OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Using Messenger Service for 'Net Send' Functionality --- Dangerous? Why?

From: Kurt Buff (kurt.buffgmail.com)
Date: Thu Jun 23 2005 - 11:58:11 CDT

michael.mailinglistsecurityfocus.com wrote:
> At a previous company I worked for we had issues with employees using
> it to taunt each other. Since the only audit trail is in the local
> machine's event logs, it is very difficult to keep track of who is
> abusing the service. We ended up disabling the service company wide.
>

However, the local machine event log entry *does* the NetBIOS name of
the sending machine, making it easy to track that, at least. Given only
minor sleuthing (and a lack of poorly configured multi-user machines),
tracking who did what when, in this case, is pretty simple.

Kurt

---------------------------------------------------------------------------
---------------------------------------------------------------------------