Subj : Bugbear.A virus notes
To   : Mike Ruskai
From : Mike Luther
Date : Thu Oct 17 2002 12:38 am

Mike ..

 MR> The user management screen has a set of radio buttons for making the 
 MR> password optional or required.  It defaults to optional for the GUEST 
 MR> account.  It defaults to required for all new accounts.

 MR> I'm not sure if there are any command-line use management programs

 MR> Basically, one should leave the GUEST account as is, and create new ones 
 MR> for password-protected access to resources.

There is such a button combination, including the 'expire password' check box 
in the Shared Resources setup folder.  However in this case, when the two 
attacks managed to get in, this was firmly set so the the GUEST required a 
password.  It was not optional at all.

And in this case it only had USER rights checked.

I haven't got my notes in front of me, but from reading the Usegroups, I know 
that there is a utility tool for command line use which will, I think I recall 
it right, create a new user with ADMIN rights from the get go at command prompt 
level.  Further I think I recall that you can also copy over the NET.ACC 
account from the install directory into the appropriate place in the operations 
game.  That will restore the standard OPERATOR - PASSWORD and GUEST with no 
password game to get you back in if you can't remember this and that.

But doing this on a bust in Port 136/7 - 139 romp?  If that happened, my 
customized access profiles would then be gone too and they hadn't changed at 
all in re what had been set, despite the escapades.  No new goodes shown there 
at all from what was there earlier.  Nor did the LAN register anyone logged in 
when it was happening ...

As we noted in the discussion, OS/2 doesn't have any three strikes and you are 
out or such password pranging block.  You can mash on it en mass trying to 
break in.  And, in both cases, I wasn't around when it started.  But if there 
wasn't anyone logged in when it was happeing in the logout, yet it was 
happening, something had to be grossly wrong.  And we never found out what it 
was that was bad.

As I think I recall all the discourse that went on at the time, NIMDA.A was 
seeking the use of boxes with NETBIOS over TCP/IP which had a GUEST account 
with no password, or an ADMIN account with no password, or a box on which the 
pest could establish adminitrative rights and create shares on the fly via this 
or that attack mode for what it wanted.

I even thought about the possibility that even though you might have had a 
GUEST with no password, and created shared resources for it with read/write 
capability, you could have then gotten rid of GUEST in LAN/UPM.  But you might 
have still left GUEST defined in the shared resources folder and so on I think 
you are citing here.  I can vizualize how that might get you into hot water 
with NB over TCP/IP and far places.  However that wasn't the case here either 
and the install admin plus password was gone too.


--> Sleep well; OS/2's still awake! ;)

Mike @ 1:117/3001

--- Maximus/2 3.01
 * Origin: Ziplog Public Port (1:117/3001)

.