Slashdot Mirror
cDc Charges MS w/ Distributing Cracker Software
davidr writes "Microsoft's response to Back Orifice 2000 has been to characterize it as a hacker tool instead of a network administration tool, because it can be installed stealthily and used to monitor users without their knowledge. cDc has reponded by pointing out that Microsoft's own tool, SMS,
does the same exact thing! They've called for antivirus software for SMS and challenged Microsoft to recall it. "
Read this one. Its interesting. Having never used SMS (hell,
I haven't really used windows in a year or so) I'll leave
it up to you guys to figure out if this is true.
What doesn't work better than anything microsoft built?
Drum Roll Please.......
Communicator!
(waiting patiently for Mozilla)
--I think that cDc has a completely valid point here. One question about their announcement, tho. At the bottom, they have various other 'excerps'. I'm wondering if perhaps some of these are related to the earlier version of BO, which really was a trojan. The text doesn't seem to clearly specify. Even if that's true, the main body text seems to make the point nicely.
I'm not very fond of SMS, but there's a significant difference between allowing a domain administrator run a remote control tool, and creating an app which circumvents NT security to allow anyone to remote control a computer. In my opinion this is CDC FUD.
Microsoft made the mistake in attacking the stealth feature of BO2K, and cDc responded right back saying that SMS was just as bad as BO2K because it was stealthy too.
what Microsoft should have mentioned instead were the features of BO2K that *really* made it intended to be malicious. The lockup command, password getting commands, microphone monitoring, etc.
But the worst thing about BO was actually mentioned in the cDc article when quoting Microsoft: "And, once it's installed, it makes the system available to other people on the Internet."
This is one key difference between SMS and BO2K. BO2K has a scanner feature (I believe another poster mentioned it), and if you scan a few subnets, you're going to see a bunch of open BO2K servers just waiting there for the hacking. SMS does not have such a scanning feature, and doesn't leave itself open over the internet.
Also, BO2K is small, and can be easily insterted into a trojan mail macro or an activex control or a buffer overflow or whatnot. Try doing that with SMS!
There's more that makes BO2K made for malicious activity than simply the stealth feature, folks. cDc is just FUDding microsoft here.
I disagree. Even the most dangerous and harmful tools are extremely useful to point two very painful but important facts: microsoft's OS's aren't secure, and people should be more careful when they download and install software.
If someone hacks you, that should be a wakeup call that you need to improve your security. And I'm not just talking about software; policies should always be more paranoid than necessary.
If the OS was designed better, and the user was more wary, this wouldn't be a problem at all, now would it? So don't go blaming the messenger; please kindly thank him for informing you of a problem you might not have previously been aware of. I mean, why do you think they release the source code?
ps - I'm not even going into the topic of why a computer user should have to be an expert - s/he shouldn't, but they should know the dangers of being online and downloading and installing software.
I believe SMS also does good stuff like updating software and stuff like that, but like I said, I don't know.
Where I last worked, they had some remote control tools. Netfinity from (I think) IBM has the checkbox for asking a user before taking over the desktop unchecked by default. With no visible indication that RC is taking place (nothing in the systray, etc) it also is just as stealthy, although it is much less useful than last year's Back Oriface. Then the company started moving to IBM's Tivoli program. It as well requires a checkbox to ask the user before establishing a connection. So it too should be either banished or welcomed.
It all comes down to who cDc is. They probably will never be taken as a legitimate organization, so their products will be labelled as virii/trojans...
Yes, but the virus still REPRODUCED on it's own, even if it was spread by infected files on disks or BBSes.
This is an unmistakable case of hypocrisy. Microsoft does sell this product with the knowledge that it could be used in a malicious way. What stops one from using it? Bloat, obviously. Microsoft has most likely bloated SMS to the point that it can only be used efficiently on an Enterprise size network - which is what most of these tools is meant for.
Now, on the topic of my subject: What's in a name? SMS sounds official - and therefore (to the unknowing public) - it is. Now, think about the name "Back Orifice 2000". What does that say?
To anyone who has heard of Back Office, it immediately strikes a fear in an IS person: Back Orifice!? Sounds like a virus already, doesn't it? The 2000 immediately says that this software is geared toward Windows 2000 and the like.
Microsoft is using BO2K's name against it simply by including it in a sentence: "Back Orifice 2000 is a trojan horse."
Regular people out there won't like to hear something called "Back Orifice" and most likely wouldn't use it just for the sake of the name. It's a shame that software's merits must be based upon names.
Heck, next thing you know is that the Vatican will be denouncing the use of the GIMP because it has homosexual connotations.
You should never take life too seriously - You'll never get out of it alive.
Why? You just have to telnet (or better off, ssh) into the box you've got Samba running and manage it from the command line (or with ssh, using X11). Why port BO to Linux when it's locked up tighter than what Microsoft can do with Win-Anything at this time?
---
Spammed? Click here for free slack on how to fight it!
--
# Canmephians for a better Linux Kernel
$Stalag99{"URL"}="http://stalag99.net";
Also, regardless of how you get it, if you have a warrant you're ok -- so I wouldn't be surprised to see BO[2k] being used by law enforcement agencies all over the place.
Well, the truth of it is that illegal evidence is not generally used, but it can be used if necessary. What generally happens is that the evidence is thrown out, but not the case - wheras in the states the entire case is thrown out the window.
Apple's network management tools do the piping mic input out thing, keystroke logging and the like. It's great if (like the admins at the high school where I worked w/ those Macs) you're trying to catch folks accessing porn.
Tried uninstalling SMS lately without your admin's OK? If you're on a well-secured NT box (ha!) it's not that trivial.
There was a BugTraq issue a few weeks ago about the lame search path that is used by Windows NT. It searches $HOME before *anything* else and so all you really need to do is put explorer.exe on the home drive and put a bo2k thread in it (well, you get the point). This can all be done easily within Word macros.
Actually, it searches . first. It's just that . is the same as %HOME% when you first log in. Let's please be acacurate when pointing out how insecure NT is... :)
To play devil's advocate here... how can you call it a real democracy if you're not free to remotely inspect and control the hardware you paid for, as legal owner or under legal authority of the corporation that owns those assets?
Democracy, voting for government action, doesn't come into this. I would call such a country a "free state for employees but not property owners."
. . a project that a friend of mine was working on WAY before BO . . . and it basically did the same thing . . .
True Dat on the "Ohhs and Ahhs" . . . Some hack for fortune, some hack for fame . . . some just want to rip off other ideas and claim them as their own by using the media . . .
my 2 centavos
They aren't doing it to "beat" Microsoft. They are exploiting the security problems in the OS in an effort to get Microsoft to fix them. In this case the whole analogy goes out the window since they aren't out to kick the goats off the mountain. I dunno. This analogy didn't really work well for me. Basically I agree that Microsoft has long ignored their security problems and will not even admit to having them in most cases. Given that degree of denial, I don't see any other way this group of people could influence Microsoft to fix the problems.
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
and it's not hidden away surreptitiously like BO2k.
Umm.. SMS can be hidden too. It's not hard.
It consists of a lot more than just remote control
Just because BO2K doesn't do everything that SMS does, it's not legit?
You could, with effort, seperate the remote control component out and use it alone, I guess, but it would be difficult to use without the entire SMS infrastructure.
What difference does it make. Microsoft could sell all the components together or separate. It wouldn't matter. The remote component obviously doesn't NEED an infrastructure to work properly, or BO2K wouldn't exist. It's just a matter of how they coded it. MS doesn't know how to make anything that works independently anymore. All products must be tied together.
Again - the difference is obvious to any but the most hardened anti-MS nerd.
Oooh... nice one. Back up flimsy argument with an ad-hominem for good measure. Maybe this'll scare you off:
If you don't agree with me then you are obviously an MS apologist with less mental capacity than my cat.
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
Since the government/police/other agencies are going to use these methods to watch us anyway, maybe we should just make it all legal. They can try to watch us... we can try to watch them... and we can both use whatever technical means we have available to avoid being watched. What other solution is there that's even marginally fair given the information we have that says that the police aren't obeying the current laws anyway? Why have the laws restricting us then?
It's not enough to bash in heads, you've got to bash in minds. - Captain Hammer
You can't TELL me you don't know how to spell 'ethics'. If you are a college graduate... good grief, I fear the implications.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
Well, just so you all know, we don't live in a democracy. We live in a constitutional republic that follows some democratic tenets. People seem to confuse the two quite frequently.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
I wonder if running 'netstat -a | more' under Windows would show the opened/listen port.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
If you were from a foreign domain that was obviously from a non-English-speaking country, I'd buy this excuse. I don't think that 'wvsc.edu' falls under that particular area, however.
:p
;)
Ethics is a major class in most colleges that I know of. I just find it quite amazing that someone who is (obviously) going to college wouldn't know that.
I'm not a "newbee" (newbie), but thanks for playing anyway.
I'm not that anally retentive. Or maybe I am. I've never bothered to check.
And I'm glad you love me so much as to reply to me. If I'm just a "newbee flamer" who isn't worth your time... I'm just so glad you care so much!
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
Okay, maybe my sarcasm was uncalled for. I just happen to think 'ethics' is a rather important word. (And one that certain businesses and gov't officials need to be reintroduced to.) Were it ANY other word, I mightn't have said anything about it.
