Re: Privilege-escalation attacks on NT-based Windows are unfixable

From: david20@alpha1.mdx.ac.uk
Date: 08/22/02 

From: david20@alpha1.mdx.ac.uk
Date: Thu, 22 Aug 2002 15:06:19 +0000 (UTC)

In article <HR199.1007$Fc4.179571@news.xtra.co.nz>, "RCC" <rcc76@hotmail.com> writes:
>"David Hopwood" <david.hopwood@zetnet.co.uk> wrote in message
>news:3D645CE5.6C296663@zetnet.co.uk...
>> -----BEGIN PGP SIGNED MESSAGE-----
>>
>> RCC wrote:
>I'm not disagreeing with you, I'm just make the point that the flaw is not
>as critical as everybody tries to imply.
>In a well-controlled environment, this weakness is well behind other, like
>user writing down the password, social engineering, etc. I don't have a LOT
>of experience as sysadmin, but as I said before, in a well secured (LAYERED)
>network, this vulnerability is NOT as critical as implied.
>The rest of the security facilities (like IPSec, Kerberos, file encryption
>and NTFS) work quite well in an environment where workstations do not hold
>sensitive data, therefore privilege escalation to the SYSTEM level is not
>compromising the entire network.
>
>Again, my two cents (under the right to separate opinion).
>
>Regards,
>RCC
>

Depends what is done on the compromised workstation. For instance if a
workstation is compromised and then a user on that workstation uses Kerberos
then a program can easily grab that user's credentials.
Communications from that compromised workstation via IPSEC are compromised
since all the information is available on the workstation either before
entering the IPSEC tunnel to be sent to a remote system or after coming out
of the IPSEC tunnel from a remote system.
Access to the encrypted data on a compromised workstation is compromised when
the user attempts to access that data.

If the user is an admin on a remote system or manages network equipment
(routers etc) and works from this compromised workstation then those systems
should be regarded as potentially compromised.

The simplest way to break into someone's online bank account would not be to
attack the banks system but to attack the user's PC which runs their home
banking application.

David Webb
VMS and Unix team leader
CCSS
Middlesex University