> -----Original Message----- > From: Nick FitzGerald [mailto:[EMAIL PROTECTED] > Sent: Tuesday, July 29, 2003 9:01 AM > To: [EMAIL PROTECTED] > Subject: RE: [Full-Disclosure] DCOM RPC exploit (dcom.c) > > > ... I'd be surprised if any > > organisation exists (outside of the military) that insists > on knowing > > the MAC addresses of machines before they get connected to the > > network. (In our case we monitor MAC addresses instead as > we can then > > spot network problems). > > Bzzzzt -- wrong. > > Some small, medium and large corporates do this. Some .edus even do > it.
Actually, we do it at UTD and have for some time now. (See, I told you I wasn't talking about myself.) You could hard code an IP on your box and get Internet connectivity, but you couldn't connect to any UTD services. And when you got caught, you'd lose your network privileges until the hearing, and then you *might* lose your job as well. We *routinely* remove network access for boxes that are unpatched or infected with viruses or worms. We were also one of the first edus to implement extension blocking, and I can't even print some of the things that were said to me about that. Suffice it to say that "idiot" was one of the nicer words used. Of course, everybody's doing it now...... Nick, while I agree with you that we (IT) have to be at the forefront of forging change (and trust me, I fight these battles daily and refuse to back down), I also think there's needs to be more tolerance in "the security community" toward the people that are in the field, doing the work. Many would like to do better, but their hands are tied by unenlightened upper management. You have to learn how to play the politics to your advantage to win the battles. If I approached folks here the way some in this list approach others on the list, I not only wouldn't have made the progress that I've made, I'd be unemployed as well. (And to answer a question asked in a different thread, no, I'm not an admin, not in the sense that was probably meant. I admin some security machines and maintain things like the IDSes, AV infrastructure, etc., but I'm not an admin by job title.) Paul Schmehl ([EMAIL PROTECTED]) Adjunct Information Security Officer The University of Texas at Dallas AVIEN Founding Member http://www.utdallas.edu/~pauls/ _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
