From: "Lance D. Tane" <Tan...@synapsellc.com> Subject: NT Security Problem Date: 1997/03/31 Message-ID: <01bc3e32$78cc19a0$49ae03cf@syn_wsernt4>#1/1 X-Deja-AN: 229751926 Organization: SYNAPSE LLC Keywords: http://www.techweb.com/se/directlink.cgi?EET19970331S0001 Newsgroups: microsoft.public.usasalesinfo.ntserver, microsoft.public.win95.commtelephony,microsoft.public.win95.dialupnetwork, microsoft.public.windowsnt.apps,microsoft.public.windowsnt.dns, microsoft.public.windowsnt.domain,microsoft.public.windowsnt.misc,micros Maybe we should have gone UNIX after all. Monday March 31 12:30 PM EDT Major Security Hole Discovered in Microsoft's Windows NT Operating System CMP's EE Times Exclusive Report Details Microsoft's Latest Woe MANHASSET, N.Y., March 31 /PRNewswire/ -- A major security flaw has been uncovered in Microsoft Corp flagship network operating system, Windows NT, that could enable a user dialing in from a remote location to unscramble encrypted information—including a corporate network's entire registry of user passwords—and display it as plain text, according to an exclusive report posted on EE Times Online. Link to the EETimes Article. <http://www.techweb.com/se/directlink.cgi?EET19970331S0001>
From: jef...@microsoft.com (Jeffrey Felbeck) Subject: RE: NT Security Problem Date: 1997/04/02 Message-ID: <eO5Y0KxP8GA.79@uppssnewspub05.moswest.msn.net>#1/1 X-Deja-AN: 230019759 References: <01bc3e32$78cc19a0$49ae03cf@syn_wsernt4> X-Tomcat-ID: 2296408 X-Tomcat-NG: microsoft.public.USASalesInfo.NTServer Organization: Microsoft Newsgroups: microsoft.public.usasalesinfo.ntserver Lance, See the Microsoft response to this article, attached below (also at www.microsoft.com/security) Essentially, the "user" that is dialing-in and unscrambling an encrypted password must first be authenticated as being the system administrator (not just any user -- much less the public in general). If a company cannot protect it's own system administrator passwords, it has many more, and potentially much more serious problems. It is inherent in the role that system adminstrators play, that they have priviledges that would allow them to take action that might be harmful to an organizations' information infrastructure - if they are of ill intent. As it so happens, UNIX is susceptible to such problems as well. No operating system can, by itself, ensure total security. Proper security policies must be implemented as well. Jeffrey Felbeck Microsoft Technical Sales Information Team Microsoft Representatives do not monitor the reply to e-mail addresses, please post inquiries directly to the appropriate newsgroup section(s). -------------------------------------------------------------- | From: "Lance D. Tane" <Tan...@synapsellc.com> | Subject: NT Security Problem | Organization: SYNAPSE LLC | | Maybe we should have gone UNIX after all. | | Monday March 31 12:30 PM EDT | Major Security Hole Discovered in Microsoft's Windows NT Operating System | CMP's EE Times Exclusive Report Details Microsoft's Latest Woe | MANHASSET, N.Y., March 31 /PRNewswire/ -- A major security flaw has been | uncovered in Microsoft Corp flagship network operating system, Windows NT, | that could enable a user dialing in from a remote location to unscramble | encrypted information—including a corporate network's entire registry of | user passwords—and display it as plain text, according to an exclusive | report posted on EE Times Online. | | Link to the EETimes Article. | | <http://www.techweb.com/se/directlink.cgi?EET19970331S0001> -------------------------------------------------------------- Microsoft's Response to the EE Times Article on Windows NT Security April 1, 1997 Microsoft Corporation The EE Times published an article, "'Hack' Punches Hole in Microsoft NT Security," on March 31, 1997, asserting that user passwords could be compromised in the Windows NT® operating system. The issue raised by the article relies on getting access to Administrator accounts and guessing user passwords by looking for common words. The reported problem is not a security flaw in Windows NT, but highlights the importance of protecting the Administrator accounts from unauthorized access. It also reinforces the importance of following basic security guidelines. Therefore, customers who want a secure solution on Windows NT should implement proper security policies. All operating systems, including UNIX or Windows NT, are susceptible to attacks any time the Administrator accounts are compromised. Description of the Issue The article states that this alleged security problem could enable a remote user to unscramble encrypted information, like a user password, and display it as plain text. The article refers to the existence of two utilities, PWDUMP and NTCRACK, that enable the uncovering of this flaw. Here's how each utility works: •PWDUMP. You can log into the system and retrieve a user name and encrypted password only if you have administrator privileges. •NTCRACK. You can run the second utility to try to guess passwords using dictionary lookup only after you run PWDUMP under administrator privileges. Microsoft has ascertained that the reported problem does not represent a security flaw in Windows NT. The issue relies on the existence of an Administrator account that has been rendered vulnerable by neglecting basic security guidelines. What Should Customers Do? Every computer operating system is susceptible to security issues if basic security guidelines are not followed. Security is achieved through a combination of technology and policy. In order to maintain a highly secure environment, standard security practices should be followed, including: •Only trusted individuals should be granted Administrator privileges on the system. •The Administrator account should not be used for casual use. •The Administrator account should only used to administer the network/domain. •The Domain controllers should be physically secured. •Maintain a strong password policy. •Rename the Administrator account. •Never run untrusted programs while logged in as Administrator. © 1997 Microsoft Corporation. All rights reserved. Legal Notices.