Also, some misspellings are simple finger missteps. I've had a few of those. But actually not knowing the spelling of that particular word strikes me as rather odd.
I'm sorry for any hurt feelings, but that's just the way I see it.
Sam: "That was needlessly cryptic."
Max: "I'd be peeing my pants if I wore any!"
at http://www.anonymizer.com
This sig left unintentionally blank.
I find being able to kill the password protected screen saver with ctrl-alt-del very funny. It is very irresponsable of MS to lull the user into a sense of security like that. It's be like a Linux distro coming with a version of login that asks for a password but doesn't check it. That and the fact that Win'9x doesn't support meaningful file permissions makes it an insecure system.
Granted, any system can be compromised with physical access, but most make it much harder to be discreet about it.
To be fair, nearly any system can be compromised by booting from a floppy. The solution s are the same in all cases, a boot password (make sure the BIOS doesn't have a backdoor (most did at one time, I don't know if they still do)), or remove the floppy drive.
For higher security needs, encrypt the filesystem (on systems that support it).
I use XDM all the time. Add the following to passwd:
xdm::0:0:XDM:/root:/usr/X11R6/bin/xdm
Just type xdm at login: and it comes up.
If you'd rather just start X, run it nohup, and log off of the console session.
That way, if someone kills X, they get a login: only. If they just kill the session, they get xdm login. If you want a text vc, just switch and login. The minor inconvenience is just the cost of security.
Don't forget to set a password on LILO so people can't just boot single. Set a configuration password in BIOS and disable booting from floppy and cdrom as well.
If you do all of the above, you guarentee that the box will have to be opened to get in. If you set up an encrypted loop device as well, even ripping the drives out and putting them on another system won't expose your data.
This is an interesting idea, but does it not open a whole other box of security problems adding a second root user with no passwd? (especially with networked machine)
It does require that XDM be looked at carefully. As long as XDM is secure, the extra entry is also secure since it will just run XDM and then log back out. PAM can be configured to only allow that login from the console. If the would be cracker tries to use a well timed ^c to interrupt XDM, they might possably succeed in running X without XDM, but that doesn't buy them anything.
I consider that line a security enhancement because it reduces the chances of forgetfully leaving a VC logged in.
I'm not sure what to do about the powermac situation. I suppose to be safe, you'd have to remove any drive that allows removable media to boot :-(. Poaasbly someone with more powermac experiance knows a better way.
IMPORTANT note about PC BIOS passwords: At one time, a surprising number of them had hard coded back door passwords. Tech support would give those out to users who forgot their passwords rather than telling them they must clear their CMOS. Very dumb. I don't know if that is still done or not, only that MINE doesn't have one. Only a disassembler will tell you for sure.
The jumper these pins to clear the BIOS isn't too bad, but drian the battery with a pair of jumpers and a resister to clear the BIOS is better.
BO2K doesn't require SQLServer 7.0 and NT 4.0 and all the little licenses that go with them, so it MUST be evil! ;^)
"I don't think software should necessarily be free
SMS can scan (actually, just running the client gives the server lots of information). I'm not sure its logging functions but it also ties into network monitor (if it's installed). However, the keystroke logging is actually the most administratively beneficial component of BO2K. Being able to see just what the inputs were that caused the system to crash.... Think about it. It's also a feature enabled in some other remote admin tools. Furthermore, the microphone piping does require a mic attached to the system, yes? Also, BO hides itself by making it's executables and registry entries look like system files/keys, which makes it a pain should you decide it's time to uninstall.
Look at Office 2000. The links it creates in your start menu aren't real shortcuts, they're like the control panel. I didn't discover this until I tried running EVWM which pulled the real name from the link rather than the short name.
Most legit remote managment tools can be removed with a minimal effort. :)
Um... Sure. Right.
I'm not trying to defend MS here, but if cDc claims that BO2K is anything but a hacker tool, they're only kidding themselves.
Just like Microsoft is kidding themselves saying SMS isn't a cracking tool.
I want to see Gates eat a big steaming turd as much as the next guy, but I think cDc is going about it entirely the wrong way, and I think they're doomed to failure.
Right. Sure you want Gates to "eat a big steaming turd." We believe you.
--
Ben Kosse
Remember Ed Curry!
GIF of how to turn off visibility. Notice how both permission required and visible signal are unchecked.
All the warning you get. WUSER32 is the process (it's not visible under the Applications pane) that runs SMS.
I don't know what SMS 2.0 behaves like as we aren't using it here yet.
--
Ben Kosse
Remember Ed Curry!
- SMS displays an indication to the user that they are under remote control
- SMS cannot be installed without access to SQL Server and the Domain Controller anyway. An administrator with these privileges would not need SMS!
- SMS is a legitimate, supported product for remote installation and helpdesk functions. If you think remote access to a user workstation is a bad thing, best disable telnetd/sshd/rsh on your LAN now. Many Unix users like to criticise MS for lack of remote administration, SMS is Microsoft's answer. It can install a software package unattended and remotely - you can, for example, upgrade a thousand installations of Office to the latest version overnight, easy. You can audit machines and check whether your office in Malaysia needs more memory in their machines before deploying your latest application, all sorts of cool stuff like that. Warez k1dz hate SMS cos it finds their pirate software and the LAN admin busts them for it.
- cDc are a self-proclaimed malicious hacker group, and released their product to other self-proclaimed hackers at a hacking event. SMS is sold to enterprise customers who legally own their own machines.
(Yes, I'm an MCSE with SMS elective.)Six of one, a half-dozen of the other. BO2K can be installed and authorized by the system administrators. And SMS can be installed by unauthorized users if they have the appropriate permissions (I don't know NT very well, but surely the same permissions -- write access to the C: drive, for one -- would be required to install BO2K as to install SMS).
Also SMS's remote control facility can be turned off by the user to prevent the admin from connecting.
Not if the user doesn't know SMS is there. Here's the "evil use of SMS" scenario: I'm a cracker wanting to take remote control of Joe User's computer. So I sneak into Joe's office when Joe isn't there and has forgotten to password-protect his screensaver, and I install SMS from the CD-ROM I always carry with me. Or I find some excuse to be in Joe's office and I watch him type his password (you'd be surprised how slowly some people type their passwords in). Anyway, I get SMS installed and (posing as Joe, the user) check the "allow remote control" box and the "hide" box. Now Joe's computer has SMS installed on it and he doesn't know.
Run through the scenario above, substituting BO2K for SMS. See? Not so different, are they? Both are remote-control-of-a-computer tools that don't always announce their presence. The only difference is that SMS costs quite a bit of money, while BO2K can be downloaded free of charge. Thus a lot more people will have access to a copy of BO2K than a copy of SMS.
The point is that both SMS and BO2K can be installed by admins for legitimate purposes, or they can be installed secretly by crackers for security-breaking purposes. A rifle can be used for hunting, or it can be used to murder someone. Rifles aren't inherently evil (let's not start a gun-control flamewar here), but they can be used for evil purposes. Same principle with BO2K.
-----
The real meaning of the GNU GPL:
"The Source will be with you... Always."
*sighs* I just wish that people would engage their brains before replying... :^)
While it's true that most of the security "features" that Windoze has are not present in Linux, does not mean that a BO server couldn't be ported to Linux.
BTW, older versions of BO command-line clients were available for Linux--is the same true now? I don't use BO because I don't care that much (don't use Windows; don't like harassing people.)
Stating on Slashdot that I like cheese since 1997.
Funnily enough, the Microsoft BOB team went on to form Valve and create Half-Life...
Yes, I was surprised too...
"Be nice, veer left, and never stop thinking" Iain Banks - Walking On Glass
BO2K remains a monumental pain in the nuts for innocent Windows administrators.
What makes you think this is the first program to do this. What CDC did *for* innocent Windows admins is shine a bright light on the problem.
Do you really think CDC are the first to use a tool like this? Its's not. It is well known. The other tools that do this will not be found by a virus checker.
Linux is only free if your time has no value. Windows is only free if you threaten to use Linux.
Actually, for all practical purposes, what makes SMS not a cracking tool is its cost and its bloat. The average script kiddie (obviously) could not afford a legit copy of SMS, and probably wouldn't be able to figure it out if he/she did have it. Ironically, what makes BO2k a "cracking tool" is its price and ease-of-use. I'm sure that if MS made SMS small, easy, and free, crackers would have a field-day with it, too.
Causation can cause correlation
Windows systems are all single user, and have adequate security for single user systems.
The hell they do.
>Without my knowledge this would be a grave >ntrusion, certainly worth suing
I am not sure if this applies outside of the US or not. No, it is not. The system is not yours it is the companies and they are free to do anything with it the like. They can monitor/log keystrokes, watch what you are doing, ANYTHING!
Arse! Don't know how that space in the URL got there. I didn't even notice it in the preview. Ho hum... The link itself works OK, just not the one you get to see!
