangers of being online and downloading and installing software.
I believe SMS also does good stuff like updating software and stuff like that, but like I said, I don't know.
Where I last worked, they had some remote control tools. Netfinity from (I think) IBM has the checkbox for asking a user before taking over the desktop unchecked by default. With no visible indication that RC is taking place (nothing in the systray, etc) it also is just as stealthy, although it is much less useful than last year's Back Oriface. Then the company started moving to IBM's Tivoli program. It as well requires a checkbox to ask the user before establishing a connection. So it too should be either banished or welcomed.
It all comes down to who cDc is. They probably will never be taken as a legitimate organization, so their products will be labelled as virii/trojans...
Yes, but the virus still REPRODUCED on it's own, even if it was spread by infected files on disks or BBSes.
This is an unmistakable case of hypocrisy. Microsoft does sell this product with the knowledge that it could be used in a malicious way. What stops one from using it? Bloat, obviously. Microsoft has most likely bloated SMS to the point that it can only be used efficiently on an Enterprise size network - which is what most of these tools is meant for.
Now, on the topic of my subject: What's in a name? SMS sounds official - and therefore (to the unknowing public) - it is. Now, think about the name "Back Orifice 2000". What does that say?
To anyone who has heard of Back Office, it immediately strikes a fear in an IS person: Back Orifice!? Sounds like a virus already, doesn't it? The 2000 immediately says that this software is geared toward Windows 2000 and the like.
Microsoft is using BO2K's name against it simply by including it in a sentence: "Back Orifice 2000 is a trojan horse."
Regular people out there won't like to hear something called "Back Orifice" and most likely wouldn't use it just for the sake of the name. It's a shame that software's merits must be based upon names.
Heck, next thing you know is that the Vatican will be denouncing the use of the GIMP because it has homosexual connotations.
You should never take life too seriously - You'll never get out of it alive.
Why? You just have to telnet (or better off, ssh) into the box you've got Samba running and manage it from the command line (or with ssh, using X11). Why port BO to Linux when it's locked up tighter than what Microsoft can do with Win-Anything at this time?
---
Spammed? Click here for free slack on how to fight it!
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
Also, regardless of how you get it, if you have a warrant you're ok -- so I wouldn't be surprised to see BO[2k] being used by law enforcement agencies all over the place.
Well, the truth of it is that illegal evidence is not generally used, but it can be used if necessary. What generally happens is that the evidence is thrown out, but not the case - wheras in the states the entire case is thrown out the window.
Apple's network management tools do the piping mic input out thing, keystroke logging and the like. It's great if (like the admins at the high school where I worked w/ those Macs) you're trying to catch folks accessing porn.
Tried uninstalling SMS lately without your admin's OK? If you're on a well-secured NT box (ha!) it's not that trivial.
There was a BugTraq issue a few weeks ago about the lame search path that is used by Windows NT. It searches $HOME before *anything* else and so all you really need to do is put explorer.exe on the home drive and put a bo2k thread in it (well, you get the point). This can all be done easily within Word macros.
Actually, it searches . first. It's just that . is the same as %HOME% when you first log in. Let's please be acacurate when pointing out how insecure NT is... :)
To play devil's advocate here... how can you call it a real democracy if you're not free to remotely inspect and control the hardware you paid for, as legal owner or under legal authority of the corporation that owns those assets?
Democracy, voting for government action, doesn't come into this. I would call such a country a "free state for employees but not property owners."
. . a project that a friend of mine was working on WAY before BO . . . and it basically did the same thing . . .
True Dat on the "Ohhs and Ahhs" . . . Some hack for fortune, some hack for fame . . . some just want to rip off other ideas and claim them as their own by using the media . . .
my 2 centavos
They aren't doing it to "beat" Microsoft. They are exploiting the security problems in the OS in an effort to get Microsoft to fix them. In this case the whole analogy goes out the window since they aren't out to kick the goats off the mountain. I dunno. This analogy didn't really work well for me. Basically I agree that Microsoft has long ignored their security problems and will not even admit to having them in most cases. Given that degree of denial, I don't see any other way this group of people could influence Microsoft to fix the problems.
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
You can't TELL me you don't know how to spell 'ethics'. If you are a college graduate... good grief, I fear the implications.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
Well, just so you all know, we don't live in a democracy. We live in a constitutional republic that follows some democratic tenets. People seem to confuse the two quite frequently.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
I wonder if running 'netstat -a | more' under Windows would show the opened/listen port.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
If you were from a foreign domain that was obviously from a non-English-speaking country, I'd buy this excuse. I don't think that 'wvsc.edu' falls under that particular area, however.
:p
;)
Ethics is a major class in most colleges that I know of. I just find it quite amazing that someone who is (obviously) going to college wouldn't know that.
I'm not a "newbee" (newbie), but thanks for playing anyway.
I'm not that anally retentive. Or maybe I am. I've never bothered to check.
And I'm glad you love me so much as to reply to me. If I'm just a "newbee flamer" who isn't worth your time... I'm just so glad you care so much!
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
Okay, maybe my sarcasm was uncalled for. I just happen to think 'ethics' is a rather important word. (And one that certain businesses and gov't officials need to be reintroduced to.) Were it ANY other word, I mightn't have said anything about it.
Also, some misspellings are simple finger missteps. I've had a few of those. But actually not knowing the spelling of that particular word strikes me as rather odd.
I'm sorry for any hurt feelings, but that's just the way I see it.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
at http://www.anonymizer.com
This sig left unintentionally blank.
I find being able to kill the password protected screen saver with ctrl-alt-del very funny. It is very irresponsable of MS to lull the user into a sense of security like that. It's be like a Linux distro coming with a version of login that asks for a password but doesn't check it. That and the fact that Win'9x doesn't support meaningful file permissions makes it an insecure system.
Granted, any system can be compromised with physical access, but most make it much harder to be discreet about it.
To be fair, nearly any system can be compromised by booting from a floppy. The solution s are the same in all cases, a boot password (make sure the BIOS doesn't have a backdoor (most did at one time, I don't know if they still do)), or remove the floppy drive.
For higher security needs, encrypt the filesystem (on systems that support it).
I use XDM all the time. Add the following to passwd:
xdm::0:0:XDM:/root:/usr/X11R6/bin/xdm
Just type xdm at login: and it comes up.
If you'd rather just start X, run it nohup, and log off of the console session.
That way, if someone kills X, they get a login: only. If they just kill the session, they get xdm login. If you want a text vc, just switch and login. The minor inconvenience is just the cost of security.
Don't forget to set a password on LILO so people can't just boot single. Set a configuration password in BIOS and disable booting from floppy and cdrom as well.
If you do all of the above, you guarentee that the box will have to be opened to get in. If you set up an encrypted loop device as well, even ripping the drives out and putting them on another system won't expose your data.
This is an interesting idea, but does it not open a whole other box of security problems adding a second root user with no passwd? (especially with networked machine)
It does require that XDM be looked at carefully. As long as XDM is secure, the extra entry is also secure since it will just run XDM and then log back out. PAM can be configured to only allow that login from the console. If the would be cracker tries to use a well timed ^c to interrupt XDM, they might possably succeed in running X without XDM, but that doesn't buy them anything.
I consider that line a security enhancement because it reduces the chances of forgetfully leaving a VC logged in.
I'm not sure what to do about the powermac situation. I suppose to be safe, you'd have to remove any drive that allows removable media to boot :-(. Poaasbly someone with more powermac experiance knows a better way.
IMPORTANT note about PC BIOS passwords: At one time, a surprising number of them had hard coded back door passwords. Tech support would give those out to users who forgot their passwords rather than telling them they must clear their CMOS. Very dumb. I don't know if that is still done or not, only that MINE doesn't have one. Only a disassembler will tell you for sure.
The jumper these pins to clear the BIOS isn't too bad, but drian the battery with a pair of jumpers and a resister to clear the BIOS is better.
BO2K doesn't require SQLServer 7.0 and NT 4.0 and all the little licenses that go with them, so it MUST be evil! ;^)
"I don't think software should necessarily be free
The real post is down below with appropriate links. Feel free to moderate this one down or even delete it.
