FILE SHARING, BIND, SENDMAIL - Anti-Technology

From Infoworld.com's Security Watch Newsletter

FILE SHARING, BIND, SENDMAIL TAKE TOP SPOTS AS
'ANTI-SECURITY' TECHNOLOGIES OF 2000

Posted at January 26, 2001 01:01 PM Pacific

IN KEEPING WITH this week's Technology of the Year theme,
I'll be discussing notable technologies that present security
challenges. These "anti-technologies" are often widely
used, but I add the prefix "anti" because, in order
for a technology to be truly useful, there has to be
an acceptable safety factor. Just as nuclear energy
seems to have created as many problems as it was
supposed to have solved, my anti-technologies of 2000
are consistent sources of vulnerability for
unsuspecting managers and users alike. Because these
applications are so widely used, people assume that
they're perfected and are sometimes proven wrong in
the most painful ways.

Remember that software is rarely perfect, and that new
vulnerabilities, not all of which can be foreseen, are
often introduced when features are added and bugs are
fixed. How do you keep these problems from becoming
your problems? By making sure that you're not running
outdated versions of these technologies and by
applying bug fixes and code patches with a religious intensity.

So without further ado, I present Security Watch's
anti-technologies of the year 2000.

For the third runner-up, I chose Microsoft's ActiveX
because it's so widely distributed that attackers can
almost guarantee that some machine inside a network
will offer a suitable beachhead for their efforts.
Although Microsoft does provide some of the
easiest-to-use patching tools in Office Update and
Windows Update, I'd be a lot happier if I didn't have
to worry about what the next attack might bring.

But being an open-source technology doesn't necessarily
confer any advantage, as seen in the case of the
second runner-up, the venerable sendmail utility used
by Linux and Unix. Finding new holes to exploit in
sendmail has been a campus pastime since the mid-1980s
when a young Robert Morris Jr. launched the first
Internet worm. Sendmail has spent more time in the top
10 than the Beatles as an evergreen subject of
security bulletins.

The first runner-up of the anti-technologies is
Berkeley Internet Name Domain (BIND), the
implementation of DNS most commonly used on Linux and
Unix boxes connected to the Internet. Because BIND is
core technology, translating host names to IP
addresses, it is a popular target for attacks.
Although a lot of vulnerabilities can be concealed
behind firewalls, even a network that's highly secure
has to let DNS traffic through. Because common
activities such as Web browsing make heavy use of DNS,
it's not always easy to figure out which traffic is
friendly and which is hostile.

But my nominee for the top security anti-technology of
2000 is file sharing. Whether we're talking AppleShare
or NetBIOS or NFS (Network File System), it's well
known that sharing files opens up machines to a host
of vulnerabilities. Although peer-to-peer networking
-- file sharing with a fancy name -- is a hot topic, I
remain skeptical for the foreseeable future of the
security of any peer offering.

In fairness, I am not saying that you shouldn't use
these technologies, and I do believe that you should
never take the security of a particular piece of
software for granted. But the important lessons to
learn from our anti-technologies are familiar ones.

1. Disable nonessential services, particularly on
publicly accessible hosts.

2. Remove the software, if possible, so that the
services can't be started accidentally.

3. Don't share files unnecessarily, don't leave sample
code on Web servers, and don't let a system get stale.

If you're responsible for securing systems, then you
owe it to yourself to check weekly for security
patches. Many third parties, as well as vendors, offer
e-mail notification of critical patches, saving you
unnecessary surfing. Finally, don't despair. Sure, the
weakness you eliminate today will be replaced by a new
one next week. But if you eliminate the
vulnerabilities you know about, you're likely to fix
the ones the crackers know about too. That will keep
your systems running quietly, instead of turning your
company into headline news for the wrong reasons.

Senior Analyst P.J. Connolly
(pj_connolly@infoworld.com) covers networking and
security technology for the Test Center.