Not if the software load includes voice mail/fax capabilities (these are
the ones that come to mind rapidly). These can and are set for
autoanswer and provide a real means for a hacker to access the box and
then the network connected to the box.
>----------
>From: manuel .
ricca @
pararede .
pt[SMTP:manuel .
ricca @
pararede .
pt]
>Sent: Tuesday, March 03, 1998 11:13 AM
>To: firewalls @
greatcircle .
com
>Subject: RE: Re: Dial-up security breach?
>
>
>
>They would have to be running a remote access server (such as RAS) wouldn't
>they?
>
>
>-----------------
>Manuel Ricca
>ParaRede - Tecnologias de Comunicacao, S.A.
>R. D. Constantino de Braganca, 12 1400 Lisboa Portugal
>Tel: +351 1 3020451
>Fax: +351 1 3020444
>E-mail: manuel .
ricca @
pararede .
pt
>
>
>-------------------
>From: firewalls-owner @
GreatCircle .
COM
>To: klinec @
mapcoinc .
com;Firewalls @
greatcircle .
com
>Cc:
>Subject: Re: Dial-up security breach?
>Date: 03-03-1998 00:30
>
>
>Horrible idea, most Windows95 users have at least one or two shared
>directories on their PCs, 99% of the time without any password level
>protection - it is trivial to access the contents of these directories via
>Netbios as your ISP is probably not filtering any traffic.
>
>--greg
>
>At 02:42 PM 2/27/98 -0600, klinec @
mapcoinc .
com wrote:
>>This is a little off-topic, but I thought I would try it anyway.
>>
>>We provide Internet access to 300 users enterprise-wide through our
>>frame-relay WAN connections and our firewall at our corporate headquarters.
>>Some users have decided to go out and get accounts with local ISPs and have
>>dial-up connections in Windows95 or Windows NT to these ISPs. How much of
>>a security risk does everyone think this may be? Since these users are
>>typically dynamically assigned an IP address when they log in to their ISP,
>>they then have TWO IP addresses on their system. One for the network card
>>and one for the dial-up PPP connection. Could an attacker use this
>>situation to attack our network? How likely is this?
>>
>>We are trying to eradicate this from our network, but some of these users
>>are pretty stubborn.
>>
>>Thanks,
>>Curtis Kline
>>Network System Engineer
>>MAPCO Coal, Inc.
>>Tulsa, OK
>>
>>
>>
>>
>
>__________________________________________________________________
>
>Gregory Perry phone: 703.318.7134
>Trusted Computer Solutions, Inc. fax: 703.318.5041
>13873 Park Center Road Suite 225 email: gperry @
tcs-sec .
com
>Herndon, VA 20171 http://www.tcs-sec.com
>__________________________________________________________________
>
|
|