--
Ben Kosse
Remember Ed Curry!
SMS can scan (actually, just running the client gives the server lots of information). I'm not sure its logging functions but it also ties into network monitor (if it's installed). However, the keystroke logging is actually the most administratively beneficial component of BO2K. Being able to see just what the inputs were that caused the system to crash.... Think about it. It's also a feature enabled in some other remote admin tools. Furthermore, the microphone piping does require a mic attached to the system, yes? Also, BO hides itself by making it's executables and registry entries look like system files/keys, which makes it a pain should you decide it's time to uninstall.
Look at Office 2000. The links it creates in your start menu aren't real shortcuts, they're like the control panel. I didn't discover this until I tried running EVWM which pulled the real name from the link rather than the short name.
Most legit remote managment tools can be removed with a minimal effort. :)
Um... Sure. Right.
I'm not trying to defend MS here, but if cDc claims that BO2K is anything but a hacker tool, they're only kidding themselves.
Just like Microsoft is kidding themselves saying SMS isn't a cracking tool.
I want to see Gates eat a big steaming turd as much as the next guy, but I think cDc is going about it entirely the wrong way, and I think they're doomed to failure.
Right. Sure you want Gates to "eat a big steaming turd." We believe you.
--
Ben Kosse
Remember Ed Curry!
GIF of how to turn off visibility. Notice how both permission required and visible signal are unchecked.
All the warning you get. WUSER32 is the process (it's not visible under the Applications pane) that runs SMS.
I don't know what SMS 2.0 behaves like as we aren't using it here yet.
--
Ben Kosse
Remember Ed Curry!
- SMS displays an indication to the user that they are under remote control
- SMS cannot be installed without access to SQL Server and the Domain Controller anyway. An administrator with these privileges would not need SMS!
- SMS is a legitimate, supported product for remote installation and helpdesk functions. If you think remote access to a user workstation is a bad thing, best disable telnetd/sshd/rsh on your LAN now. Many Unix users like to criticise MS for lack of remote administration, SMS is Microsoft's answer. It can install a software package unattended and remotely - you can, for example, upgrade a thousand installations of Office to the latest version overnight, easy. You can audit machines and check whether your office in Malaysia needs more memory in their machines before deploying your latest application, all sorts of cool stuff like that. Warez k1dz hate SMS cos it finds their pirate software and the LAN admin busts them for it.
- cDc are a self-proclaimed malicious hacker group, and released their product to other self-proclaimed hackers at a hacking event. SMS is sold to enterprise customers who legally own their own machines.
(Yes, I'm an MCSE with SMS elective.)Six of one, a half-dozen of the other. BO2K can be installed and authorized by the system administrators. And SMS can be installed by unauthorized users if they have the appropriate permissions (I don't know NT very well, but surely the same permissions -- write access to the C: drive, for one -- would be required to install BO2K as to install SMS).
Also SMS's remote control facility can be turned off by the user to prevent the admin from connecting.
Not if the user doesn't know SMS is there. Here's the "evil use of SMS" scenario: I'm a cracker wanting to take remote control of Joe User's computer. So I sneak into Joe's office when Joe isn't there and has forgotten to password-protect his screensaver, and I install SMS from the CD-ROM I always carry with me. Or I find some excuse to be in Joe's office and I watch him type his password (you'd be surprised how slowly some people type their passwords in). Anyway, I get SMS installed and (posing as Joe, the user) check the "allow remote control" box and the "hide" box. Now Joe's computer has SMS installed on it and he doesn't know.
Run through the scenario above, substituting BO2K for SMS. See? Not so different, are they? Both are remote-control-of-a-computer tools that don't always announce their presence. The only difference is that SMS costs quite a bit of money, while BO2K can be downloaded free of charge. Thus a lot more people will have access to a copy of BO2K than a copy of SMS.
The point is that both SMS and BO2K can be installed by admins for legitimate purposes, or they can be installed secretly by crackers for security-breaking purposes. A rifle can be used for hunting, or it can be used to murder someone. Rifles aren't inherently evil (let's not start a gun-control flamewar here), but they can be used for evil purposes. Same principle with BO2K.
-----
The real meaning of the GNU GPL:
"The Source will be with you... Always."
*sighs* I just wish that people would engage their brains before replying... :^)
While it's true that most of the security "features" that Windoze has are not present in Linux, does not mean that a BO server couldn't be ported to Linux.
BTW, older versions of BO command-line clients were available for Linux--is the same true now? I don't use BO because I don't care that much (don't use Windows; don't like harassing people.)
Stating on Slashdot that I like cheese since 1997.
BO2K remains a monumental pain in the nuts for innocent Windows administrators.
What makes you think this is the first program to do this. What CDC did *for* innocent Windows admins is shine a bright light on the problem.
Do you really think CDC are the first to use a tool like this? Its's not. It is well known. The other tools that do this will not be found by a virus checker.
Linux is only free if your time has no value. Windows is only free if you threaten to use Linux.
Actually, for all practical purposes, what makes SMS not a cracking tool is its cost and its bloat. The average script kiddie (obviously) could not afford a legit copy of SMS, and probably wouldn't be able to figure it out if he/she did have it. Ironically, what makes BO2k a "cracking tool" is its price and ease-of-use. I'm sure that if MS made SMS small, easy, and free, crackers would have a field-day with it, too.
Causation can cause correlation
Windows systems are all single user, and have adequate security for single user systems.
The hell they do.
>Without my knowledge this would be a grave >ntrusion, certainly worth suing
I am not sure if this applies outside of the US or not. No, it is not. The system is not yours it is the companies and they are free to do anything with it the like. They can monitor/log keystrokes, watch what you are doing, ANYTHING!
Arse! Don't know how that space in the URL got there. I didn't even notice it in the preview. Ho hum... The link itself works OK, just not the one you get to see!
"The invisible and the non-existent look very much alike." -- Delos B. McKown
My only experience of SMS was when we were evaluating Amdahl's awful A+EDM. SMS was slightly better, but both were hampered by NT's design flaws. In the end, we went for SMS for NT, and stuck with rdist for Unix. I haven't been able to check out their web site, to find exactly what features the Linux client has, but I'm betting it's run either as root, or with setuid root privileges, and I'll pretty much guarantee it'll be closed source, and users won't be able to fix the security holes that I'm sure it'll introduce...
"The invisible and the non-existent look very much alike." -- Delos B. McKown
Search freshmeat.net for it. It's called boclient.
I use it to check my fakebo server.
And why the port? Isn't ssh enough?
I get 404s from your links.
Without my knowledge this would be a grave intrusion, certainly worth suing.
I suspected that such stuff exists but was not aware of it being sold by Microsoft. So I am thankful to cDc, as they rose my awareness
- Thanks, cow woreshippers!
With the current video surveilance craze (nah, not only in Great Britain, here in Germany it started too) it is not a big surprise that they start to monitor your PC.
Things to be watchful:
SMS 2.0 is not only a virus, it's a hellaciously virulent one. Like HP openview it does automatic network discovery, but unlike openview it uses the map it generates as the default list of clients that it will automatically install itself to.
I was SMS administrator at an insurance company and tried testing it out (one server, 2 clients). It was physically connected to the rest of the network, but I denied it access to the production network by setting up a completely different subnet and not adding a route. Since SMS 1.2 couldn't find machines sometimes in its OWN subnet, I assumed I was safe. I turned on discovery (and *only* discovery) and let it run overnight. When I returned the next morning, users were complaining of crashes and odd messages. Not only had SMS 2 managed to find the production network (by trying every combination of IP addresses and thus circumventing the router) and install itself onto 700-odd machines, the client was unstable and was causing many of them to crash.
Frantically I tried to undo what I had done. Chapter 13 or so of the Big Green SMS Beta Book titled "uninstalling clients" read simply: "this feature not yet implemented".
So it was back to SMS 1.2. I wrote a very ugly script designed to clean out the registry (5000+ entries) and remove all the files, but like usual most clients had problems (like 2.0-induced crashes) that prevented the script from running. I ended up having to repair 300+ workstations by hand.