"The invisible and the non-existent look very much alike." -- Delos B. McKown
My only experience of SMS was when we were evaluating Amdahl's awful A+EDM. SMS was slightly better, but both were hampered by NT's design flaws. In the end, we went for SMS for NT, and stuck with rdist for Unix. I haven't been able to check out their web site, to find exactly what features the Linux client has, but I'm betting it's run either as root, or with setuid root privileges, and I'll pretty much guarantee it'll be closed source, and users won't be able to fix the security holes that I'm sure it'll introduce...
"The invisible and the non-existent look very much alike." -- Delos B. McKown
Search freshmeat.net for it. It's called boclient.
I use it to check my fakebo server.
And why the port? Isn't ssh enough?
Without my knowledge this would be a grave intrusion, certainly worth suing.
I suspected that such stuff exists but was not aware of it being sold by Microsoft. So I am thankful to cDc, as they rose my awareness
- Thanks, cow woreshippers!
With the current video surveilance craze (nah, not only in Great Britain, here in Germany it started too) it is not a big surprise that they start to monitor your PC.
Things to be watchful:
SMS 2.0 is not only a virus, it's a hellaciously virulent one. Like HP openview it does automatic network discovery, but unlike openview it uses the map it generates as the default list of clients that it will automatically install itself to.
I was SMS administrator at an insurance company and tried testing it out (one server, 2 clients). It was physically connected to the rest of the network, but I denied it access to the production network by setting up a completely different subnet and not adding a route. Since SMS 1.2 couldn't find machines sometimes in its OWN subnet, I assumed I was safe. I turned on discovery (and *only* discovery) and let it run overnight. When I returned the next morning, users were complaining of crashes and odd messages. Not only had SMS 2 managed to find the production network (by trying every combination of IP addresses and thus circumventing the router) and install itself onto 700-odd machines, the client was unstable and was causing many of them to crash.
Frantically I tried to undo what I had done. Chapter 13 or so of the Big Green SMS Beta Book titled "uninstalling clients" read simply: "this feature not yet implemented".
So it was back to SMS 1.2. I wrote a very ugly script designed to clean out the registry (5000+ entries) and remove all the files, but like usual most clients had problems (like 2.0-induced crashes) that prevented the script from running. I ended up having to repair 300+ workstations by hand.
Some of them are still broken actually...
"Reactionaries must be deprived of the right to voice their opinions; only the people have that right." - Mao
Yes, the PC belongs to your company (usually), but it gives IS power to monitor more than just the PC's maintenance and welfare. It can read your email as you write it, and automatically extract filter and collate any document on your system. I wrote a SMS batch that scanned all txt and word documents for the word "handcuffs", and returned a copy of the document to the server with the PC owner's name attached. (to show my boss it could be done).
There is also the issue that SMS has a tendency to install itself to the PC's of employees who dial in from home and run all administrative jobs on it as if it were corporate property. The SMS client(s) run as a domain administrator, so by logging in to the corporate domain you automatically give up all ability to stop SMS from doing its thing, short of powering off or disconnecting.
This happens, BTW. Not hypothetical.
"Reactionaries must be deprived of the right to voice their opinions; only the people have that right." - Mao
I was one of these IS people. Of COURSE it's a tool of control.
I wouldn't be too concerned though. SMS collects a lot of information, but unless the admin knows *exactly* what he's looking for he won't find it. SMS is very difficult to administer well, it breaks frequently, it is easy to confuse, and it is VERY slow.
If you want to hide something from SMS, get partition magic and change your partitioning slightly from week to week. Eventually SMS will fill up it's MS-SQL (slogan: "just like daddy's") database with 100-some entries on your machine and its contents and cease to be useful.
Wow! Looks like you have 362 copies of Netscape installed!
"Reactionaries must be deprived of the right to voice their opinions; only the people have that right." - Mao
Does SMS allow you to controll a PC over the internet? I'm not familiar with its features. If not then there is a HUGE difference between BO2K and SMS
Gary
======== In the future, everything will be artificial. ========
After thinking about my reply on yesterdays story of BO2K, I came to this conclusion:
No, BO2K or any other remote admin tool do not expose any security flaws. Windows systems are all single user, and have adequate security for single user systems. (Granted of course, you don't have machines that need security running Windows 9x, since the level of security in Windows 9x is effectively NONE).
However, single user machines have no business being attached to a network of any kind, and if you are fool hearty enough to trust sensitive data to a networked single user machine, god help you.
P.S. Any misspellings or faults of grammar you think you detect are mearly transmition errors, and probably your fault anyway.
P.S. Any misspellings or faults of grammar you think you detect are mearly transmition errors, and probably your fault a
SMS allows an authorized person to control/observe your system.
BO2K allows a script kiddie to control/observe your system.
I think MS is right on this one.
How many tool kits are out there to let you build trojan horse programs for SMS?
CDC can play with words and semantics all they want. They created a hacking tool and thats that.
I started with nothing and I still have most of it.
All in all a relevant post, but I want to point out that IBM once shipped copies of OS/2 with a virus on the CD.
This whole incident made us look a little TOO much like "professional" software developers for my taste.
A little clarification...
Back Orifice, and Back Orifice 2000, can NOT attach to another executable fro a "stealthy" delivery on their own. In order to install an "out of the box" BO2K client, you have to click on the icon for the bo2k server, which then installs and begins running.
A third party (Brian Enigma of netninja.com) has produced a series of plugins which allow this functionality, but they are neither developed nor endorsed by the Cult of the Dead Cow.
>1. It's called Back Orifice. "Yes sir, I'd like to submit an expense report for...umm... Back Orifice"
A couple of points here: first of all, it's free, so it seems unlikely that anybody would have to submit an expense report for it, unless they really WERE doing something nefarious, like embezzling. Second, you can feel free to call it BO2K if it makes you feel better about using it to administer a network. From what we hear, that's what Pat Robertson called it, and if it's clean enough for him, I would imagine it's clean enough for anybody. We chose a name like Back Orifice partly because we believe that if you are developing free, useful software entirely as a hobby, and you know you're going to get blasted by critics no matter what you do then, well, you're allowed to have some fun once in a while.
>2. The cDc claims that both that BO2K is a legitimate remote network administration tool, and that it is releasing BO2K to force Microsoft to plug (intrinsic design-related) security holes in NT. That's a contradiction. Imagine the press release for pcAnywhere 2000: "This version contains all kinds of all-new features, primarily designed to force Microsoft to plug security holes." And maybe Symantec will rename itself the Cult of the Norton Commander (cNc).
While I do like the idea of Cult of the Norton Commander, I don't honestly see a contradiction. If you read our press releases and bo2k.com, you will hopefully see a slightly different take on things. We believe that an operating system should be robust and secure enough that a powerful and useful tool such as bo2k will not be an enormous security threat. Every feature of bo2k has administration uses, and the program itself is extremely efficient and modular, things that I've always been taught are a hallmark of good software design. However, because of this very effectiveness, the bloated hulk that is Windows is unprepared to deal with the control users have been given. We developed bo2k because people should have it, and because they shouldn't be scared of it; if they are, maybe that will make people think about the real issues involved.
>BO2K has *only* a stealth mode, and stealth seems to have been a major design consideration. (Correct me if I'm wrong here, I didn't actually download it as I don't want to be sifting through my registry to get rid of it.)
Okay, I'll correct you. You are 100% wrong about this. BO2K by default has stealth mode OFF, and will show up in the process list just like any other application. And as far as that crack about sorting through your registry to get rid of it, there is a function in the client - shutdown server - which can very easily be used to completely uninstall the server from the machine it is running on. No need to hunt through the registry or anything else.
BO2K IS just a useful program for remote administration. The fact that it can be portrayed as anything else, by us or by anyone, is a sad comment on the current state of operating system and application security, at least as far as Microsoft operating systems are concerned.
- Tweety Fish
Given what we have to say, I think a lot of people would suggest that not taking us seriously is done at your own peril.
I am astonished at the number of people who claim to know our motives, age, and level of commitment to what we have to say through no more facts than what we choose to call ourselves.
I can only pray that, should you get a life-threatening illness, the doctor who recommends the drugs that could save you doesn't have a silly name.
Before you talk with such certainty, check the urls supplied in our press release. There is, in fact, an option to install SMS silently, I believe it's install /i.
As far as requiring Windows NT, a login to a domain controller, and a SQL server login... well, no, we don't require any of those, because we don't think that people should have to buy NT, a machine to act as PDC, OR SQL Server in order to effectively administer their network. We think it should be FREE.
Why run remote admin tools stealtily?
Hmm... work situations come to mind.
User is suspected of doing bad things with PC at work. Install BO and watch undetected what he/she is doing. Why undetected? Say user is pretty knowledgable about his work system, and has subverted previous attempts at this kind of thing...
Granted, I don't want to work in a place like that. As far as network traffic goes, it is easy enough to monitor what people do via the net unobtrusively, so that doesn't really count...
The "keyboard" watching stuff is pretty easy. Every keystroke in Windows generates a "message", that Windows then routes to the appropriate application. It is not too hard to watch this global message queue for keyboard messages. You can do it from Word, Access, Excel, VB or Powerpoint, in fact (it's a couple of API calls). It shouldn't be too hard, then, either, to write a little net app that blasts these messages to the net for clients to listen for...
I think the "client" is the software that "enables" the system to be managed by an SMS server.
