David Litchfield wrote: > Hi Eliah, > > >David Litchfield wrote: > >> Hey all, > >> I've just put up a paper on a curious flaw that appears when running a > > >My intent is not to MS-bash here, but perhaps Microsoft is to blame > >for not educating people about this issue. (If they had, your paper > >would be superfluous.) > > >Usually if millions of users are insecure because they don't know > >something, someone is to blame. > > To be honest I don't think we're talking millions of people. How many people > at home run a fully fledged RDBMS on their XP systems? Very few I'd guess. > Besides, Simple File Sharing is documented so MS are educating those willing > to seek information. > > Cheers, > David > http://www.databasesecurity.com/ > http://www.ngssoftware.com/
If I use an insecurely configured database for anything critical, I am insecure. That's everybody at a company that runs such a server and has it configured insecurely, every customer of the company who has personal information stored in the server, etc. I think that amounts to millions. However, it is true that by saying that, I made the problem look more widespread than it actually is, which is bad because it dilutes the power of the term, "millions of users," so that when the next UPnP or DCOM comes around, it will be more difficult to raise awareness about it. For this, I apologize. What I should say is, "usually, if millions of people are at risk of having their information security compromised because a few people don't know something they should, someone is to blame." The fault is certainly distributed, and it's not all on MS's shoulders. Come to think of it, if I (putting myself in the shoes of a clueless network administrator) am running a database server with simple file sharing enabled and not thinking about security, the fault is probably mine. But whoever's fault it is, I hope your paper moves people who don't have their act together, to get it together. -Eliah _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