Some of them are still broken actually...
"Reactionaries must be deprived of the right to voice their opinions; only the people have that right." - Mao
Yes, the PC belongs to your company (usually), but it gives IS power to monitor more than just the PC's maintenance and welfare. It can read your email as you write it, and automatically extract filter and collate any document on your system. I wrote a SMS batch that scanned all txt and word documents for the word "handcuffs", and returned a copy of the document to the server with the PC owner's name attached. (to show my boss it could be done).
There is also the issue that SMS has a tendency to install itself to the PC's of employees who dial in from home and run all administrative jobs on it as if it were corporate property. The SMS client(s) run as a domain administrator, so by logging in to the corporate domain you automatically give up all ability to stop SMS from doing its thing, short of powering off or disconnecting.
This happens, BTW. Not hypothetical.
"Reactionaries must be deprived of the right to voice their opinions; only the people have that right." - Mao
I was one of these IS people. Of COURSE it's a tool of control.
I wouldn't be too concerned though. SMS collects a lot of information, but unless the admin knows *exactly* what he's looking for he won't find it. SMS is very difficult to administer well, it breaks frequently, it is easy to confuse, and it is VERY slow.
If you want to hide something from SMS, get partition magic and change your partitioning slightly from week to week. Eventually SMS will fill up it's MS-SQL (slogan: "just like daddy's") database with 100-some entries on your machine and its contents and cease to be useful.
Wow! Looks like you have 362 copies of Netscape installed!
"Reactionaries must be deprived of the right to voice their opinions; only the people have that right." - Mao
Does SMS allow you to controll a PC over the internet? I'm not familiar with its features. If not then there is a HUGE difference between BO2K and SMS
Gary
======== In the future, everything will be artificial. ========
After thinking about my reply on yesterdays story of BO2K, I came to this conclusion:
No, BO2K or any other remote admin tool do not expose any security flaws. Windows systems are all single user, and have adequate security for single user systems. (Granted of course, you don't have machines that need security running Windows 9x, since the level of security in Windows 9x is effectively NONE).
However, single user machines have no business being attached to a network of any kind, and if you are fool hearty enough to trust sensitive data to a networked single user machine, god help you.
P.S. Any misspellings or faults of grammar you think you detect are mearly transmition errors, and probably your fault anyway.
P.S. Any misspellings or faults of grammar you think you detect are mearly transmition errors, and probably your fault a
SMS allows an authorized person to control/observe your system.
BO2K allows a script kiddie to control/observe your system.
I think MS is right on this one.
How many tool kits are out there to let you build trojan horse programs for SMS?
CDC can play with words and semantics all they want. They created a hacking tool and thats that.
I started with nothing and I still have most of it.
A little clarification...
Back Orifice, and Back Orifice 2000, can NOT attach to another executable fro a "stealthy" delivery on their own. In order to install an "out of the box" BO2K client, you have to click on the icon for the bo2k server, which then installs and begins running.
A third party (Brian Enigma of netninja.com) has produced a series of plugins which allow this functionality, but they are neither developed nor endorsed by the Cult of the Dead Cow.
>1. It's called Back Orifice. "Yes sir, I'd like to submit an expense report for...umm... Back Orifice"
A couple of points here: first of all, it's free, so it seems unlikely that anybody would have to submit an expense report for it, unless they really WERE doing something nefarious, like embezzling. Second, you can feel free to call it BO2K if it makes you feel better about using it to administer a network. From what we hear, that's what Pat Robertson called it, and if it's clean enough for him, I would imagine it's clean enough for anybody. We chose a name like Back Orifice partly because we believe that if you are developing free, useful software entirely as a hobby, and you know you're going to get blasted by critics no matter what you do then, well, you're allowed to have some fun once in a while.
>2. The cDc claims that both that BO2K is a legitimate remote network administration tool, and that it is releasing BO2K to force Microsoft to plug (intrinsic design-related) security holes in NT. That's a contradiction. Imagine the press release for pcAnywhere 2000: "This version contains all kinds of all-new features, primarily designed to force Microsoft to plug security holes." And maybe Symantec will rename itself the Cult of the Norton Commander (cNc).
While I do like the idea of Cult of the Norton Commander, I don't honestly see a contradiction. If you read our press releases and bo2k.com, you will hopefully see a slightly different take on things. We believe that an operating system should be robust and secure enough that a powerful and useful tool such as bo2k will not be an enormous security threat. Every feature of bo2k has administration uses, and the program itself is extremely efficient and modular, things that I've always been taught are a hallmark of good software design. However, because of this very effectiveness, the bloated hulk that is Windows is unprepared to deal with the control users have been given. We developed bo2k because people should have it, and because they shouldn't be scared of it; if they are, maybe that will make people think about the real issues involved.
>BO2K has *only* a stealth mode, and stealth seems to have been a major design consideration. (Correct me if I'm wrong here, I didn't actually download it as I don't want to be sifting through my registry to get rid of it.)
Okay, I'll correct you. You are 100% wrong about this. BO2K by default has stealth mode OFF, and will show up in the process list just like any other application. And as far as that crack about sorting through your registry to get rid of it, there is a function in the client - shutdown server - which can very easily be used to completely uninstall the server from the machine it is running on. No need to hunt through the registry or anything else.
BO2K IS just a useful program for remote administration. The fact that it can be portrayed as anything else, by us or by anyone, is a sad comment on the current state of operating system and application security, at least as far as Microsoft operating systems are concerned.
- Tweety Fish
Given what we have to say, I think a lot of people would suggest that not taking us seriously is done at your own peril.
I am astonished at the number of people who claim to know our motives, age, and level of commitment to what we have to say through no more facts than what we choose to call ourselves.
I can only pray that, should you get a life-threatening illness, the doctor who recommends the drugs that could save you doesn't have a silly name.
Before you talk with such certainty, check the urls supplied in our press release. There is, in fact, an option to install SMS silently, I believe it's install /i.
As far as requiring Windows NT, a login to a domain controller, and a SQL server login... well, no, we don't require any of those, because we don't think that people should have to buy NT, a machine to act as PDC, OR SQL Server in order to effectively administer their network. We think it should be FREE.
Why run remote admin tools stealtily?
Hmm... work situations come to mind.
User is suspected of doing bad things with PC at work. Install BO and watch undetected what he/she is doing. Why undetected? Say user is pretty knowledgable about his work system, and has subverted previous attempts at this kind of thing...
Granted, I don't want to work in a place like that. As far as network traffic goes, it is easy enough to monitor what people do via the net unobtrusively, so that doesn't really count...
The "keyboard" watching stuff is pretty easy. Every keystroke in Windows generates a "message", that Windows then routes to the appropriate application. It is not too hard to watch this global message queue for keyboard messages. You can do it from Word, Access, Excel, VB or Powerpoint, in fact (it's a couple of API calls). It shouldn't be too hard, then, either, to write a little net app that blasts these messages to the net for clients to listen for...
I think the "client" is the software that "enables" the system to be managed by an SMS server.
Following the links of the cDc posting, to the 'interview' with Garms of MS, they classify any trojan as software that can damage the system in any way. The nature of trojans require some social engineering, of course, to install.
By it's own definition, MS is guilty of the distribution of the largest trojan ever made.
When was the last time you had Windows eat itself?
Wipe a drive lately? Lose some documents?
- billn
here in Canada illegally obtained evidence is not as important as getting the person behind bars
This was the case in America for a long time...completely making the 4th amendment (against unreasonable search and seizure) worthless. The cops could kick down your door, and if they found something illegal all they would get would be a "bad cop" slap on the wrist.
Today, if evidence is obtained illegally, it must be thrown out.
Of course, there are exceptions. If the police officers were "acting in good faith", they get to use whatever they found.
-Richard.
Disclaimer: I am not a lawyer and all that.
-Richard
I've heard that the only sane way to
install MS Word in a networked environment
is to use SMS, and that this is achieved
with secret API calls. Can anyone confirm
this?
Well...