Following the links of the cDc posting, to the 'interview' with Garms of MS, they classify any trojan as software that can damage the system in any way. The nature of trojans require some social engineering, of course, to install.
By it's own definition, MS is guilty of the distribution of the largest trojan ever made.
When was the last time you had Windows eat itself?
Wipe a drive lately? Lose some documents?
- billn
here in Canada illegally obtained evidence is not as important as getting the person behind bars
This was the case in America for a long time...completely making the 4th amendment (against unreasonable search and seizure) worthless. The cops could kick down your door, and if they found something illegal all they would get would be a "bad cop" slap on the wrist.
Today, if evidence is obtained illegally, it must be thrown out.
Of course, there are exceptions. If the police officers were "acting in good faith", they get to use whatever they found.
-Richard.
Disclaimer: I am not a lawyer and all that.
-Richard
I've heard that the only sane way to
install MS Word in a networked environment
is to use SMS, and that this is achieved
with secret API calls. Can anyone confirm
this?
Well...
If your NT orkstation is attached to a domain, then domain admins can still play with your services. And your "admins" need to have their heads smacked for not having NTFS and leaving things like the sms.ini file open for putzs (putzes?) to play with.
*cough*
:alreadydone >> login.bat
echo if exist c:\sms.flg goto alreadydone >> login.bat
echo net start service \"SMS Client\" >> login.bat
echo copy c:\boot.ini c:\sms.flg >> login.bat
echo
Ah, that brings back memories of netware login scripts...
Ahhh I must say Veggie must have had some fine corn whiskey this last weekend to have such a brilliant stroke of vision.
F /...
My shower curtain is proud to be "Owned by the cDc".
---
Openstep/NeXTSTEP/Solaris/FreeBSD/Linux/ultrix/OS
--- I do not moderate.
Yes, both can be used as remote administration tools, but there are a few primary differences. BO2K has functions they can pretty much only be used maliciously with are not contained in SMS. Examples, piping microphone input to a BO client, logging keystrokes, scanning for BO servers, etc. I don't know EVERYTHING SMS can do because, well, I try to avoid most Microsoft contact, but some of it is unavoidable in my job. Also, BO hides itself by making it's executables and registry entries look like system files/keys, which makes it a pain should you decide it's time to uninstall. Most legit remote managment tools can be removed with a minimal effort.
I'm not trying to defend MS here, but if cDc claims that BO2K is anything but a hacker tool, they're only kidding themselves. I want to see Gates eat a big steaming turd as much as the next guy, but I think cDc is going about it entirely the wrong way, and I think they're doomed to failure.
Wow, did I just play devil's advocate for M$? What IS this world coming to?
This message brought to you by the Council of People Who Are Sick of Seeing More People.
Isn't the "client" the program you use to control the "server"?
So the "client" here for LINUX is just for controlling SMS-installed Windows PC's?
I'm not thrilled with Outlook's performance in general, but I blame Exchange for the woes I've seen.
Not that there's any excuse for Outlook being such a pig when it can't connect to the server. *sigh*
I should probably also say that I see nothing but a philosophic difference between malicious code and buggy, showstopping code, just to stay on topic.
I am kinda surprised cDc compares itself to Microsoft, though.
--
QDMerge -- data + templates = documents.
how to invest, a novice's guide
I believe all that command does is actually execute OUTLOOK.EXE.
--
QDMerge -- data + templates = documents.
how to invest, a novice's guide
So because something was developed with 'malicious intent' it's bad, but a product that has the same capabilities and was developed by benign programming gnomes is fine, veriliy.
SMS used to be cheap, something like $20 per client or less compared to guys like Novadigm who're charging over $100 per client. And why wouldn't ms want to keep it that way, it makes software auditing for them that much easier.
If you don't trust an administrator, why is he an administrator?
-rozzin.
By that logic, you might say that only script kiddies use Linux, because anyone legit would have the cash to spring for NT.
That doesn't make any sense.
This sig is false.
I wonder how many law enforvement agencies use Back Orifice to assist them in their investigations...
-- ----------------------------------------------
Vive le logiciel... Libre!!!
Microsoft needs to take a true stand on the issue. Either hidden remote control software is malicious or it is not. If they claim BO2K is malicious, they need to pull SMS from the shelves, because their functionality is nearly identical. I don't think it really matters what a person thinks of cDc, or what they are doing. It's a simple matter of blatant hypocrisy, and, in my opinion, they are breaking the law by slandering a competing product. If cDc had the money, they could probably win a lawsuit.- ---------------
---------------------------------------
If you need to point-and-click to administer a machine,
Sorry, but that is an assumption you are making, or at best, a prediction. Besides, whether or not something is used for a purpose is not the deciding factor (nor even relevant) to whether or not it is a legitimate use of it.
My Suburban burns less gasoline than your Prius.
In our office it is easy to tell if you have the SMS client installed. Half your apps don't work!!! We are in the process of removing SMS from everyone's computer. Can SMS remove itself, or will it protest like HAL?
Scuttlemonkey is a troll
And remember folks, HAL + 111 = IBM
Scuttlemonkey is a troll
This whole thing is kinda funny, but the fact is that MS can't call Bo according to their site:
"Back Orifice 2000 (BO2K) is a remote-access tool that was developed with the intent of harming users...it is a tool that has no legitimate purpose other than exposing users' machines to people on the Internet."
How can they say that, if their software does the same thing! I have been waiting for this to get noticed, it just shows how microsoft does the same things it curses. I wonder how MS will respond.
Overflow on
yes of the current product....but you could have something similar.....depending on what you want it's called a remote X-Session :-)
Overflow on
Well maybe you should think a bit more...Sure it can be used as a cracking tool, but it can also be used justifiably, in the work place...The program is essentially a remote administration tool.
Plus remeber a bit back when that little HTML tag could crash all ver. of netscape, that was not made to be used maliciously, but was. All this is not the point the point is MS' software does the same thing as BO and SMS is not checked by VirusScaners.
Overflow on
You haven't gotten around to using BO2K have you? Your description applies to the original BO, but not the new one. It's important to recognise that BO2K can't be installed without a user specified port and password, no less than 14 characters! (Like ByTemyS00percRank) We admins aren't going to see widespread distribution or network scans. It could still be used for attacks, but it's not really more of a problem than anything else.
Does anyone know if B02K behaves the same way as BO did? Eg. by default, putting a registry setting in the RunOnce or RunOnceEx to start BO without a user noticing?
As a side note, I think it would have put cDc in a better light if they had included a method of detection as well. Of course that would fly in the face of this being a SA tool because every user knows how to scan a registry or check for remote administration tools.
Uhh, yeah...ever heard of warez? All of the script kiddies have, and since crackers are genrerally immoral jackasses they will have no problem stealing SMS.
Q.
Funny NT sidenote-- a user can hack the registry, but can't install programs.
Which is more dangerous...?
Returned Peace Corps IT Volunteer
The security flaws BO2k exposes are not hacking-in flaws, though these abound, but basic flaws in the lack of security in the OS. The thing with BO2k is that it isn't hacking programs or fragging with the system to do its deeds, it's using MS-created and supported programming calls that any legit or non-legit program could use with no problem. Stealthmode? supported. IBM's NEtfinity does it, too. Folders that are remotely accessible w/o telling the user? That's supported in MS code as well.
Sure, you can hack into any computer, but most systems don't serve you drinks and snacks once you get inside...
Returned Peace Corps IT Volunteer
There is a diffrence... a very small one...
SMS is made to be an admin tool... the fact that it can be abused is an oversite...
BO2K is made to be abused the fact that it is an admin tool just shows how sereous the situation is.
cDc set out to rase awareness and they have done that.
It's not like Windows is the only operating system with holes you could drive a truck through.. Mearly that Microsoft pretends they don't exist...
I don't actually exist.
anybody got a mirror for this? I hate being behind proxies...
Juiced? Or Not?
I tried anonymizer, but that's blocked too....looks like I'm gonna have to wait until I get home to find out what all the fuss is about :)
Juiced? Or Not?
If it's the *largest* (not most valuable) company in the world, he's at GE (General Electric). Misguided types may think he's at Exxon, Phillips, Shell, BP, BT, AT&T, Bell Atlantic, Southwestern Bell, Merck, IBM, Pfizer or Gillette. However, to my recollection, GE is still the largest.
--Al
Like most people, I laughed. I even downloaded the word document (I'll be sure to scan it before using it).
This does show Microsoft to be hypocrites, but that's hardly news to anyone.
One thing to remember, though, is that this doesn't make CDC angels.
BO2K is, to all intents and purposes, a cracker tool. It has valid uses, but the vast majority of people who download it are not sysadmins. BO2K remains a monumental pain in the nuts for innocent Windows administrators.
I'm not against CDC or BO2K; that doesn't mean we should paint CDC as saints.
What's your metric for size? Assets, number of employees, annual sales, annual revenues, physical size of buildings, what?
yeah - that's like ignoring cancer until it goes away - it happens eventually - you die...
OK, kid, before you get too carried away with your own brilliance, tell me why practical geneticists - the people who develop new breeds of animals and new varieties of plants - cross offspring with parents and with each other when trying to get a trait to breed true. I took the original poster to mean "They are increasing one trait, but they are doing it through inbreeding, so eventuallky they will be a bunch of musclebound hemophiliac morons".
