-----BEGIN PGP SIGNED MESSAGE-----

Well, I'm supposed to be elated at Microsoft's latest security tool,
IISLockD;

http://www.microsoft.com/technet/itsolutions/security/tools/locktool.a
sp

I'm not exactly sure why I'm supposed to be elated, maybe its the
fact it has an "Undo" feature. Call it sour grapes, but this thing
falls short of what I offered as a prototype several weeks ago (in
some ways) while being far superior in other ways.

The tool is targeted at Novice users, offering an Express mode and
Advanced Mode.

What it does;

1. Creates two new groups, Web Anonymous Users and Web Applications,
puts the IUSR and IWAM accounts in them respectively, then sets an
ACE more than enough executables to specifically deny any access to
those files. Good job.

2. Disables WebDAV. Good job.

3. Provides a new .dll, called 404.dll, that is implemented with all
(or some) ISAPI filter script mappings. This provides a 404 response
to any request for such a file. Probably the best we could expect
since its impossible to tell IIS to not allow the re-implementation
of a given script type (i.e. you can't prevent it from
re-implementing .ida, but if its already mapped to a .dll you're not
likely to overwrite the existing mapping). So so job. I haven't
checked yet whether 404.dll is added to the WFC dllcache, I sure hope
so.

4. Removes sample files. About time.

5. Removes the \scripts and \msadc *virtual* directories (the actual
directories themselves, and their contents, are left intact). The
directories should have been removed as well.

6. Explicitly denies the IUSR account write access to the contents of
the INETPUB directory. Unfortunately it does this using a DACE, which
NT 4.0 cannot handle, so on NT 4.0 systems you won't be able to view
any security information about these modified files after the tool is
run. W2K systems don't have this problem. Guess this is just another
example of how MS seems to have forgotten how many NT 4.0 systems are
out there, or figure that no Novices run NT 4.0?

In general, I'm disappointed at Microsoft Security for labeling the
tool as an IIS Lockdown tool. It isn't, its a Web Services lockdown
tool. It does nothing about the default installations of FTP and SMTP
servers out there (and there are way too many of them!). Most people
who are likely to run the tool probably aren't aware they have FTP
and SMTP enabled in addition to web services. They're likely going to
get a false sense of security out of running an IIS Lockdown tool
when it doesn't touch these other services. At the very least it
should have an option to remove those services if found.

MS01-037 describes a ripe scenario for the boxes which are prime
candidates to have this tool run, stand-alone servers with a default
install, yielding them up as SPAM relay servers. Microsoft seems to
think that we consumers feel the SMTP service of IIS 5.0 isn't part
of IIS 5.0 at all, even though its managed through IIS Manager and
installed by default as part of IIS. Heck, even MS01-037 doesn't
mention its part of IIS, and MS01-037 doesn't show up in a Security
Bulletin Search of IIS 5.0.

They also don't clean the machine up the way I would like to see it
done. It should remove files, directories, and registry keys that are
associated with the functionality they disable. The RDS keys, for
example, aren't removed and Jet operation isn't set to safe mode. The
\msadc directory and its contents are left intact.

They're making the assumption that people who don't know much about
what they should or shouldn't have on their systems, or what they
should do to protect it, are going to use the tool to make themselves
far more secure. They go so far as to state;

"Consider this: a web server configured using the Express Lockdown
would be completely protected against Code Red and virtually all
known security vulnerabilities affecting IIS 4.0 and 5.0 - even
without the patches for these vulnerabilities. We do, of course,
recommend that all customers, even those running locked-down servers,
continue to stay current on all security patches, but this vividly
illustrates the value of the tool."

All-in-all IISLockD is a few steps short of the mark I tried to
establish with my tool. My tool was never ready for prime-time, and
theirs is, but they really should've gone the whole nine yards and
done it right the first time.

Cheers,
Russ - Surgeon General of TruSecure Corporation/NTBugtraq Editor

-----BEGIN PGP SIGNATURE-----
Version: PGP Personal Privacy 6.5.2

iQCVAwUBO4Vs+RBh2Kw/l7p5AQEmEAP+Pxoj3Elq88Zr3u/X9p9vYNWXkFGKCUBW
qIn2yTFxlPBwRe9VtqMEY2ymMIF32kMwjwQUJMBRtz4nScQyY8rO0+MPGnOkIspX
CqpKqKyX9H9h/+HVIhmGFOt+XWp198mBZQbs5XFz0w1dF2hNh/ViQGEW4db8lPjM
bCRtO5HI06s=
=ghqu
-----END PGP SIGNATURE-----

============================================================================
Delivery co-sponsored by Trend Micro, Inc.
============================================================================
TREND MICRO SCANMAIL FOR EXCHANGE 2000 -- SECOND to NONE

If you are worried about email viruses, you need Trend Micro ScanMail for
Exchange. ScanMail is the first antivirus solution that seamlessly
integrates with the Microsoft Exchange 2000 virus-scanning API 2.0. ScanMail
ensures 100% inbound and outbound email virus scanning and provides remote
software management. Download a FREE 30-day trial copy of ScanMail and find
out why it is the best:
http://www.antivirus.com/banners/tracking.asp?si=8&BI;=240&UL;=/smex2000
============================================================================

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]