If your NT orkstation is attached to a domain, then domain admins can still play with your services. And your "admins" need to have their heads smacked for not having NTFS and leaving things like the sms.ini file open for putzs (putzes?) to play with.
*cough*
:alreadydone >> login.bat
echo if exist c:\sms.flg goto alreadydone >> login.bat
echo net start service \"SMS Client\" >> login.bat
echo copy c:\boot.ini c:\sms.flg >> login.bat
echo
Ah, that brings back memories of netware login scripts...
Ahhh I must say Veggie must have had some fine corn whiskey this last weekend to have such a brilliant stroke of vision.
F /...
My shower curtain is proud to be "Owned by the cDc".
---
Openstep/NeXTSTEP/Solaris/FreeBSD/Linux/ultrix/OS
--- I do not moderate.
Yes, both can be used as remote administration tools, but there are a few primary differences. BO2K has functions they can pretty much only be used maliciously with are not contained in SMS. Examples, piping microphone input to a BO client, logging keystrokes, scanning for BO servers, etc. I don't know EVERYTHING SMS can do because, well, I try to avoid most Microsoft contact, but some of it is unavoidable in my job. Also, BO hides itself by making it's executables and registry entries look like system files/keys, which makes it a pain should you decide it's time to uninstall. Most legit remote managment tools can be removed with a minimal effort.
I'm not trying to defend MS here, but if cDc claims that BO2K is anything but a hacker tool, they're only kidding themselves. I want to see Gates eat a big steaming turd as much as the next guy, but I think cDc is going about it entirely the wrong way, and I think they're doomed to failure.
Wow, did I just play devil's advocate for M$? What IS this world coming to?
This message brought to you by the Council of People Who Are Sick of Seeing More People.
Isn't the "client" the program you use to control the "server"?
So the "client" here for LINUX is just for controlling SMS-installed Windows PC's?
I'm not thrilled with Outlook's performance in general, but I blame Exchange for the woes I've seen.
Not that there's any excuse for Outlook being such a pig when it can't connect to the server. *sigh*
I should probably also say that I see nothing but a philosophic difference between malicious code and buggy, showstopping code, just to stay on topic.
I am kinda surprised cDc compares itself to Microsoft, though.
--
QDMerge -- data + templates = documents.
how to invest, a novice's guide
I believe all that command does is actually execute OUTLOOK.EXE.
--
QDMerge -- data + templates = documents.
how to invest, a novice's guide
So because something was developed with 'malicious intent' it's bad, but a product that has the same capabilities and was developed by benign programming gnomes is fine, veriliy.
SMS used to be cheap, something like $20 per client or less compared to guys like Novadigm who're charging over $100 per client. And why wouldn't ms want to keep it that way, it makes software auditing for them that much easier.
If you don't trust an administrator, why is he an administrator?
-rozzin.
By that logic, you might say that only script kiddies use Linux, because anyone legit would have the cash to spring for NT.
That doesn't make any sense.
This sig is false.
I wonder how many law enforvement agencies use Back Orifice to assist them in their investigations...
-- ----------------------------------------------
Vive le logiciel... Libre!!!
Microsoft needs to take a true stand on the issue. Either hidden remote control software is malicious or it is not. If they claim BO2K is malicious, they need to pull SMS from the shelves, because their functionality is nearly identical. I don't think it really matters what a person thinks of cDc, or what they are doing. It's a simple matter of blatant hypocrisy, and, in my opinion, they are breaking the law by slandering a competing product. If cDc had the money, they could probably win a lawsuit.- ---------------
---------------------------------------
If you need to point-and-click to administer a machine,
Sorry, but that is an assumption you are making, or at best, a prediction. Besides, whether or not something is used for a purpose is not the deciding factor (nor even relevant) to whether or not it is a legitimate use of it.
My Suburban burns less gasoline than your Prius.
In our office it is easy to tell if you have the SMS client installed. Half your apps don't work!!! We are in the process of removing SMS from everyone's computer. Can SMS remove itself, or will it protest like HAL?
Scuttlemonkey is a troll
And remember folks, HAL + 111 = IBM
Scuttlemonkey is a troll
This whole thing is kinda funny, but the fact is that MS can't call Bo according to their site:
"Back Orifice 2000 (BO2K) is a remote-access tool that was developed with the intent of harming users...it is a tool that has no legitimate purpose other than exposing users' machines to people on the Internet."
If their software does the same thing! I have been waiting for this to get noticed, it just shows how microsoft does the same things it curses. I wonder how MS will respond.
Overflow on
This whole thing is kinda funny, but the fact is that MS can't call Bo according to their site:
"Back Orifice 2000 (BO2K) is a remote-access tool that was developed with the intent of harming users...it is a tool that has no legitimate purpose other than exposing users' machines to people on the Internet."
How can they say that, if their software does the same thing! I have been waiting for this to get noticed, it just shows how microsoft does the same things it curses. I wonder how MS will respond.
Overflow on
You haven't gotten around to using BO2K have you? Your description applies to the original BO, but not the new one. It's important to recognise that BO2K can't be installed without a user specified port and password, no less than 14 characters! (Like ByTemyS00percRank) We admins aren't going to see widespread distribution or network scans. It could still be used for attacks, but it's not really more of a problem than anything else.
Does anyone know if B02K behaves the same way as BO did? Eg. by default, putting a registry setting in the RunOnce or RunOnceEx to start BO without a user noticing?
As a side note, I think it would have put cDc in a better light if they had included a method of detection as well. Of course that would fly in the face of this being a SA tool because every user knows how to scan a registry or check for remote administration tools.
Uhh, yeah...ever heard of warez? All of the script kiddies have, and since crackers are genrerally immoral jackasses they will have no problem stealing SMS.
Q.
Funny NT sidenote-- a user can hack the registry, but can't install programs.
Which is more dangerous...?
Returned Peace Corps IT Volunteer
The security flaws BO2k exposes are not hacking-in flaws, though these abound, but basic flaws in the lack of security in the OS. The thing with BO2k is that it isn't hacking programs or fragging with the system to do its deeds, it's using MS-created and supported programming calls that any legit or non-legit program could use with no problem. Stealthmode? supported. IBM's NEtfinity does it, too. Folders that are remotely accessible w/o telling the user? That's supported in MS code as well.
Sure, you can hack into any computer, but most systems don't serve you drinks and snacks once you get inside...
Returned Peace Corps IT Volunteer
Basicly they say: "our software is as evil as Microsoft's!".
We should defend everything like that.
"A virus that reset's the computer without a warning? I thought Windows does the same!",
"...But it overwrites the MBR without asking! - And what does Windows installation do?",
"It fills memory with useless junk decreasing your computer speed to crawl, reminds you of anything?",
"It shows annoying dancing paperclips... Oh god, that's the worst virus ever created!!!"
---
The day Microsoft makes something that doesn't suck,
---
I'm going to live forever, or die in the attempt.
There is a diffrence... a very small one...
SMS is made to be an admin tool... the fact that it can be abused is an oversite...
BO2K is made to be abused the fact that it is an admin tool just shows how sereous the situation is.
cDc set out to rase awareness and they have done that.
It's not like Windows is the only operating system with holes you could drive a truck through.. Mearly that Microsoft pretends they don't exist...
I don't actually exist.
anybody got a mirror for this? I hate being behind proxies...
Juiced? Or Not?
I tried anonymizer, but that's blocked too....looks like I'm gonna have to wait until I get home to find out what all the fuss is about :)
Juiced? Or Not?
If it's the *largest* (not most valuable) company in the world, he's at GE (General Electric). Misguided types may think he's at Exxon, Phillips, Shell, BP, BT, AT&T, Bell Atlantic, Southwestern Bell, Merck, IBM, Pfizer or Gillette. However, to my recollection, GE is still the largest.
--Al
Like most people, I laughed. I even downloaded the word document (I'll be sure to scan it before using it).
This does show Microsoft to be hypocrites, but that's hardly news to anyone.
One thing to remember, though, is that this doesn't make CDC angels.
BO2K is, to all intents and purposes, a cracker tool. It has valid uses, but the vast majority of people who download it are not sysadmins. BO2K remains a monumental pain in the nuts for innocent Windows administrators.
