Re: Warning: ShareSniffer Released

Article View: comp.security.firewalls

Article #250

Back to comp.security.firewalls Previous Next

#250

From: Rostyslaw J. Lewyckyj
Date: Fri, 23 Feb 2001 15:46

40 lines
2612 bytes

Lawrence Baldwin wrote:

> The last thing I want to do is give this guy any press, but figured I'd
> send a heads up:
>
> http://www.sharesniffer.com/FAQ.html#Q-001
>
> Advocates utilizing the open shares for extra disk space "...because
> it's there".
>
> My biggest concern is that it utilizes a newsgroup repository to collect
> and dissemenate IP addresses with known open shares.  Others (including
> automated worms) could easily leverage this data, facilitating system
> compromises.
>
> Expect an increase in Netbios scans over the coming days....sigh.
>
> lb.
> -------------------------
> Lawrence Baldwin
> Protocol Scientist
> 678-624-0924
> http://www.mynetwatchman.com/about.htm - I'm under attack, now what?

Spy --- Counterspy   ;)
Jiujitsu ... and all that  ;)

Suppose that someone takes on the challenge of fighting this      as
follows:

Since the aim of the product is to let the user store his/her data on your
machine,
set up a poisoned honey-pot.  Let them get access. Let them put their file
on
your disk. You can then inspect their files, collect evidence of illegal
entry,
and also poison their data.
I don't think that it  will take long for the scuttlebut  about that to get
around.
I think that will kill the product.

Technical Details

Message-ID: <3A9685EA.8B4B5E3E@bellsouth.net>

Path:

arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!cyclone-sf.pbi.net!63.208.208.143!feed2.onemain.com!feed1.onemain.com!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news1.atl.POSTED!not-for-mail

References: <3A966412.9336DCD8@mynetwatchman.com>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: f922c,b3c453f70036b961
X-Google-Attributes: gidf922c,public
X-Google-Thread: 113850,b3c453f70036b961
X-Google-Attributes: gid113850,public
X-Google-Thread: f5dc1,b3c453f70036b961
X-Google-Attributes: gidf5dc1,public
X-Google-Thread: 10090f,b3c453f70036b961
X-Google-Attributes: gid10090f,public
X-Google-ArrivalTime: 2001-02-23 07:46:10 PST
Path: arc1-ca.pugleaf.net!supernews.google.com!sn-xit-03!supernews.com!cyclone-sf.pbi.net!63.208.208.143!feed2.onemain.com!feed1.onemain.com!news-spur1.maxwell.syr.edu!news.maxwell.syr.edu!newsfeed.atl.bellsouth.net.MISMATCH!newsfeed.atl!news1.atl.POSTED!not-for-mail
Message-ID: <3A9685EA.8B4B5E3E@bellsouth.net>
From: "Rostyslaw J. Lewyckyj" <urjlew@bellsouth.net>
X-Mailer: Mozilla 4.76 [en] (Win98; U)
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: comp.security.firewalls,bellsouth.net.security,comp.dcom.xdsl,comp.dcom.modems.cable
Subject: Re: Warning: ShareSniffer Released
References: <3A966412.9336DCD8@mynetwatchman.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Lines: 42
Date: Fri, 23 Feb 2001 10:46:50 -0500
NNTP-Posting-Host: 216.77.243.184
X-Trace: news1.atl 982943130 216.77.243.184 (Fri, 23 Feb 2001 10:45:30 EST)
NNTP-Posting-Date: Fri, 23 Feb 2001 10:45:30 EST

Reply to Parent Message