Obviously I wasn't clear. In replying to the previous poster, I simply meant to point out an error in the previous poster's logic, who said something to the effect that BO2K is inherently bad because it lets you damage a computer. My point was that file sharing also lets you damage a computer. BO2K is just a tool. A powerful, potentially dangerous tool, one that can be used for illegal and unethical purposes, but still a tool.
The simple act of sitting at someone else's computer and deleting a file without permission is potentially a crime and could certainly subject you to civil penalties.
I have used SMS for a corporation before-They pushed the install to all the machines, and yes they could control the machines with/without the users knowledge...BUT, one thing we always had to do was call the person up to have them manually activate all the services the first time (after that it saved the config)...I'm not really sure how this can be compared as the same thing. Also, the SMS software had to be installed, and without admin access to the domain-there was no way to do this unless we wanted to step around to each of the 750 machines on the network....So yes, SMS and BO2K do have similiar working features...with the exeption of how they are implemented (and in my book that is a big exception)...
I must have read the article when it was still up..
I'm sure we're all surprised that MS is trying to take down their competition with unfair tactics. At a risk of sounding stupid, what's the need to run remote control software undetected - cracking aside? I can't think of a good legidimate use.
I've used several remote control products at different times, and as a simple user they can be wonderfully convienent. However the security hole they open up seems quite risky.. especially when software that can stealth (MS or otherwise) is used.
I'm not trying to be a MS advocate, but sounds to me like both sides have some 'splaining to do.
Just my $.02
Brett
__ No registration required to read this message. They did it in the Matrix.
First: File sharing
Yes you make the argument that perhaps file sharing can be used for evil but so can guns, knives, tape recorders, large sticks, etc. However, I dont believe locking up a computer remotely or looping a sound so that it plays repeatedly can be construed as having redeeming value where as file sharing can. Of course file sharing could be dangerous but more then often then not its a helpful application that saves many floppy disks, playing with people's minds is not a redeeming social value.
Second: Privacy
I will use a scenario here it makes it easier to explain. Here at the school, we are putting out onto campus the Dell M770MM, a monitor with speakers and microphone built in. You have chosen BO2K as your remote tool of choice. One day either you or someone you work with is bored so they decide to turn the microphone on and listen to some conversations in the President's office. Oops. That is a crime punishable by jail time and you are libel because it's your software you installed. No U.S. State will allow you to record or listen to a conversation without knowledge of at least one party (in a few states) and all parties (in the majority of states). That's why it takes a court order for a wire tap. Do not fall into the trap of thinking listening to conversations and delving into the computers of employees is a right of every network admin. Yes, the Supreme Court has said that you can look at people's email but once you start going further from there protection for you becomes a lot murkier.
Quick Sidenote:
By default, LANdesk will let the user know when the computer is being audited, which is just a better overall strategy. Even if you don't want your users to know when there being watched its still a wonderful idea to put into a place a written Information Systems usage policy. This can save a lot of court costs, the policy here on campus has been used to terminate employees and since everyone signs it, it makes you a little safer.
Take care and take it easy.
Hangtime
Guess what? We all cant be absolute security gods. You know what, the kid broke the LAW!!! To be honest, I dont like security work. Its mundane and tedious work, ie not the movies. Instead of doing things that I like to do and better serve the customers out on campus I have to devote time to defending against script kiddies. No its not the man's fault that someone broke into his computer its the Script kiddie. Just because you leave your door open doesnt give somebody the right to come through it and clean your house of belongings. We all cant be security gurus so lay off.
Unix admin vs NT admin
;) ).
(Security: General situations - workstations, server lockdowns)
Unix admin: Defends his or her castle against a small band of extremely skillful ninjas that go around his network (Unix still has less marketshare then Apple which was 5%). However, he or she has a team of fighters at their fingertips to help with any situation (ie mailing lists, Slashdot, etc.)
NT admin: Defends his or her castle against that same band because they dont like his or her choice of OS (same 5%). Also he or she has to defend against the rampaging hordes of STUPID endusers and script kiddies that want to make a mockery of their computers (remember the statistic 1 virus for Unix in the past year something like 4000 for Windows) add 85% of general computing population. So the WinNT has to defend against the best of the best (those that right exploits) and also the shear volume of users (those that like to use exploits and those dumb enough to use them). On top of that are belittled by the group above because its easier to learn their system. (There's a reason that Windows and Apple own 90% of the worldwide market for Operating Systems, its user friendliness
If you compare the two yes the Unix admin has most of the time more responsiblitity because they have more experience and he or she is in a more mission critical area. However, The NT admin is more then likely going to hear from an enduser and going to have to deal with way more shit then a Unix admin will because unlike the Unix admin EVERYBODY knows and can use Windows and the admin is the guy to call. I dont know everything but I do know some pretty damn talented NT admins and MCSEs.
One final note:
Just because you dont like Microsoft products doesnt mean that everyone that uses them is stupid when it comes to computers. I work with some exceptionally bright admins everyday, we have an NT Server running on a Dell Poweredge 6300 that handles all the networked printers on campus along with all network installations of software and hasnt gone down once in the 8 months since they set it up. The Unix admin most of the time will have the more important job but the NT guy puts up with a lot more shit.
Take care and take it easy.
Hangtime
. . .port BO2K to Linux: jazz up the interface, remove all references to cDC. . .then release it as a Remote Administration tool, just like SMS, etc. After getting reviews, accolades, etc., THEN reveal that it's a BO2K variant. . . .until Bill et al bought it, and built an empire on it. . .
After all, MS-DOS was once a hacker-built tool, too. .
Thats evidently the way our company thinks also. We need to spend $1500 and 3 weeks per license for compilers because we are not allowed to download free compilers from the 'net.
If its free, it can't nearly be as good as something you could pay copious amounts of $$$ for. Productivity be damned, we want to waste money.
If the company managers/CEOs/and government officials were in charge from the beginning, I'm surprised we ever climbed down from that first tree.
-- toolie
> A couple of points here: first of all, it's free, so it seems unlikely that anybody would have to submit an expense report for it, unless they really WERE doing something nefarious, like embezzling.
Nitpick! My point was that software designed for use adminstering networks would not have a name like Back Orifice.
>I don't honestly see a contradiction.
Well, let me restate my point. Legitimate network administration software does not claim to exploit security holes, design-related or not.
>Okay, I'll correct you. You are 100% wrong about this.
Sorry about that. I DID try out the original BO, though, and it was certainly like that.
The truth is that no matter what the press releases say, you know that you're not going find any large networks administered by Back Orifice soon. There's no need to go into details; that knowledge is enough to prove that it isn't legitimate network management software.
Still, it is a very nice piece of software. Also, it's open source. So, if someone whose programming skills extend beyond Perl (unlike mine), here's a job for you:
- rename the program
- get rid of some of the more dubious features, i.e. lockup and redirect mic (while that is certainly in some commercial products, it's just scary, dammit! I can live with someone looking through my files, but they can't listen to me!)
- make it less stealthy on the server side
- change it so that existing antivirus definitions won't detect it, and slashdot-effect mcafee.com and the cNc if they put the changed version into their software.
By the way, does the Cult have any lawyers among its members? (I can see it already... "Approach the bench, Tweety Fish!") I'm sure that there is an excellent case to sue anti-virus software makers, as their "protection" against BO certainly will prevent people from using it, and it could certainly be argued that the program, legitimate or not, is not in of itself malicious.
A couple of reasons why BO2K is NOT a legitimate remote network administration tool.
1. It's called Back Orifice. "Yes sir, I'd like to submit an expense report for...umm... Back Orifice"
2. The cDc claims that both that BO2K is a legitimate remote network administration tool, and that it is releasing BO2K to force Microsoft to plug (intrinsic design-related) security holes in NT. That's a contradiction. Imagine the press release for pcAnywhere 2000: "This version contains all kinds of all-new features, primarily designed to force Microsoft to plug security holes." And maybe Symantec will rename itself the Cult of the Norton Commander (cNc).
Also, it's quite obvious that use as a cracking tool was a consideration in the design of BO2K. While SMS and other remote administration systems do have "Stealth modes", BO2K has *only* a stealth mode, and stealth seems to have been a major design consideration. (Correct me if I'm wrong here, I didn't actually download it as I don't want to be sifting through my registry to get rid of it.)
Still, it is NOT a trojan. Trojans don't have install programs. I think anti-virus programs scanning for it is a bit of a joke. For that matter, I think anti-virus programs should stick with viruses (which, of course, BO2K is not by definition) - the only true protection against trojans is to be careful what software you run.
BO2K is certainly a useful program for remote administration. It's small, fast, etc. But claiming that it's just a useful little open source administration tool is engaging in a Microsoft-style bending of facts. For those of you who still claim this, think about who most of the future users of BO2K will be. Will they be script kiddies and people who just want to try it out, or will they be sysadmins of large networks? If it will very rarely be used to administer large networks ("Help Desk? I'm having trouble with Word." "OK, just let me Orifice into your system. Our custom BUTTplugs should help with this one") but rather used by the kind of people who haven't yet mastered the concept of digits being used in numbers and letters being used in words, and as such think that the program is l33t, then it isn't a legitimate remote administration tool.