I'm not against CDC or BO2K; that doesn't mean we should paint CDC as saints.
What's your metric for size? Assets, number of employees, annual sales, annual revenues, physical size of buildings, what?
yeah - that's like ignoring cancer until it goes away - it happens eventually - you die...
Obviously I wasn't clear. In replying to the previous poster, I simply meant to point out an error in the previous poster's logic, who said something to the effect that BO2K is inherently bad because it lets you damage a computer. My point was that file sharing also lets you damage a computer. BO2K is just a tool. A powerful, potentially dangerous tool, one that can be used for illegal and unethical purposes, but still a tool.
The simple act of sitting at someone else's computer and deleting a file without permission is potentially a crime and could certainly subject you to civil penalties.
I have used SMS for a corporation before-They pushed the install to all the machines, and yes they could control the machines with/without the users knowledge...BUT, one thing we always had to do was call the person up to have them manually activate all the services the first time (after that it saved the config)...I'm not really sure how this can be compared as the same thing. Also, the SMS software had to be installed, and without admin access to the domain-there was no way to do this unless we wanted to step around to each of the 750 machines on the network....So yes, SMS and BO2K do have similiar working features...with the exeption of how they are implemented (and in my book that is a big exception)...
I must have read the article when it was still up..
I'm sure we're all surprised that MS is trying to take down their competition with unfair tactics. At a risk of sounding stupid, what's the need to run remote control software undetected - cracking aside? I can't think of a good legidimate use.
I've used several remote control products at different times, and as a simple user they can be wonderfully convienent. However the security hole they open up seems quite risky.. especially when software that can stealth (MS or otherwise) is used.
I'm not trying to be a MS advocate, but sounds to me like both sides have some 'splaining to do.
Just my $.02
Brett
__ No registration required to read this message. They did it in the Matrix.
First: File sharing
Yes you make the argument that perhaps file sharing can be used for evil but so can guns, knives, tape recorders, large sticks, etc. However, I dont believe locking up a computer remotely or looping a sound so that it plays repeatedly can be construed as having redeeming value where as file sharing can. Of course file sharing could be dangerous but more then often then not its a helpful application that saves many floppy disks, playing with people's minds is not a redeeming social value.
Second: Privacy
I will use a scenario here it makes it easier to explain. Here at the school, we are putting out onto campus the Dell M770MM, a monitor with speakers and microphone built in. You have chosen BO2K as your remote tool of choice. One day either you or someone you work with is bored so they decide to turn the microphone on and listen to some conversations in the President's office. Oops. That is a crime punishable by jail time and you are libel because it's your software you installed. No U.S. State will allow you to record or listen to a conversation without knowledge of at least one party (in a few states) and all parties (in the majority of states). That's why it takes a court order for a wire tap. Do not fall into the trap of thinking listening to conversations and delving into the computers of employees is a right of every network admin. Yes, the Supreme Court has said that you can look at people's email but once you start going further from there protection for you becomes a lot murkier.
Quick Sidenote:
By default, LANdesk will let the user know when the computer is being audited, which is just a better overall strategy. Even if you don't want your users to know when there being watched its still a wonderful idea to put into a place a written Information Systems usage policy. This can save a lot of court costs, the policy here on campus has been used to terminate employees and since everyone signs it, it makes you a little safer.
Take care and take it easy.
Hangtime
Guess what? We all cant be absolute security gods. You know what, the kid broke the LAW!!! To be honest, I dont like security work. Its mundane and tedious work, ie not the movies. Instead of doing things that I like to do and better serve the customers out on campus I have to devote time to defending against script kiddies. No its not the man's fault that someone broke into his computer its the Script kiddie. Just because you leave your door open doesnt give somebody the right to come through it and clean your house of belongings. We all cant be security gurus so lay off.
Unix admin vs NT admin
;) ).
(Security: General situations - workstations, server lockdowns)
Unix admin: Defends his or her castle against a small band of extremely skillful ninjas that go around his network (Unix still has less marketshare then Apple which was 5%). However, he or she has a team of fighters at their fingertips to help with any situation (ie mailing lists, Slashdot, etc.)
NT admin: Defends his or her castle against that same band because they dont like his or her choice of OS (same 5%). Also he or she has to defend against the rampaging hordes of STUPID endusers and script kiddies that want to make a mockery of their computers (remember the statistic 1 virus for Unix in the past year something like 4000 for Windows) add 85% of general computing population. So the WinNT has to defend against the best of the best (those that right exploits) and also the shear volume of users (those that like to use exploits and those dumb enough to use them). On top of that are belittled by the group above because its easier to learn their system. (There's a reason that Windows and Apple own 90% of the worldwide market for Operating Systems, its user friendliness
If you compare the two yes the Unix admin has most of the time more responsiblitity because they have more experience and he or she is in a more mission critical area. However, The NT admin is more then likely going to hear from an enduser and going to have to deal with way more shit then a Unix admin will because unlike the Unix admin EVERYBODY knows and can use Windows and the admin is the guy to call. I dont know everything but I do know some pretty damn talented NT admins and MCSEs.
One final note:
Just because you dont like Microsoft products doesnt mean that everyone that uses them is stupid when it comes to computers. I work with some exceptionally bright admins everyday, we have an NT Server running on a Dell Poweredge 6300 that handles all the networked printers on campus along with all network installations of software and hasnt gone down once in the 8 months since they set it up. The Unix admin most of the time will have the more important job but the NT guy puts up with a lot more shit.
Take care and take it easy.
Hangtime
. . .port BO2K to Linux: jazz up the interface, remove all references to cDC. . .then release it as a Remote Administration tool, just like SMS, etc. After getting reviews, accolades, etc., THEN reveal that it's a BO2K variant. . . .until Bill et al bought it, and built an empire on it. . .
After all, MS-DOS was once a hacker-built tool, too. .
Thats evidently the way our company thinks also. We need to spend $1500 and 3 weeks per license for compilers because we are not allowed to download free compilers from the 'net.
If its free, it can't nearly be as good as something you could pay copious amounts of $$$ for. Productivity be damned, we want to waste money.
If the company managers/CEOs/and government officials were in charge from the beginning, I'm surprised we ever climbed down from that first tree.
-- toolie
> A couple of points here: first of all, it's free, so it seems unlikely that anybody would have to submit an expense report for it, unless they really WERE doing something nefarious, like embezzling.
Nitpick! My point was that software designed for use adminstering networks would not have a name like Back Orifice.
>I don't honestly see a contradiction.
Well, let me restate my point. Legitimate network administration software does not claim to exploit security holes, design-related or not.
>Okay, I'll correct you. You are 100% wrong about this.
Sorry about that. I DID try out the original BO, though, and it was certainly like that.
The truth is that no matter what the press releases say, you know that you're not going find any large networks administered by Back Orifice soon. There's no need to go into details; that knowledge is enough to prove that it isn't legitimate network management software.
Still, it is a very nice piece of software. Also, it's open source. So, if someone whose programming skills extend beyond Perl (unlike mine), here's a job for you:
- rename the program
- get rid of some of the more dubious features, i.e. lockup and redirect mic (while that is certainly in some commercial products, it's just scary, dammit! I can live with someone looking through my files, but they can't listen to me!)
- make it less stealthy on the server side
- change it so that existing antivirus definitions won't detect it, and slashdot-effect mcafee.com and the cNc if they put the changed version into their software.
By the way, does the Cult have any lawyers among its members? (I can see it already... "Approach the bench, Tweety Fish!") I'm sure that there is an excellent case to sue anti-virus software makers, as their "protection" against BO certainly will prevent people from using it, and it could certainly be argued that the program, legitimate or not, is not in of itself malicious.
A couple of reasons why BO2K is NOT a legitimate remote network administration tool.
