Re: Some security-related suggestions

[Ned Freed <[e-mail]>]

> Ned Freed <[e-mail]> writes:
> >    "Providing an indication of the existence of an account in the absence of
> >    a proper password lets attackers narrow the search to known accounts, and
> >    thus represents an increased security risk."

> There are people who still believe this?

Yeah, I happen to believe it because it happens to be true.

> Attackers can narrow the
> search to known accounts by examining the local-parts of addresses in
> messages sent from the site.

Not at most of the larger sites I deal with, they can't. Most of them
unconditionally rewrite all addresses on outgoing mail so that no information
is given about the actual account names involved. The local-parts are therefore
totally worthless in determining actual account names and even specific systems
containing the accounts (getting rid of system names in headers is a harder
problem, but it can be done if you torque on it hard enough).

Often as not their account names then become some numeric code or other crap I
don't care for and which make my life hard when I have to debug stuff, but hey,
I wasn't asked for permission to do this, you know?

Besides, even the dumbest crackers out there know that the best accounts to
break into are the old ones lying around that nobody ever uses (and hence never
appear in a local-part). Find one of these and you'll be sitting pretty, since
nobody will ever go running to the system manager saying that they saw someone
else logged in on their account.

> These issues aren't mentioned at all in RFC 1510.  If the issues
> aren't important enough to deal with in Kerberos, why should they be
> addressed in POP?

I never said that the IESG is consistent in its consideration of such issues.
(No disrespect intended, but my observations have indicated that they aren't.)
All I said was that documents have been sent back to committee for their
failure to address such issues. This is proven fact. Since someone has been
kind enough to specify some prose that may help, I don't see any compelling
reason for its exclusion and at least one good reason to include it.

				Ned

P.S. I once spent almost three months tracking down a cracker. They found an
unused account using precisely this sort of attack and then used this account
as a springboard to attack systems all over the Internet. We caught on early
and started in on a daily ritual where we watched this clown break into system
after system after system using this sort of technique as well as several
others. (There was a strong preference for military sites, which on average
seemed to be a bit more vulnerable than most.)

After that came the daily ritual of cold-calling administrative contacts listed
by WHOIS and telling incredulous people that their systems had just been
invaded. Then there were the return calls, personal visits from military
personnel, and whatnot as we worked out ways to reliably exchange information
about how the breakins were done back to these admins so they could plug the
holes.

And finally, after this clown broke into some important military databases and
did some really serious damage once again using this same sort of attack, the
FBI managed to bestir itself enough to issue the warrants we'd been asking for,
and they nailed the cracker. Needless to say, my stolen three months of time
weren't returned to me...