🚀 go-pugleaf

In article <seagullCzzzL6.FLz@netcom.com>, Seagull <seagull@netcom.com> wrote:
| A little bird told me that bill davidsen (davidsen@tmr.com) wrote:

| > This "security by obscurity" policy is a crock; I've been helping keep
| > business systems secure for over 25 years, and full disclosure has
| > always been best, allowing the system administrators to understand and
| > evaluate the problems for their own machines. This "we won't tell you
| > what the problems is, but there is one, and the vendor will tell you
| > when it's fixed, but you won't be able to test it because the problem is
| > a SECRET only the few are allowed to know" policy translates to the
| > crackers having the info on their mailing lists and BBS's, while
| > legitimate system owners are in the dark.
| 
| This, IMHO, is not.  So your solution is to give every two-bit idiot
| that doesn't have the brains to be a cracker, but enough brains to read
| and be dangerous a sure-fire way of becoming 'root' on your system?  How
| many crackers do you think there are in the world?  How many cracker-
| wannabe's are there?  I'll bet you everything I own that the second group
| is larger than the first.

Right now my entire consulting organization, both locations, if off the
net because we use SCO servers as gateways and have no way to evaluate
the danger. We will probably be back up on another operating system
this weekend. The fact that the novice crackers don't have the
information doesn't bother me, *I* have no idea if this depends on
nothing but access to the login command, or if other holes must be left
open, as well.

There's enough information for the crackers to know where to start,
without me knowing the nature or magnitude of the risk.
|  
| And, not everyone who would be tempted to try this trick to login as 'root'  
| is subscribed to mailing lists and/or BBS's.  There are quite a few 
| people in the world, however, that would be more than happy to try something 
| like this if they were handed the solution on a silver platter, whether 
| or not they have had any incliniations or desires to becoming a cracker 
| in the first place. 

Once the word is out that there is a hole in SCO, the expertise of the
people having the information is not the issue, the risk to the system
is. Unless I can find this info on a cracker BBS somewhere (and I don't
even have a starting place at the moment), our SCO systems are going to
be off the air, or on their own net feed.

No, I don't intend to use a patch (if available) which is labeled "this
fixes a security hole but we won't tell you what it was or how to test
that you have it now and don't have it after this patch is applied."

Does this mean SCO will have to get their system C2 rated all over again?
-- 
Bill Davidsen (davidsen@tmr.com) UNIX Codger
	Will solve problems for money.
Stupidity, like virtue, is its own reward.