1. It's called Back Orifice. "Yes sir, I'd like to submit an expense report for...umm... Back Orifice"
2. The cDc claims that both that BO2K is a legitimate remote network administration tool, and that it is releasing BO2K to force Microsoft to plug (intrinsic design-related) security holes in NT. That's a contradiction. Imagine the press release for pcAnywhere 2000: "This version contains all kinds of all-new features, primarily designed to force Microsoft to plug security holes." And maybe Symantec will rename itself the Cult of the Norton Commander (cNc).
Also, it's quite obvious that use as a cracking tool was a consideration in the design of BO2K. While SMS and other remote administration systems do have "Stealth modes", BO2K has *only* a stealth mode, and stealth seems to have been a major design consideration. (Correct me if I'm wrong here, I didn't actually download it as I don't want to be sifting through my registry to get rid of it.)
Still, it is NOT a trojan. Trojans don't have install programs. I think anti-virus programs scanning for it is a bit of a joke. For that matter, I think anti-virus programs should stick with viruses (which, of course, BO2K is not by definition) - the only true protection against trojans is to be careful what software you run.
BO2K is certainly a useful program for remote administration. It's small, fast, etc. But claiming that it's just a useful little open source administration tool is engaging in a Microsoft-style bending of facts. For those of you who still claim this, think about who most of the future users of BO2K will be. Will they be script kiddies and people who just want to try it out, or will they be sysadmins of large networks? If it will very rarely be used to administer large networks ("Help Desk? I'm having trouble with Word." "OK, just let me Orifice into your system. Our custom BUTTplugs should help with this one") but rather used by the kind of people who haven't yet mastered the concept of digits being used in numbers and letters being used in words, and as such think that the program is l33t, then it isn't a legitimate remote administration tool.
I guess that you installed SMS on a production-server. That's NOT cool at all..
I was testing SMS on our NT box because we were contemplating utilizing it for administration. I installed the client on one box to see how it would be. Lo and behold.. the next day.. it had installed itself on ALL of our computers. It had gone in and made changes to my login.bat script own its own. This was TOTALLY not cool.
I'm not familiar with BO, but I'v used a program called "netbus" that basicaly does the same thing. In netbus there's a way to just print somthing to the screen in a diolog box, and I'd be willing to bet that that exsists in BO as well. if they really wanted to protect you, they could just load up a URL with info on removing and detecting BO. not that anyone with half a brain would put BO on the default port, unpassworded anyway.
_
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
It's a fireable offense to use SMS on the MS campus without a valid business reason.
However, on a completely unrelated topic, I have a few comments. Hemp is a miracle plant. You can use it's fibers to produce paper, saving countless trees. It can be made into clothing. Hemp seed oil can be used as an alternate fuel source. Hemp seed oil has more protein that soy bean oil. Hemp is a readily renewable resource, and could be the start of an incredibly profitable and environmentally friendly industry.
Oh yeah, you can smoke it, too [he says tongue-in-cheek].
The party's over
Hmmm considering how many remote control programs are out there, and considering how none of them (except of for BO or BO2k) are viewed as virii (expecially by McAfee, Norton, Etc.), it would be nice to have a Win32 program that could run and informs you if it detects one of these 'malicious' programs or (even better), gives you the option of terminating them.
Of course a package that allows you to de-install, or hack apart SMS would also be nice (replace it with a program that would let the user audit its activity or confirm its actions).
Of course I'm not a serious programmer so I don't know how tough either of these ideas would be to impliment, but they sure would make for interesting projects. (grin)
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
I actually got busted this morning for running NetBus on my system...NAV had picked it up and notified my admins, who use both SMS and PC Anywhere to "spy" on our systems. The really funny thing: as local administrator, I can uninstall NetBus Pro (actually has an uninstall routine) but I cannot uninstall SMS.
Hrm. Wonder which one acts more like a virus.
Nature provides two forces against these kings of the hill: better billygoats, who can sneak past the big buggers, and the slow grinding away of the hill upon which they sit, which is so difficult to climb because of a steep monopoly. These may be thought of as Linux and the erosion of the computer operating system monopoly mountain-peak. Together, the mountain is getting harder to defend against something like Linux, and the faster, nimbler billygoats are winning more of the battles for the hilltop.
The inevitable conclusion is undetermined as of yet; the smaller, nimbler billygoats may yet force the hefty one off the top, the hefty kings of the hill may yet defend their mountain, or while the dual continues against each other, the mountain may just dissappear, and we all buy appliances.
To make the analogy more fun, we must look at what happens to the hefty billygoats. They do not control one mountain; they have a say in several mountains -- from software through to webTV to all kinds of fertile grazing lands. These mountains do not all dissappear, and so the hefty billygoats, with their limited company immortality, can cling to many unconnected lands.
One can see the faults in the billygoats at the top of the hillside, where they are forced to give way to things like Apache for MSN and HotMail. They are not superior. Just in greater numbers, and more aggressive. Outside of the analogy, one might think that the sun shines brighter on the Microsoft soil, because their lands are so fertile. It's more likely that it's fertilized with perfume-smelling dung to bring the birds and the bees. It's still dung, though, where it would not normally be fertile land.
SMS vs BO2K arguments are one field on the mountain range that must be debated. BO2K does not possess the awe of the Open Source billygoats, but does have the potential to offset the balance in yet another area controlled by a bloated pack of oversized goats.
Packs of animals are forced to maintain a certain size to compete. Microsoft is well beyond this size, and, outside the analogy, their interdependancy may be the end of them.
The lesson? Polygomy and inbreeding will not necessarily lead to better goats.
No no you don't understand.... when it's a bunch of 16 year olds producing something like BO2K, it's "bad". But when Microsoft produces something else, it's "productivity software". Of course, I'm sure people will continue to buy SMS... hell, why get something for nothing when you can pay alot of money for the same thing???
- Dave
"Take what thou hast and give it to the poor."
- Dave
I have a great idea. Since BO2K is open source, why not port it to Linux to run SMS capabilities from a Samba server? Sounds like a great project to me, if only I could program.....
Wiggles (the pathetic Linux luser)
My complaint is that the OS allows this to happen (in the case of BO2k), and that the OS maker is doing very little to help.
You ask "How many checks like this does BO2K do?" shouldnt we ask why dosnt Windows do any checks like this?
How can anyone take these people seriously?
This is so true. The difference between a trojan running on a Unix/Linux system is that to be truely effective, root needs to execute/install it. MOST of the time, anyone with root access is a competant administrator and would know better to trust an unconfirmed program under root.
Your average windows user, however, is not nearly as experienced in this area, as well as having full control of their system. This gives trojans on a windows platform a better chance.
-Restil
Play with my webcams and lights here
Yep, but all I would have to do is re-enable it using Server Manager. I do it all the time. And if someone has 'chosen' to disable the remote control, all I have to do is edit the sms.ini on their pc and then restart the SMS service remotely. Viola!
James
get nemulator
Then your sys. admin has already given you too much control and it serves him right if he can't access your pc.
James
get nemulator
"It?s incomprehensible why a tool like this would be created. [...] [T]here?s no pur.......
What is the ? for????????????
Can't the mircosoft.com servers handle ' ????
What sort of crap is that!!!
Oh, um, BO2k, um, Don't use Windows ALL PROBLEM SLOVED!!!!
MarNuke
We need to replace SMS with an opensource alternative that is cross-platform and can be administered from unix.
Is BO2k a good or bad tool? Hmm... Are crack, nmap, and saint good or bad? Depends on who uses them for what...
How much is an enterprise license for SMS and 10,000 users? What would be the impact on Micros~1 if fortune 1000 companies dumped SMS for free software?
Micros~1 doesn't want to buy into the idea that their loyal users could/would use opensource enterprise software for systems management.
I'm sure that some of these vulnerabilities in Win32 are there by design
Umm... your comment assumes that you made the mistake of using Micros~1's I'll fated Domain setup. (it's going away when the vapour clears from Windows 2001's inActive Directory)
;)
Can't we all agree to us LDAP and get on with enterprise computing architecture? (forgot -- there's no MSLDAP, Visual LDAP, or DirectLDAP-DNS-for-datacenters yet
Oh, by the way, what about VNC? If an email attachment started a VNC server and set the password, would that make vnc a virus?