I guess that you installed SMS on a production-server. That's NOT cool at all..
I was testing SMS on our NT box because we were contemplating utilizing it for administration. I installed the client on one box to see how it would be. Lo and behold.. the next day.. it had installed itself on ALL of our computers. It had gone in and made changes to my login.bat script own its own. This was TOTALLY not cool.
I'm not familiar with BO, but I'v used a program called "netbus" that basicaly does the same thing. In netbus there's a way to just print somthing to the screen in a diolog box, and I'd be willing to bet that that exsists in BO as well. if they really wanted to protect you, they could just load up a URL with info on removing and detecting BO. not that anyone with half a brain would put BO on the default port, unpassworded anyway.
_
"Subtle mind control? Why do all these HTML buttons say 'Submit' ?"
ReadThe ReflectionEngine, a cyberpunk style n
It's a fireable offense to use SMS on the MS campus without a valid business reason.
However, on a completely unrelated topic, I have a few comments. Hemp is a miracle plant. You can use it's fibers to produce paper, saving countless trees. It can be made into clothing. Hemp seed oil can be used as an alternate fuel source. Hemp seed oil has more protein that soy bean oil. Hemp is a readily renewable resource, and could be the start of an incredibly profitable and environmentally friendly industry.
Oh yeah, you can smoke it, too [he says tongue-in-cheek].
The party's over
Hmmm considering how many remote control programs are out there, and considering how none of them (except of for BO or BO2k) are viewed as virii (expecially by McAfee, Norton, Etc.), it would be nice to have a Win32 program that could run and informs you if it detects one of these 'malicious' programs or (even better), gives you the option of terminating them.
Of course a package that allows you to de-install, or hack apart SMS would also be nice (replace it with a program that would let the user audit its activity or confirm its actions).
Of course I'm not a serious programmer so I don't know how tough either of these ideas would be to impliment, but they sure would make for interesting projects. (grin)
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
I actually got busted this morning for running NetBus on my system...NAV had picked it up and notified my admins, who use both SMS and PC Anywhere to "spy" on our systems. The really funny thing: as local administrator, I can uninstall NetBus Pro (actually has an uninstall routine) but I cannot uninstall SMS.
Hrm. Wonder which one acts more like a virus.
Thank you. I'm glad that not only somebody was listening, but that somebody understood. lol. The whole point is not in the seriousness of the analogy, as comparing billygoats to multibillion dollar corporations lacks the implicit parallelism necessary for a good analogy (for obvious reasons), and should be taken only on a whimsical note, with a sense of humour. The analogy I meant to bring out was between that of the animal kingdom and that of the competitive corporate market.
Albeit possible that I sorely failed in this, I'm sure that some of the messages intended were blatently obvious, whereas others were a little more subtle. I'm quite glad that you understood, and brought out, this one.
Strange how it is generally the anonymous coward that tends to miss the really interesting points, only to harp on what is (often inaccurately) obviously wrong. lol.
It takes all kinds ...
Nature provides two forces against these kings of the hill: better billygoats, who can sneak past the big buggers, and the slow grinding away of the hill upon which they sit, which is so difficult to climb because of a steep monopoly. These may be thought of as Linux and the erosion of the computer operating system monopoly mountain-peak. Together, the mountain is getting harder to defend against something like Linux, and the faster, nimbler billygoats are winning more of the battles for the hilltop.
The inevitable conclusion is undetermined as of yet; the smaller, nimbler billygoats may yet force the hefty one off the top, the hefty kings of the hill may yet defend their mountain, or while the dual continues against each other, the mountain may just dissappear, and we all buy appliances.
To make the analogy more fun, we must look at what happens to the hefty billygoats. They do not control one mountain; they have a say in several mountains -- from software through to webTV to all kinds of fertile grazing lands. These mountains do not all dissappear, and so the hefty billygoats, with their limited company immortality, can cling to many unconnected lands.
One can see the faults in the billygoats at the top of the hillside, where they are forced to give way to things like Apache for MSN and HotMail. They are not superior. Just in greater numbers, and more aggressive. Outside of the analogy, one might think that the sun shines brighter on the Microsoft soil, because their lands are so fertile. It's more likely that it's fertilized with perfume-smelling dung to bring the birds and the bees. It's still dung, though, where it would not normally be fertile land.
SMS vs BO2K arguments are one field on the mountain range that must be debated. BO2K does not possess the awe of the Open Source billygoats, but does have the potential to offset the balance in yet another area controlled by a bloated pack of oversized goats.
Packs of animals are forced to maintain a certain size to compete. Microsoft is well beyond this size, and, outside the analogy, their interdependancy may be the end of them.
The lesson? Polygomy and inbreeding will not necessarily lead to better goats.
I have a great idea. Since BO2K is open source, why not port it to Linux to run SMS capabilities from a Samba server? Sounds like a great project to me, if only I could program.....
Wiggles (the pathetic Linux luser)
My complaint is that the OS allows this to happen (in the case of BO2k), and that the OS maker is doing very little to help.
You ask "How many checks like this does BO2K do?" shouldnt we ask why dosnt Windows do any checks like this?
How can anyone take these people seriously?
This is so true. The difference between a trojan running on a Unix/Linux system is that to be truely effective, root needs to execute/install it. MOST of the time, anyone with root access is a competant administrator and would know better to trust an unconfirmed program under root.
Your average windows user, however, is not nearly as experienced in this area, as well as having full control of their system. This gives trojans on a windows platform a better chance.
-Restil
Play with my webcams and lights here
Exactly... to bring up the old quote: It's not the gun that kills, it's the person with their finger on the trigger.
"Alcohol, Tobacco, Firearms, and Explosives" should be a convenience store, not a government agency.
Yep, but all I would have to do is re-enable it using Server Manager. I do it all the time. And if someone has 'chosen' to disable the remote control, all I have to do is edit the sms.ini on their pc and then restart the SMS service remotely. Viola!
James
get nemulator
Then your sys. admin has already given you too much control and it serves him right if he can't access your pc.
James
get nemulator
"It?s incomprehensible why a tool like this would be created. [...] [T]here?s no pur.......
What is the ? for????????????
Can't the mircosoft.com servers handle ' ????
What sort of crap is that!!!
Oh, um, BO2k, um, Don't use Windows ALL PROBLEM SLOVED!!!!
MarNuke
We need to replace SMS with an opensource alternative that is cross-platform and can be administered from unix.
Is BO2k a good or bad tool? Hmm... Are crack, nmap, and saint good or bad? Depends on who uses them for what...
How much is an enterprise license for SMS and 10,000 users? What would be the impact on Micros~1 if fortune 1000 companies dumped SMS for free software?
Micros~1 doesn't want to buy into the idea that their loyal users could/would use opensource enterprise software for systems management.
I'm sure that some of these vulnerabilities in Win32 are there by design
Umm... your comment assumes that you made the mistake of using Micros~1's I'll fated Domain setup. (it's going away when the vapour clears from Windows 2001's inActive Directory)
;)
Can't we all agree to us LDAP and get on with enterprise computing architecture? (forgot -- there's no MSLDAP, Visual LDAP, or DirectLDAP-DNS-for-datacenters yet
Oh, by the way, what about VNC? If an email attachment started a VNC server and set the password, would that make vnc a virus?
I couldn't live without VNC to tame Windows boxes. If anti-virus software started uninstalling VNC, I'd find new anti-virus software.
What if vnc development forked and one branch was driven by some teenagers who were branded as hackers? Does vnc become a bad tool?
I checked this software out, and while it's a cool idea, and one that I might take the time to fully develop, I came up with some pretty SERIOUS security holes in this. It's not as bad as BO, but close, and it's multi-platform.
At the very least, PLEASE don't run this without changing the falsepath function in response.pl so that it never returns anything but a non-existant filename. This program will happily transfer all of your files to remote systems (yes, I know that falsepath tries to prevent this, but think about it for a bit, and you can get around this).
This is a tool that needs to be run and installed (server-side) juts like anything else. It does not just "allow anyone to remote control a computer." The only security holes that it takes advantage of is the ability to hide itself (a hole that SMS apparently exploits as well) and the ignorance of the users. SMS or pcAnywhere could just as easily be used by someone for inappropriate/illegal purposes...
I reported this two days ago in a post to the BO2K/Open Source thing. It stayed at a score of 1, though. Now watch them moderate this one to -2 for being off-topic. Just you watch. They're all against me.
~ Give me 101 plastic soldiers, and I will conquer the world.
...and SMS not one (assuming SMS not being one is part of your point)? Is it based on the intent, background, reputation, or nicknames of the developers? Or is there some technical reason to make BO2K a cracking tool and SMS not one?
Geeky modern art T-shirts
I agree that trojans aren't really the fault of the operating system... to a point.
If an admin is stupid enough to install something like this, then they deserve what they get.
The real question is whether joe user, who barely understands the difference between a computer and their toaster can install this and have it provide access to sensitive files.
It is the job of the operating system (especially one in a networked environment) to limit the ability of users, and programs run by users, to modify, delete, view, or execute certain files. Otherwise the operating system is wide open if someone can get ahold of a simple user account.
