🚀 go-pugleaf

In article <jm7tLGACp8H1Ewzq@email.demon.co.uk>, Terry Dosdale
<axiom@email.demon.co.uk> writes

>Since this group seems to have little useful and to the point in it, I'd
>like to ask a question about Turnpike security.  With a dial up
>connection, the only danger from real-time attacks (as opposed to
>viruses) is when TP is on-line.

Turnpike is the offline program. Your problems arise when the TCP/IP
stack is online. There may be specific issues relating to Connect which
is one of many possible programs which may use the stack. Connect can be
used to initiate the call - which can lead to issues if you are trying
to arrange that only some people can make phonecalls.

>  However, with Windows (eg 3.1) there
>seems to be no danger from FTP or Telnet, since there are no servers for
>these.

you can find programs to do these functions - but you are correct,
Connect does not contain such servers.

>  This leaves the mail server.  

two actually - an SMTP server and a POP3 server

>Could an attacker get this mail
>server to do anything insecure?

with knowledge of the passwords of users, mail can be fetched from the
POP3 server. This is why we disable it by default.

the worst that you can do with the SMTP server is a denial of service
attack (filling up the hard disk for example).

>
>Terry Dosdale
>
>Dr Terence Dosdale CEng FBCS Chartered Information Systems Practitioner
>-----------------------------------------------------------------------
>Axiom Services Limited    -   for   -  Electronic Commerce/EDI/Security

hmmm.... I would expect less open ended questions

-- 
richard                      richard.clayton    @    T U R N P I K E .com
 http://www.demon.net/news/features/crypto/  for Demon's views on crypto
"Assembly of Japanese bicycle require great peace of mind" quoted in ZAMM