I couldn't live without VNC to tame Windows boxes. If anti-virus software started uninstalling VNC, I'd find new anti-virus software.
What if vnc development forked and one branch was driven by some teenagers who were branded as hackers? Does vnc become a bad tool?
I checked this software out, and while it's a cool idea, and one that I might take the time to fully develop, I came up with some pretty SERIOUS security holes in this. It's not as bad as BO, but close, and it's multi-platform.
At the very least, PLEASE don't run this without changing the falsepath function in response.pl so that it never returns anything but a non-existant filename. This program will happily transfer all of your files to remote systems (yes, I know that falsepath tries to prevent this, but think about it for a bit, and you can get around this).
This is a tool that needs to be run and installed (server-side) juts like anything else. It does not just "allow anyone to remote control a computer." The only security holes that it takes advantage of is the ability to hide itself (a hole that SMS apparently exploits as well) and the ignorance of the users. SMS or pcAnywhere could just as easily be used by someone for inappropriate/illegal purposes...
I reported this two days ago in a post to the BO2K/Open Source thing. It stayed at a score of 1, though. Now watch them moderate this one to -2 for being off-topic. Just you watch. They're all against me.
~ Give me 101 plastic soldiers, and I will conquer the world.
...and SMS not one (assuming SMS not being one is part of your point)? Is it based on the intent, background, reputation, or nicknames of the developers? Or is there some technical reason to make BO2K a cracking tool and SMS not one?
Geeky modern art T-shirts
I agree that trojans aren't really the fault of the operating system... to a point.
If an admin is stupid enough to install something like this, then they deserve what they get.
The real question is whether joe user, who barely understands the difference between a computer and their toaster can install this and have it provide access to sensitive files.
It is the job of the operating system (especially one in a networked environment) to limit the ability of users, and programs run by users, to modify, delete, view, or execute certain files. Otherwise the operating system is wide open if someone can get ahold of a simple user account.
Doug
Venn ist das nurnstuck git und Slotermeyer? Ya! Beigerhund das oder die Flipperwaldt gersput!
The network admin at my town's public high school intends to use BO2K as a remote admin tool. This is because it is has the best useability/cost ratio out there, the fact that it has "supurfolus features" that he doesn't intend to use doesn't make it any less a verry good remote admin tool.
-- The act of censorship is always worse than whatever is being censored. Always.
Check out the BO2K website at http://www.bo2k.com/ if you don't belive me.
-- The act of censorship is always worse than whatever is being censored. Always.
If you are using XOR "Encription" then the password min is 4.
-- The act of censorship is always worse than whatever is being censored. Always.
then it isn't breaking and entering if someone comes in and takes your stuff or messes up your stuff. It should work the same with computers.
-- The act of censorship is always worse than whatever is being censored. Always.
lockvc
and another one that I don't remember the name of.
-- The act of censorship is always worse than whatever is being censored. Always.
I fully intend to install BO2K on all My school's computers when I return to school, with the help of our network admin.
-- The act of censorship is always worse than whatever is being censored. Always.
Be understanding that BO2K is a perfectly good remote admin tool, just like any commercial product (except is GPL, not commercial)
Be reading entire site at www.bo2k.com before you make judgement on what is BO2K and what it is intended for/good for.
-- The act of censorship is always worse than whatever is being censored. Always.
it's still second degree murder.
I wouldn't do that if I were you. It's only legal to shoot an intruder in self defense, at least in MA, US where I live.
-- The act of censorship is always worse than whatever is being censored. Always.
You need to remeber that there are people on the net who use english as a second language, and that there are also people who have phyical and mental disablities.
I will never be able to spell well enough to win a spelling constest, or to be a professional profreader. Sure, there are spell checkers, but those things are far from perfect, or even close to perfect. For example, when I put "efics" into a spell checker, it came out with a few correctly spelled words, that had diffrent meanings from what I whated to say. If the word "ethics" was spelled, for example, "effects" in my previous post, that part of the post would not have made any sense.
FYI, spelling flames are considered to be a major violation of netiquite. Also, if you have a real disagreement with someone, take it up with the person through privite email. A public fourm is not a good place to carry on a disagreement with someone. Another thing, the (sp?) means "I know that this is the wrong spelling, but I don't know of a better spelling at the moment, so this will have to do".
I don't usially bother with dumbass flamers, but, demon, I'm going to assume that you are a newbee who doesn't know, or fully understand, the ropes. If your not, then you really need to get your head out of your ass.
Demon, if you are a college graduate, then I feel sorry for other college graduates who will now have to put up with the reputation, that you just single-handedly give them, as analy-retentive blow-hards who have nothing better to do than post spelling/grammer flames. If you're so analy-retentive that you think that a mispelled word is the end of the world as we know it, then I strongly suggest that you learn to relax, grow up, and get a life. Your own.
My job runs SMS, and I hate it. When a sysadmin can tell me to get back to work, that's bs. Fortunately, I'm cool with the admins, so it's just a joke. I'm amazed that no one else has pointed this out yet (and my apologies if you have), but if B02K is OpenSource, and has the same functionality as SMS, why not do an OpenSource SMS client? Then, even if you got sued by M$, you could state BO2K as your code base, which would then have to refer to BO2K being like SMS, and making M$ admit they have a $1000 hacking tool.
PassiveRoot
I personally think that Microsoft is attacking BO2k so much because cDc is not exactly a so called company like Netscape or Sun... They have no choice in the matter with eithe rof them as both companies have public support as well as an established business... cDc however is a small group of internet hackers who threw together a remote admin tool which challenges one made by Microsoft. It's not that they believe it's a hacker tool, it's that they're trying to knock out competition before it even starts, reguardless of how it's done.
-PhaseBurn Welcome to Linux country. On quiet nights, you can hear windows reboot.
That is the FUNNIEST thing I ever seen!!!
FunOne
FunOne
Why does it even matter what MS thinks or says? So they say your tool is a "Hacker Tool". Considering the Fact that the cDc is not selling BO2K I don't see why it matters. I mean, do we really care about market share when it comes to BO2K vs SMS? Or are we just trying to, ahem, Bitch as much as we can about a stupid issue. What is the point?
On my NT Workstation box, I can see SMS client - the prcess has SMSAPM32.exe and smss.exe listed, as well as a Systems Management icon under Control Panel. However, this visibility is probably due to my adminstrator access, both locally, and in the domain.
One interesting thing to note about SMS, though - we applied SP 1 to it, and a previously unknown bug appeared (something to do with a certain configuration), where the client began to cause errors on seemingly random machines.
We're now in the process of removing the client.
Ahh, how I love Open Source...
PinkFreud
YEs both Back Oficife 2000 and SMS can run without detection. You have to look at the midset of publication though. SMS is a valuable tool that is used more for standardization of settings and volume deployments of software. The cult of the dead cow specificaly states in a press release that their package is written because windows has no security... So they say they are exploting security holes, yet helping administrators...Maybe someone can clear this up for me. You can't charge someone with somehting you are guilty of. Of course I run linux anyway, so it really doesn't matter much to me :)
We have it here at work too. All you have to do to disable it is go into the "services" section of the conrol panel.
If SMS is like other Microsoft products, then there is no need to run a virus check for it. It would have the patented Microsoft trait of gobbling down your resources and bringing the system to its knees. of course, if you run too many other MS products there will be no telling which one is doing it at any one time...
Wake up - the future is arriving faster than you think.
So because MS writes software to perform a certain function, then I can't write software that performs a similar function.
People like you are why Apple sued Microsoft over "look and feel"...
I can write a malicious Macro Virus in Micro$oft Word just as I can use BO2K or even SMS to maliciously tamper with someone's machine. I argue that M$ security problems with Visual Basic in its Office apps are far more of a security problem then trojans like BO2K. Windows has a LOT of security problems, least of which is the "features" that cDc took advantage of to hide the trojan in other processes threads. Micro$oft needs to shut up and start fixing holes and stop pointing its fingers at people who exploit them. That's what people do, it might be wrong, but people are going to do it anyway. Shut your hole and start fixing security issues Bill.
