OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: NT Screen Saver Password Protect Bug
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: NT Screen Saver Password Protect Bug

  • To: NTBUGTRAQLISTSERV.NTBUGTRAQ.COM
  • Subject: Re: NT Screen Saver Password Protect Bug
  • From: Steve Birnbaum <sbirnSECURITY.ORG.IL>
  • Date: Sat, 28 Mar 1998 02:18:19 +0300
  • Comments: cc: Paul Leach <paulleMICROSOFT.COM>, David Hiers <USFTLTV9IBMMAIL.COM>
  • In-Reply-To: Your message of "Fri, 27 Mar 1998 11:55:33 -0800."
  • Reply-To: Steve Birnbaum <sbirnSECURITY.ORG.IL>
  • Sender: Windows NT BugTraq Mailing List <NTBUGTRAQLISTSERV.NTBUGTRAQ.COM>
> However, it is an UNSOLVABLE problem, and so
> fixing one instance is useless and can only lead to a false sense of
> security.

I never thought I'd find myself agreeing with Paul, but stranger
things have happened (though not many <g>).

NT is not B1 or B2 rated.  I haven't heard about it being rated C2 with
a NIC.  So why are people sitting here comparing it to such systems?
If you want such a system, go talk to Argus systems or some other
vendor who'se OS meets your security requirements.

As long as the admin is a superuser, what differences does it make
*HOW* he is able to use your account?  If it's not one way, it's another.

Forget software, maybe the keyboard is specially wired to record
your keystrokes and send them via a wireless transmitter to a receiving
device on the admin's desk?  Go find that in your audit log.

Like Paul said, if you can't trust the admin don't touch the computer.

  Steve

---
sbirnsecurity.org.il Phone: +972-2-6795860    (PGP key available)
Fight Internet Spam!  http://www.vix.com/spam/  Disclaimer: My opinions only.