Want to prevent break-ins? Just ask a hacker

(News, 03/02/98)

Want to prevent break-ins? Just ask a hacker
Laura DiDio

Computer security, like politics, makes strange bedfellows. Hacker Web pages that contain detailed lists and instructions on how to crack major operating systems such as Windows NT, NetWare and Unix are fast proliferating, leaving the vendor community hard-pressed to keep abreast of new hacking methods. Vendors, including Microsoft Corp. and Novell, Inc., have not only beefed up their internal security departments with more engineers and testers, but they also are monitoring dozens of hacker World Wide Web sites that have links to hundreds or more of security, or insecurity, sites. And in many cases, they are in touch with the hackers themselves. BENEFITS OF HACKER SITES Vendors and users alike find the sites helpful. ``These sites serve a useful purpose,'' said Ed Ehrgott,director of information systems at Charles Schwab & Co. in San Francisco. ``I consider them one more weapon in the fight to keep my networks secure. If the vendors are working with them, so much the better.'' Two of the more celebrated ``white hat'' helpful hacker sites are www.10pht.com and www.nmrc.org. White hat-type hackers distinguish themselves from their cracker brethren because their attempts to find flaws in software are strictly for informational purposes. The 10pht site is operated by ``Mudge'' and purports to offer users all the ins and outs of hacking operating systems as well as a tool called 10phtcrack, which helps defend specifically against password attacks. Another white hat hacker, calling himself Simple Nomad, runs www.nmrc.org. It includes sections that detail the ``Insecurities and Securities'' of the major network operating systems including a hackers' tool kit called Pandora that can break in to Novell Directory Services (NDS). With so much information on its network operating systems readily available, Microsoft is working with the hacker community to learn about potential security flaws in its products and to develop fixes before malicious hackers or crackers can do any real damage. ``This makes perfect sense,'' said Bruce Murphy, a partner at Coopers & Lybrand LLP's computer security service in Parsippany, N.J. ``The concept of closed, proprietary networks is no longer valid. Security is about risk reduction, not risk prevention.'' Karan Khanna, a Microsoft product manager in charge of Windows NT security, said that after three security flaws in Internet Explorer were exposed in the same week last summer, Microsoft contacted 10pht's Mudge. ``He's extremely helpful; 10pht informs us of any security holes [we might have missed]. That way, we can post a hot fix to customers before a potential hole becomes public knowledge,'' Khanna said. Novell hasn't officially been as active in approaching hackers, though Samm DiStasio, a NetWare product marketing manager, said he has exchanged electronic mail with Simple Nomad. ``He warned us about the Pandora hackers' tool kit. And his NetWare Hack FAQs give us another forum to tell users what they need to do to protect themselves,'' DiStasio said. Novell followed suit, posting many of the same details on how to resolve known NetWare and NDS security breaches on its own Web page. Gary Hein, a Novell corporate strategist, said the best defense to secure NDS from the Pandora hack is to physically restrict access to the NetWare server. ``Thank God for Simple Nomad,'' said an MIS manager at a longtime Novell shop in the Southwest who requested anonymity. ``The last thing I need is to have someone hack into my NDS tree that contains all of the information about my network and users in one central place,'' the MIS manager said.

Copyright © 1998 @Computerworld. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of @Computerworld is prohibited. Computerworld and @Computerworld and the respective logos are trademarks of Computerworld, Inc.

(News, 03/02/98)
	`Want to prevent break-ins? Just ask a hacker` `Laura DiDio` Computer security, like politics, makes strange bedfellows. Hacker Web pages that contain detailed lists and instructions on how to crack major operating systems such as Windows NT, NetWare and Unix are fast proliferating, leaving the vendor community hard-pressed to keep abreast of new hacking methods. Vendors, including Microsoft Corp. and Novell, Inc., have not only beefed up their internal security departments with more engineers and testers, but they also are monitoring dozens of hacker World Wide Web sites that have links to hundreds or more of security, or insecurity, sites. And in many cases, they are in touch with the hackers themselves. BENEFITS OF HACKER SITES Vendors and users alike find the sites helpful. ``These sites serve a useful purpose,'' said Ed Ehrgott,director of information systems at Charles Schwab & Co. in San Francisco. ``I consider them one more weapon in the fight to keep my networks secure. If the vendors are working with them, so much the better.'' Two of the more celebrated ``white hat'' helpful hacker sites are www.10pht.com and www.nmrc.org. White hat-type hackers distinguish themselves from their cracker brethren because their attempts to find flaws in software are strictly for informational purposes. The 10pht site is operated by ``Mudge'' and purports to offer users all the ins and outs of hacking operating systems as well as a tool called 10phtcrack, which helps defend specifically against password attacks. Another white hat hacker, calling himself Simple Nomad, runs www.nmrc.org. It includes sections that detail the ``Insecurities and Securities'' of the major network operating systems including a hackers' tool kit called Pandora that can break in to Novell Directory Services (NDS). With so much information on its network operating systems readily available, Microsoft is working with the hacker community to learn about potential security flaws in its products and to develop fixes before malicious hackers or crackers can do any real damage. ``This makes perfect sense,'' said Bruce Murphy, a partner at Coopers & Lybrand LLP's computer security service in Parsippany, N.J. ``The concept of closed, proprietary networks is no longer valid. Security is about risk reduction, not risk prevention.'' Karan Khanna, a Microsoft product manager in charge of Windows NT security, said that after three security flaws in Internet Explorer were exposed in the same week last summer, Microsoft contacted 10pht's Mudge. ``He's extremely helpful; 10pht informs us of any security holes [we might have missed]. That way, we can post a hot fix to customers before a potential hole becomes public knowledge,'' Khanna said. Novell hasn't officially been as active in approaching hackers, though Samm DiStasio, a NetWare product marketing manager, said he has exchanged electronic mail with Simple Nomad. ``He warned us about the Pandora hackers' tool kit. And his NetWare Hack FAQs give us another forum to tell users what they need to do to protect themselves,'' DiStasio said. Novell followed suit, posting many of the same details on how to resolve known NetWare and NDS security breaches on its own Web page. Gary Hein, a Novell corporate strategist, said the best defense to secure NDS from the Pandora hack is to physically restrict access to the NetWare server. ``Thank God for Simple Nomad,'' said an MIS manager at a longtime Novell shop in the Southwest who requested anonymity. ``The last thing I need is to have someone hack into my NDS tree that contains all of the information about my network and users in one central place,'' the MIS manager said.


	Copyright © 1998 @Computerworld. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of @Computerworld is prohibited. Computerworld and @Computerworld and the respective logos are trademarks of Computerworld, Inc.