James D. Stallardblog

I don't really want to get into a huge discussion about the full disclosure issue that raises it's ugly head everytime a particularly juicy exploit hits the headlines, so i'll simply offer my general opinion:

Full disclosure is a good thing, so long as the vendor in has been given enough time to re-produce the vulnerability and patch their code.

The amount of time causes as many arguments as the issue itself. For an exellent discussion on Full Disclosure read this article, written by the outspoken and eminent Mr. Bruce Schneier.

In short:

Michael Lynn wrote a presentation while working for ISS that demonstrated significant flaws in the Cisco IOS. Cisco threatened legal action (and carried out the threat) and Blackhat pulled the presentation and 2000 CDs containing the content. ISS bowed under pressure from Cisco and told Mr. Lynn to keep quiet. Lynn promptly quit his job and presented anyway - to rapturous applause.

Cisco (demonstrating true corporate idiocy) first denied that there was a vulnerability and then stated "Cisco believes that the information Lynn presented at the Blackhat conference today contained proprietary information and was illegally obtained."

So, who came out looking the worst?
Cisco acted badly, but they did what every big corporate would do, they called in the lawyers. It is obvious that their attempts to censor the security folks were always going to fail, but Cisco doesn't sell to the security folks, it sells to managers on the golf course, so they wont suffer permanent harm from this. Cisco's statement.

Michael Lynn acted correctly and with integrity, anyone who really considers the implications of what he did will agree. He needs another job, but that will be with the security folks and they mostly agree with him.

IMHO the real villians of this are ISS and Blackhat. They should have stood up to Cisco and backed their guy. They should have come to an arrangement with Cisco if necessary to allow them to release a patch in time and they should have done everything possible to keep Mr Lynn on side. They do sell to the security folks and they have had their reputation permanently damaged by their rotten handling of the whole mess. The ISS press release. The Blackhat statement apparently doesn't exist, and all references to the presentation have been removed from blackhat.com. However, they did leave the barest taster on the blackpage.

Here is a copy of the presentation pulled by Blackhat 2005 at the behest of ISS and Cisco. Enjoy it, wisely.

Now that the domain has settled it is time to start tidying it up. I performed an extensive domain cleanup operation before the upgrade, but this is limited to what NT4 domains can support. Now that we have an OU structure we must move the users into their geo-political OUs and start imposing the naming standards.

I wrote a small bit of code that runs as a second logon script to help with the filing. This code collects a small amount of information about each user and computer that will tell me were the user or computer is physically located across the 22 sites in the estate. I wrote another bit of VBScript that parses the output of the second login script and helps perform that actual "filing" of users into the correct OUs. After a few days I had collected enough information to run the "filer" and move most of the accounts (2800 that day).

When NT4 Domains are in-place upgraded very little information is available about user accounts to populate the rest of the available AD attributes. Further, the Name attribute (Name in the GUI, actually CN in the database) is the old NT4 account name (SAMAccountName), the actual logon account name (UserPrincipalName) is left blank and the UPNSuffix (computed from UserPrincipalName) is also empty. Worse, the old netware password sync data comes across too, and lurks incomprehensibly in the UserParameters attribute. More code was clearly needed...

I wrote another VBScript utility that copied SAMAccountName to UserPrincipalName and concatentated the UPNSuffix for the domain. The utility then set DisplayName to the values from GivenName and SN (Surname to us) and renamed the whole object to GivenName SN to comply fully with our new naming standards. I cleared the UserParameters attribute for a template user and then reset the dial-in permissions (that’s where they are stored while the domain is in mixed mode). Finally, the utility cleared the UserParameters attribute for all users (there goes that pesky netware data) and copied the correct binary values from the template user to those that were supposed to have dial-in access.

At the end of this, all the user accounts looked like they had been created in the AD to start with and were far easier to find and work with. The netware password sync data had been causing and fpnwclient.dll not found error the administrative workstations, and that was also now gone. Success.

The next phase is to populate more of the object attributes in the AD and integrate other directories - all the time move ever forwards to that mythical single list. The first target is the HR database, where I will integrate Job title and manager details; after that I will integrate the telephone list and the helpdesk support tool.