Spyky
Funny you should say that. I read this article on Yahoo just today. It talks about a similar "Law enforcement only" program called DIRT. It mentions BO, too, but was just a little condescending. Scary to think of law enforcement using this on a regular basis.
This one's quite simple, BO was _not_ the first trojan for Windoze - they just got so much fame because CDC released it at Defcon, to get the "ooh"'s and "aah"'s from the script kiddies and the wanna-be hacker community.
I'm sure if you look hard enough, you'll find older trojans that were released long before BO was a twinkle in CDC's eyes. PC-Anywhere has been around for quite some time, and it's a remote-administration tool - if someone's tricked into setting it up, their computer can be controlled remotely. That's all there is to it.
BO is not a security flaw in m$ windoze, as they claim it is. A trojan can be written for BSD, or Linux, or any other OS for that matter. User stupidity (running a trojan) isn't the operating system's fault.
That's my $.02
Saying something like this PROVES that BO is abused by people... sure, it could be a legitimate "remote administration utility", but when I hear this, I'm reminded of the millions of script kiddies rejoicing at Defcon when it was released.
The only "obvious" weakness in Windows (95/98) is the lack of powers per user (i.e., everyone has administrative power). In my opinion, the only thing BO ever exploited was user stupidity.
On another note, adding "open source all the way" makes me sick. This is NOT what open source was made for.. script kiddies copying/compiling/running lame little backdoors and explioits. Yes, I support full disclosure with security issues, but you're looking at open source from the wrong perspective.
I'm sure your school's lab admin would really appreciate this. If you were caught, you'd probably get expelled.
Have a nice day.
nope it's really easy to mess with an NT machine. Just boot off a floppy with linux and NTFS read/write support. I am using kernel 2.3.11 and copying to and from ntfs works fine, but deleting is a little weird. Files I delete on the NT machine seem to be changed to 0kb (effectively deleting them), but remain.
After doing this you are free to play with whatever you like. BTW c:\winnt\repair\SAM._ is a file of the winnt passwd hashmarks. You can import this into a tool such as l0phtcrack and with a little time attain passwds for all accounts on that machine.
Linux is equally vulnerable should the user have access to the actual machine. This is a great flaw in my opinion. My school has circumvented the problem by not allowing the Lab machines to boot off floppies, but users could still physically damage the machines.
Shadow Passwds help and all distributions I can think of use them by default, thus only with root access could a malicious cracker have acces to your passwd and by then he would not really need to.
I have little NT experience, but there are various user-levels and permissions, right? As i understood, unless the user was set to power user or admin he/she could not really do much to change the system. BO could be installed, but would it not only work for that user? I don't see how it would compromise the entire machine. It would only allow the cracker to remove files the user had permission to delete (right?)
I would be curious to know if a cracker who was using BO on an NT machine and a user of that machine with limited permissions and BO infecting their Profile could still restart/shutdown/lockup the machine. I'm guessing not as the user cannot normally do these things.
win 9x is another story..
CDC have been around for how long?
(at least over 10 years afk)
doubt they work at taco bell. With their skill sets they could work anywhere they wish)
Well, I could wrap up pcanywhere in a *.exe and let you run it without knowledge. Would you then put pcanywhere in the same group as bo2k?
I know I'm posting this kind of late - I hope someone reads it anyhow.
Can someone possibly get themselves DIRTed, then use tcplogd, wine and linux's netstat to see exactly how this soil works? Perhaps those of us who are unfond of that level of privacy-violating software who live _outside_ the States, where US cops (corrupt official policing services?) have no jurisdiction, can work together to fight back against DIRT and write detection software for the trojan.
OFTC: By the community, for the community
Heheh, over 10 years away-from-keyboard? :)
They claim to have been around since '84.
OFTC: By the community, for the community
Aha, someone else who has discovered VNC! A top tool.
Aren't MS implementing a 'broken' version of LDAP in W2K? You aouldn't expect anything else really, could you? It would be too much to ask for them to just follow a standard...
j.
Tally-ho, yippety-dip, and zing zang spillip. Looking forward to bullying off for the final chukka?
I can't believe people are just realizing this now... as soon as all the negative talk that came up about BO2K generated by M$, I was thinking "What about SMS?".
The only reason why this is happening is because it was created by a hacker group; people always believe that hackers are out to destroy. And M$ doesn't consider them professionals (and we all know how professional M$ is) and that the result is a crappy piece of software. But in my opinion BO2K is alot better then SMS, hell, there are tons of programs out there better then Microsoft's...
"Imagination is the only weapon in the war against reality." -Jules de Gautier
It wouldn't be the same program. BO2K is a program that takes advantage of the fact that there are some secuirty issues with Windows...issues that are not present with Linux...
"Imagination is the only weapon in the war against reality." -Jules de Gautier
Either Microsoft has to admit that they have the same program and recall it...or anti-virus software has to scan for it...if either of the 2 happen people are going to be laughing for days....
But Microsoft will probably ignore the problem until it goes away
"Imagination is the only weapon in the war against reality." -Jules de Gautier
okay, ill admit it, BO2K does have its "evil" qualities but it should NOT be concidered a trojen horse nor should cDc be shot down just b/c they are pointing out the obvious weknesses in windows. i am in no way defending cDc, but i hate to see the underdog(a.k.a. everyone but microsoft) keep getting kicked. if one is going to list BO2K as a virus, then SMS should be right next to it on the list (unless the list is alphabetical that is). Far as im concerned, BO2K is going on every machine in the lab as soon as i get back to school. open source all the way! i didnt think microsoft could get much greedier, guess i was wrong. so, is everything non-microsoft a viurs in their eyes?
This is obviously just a ploy by cDc to legitimize a trojan horse app, that in 99% of all cases will be used to break into an unsuspecting user's machine.
I have been involved in dozens of SMS rollouts. SMS is a network analysis tool, that has the capability to remote control client workstations on the network.
In order for SMS to do this, you must install the SMS Client on a machine in the same Windows NT domain. This installation process will *not* run in the background, and will pop up several boxes to the user. Once the client is installed, the client configuration app must be opened, and the machine must be set to allow remote control. You also have the option of a dialog box show up informing you that someone is connected.
Along with these settings, every user that logs on to a network that is SMS aware, knows that the client is installed, because it pops and SMS configuration dialog box during every logon.
This remote control feature of SMS is used primarily for network admins that need to remote control servers than client desktops. In fact, out of all the installations I have done, the only machines that have this option turned on are the servers.
BTW, the SMS Admin tool that allows you to connect to the clients requires Windows NT, a valid logon to the Windows NT Domain that you want to administer, and a SQL server logon with appropriate rights to administer SMS.
How many checks like this does BO2K do?
Regards,
eg
I can't say that I care much for SMS. It always seems to cause plenty of problems. And yes, it definately has some "Orwelian" overtones. The remote administration application I have had the most experience with is Timbuktu. It allows full access of the target computer, including behind the scenes file transfer. However, it lets the end user know when people are connected and who is connnected. When someone connects there is an icon alerting the user to the connection, and an icon that alerts them that there has been a connection. And finally there is a log that keeps track of all connections by computer name and network address as well as by login name.
:-)
For an administrator this is actually a good thing. That way you have proof if the user claims you were tampering with their machine. And believe me, I've gotten those accusations.
I don't know why users thing we have time to go through their hard drives and throw away random files....
As for Back Orifice, I think the most impressive aspect is the small memory footprint. That is something the large companies need to emulate. And I think the biggest drawback of using it as a support tool is the lack of support and the skimpiness of the documentation.
And yes... the lockup feature is really of little use to a System Administrator. Unless that user REALLY pissed you off. But then that would be childish.
From my understanding, SMS only works on workstations of an NT/LM domain, and requires a domain login. When a user is a member of a domain, they are giving up certain "Rights" or "freedom" for the sake of central administration and access to shared resources. Typically, this is backed up by a corporate contract which states that anything on an employees machine is owned by the employer. That said, despite the fact that SMS is indeed a Big Brother tool, it is up front as such and it's security threshold limited to the scope of the domain and backed up by the user's decision to log into the domain.