Re: Security? Right.
Date: 19 May 2005 11:05:12 -0700
The obvious, easiest answer is to just not use the tool, and makes sure
it isn't on your system. Nevertheless, I think we are in agreement its
the disparaging messages sent about security thats most troublesome.
Microsoft may want to be serious about security, and I'm sure there are
a number of people at Micorsoft very serious about Microsoft...but
overall, the message is not getting out.
Roger Abell wrote:
> That is pretty embarassing, worse actually.
> IIRC this Remote.exe is much like an earlier NT4 era MSDN
> sample to illustrate client/server. No checks, if you know the
> port and syntax . . .
> I imagine someone thought, its is not much different from other
> remote shell type binaries one can get to install on someone's
> machine, that one must first have admin it install a service, etc.
> basically too much old generation MS-think that they are still
> working to infuse throughout the company.
> But placing it in the ResKit as a remote admin tool, embarassing.
> It reminds me of a comment nearly a couple years back by an
> MS sec strategist to effect that the ResKit is misnamed and
> should have been called the Windows cracker's toolkit.
> Anyway, I am emailing off as this is IMO something that has
> so far gone overlooked in the multiple waves of content purging
> that have happened since the security initiative got manpower.
> Roger Abell
> Microsoft MVP (Windows Security)
> MCSE (W2k3,W2k,Nt4) MCDBA
> <firstname.lastname@example.org> wrote in message
> > http://www.microsoft.com/security/twc/vision_frame.mspx
> > Security Vision and Framework
> > "Microsoft is committed to enabling every customer to work,
> > communicate, and transact business more securely."
> > "Implementing threat modeling and other key security considerations
> > design and development stages."
> > "Promoting more secure deployment and management of our software."
> > Now read:
> > Remote Limitations
> > "In addition to exposing your server to unauthorized users, Remote
> > the following limitations..."
> > "Remote performs no security authorization. It permits anyone
> > Remote.exe Client to connect to your remote server. Because of
> > the account under which the remote server was run is open to anyone
> > connects."
> > Wow. What a joke.