Re: Hack Microsoft NT C2 Rating?

At 07:27 AM 9/26/95 -0700, todd@lgt.com (Todd Glassey) replied to Ray:
>>So, if one can find bugs in NT's security, one can
>>toss a little more egg on the NSA's face and the sham that part of
>>their activies to *help* to secure american computers. A simple
>>violation of NT's C2 status would be to demostrate a flaw in it's
>>memory protection implementation.

One of the bigger cracks on VMS was after it got its C2 rating;
a strong system doesn't do you much good if you don't change
the default passwords for the SYSTEM and FIELD service accounts :-)

I'm more surprised by the rating since the Orange Book is basically
for non-networked systems; Red Book rating is _much_ harder, unless
the NSA's taking a different view of trustability of software encryption 
for authentication purposes than they used to.

>As per NT's orange book C2 Rating... C2 is about the lowest level of Secure
>that you can get. In fact I personally am unimpressed, rather it is a box
>on an RFQ that gets checked.  Very few people run C anything sites in reality.

A C2 rating says that most of the obvious bugs have been found, access to
the system and individual files requires authentication, and you can do an 
audit trail to find out who accessed what data when.  Ignoring networks,
that's not too bad.  But, yeah, one of the big reasons for C2 rating is that
government RFPs generally require C2 security, at least for military or
sensitive non-military purchases.  B-level ratings give you multi-level
security, so you can run SECRET and CONFIDENTIAL on the same box;
it's not a very useful security model for non-military applications,
but does let you do a better-trusted job of system integrity.

>IMHO - Military sites passing real classified data usually are not run on
>anything as low as C2. If you want a secure os, look at the Harris Computer
>Corp's B1-Certified version of ES/MP UNIX (they call it CX/SX). 

Hah.  Maybe it's changed since I was working with the AT&T System V/MLS folks,
but the vast majority of classified processing back then was done on unrated
or C2 systems running System High - everybody's cleared, and the boxes
with the classified stuff aren't connected to the outside except by
limited sneakernet.  You can get a _lot_ of security by keeping your
computers in locked rooms, and the average PC of those days could fit
in a big safe at night even if it couldn't fit in a locked file cabinet.
(And floppy disks or external shoeboxes were easy to lock up.)


Dan B. wrote
>For fun ways to hack NT, check out http://www.somar.com/security.html.
>Some of these are really laughable.  You can use NT's LogonUser API
>call to repeatedly guess passwords until you hit it, since NT offers
>no way to limit number of login attempts.
That's the kind of thing that would get changed for a C2 version,
just as the Unix login program had to be souped up for C2 and B1.
Even adding a constant delay, or an increasing delay after bad attempts,
is a good start for systems like that.  (It turns out that logging
user names on bad attempts has to be done carefully to avoid
increasing risk - if users get out of sync on typeahead when
entering their login and password, you can end up logging 
passwords, which was especially bad when that sort of data got
printed on the paper console...)
#---
# Bill Stewart, Freelance Information Architect, stewarts@ix.netcom.com
# Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281
#---

>I'm more surprised by the rating since the Orange Book is basically
>for non-networked systems; Red Book rating is _much_ harder, unless
>the NSA's taking a different view of trustability of software encryption 
>for authentication purposes than they used to.

I'm a little sceptical as to the relevance of C2. It is a set of criteria that 
is now very old and concerns military security where people can be told what to 
do. One way in which securoty systems often fail is in the security structure 
being so suffocating that people have to poke air holes in it so they can 
breathe.

I think that c2 is possibly the limit of orange/red bookishness that is 
reasonable to work to. It is not a trivial level of security however, UNIX 
despite all the claims has never been shipped as C2 secure as standard by a 
mainstream vendor. Even requirements involving trivial effort but which are 
extreemly important such as the writing of a users security guide have never 
been taken seriously on any of the UNIX platforms on which I have worked.

	Phill

hallam@w3.org writes:

> I think that c2 is possibly the limit of orange/red bookishness that is 
> reasonable to work to. It is not a trivial level of security however, UNIX 
> despite all the claims has never been shipped as C2 secure as standard by a 
> mainstream vendor. Even requirements involving trivial effort but which are 
> extreemly important such as the writing of a users security guide have never 
> been taken seriously on any of the UNIX platforms on which I have worked.

A slight correction: SCO shipped the C2 version of their Open
Desktop 1.1 as the standard (in fact, only) version a few years
back.  The howls of outrage from their customer base (due to the
non-standard-Unix behavior) caused them to back off in the next
major release.  Last time I tried to install their software, C2
had been made an option.  (Of course, AFAIK, they never actually
completed a C2 evaluation.)


-- Jeff