Re: .Net Server and 'taskkill'
From: Mike Coppins (mike@legolas.com)Date: 08/14/02
- Previous message: Alan J. Raveling: ".Net Server and 'taskkill'"
- In reply to: Alan J. Raveling: ".Net Server and 'taskkill'"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Wed, 14 Aug 2002 00:35:15 +0100 To: focus-ms@lists.securityfocus.com From: Mike Coppins <mike@legolas.com>
At 13/08/2002 14:18, Alan J. Raveling wrote:
>The latest versions of Microsoft's Server OSes .NET come with a command
>feature that already exists in XP 'taskkill' This handy little command
>allows one to remotely kill the task if one knows the name of the task by
>simply providing a sufficient username and password. Now what can I do to
>prevent an attack against my servers from some user out there who would
>create a program to just keep feeding taskkill commands to the server until
>it kills a process?
There are plenty of 'kill app' programs written already for Windows, the
best one I've used is from sysinternals.com, pskill. There are a load of
other freely downloadable programs you can find there.
Programs like this use RPC (remote procedure call) in order to be able to
talk to the remote machine. With Windows the Server service is used to
receive the request. However, authentication is required to actually kill
a task, and the appropriate privileges (admin privs) are also required.
On say a webserver facing the outside world, even with firewalling in
place, I would not put your trust in the Server service keeping out attacks
on Windows networking, stopping the service is a wise precaution.
Stopping the service obviously has implications. You can't create or
connect to any shares on the machine you stop the service on*.
This is the tip of the iceberg regarding improvement on the security of a
Windows box.
* - (amongst other things, many of which can be categorised under the
heading "Why the heck should that affect that?", to which Microsoft shrug
back at you in their support articles :-))
-- Mike Coppins mike@legolas.com http://www.legolas.com/
- Previous message: Alan J. Raveling: ".Net Server and 'taskkill'"
- In reply to: Alan J. Raveling: ".Net Server and 'taskkill'"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