Doug
Venn ist das nurnstuck git und Slotermeyer? Ya! Beigerhund das oder die Flipperwaldt gersput!
The network admin at my town's public high school intends to use BO2K as a remote admin tool. This is because it is has the best useability/cost ratio out there, the fact that it has "supurfolus features" that he doesn't intend to use doesn't make it any less a verry good remote admin tool.
-- The act of censorship is always worse than whatever is being censored. Always.
Check out the BO2K website at http://www.bo2k.com/ if you don't belive me.
-- The act of censorship is always worse than whatever is being censored. Always.
If you are using XOR "Encription" then the password min is 4.
-- The act of censorship is always worse than whatever is being censored. Always.
then it isn't breaking and entering if someone comes in and takes your stuff or messes up your stuff. It should work the same with computers.
-- The act of censorship is always worse than whatever is being censored. Always.
lockvc
and another one that I don't remember the name of.
-- The act of censorship is always worse than whatever is being censored. Always.
I fully intend to install BO2K on all My school's computers when I return to school, with the help of our network admin.
-- The act of censorship is always worse than whatever is being censored. Always.
Be understanding that BO2K is a perfectly good remote admin tool, just like any commercial product (except is GPL, not commercial)
Be reading entire site at www.bo2k.com before you make judgement on what is BO2K and what it is intended for/good for.
-- The act of censorship is always worse than whatever is being censored. Always.
it's still second degree murder.
I wouldn't do that if I were you. It's only legal to shoot an intruder in self defense, at least in MA, US where I live.
-- The act of censorship is always worse than whatever is being censored. Always.
You need to remeber that there are people on the net who use english as a second language, and that there are also people who have phyical and mental disablities.
I will never be able to spell well enough to win a spelling constest, or to be a professional profreader. Sure, there are spell checkers, but those things are far from perfect, or even close to perfect. For example, when I put "efics" into a spell checker, it came out with a few correctly spelled words, that had diffrent meanings from what I whated to say. If the word "ethics" was spelled, for example, "effects" in my previous post, that part of the post would not have made any sense.
FYI, spelling flames are considered to be a major violation of netiquite. Also, if you have a real disagreement with someone, take it up with the person through privite email. A public fourm is not a good place to carry on a disagreement with someone. Another thing, the (sp?) means "I know that this is the wrong spelling, but I don't know of a better spelling at the moment, so this will have to do".
I don't usially bother with dumbass flamers, but, demon, I'm going to assume that you are a newbee who doesn't know, or fully understand, the ropes. If your not, then you really need to get your head out of your ass.
Demon, if you are a college graduate, then I feel sorry for other college graduates who will now have to put up with the reputation, that you just single-handedly give them, as analy-retentive blow-hards who have nothing better to do than post spelling/grammer flames. If you're so analy-retentive that you think that a mispelled word is the end of the world as we know it, then I strongly suggest that you learn to relax, grow up, and get a life. Your own.
The distribution with the virus was a lame oversight- and I'm sure they won't happen again. Someone already pointed out IBM's error. Here's a somewhat similar one just made by MS (granted not a virus, but shows any company can slip up- then again, how could they do not write a basic javascript function correctly when they have the steps/keys RIGHT IN FRONT of them?).
9 9-025.asp), which was 9 9-025faq.asp) provided
---
The following is a Security Bulletin from the Microsoft Product Security
Notification Service.
Please do not reply to this message, as it was sent from an unattended
mailbox.
********************************
Microsoft Security Bulletin MS99-025
(http://www.microsoft.com/security/bulletins/MS
released on July 19, 1999, discussed a vulnerability associated with
Internet Information Server and Microsoft Data Access Components. The
Frequently Asked Questions (FAQ) page for this bulletin
(http://www.microsoft.com/security/bulletins/MS
instructions on how to manually change the registry in order to protect
vulnerable systems, and also provided an automated method for making the
changes. However, we have discovered that the automated method is
incorrect.
If you manually changed the registry entries as discussed in the bulletin,
you do not need to take any further action. All of the information in the
bulletin and FAQ regarding registry keys is correct. However, if you
downloaded HANDUNSF.REG and used it to automatically change the registry,
you should download the corrected file and run it on all affected systems.
The corrected file is named HANDSAFE.REG, in order to make it easy to tell
that you are using the right file. The file can be downloaded from the FAQ
page; the link to the file is contained in the answer to "I have MDAC 2.x
installed, what should I do?".
Kinda like Moe, but just a little more Kool
My job runs SMS, and I hate it. When a sysadmin can tell me to get back to work, that's bs. Fortunately, I'm cool with the admins, so it's just a joke. I'm amazed that no one else has pointed this out yet (and my apologies if you have), but if B02K is OpenSource, and has the same functionality as SMS, why not do an OpenSource SMS client? Then, even if you got sued by M$, you could state BO2K as your code base, which would then have to refer to BO2K being like SMS, and making M$ admit they have a $1000 hacking tool.
PassiveRoot
I personally think that Microsoft is attacking BO2k so much because cDc is not exactly a so called company like Netscape or Sun... They have no choice in the matter with eithe rof them as both companies have public support as well as an established business... cDc however is a small group of internet hackers who threw together a remote admin tool which challenges one made by Microsoft. It's not that they believe it's a hacker tool, it's that they're trying to knock out competition before it even starts, reguardless of how it's done.
-PhaseBurn Welcome to Linux country. On quiet nights, you can hear windows reboot.
That is the FUNNIEST thing I ever seen!!!
FunOne
FunOne
Why does it even matter what MS thinks or says? So they say your tool is a "Hacker Tool". Considering the Fact that the cDc is not selling BO2K I don't see why it matters. I mean, do we really care about market share when it comes to BO2K vs SMS? Or are we just trying to, ahem, Bitch as much as we can about a stupid issue. What is the point?
On my NT Workstation box, I can see SMS client - the prcess has SMSAPM32.exe and smss.exe listed, as well as a Systems Management icon under Control Panel. However, this visibility is probably due to my adminstrator access, both locally, and in the domain.
One interesting thing to note about SMS, though - we applied SP 1 to it, and a previously unknown bug appeared (something to do with a certain configuration), where the client began to cause errors on seemingly random machines.
We're now in the process of removing the client.
Ahh, how I love Open Source...
PinkFreud
YEs both Back Oficife 2000 and SMS can run without detection. You have to look at the midset of publication though. SMS is a valuable tool that is used more for standardization of settings and volume deployments of software. The cult of the dead cow specificaly states in a press release that their package is written because windows has no security... So they say they are exploting security holes, yet helping administrators...Maybe someone can clear this up for me. You can't charge someone with somehting you are guilty of. Of course I run linux anyway, so it really doesn't matter much to me :)
We have it here at work too. All you have to do to disable it is go into the "services" section of the conrol panel.
If SMS is like other Microsoft products, then there is no need to run a virus check for it. It would have the patented Microsoft trait of gobbling down your resources and bringing the system to its knees. of course, if you run too many other MS products there will be no telling which one is doing it at any one time...
Wake up - the future is arriving faster than you think.
So because MS writes software to perform a certain function, then I can't write software that performs a similar function.
People like you are why Apple sued Microsoft over "look and feel"...
I can write a malicious Macro Virus in Micro$oft Word just as I can use BO2K or even SMS to maliciously tamper with someone's machine. I argue that M$ security problems with Visual Basic in its Office apps are far more of a security problem then trojans like BO2K. Windows has a LOT of security problems, least of which is the "features" that cDc took advantage of to hide the trojan in other processes threads. Micro$oft needs to shut up and start fixing holes and stop pointing its fingers at people who exploit them. That's what people do, it might be wrong, but people are going to do it anyway. Shut your hole and start fixing security issues Bill.
Spyky
Funny you should say that. I read this article on Yahoo just today. It talks about a similar "Law enforcement only" program called DIRT. It mentions BO, too, but was just a little condescending. Scary to think of law enforcement using this on a regular basis.
This one's quite simple, BO was _not_ the first trojan for Windoze - they just got so much fame because CDC released it at Defcon, to get the "ooh"'s and "aah"'s from the script kiddies and the wanna-be hacker community.
I'm sure if you look hard enough, you'll find older trojans that were released long before BO was a twinkle in CDC's eyes. PC-Anywhere has been around for quite some time, and it's a remote-administration tool - if someone's tricked into setting it up, their computer can be controlled remotely. That's all there is to it.
BO is not a security flaw in m$ windoze, as they claim it is. A trojan can be written for BSD, or Linux, or any other OS for that matter. User stupidity (running a trojan) isn't the operating system's fault.
That's my $.02
Saying something like this PROVES that BO is abused by people... sure, it could be a legitimate "remote administration utility", but when I hear this, I'm reminded of the millions of script kiddies rejoicing at Defcon when it was released.
The only "obvious" weakness in Windows (95/98) is the lack of powers per user (i.e., everyone has administrative power). In my opinion, the only thing BO ever exploited was user stupidity.
On another note, adding "open source all the way" makes me sick. This is NOT what open source was made for.. script kiddies copying/compiling/running lame little backdoors and explioits. Yes, I support full disclosure with security issues, but you're looking at open source from the wrong perspective.
