From: an407769@anon.penet.fi (jerry the golden retriever)
Date: Mon, 13 Nov 1995 17:23:07 +0800
To: cypherpunks@toad.com
Subject: hacker's dream
Message-ID: <9511110629.AA27945@anon.penet.fi>
MIME-Version: 1.0
Content-Type: text/plain



Windows 95 Is A Hacker's Dream Over The Internet
CENTRAL, HONG KONG, 1995 NOV 9 (NB) -- Windows 95, combined with the
Internet, could be a dream made in hacker heaven. From seasoned propeller
heads Newsbytes has contacted, it looks like Windows 95 could be more of a
security nightmare than was first thought.

This is especially true where fixed link companies are concerned. An
investigation of the new operating system, when hooked onto the Internet,
leaves computers wide open. Executing a series of simple, uncomplicated
commands opens up company and private users' computers to hacking the moment
they access the Internet, claim some analysts.

Worse, they may never know it has been done. Using a simple Unix command, a
hacker can locate the IP (Internet protocol) address of the subscriber logged
into an Internet service provider. Then he needs only one more thing; a
logged-on Internet user using Microsoft's new operating system.

For businesses with leased line Internet links, it can happen at any time,
day or night. Once the IP address has been noted, the hacker simply creates a
file through DOS on his own system, specifying the address and naming it.
Using two other commands -- which purge the remote names on the IP, or
Internet provider's port -- the system then refreshes and remaps itself in
preparation to be accessed by the hacker's computer.

Because Windows 95 is designed with a networking capability, it leaves all
computers in the office open to illegal access. Once the hacker has called up
his Map Network Drive, the hard disk on his own machine cannot be
differentiated from that of the genuine user. All that need be done then is
to put in a common drive name, most obviously "C:\." For networked machines,
the default "C$" is common.

This gives access to all files on the subscriber's drive. While Windows 95
allows the user to protect the drive by giving it a password, computer
experts Newsbytes talked to said that device won't necessarily lock out
intruders. Because the operating system has no "audit" trail -- in other
words, it does not log who or how someone is accessing the drive -- a hacker
can spend weeks trying to discover the password. Password search programs,
like Cracker, are readily available and can break through most simple
password sequences.

(Joel McCormick & I.T. Daily/19951109)
--****ATTENTION****--****ATTENTION****--****ATTENTION****--***ATTENTION***
Your e-mail reply to this message WILL be *automatically* ANONYMIZED.
Please, report inappropriate use to                abuse@anon.penet.fi
For information (incl. non-anon reply) write to    help@anon.penet.fi
If you have any problems, address them to          admin@anon.penet.fi