I'm sure your school's lab admin would really appreciate this. If you were caught, you'd probably get expelled.
Have a nice day.
I don't know... the security at Black Mesa didn't seem that hot either -- didn't slow Freeman down much anyway :).
Jim
nope it's really easy to mess with an NT machine. Just boot off a floppy with linux and NTFS read/write support. I am using kernel 2.3.11 and copying to and from ntfs works fine, but deleting is a little weird. Files I delete on the NT machine seem to be changed to 0kb (effectively deleting them), but remain.
After doing this you are free to play with whatever you like. BTW c:\winnt\repair\SAM._ is a file of the winnt passwd hashmarks. You can import this into a tool such as l0phtcrack and with a little time attain passwds for all accounts on that machine.
Linux is equally vulnerable should the user have access to the actual machine. This is a great flaw in my opinion. My school has circumvented the problem by not allowing the Lab machines to boot off floppies, but users could still physically damage the machines.
I am a registered user and I agree with the AC. Although I'll try to make a less flamable comment.
IE5, probably because of its integration with windows, voodoo magic, and the nerve gas MS had reportedly released on the Netscape compound renders faster and appears to be a better contender than Netscape 4.61 and with AOL as its adopted parent I have little hope for netscape's future. Mozilla is in an equally poor condition. My hope lies in opera or a clone of that technology. I also really like Lynx.
Shadow Passwds help and all distributions I can think of use them by default, thus only with root access could a malicious cracker have acces to your passwd and by then he would not really need to.
I have little NT experience, but there are various user-levels and permissions, right? As i understood, unless the user was set to power user or admin he/she could not really do much to change the system. BO could be installed, but would it not only work for that user? I don't see how it would compromise the entire machine. It would only allow the cracker to remove files the user had permission to delete (right?)
I would be curious to know if a cracker who was using BO on an NT machine and a user of that machine with limited permissions and BO infecting their Profile could still restart/shutdown/lockup the machine. I'm guessing not as the user cannot normally do these things.
win 9x is another story..
CDC have been around for how long?
(at least over 10 years afk)
doubt they work at taco bell. With their skill sets they could work anywhere they wish)
Well, I could wrap up pcanywhere in a *.exe and let you run it without knowledge. Would you then put pcanywhere in the same group as bo2k?
Oh how true dilbert rings in the corporate world.
OFTC: By the community, for the community
http://www.defcon.org/html/defcon-2.html
The sound file is a broken link.
OFTC: By the community, for the community
I know I'm posting this kind of late - I hope someone reads it anyhow.
Can someone possibly get themselves DIRTed, then use tcplogd, wine and linux's netstat to see exactly how this soil works? Perhaps those of us who are unfond of that level of privacy-violating software who live _outside_ the States, where US cops (corrupt official policing services?) have no jurisdiction, can work together to fight back against DIRT and write detection software for the trojan.
OFTC: By the community, for the community
Heheh, over 10 years away-from-keyboard? :)
They claim to have been around since '84.
OFTC: By the community, for the community
Aha, someone else who has discovered VNC! A top tool.
Aren't MS implementing a 'broken' version of LDAP in W2K? You aouldn't expect anything else really, could you? It would be too much to ask for them to just follow a standard...
j.
Tally-ho, yippety-dip, and zing zang spillip. Looking forward to bullying off for the final chukka?
For the record, cDc isn't a bunch of 16 year olds :)
cDc has been around since 1984, I believe.
also, it isn't the same thing, B02k works better. But you knew that. What doesn't work better than anything microsoft built?
Failure is not an option.
It comes bundled with Windows.
I can't believe people are just realizing this now... as soon as all the negative talk that came up about BO2K generated by M$, I was thinking "What about SMS?".
The only reason why this is happening is because it was created by a hacker group; people always believe that hackers are out to destroy. And M$ doesn't consider them professionals (and we all know how professional M$ is) and that the result is a crappy piece of software. But in my opinion BO2K is alot better then SMS, hell, there are tons of programs out there better then Microsoft's...
"Imagination is the only weapon in the war against reality." -Jules de Gautier
It wouldn't be the same program. BO2K is a program that takes advantage of the fact that there are some secuirty issues with Windows...issues that are not present with Linux...
"Imagination is the only weapon in the war against reality." -Jules de Gautier
There is a Unix port already for the client portion of the program. I answered as if he was asking for a port of the whole program, which isn't possible.
"Imagination is the only weapon in the war against reality." -Jules de Gautier
Either Microsoft has to admit that they have the same program and recall it...or anti-virus software has to scan for it...if either of the 2 happen people are going to be laughing for days....
But Microsoft will probably ignore the problem until it goes away
"Imagination is the only weapon in the war against reality." -Jules de Gautier
heh, true, once, but I just got Communicator 4.61 for my Debian box and its both solid and handy.
:D
before I got it I used the Mozilla browser included with version 2.1 of the distro. what a piece of crap! I'll take Communicator any day, I don't care how much Mozilla has grown up, the version I was stuck with was so buggy it never should have seen the light of day, or a "stable" Debian release.
but the topic today is Microsoft, and I have to be amused at how almost all of the MS defenders are posting anonymously. Every time a story about them comes up. Of course I would assume someone at HQ is going to read this, and tell them all to start logging in before posting for Bill's causes...
on the issue of cDc, all I will say is they certainly have a certain flair for style
Boo!
okay, ill admit it, BO2K does have its "evil" qualities but it should NOT be concidered a trojen horse nor should cDc be shot down just b/c they are pointing out the obvious weknesses in windows. i am in no way defending cDc, but i hate to see the underdog(a.k.a. everyone but microsoft) keep getting kicked. if one is going to list BO2K as a virus, then SMS should be right next to it on the list (unless the list is alphabetical that is). Far as im concerned, BO2K is going on every machine in the lab as soon as i get back to school. open source all the way! i didnt think microsoft could get much greedier, guess i was wrong. so, is everything non-microsoft a viurs in their eyes?
This is obviously just a ploy by cDc to legitimize a trojan horse app, that in 99% of all cases will be used to break into an unsuspecting user's machine.
I have been involved in dozens of SMS rollouts. SMS is a network analysis tool, that has the capability to remote control client workstations on the network.
In order for SMS to do this, you must install the SMS Client on a machine in the same Windows NT domain. This installation process will *not* run in the background, and will pop up several boxes to the user. Once the client is installed, the client configuration app must be opened, and the machine must be set to allow remote control. You also have the option of a dialog box show up informing you that someone is connected.
Along with these settings, every user that logs on to a network that is SMS aware, knows that the client is installed, because it pops and SMS configuration dialog box during every logon.
This remote control feature of SMS is used primarily for network admins that need to remote control servers than client desktops. In fact, out of all the installations I have done, the only machines that have this option turned on are the servers.
BTW, the SMS Admin tool that allows you to connect to the clients requires Windows NT, a valid logon to the Windows NT Domain that you want to administer, and a SQL server logon with appropriate rights to administer SMS.
How many checks like this does BO2K do?
Regards,
eg
I can't say that I care much for SMS. It always seems to cause plenty of problems. And yes, it definately has some "Orwelian" overtones. The remote administration application I have had the most experience with is Timbuktu. It allows full access of the target computer, including behind the scenes file transfer. However, it lets the end user know when people are connected and who is connnected. When someone connects there is an icon alerting the user to the connection, and an icon that alerts them that there has been a connection. And finally there is a log that keeps track of all connections by computer name and network address as well as by login name.
:-)
For an administrator this is actually a good thing. That way you have proof if the user claims you were tampering with their machine. And believe me, I've gotten those accusations.
I don't know why users thing we have time to go through their hard drives and throw away random files....
As for Back Orifice, I think the most impressive aspect is the small memory footprint. That is something the large companies need to emulate. And I think the biggest drawback of using it as a support tool is the lack of support and the skimpiness of the documentation.
And yes... the lockup feature is really of little use to a System Administrator. Unless that user REALLY pissed you off. But then that would be childish.
SMS = Systems Management Server. It's Microsoft's "Big Brother" Software. Pretty cool - if you are a netadmin and don't mind running a 16 bit app in realmode across your workstations.
From my understanding, SMS only works on workstations of an NT/LM domain, and requires a domain login. When a user is a member of a domain, they are giving up certain "Rights" or "freedom" for the sake of central administration and access to shared resources. Typically, this is backed up by a corporate contract which states that anything on an employees machine is owned by the employer. That said, despite the fact that SMS is indeed a Big Brother tool, it is up front as such and it's security threshold limited to the scope of the domain and backed up by the user's decision to log into the domain.
Only if the sysadmin set it up that way. This can be turned off so the user isn't even aware that it is in use.
This isn't exactly stealth. The person could easily close out the program which resides unhidden on the taskbar like a minimized program.
Assuming they can see it (see above) and assuming they have the know-how and the rights to kill the program (it probably runs as an admin/the system, so the user wouldn't have the rights to kill the process--it isn't theirs!).
There is also a line in autoexec.bat you need (something like SMS_SETUP=NT) which could be taken out.
It can't be taken out if the machine uses NTFS and you don't have permission to even touch the file.
ufdraco