Messenger Pop-Ups - I told you so!

On Fri, 17 Oct 2003 00:57:54 -0600, Total Exterminator wrote:

> Kevin Davis³ wrote:

>> See the recent MS security bulletin:
>>
>> http://www.microsoft.com/technet/tre...n/ms03-043.asp
>>
>> As I have suggested OVER and OVER and OVER again, you need to disable
>> services that you don't need. Several people asserted that I was
>> being ridiculous in suggesting that there just might be a
>> vulnerability in the Messenger service that could expose your system
>> as vulnerable. Now we know that it has been true. If somebody got
>> past your firewall, they could own your system simply if you were
>> running the Messenger service. This is a great example why you should
>> absolutely turn any services off that you don't need.
>>
>>
>>
>> ---------------------------------------
>> What could possibly go wrong?

> And who by now has not installed sp1 for xp ..... You are protected if
> you installed sp1 .... Total

But its enabled by default (and messenger isnt that easy to turn off)
then theres the firewall thats disabled by default.

If someone got through your firewall, the messenger service is the least of
your worries.

Kevin Davis³ wrote:

> See the recent MS security bulletin:
>
>

http://www.microsoft.com/technet/tre...n/ms03-043.asp

>
> As I have suggested OVER and OVER and OVER again, you need to disable
> services that you don't need. Several people asserted that I was
> being ridiculous in suggesting that there just might be a
> vulnerability in the Messenger service that could expose your system
> as vulnerable. Now we know that it has been true. If somebody got
> past your firewall, they could own your system simply if you were
> running the Messenger service. This is a great example why you should
> absolutely turn any services off that you don't need.
>
>
>
> ---------------------------------------
> What could possibly go wrong?

"Buggs Bunny" <szandor9000@NOSPAMhotmail.com> wrote in message
newsan.2003.10.17.14.38.01.716852@NOSPAMhotmail. com...

> On Fri, 17 Oct 2003 00:57:54 -0600, Total Exterminator wrote:
>

> > Kevin Davis³ wrote:

> >> See the recent MS security bulletin:
> >>
> >>

http://www.microsoft.com/technet/tre...hnet/security/
bulletin/ms03-043.asp

> >>
> >> As I have suggested OVER and OVER and OVER again, you need to disable
> >> services that you don't need. Several people asserted that I was
> >> being ridiculous in suggesting that there just might be a
> >> vulnerability in the Messenger service that could expose your system
> >> as vulnerable. Now we know that it has been true. If somebody got
> >> past your firewall, they could own your system simply if you were
> >> running the Messenger service. This is a great example why you should
> >> absolutely turn any services off that you don't need.
> >>
> >>
> >>
> >> ---------------------------------------
> >> What could possibly go wrong?

> > And who by now has not installed sp1 for xp ..... You are protected if
> > you installed sp1 .... Total

>
> But its enabled by default (and messenger isnt that easy to turn off)
> then theres the firewall thats disabled by default.

The messenger service is very simple to turn off, I think you're mistaking
it for Windows Messenger which is a totally different animal...

Lorne

On Fri, 17 Oct 2003 16:05:36 +0100, Lorne Smith wrote:

> "Buggs Bunny" <szandor9000@NOSPAMhotmail.com> wrote in message
> newsan.2003.10.17.14.38.01.716852@NOSPAMhotmail. com...

>> On Fri, 17 Oct 2003 00:57:54 -0600, Total Exterminator wrote:
>>

>> > Kevin Davis³ wrote:
>> >> See the recent MS security bulletin:
>> >>
>> >>

> http://www.microsoft.com/technet/tre...hnet/security/
> bulletin/ms03-043.asp

>> >>
>> >> As I have suggested OVER and OVER and OVER again, you need to disable
>> >> services that you don't need. Several people asserted that I was
>> >> being ridiculous in suggesting that there just might be a
>> >> vulnerability in the Messenger service that could expose your system
>> >> as vulnerable. Now we know that it has been true. If somebody got
>> >> past your firewall, they could own your system simply if you were
>> >> running the Messenger service. This is a great example why you should
>> >> absolutely turn any services off that you don't need.
>> >>
>> >>
>> >>
>> >> ---------------------------------------
>> >> What could possibly go wrong?
>> > And who by now has not installed sp1 for xp ..... You are protected if
>> > you installed sp1 .... Total

>>
>> But its enabled by default (and messenger isnt that easy to turn off)
>> then theres the firewall thats disabled by default.

>
> The messenger service is very simple to turn off, I think you're mistaking
> it for Windows Messenger which is a totally different animal...
>
> Lorne

Yep Windows Messenger

On Fri, 17 Oct 2003 00:57:54 -0600, Total Exterminator
<total.exterminator@myrealbox.com> wrote:

> Kevin Davis³ wrote:

> > See the recent MS security bulletin:
> >
> > http://www.microsoft.com/technet/tre...n/ms03-043.asp
> >
> > As I have suggested OVER and OVER and OVER again, you need to disable
> > services that you don't need. Several people asserted that I was
> > being ridiculous in suggesting that there just might be a
> > vulnerability in the Messenger service that could expose your system
> > as vulnerable. Now we know that it has been true. If somebody got
> > past your firewall, they could own your system simply if you were
> > running the Messenger service. This is a great example why you should
> > absolutely turn any services off that you don't need.
> >
> >
> >
> > ---------------------------------------
> > What could possibly go wrong?

> And who by now has not installed sp1 for xp ..... You are protected if
> you installed sp1 .... Total

SP1 does not fix the RPC flaw/conspiraacy.
SP1 does not stop the abuse of the Messenger Service.
SP1 does not make XP more resistant to virus or trojan attacks.

There are a lot of people who have not installed SP1. People who started
with XP and have been reluctant to take the chance on installing something
that may ruin their OS or make it unusable.

While SP1 does improve the original XP, the fear of installing a bugfix or
upgrade from MS is quite understandable.


§ß©

On Fri, 17 Oct 2003 00:57:54 -0600, Total Exterminator
<total.exterminator@myrealbox.com> wrote:

>Kevin Davis³ wrote:

>> See the recent MS security bulletin:
>>
>> http://www.microsoft.com/technet/tre...n/ms03-043.asp
>>
>> As I have suggested OVER and OVER and OVER again, you need to disable
>> services that you don't need. Several people asserted that I was
>> being ridiculous in suggesting that there just might be a
>> vulnerability in the Messenger service that could expose your system
>> as vulnerable. Now we know that it has been true. If somebody got
>> past your firewall, they could own your system simply if you were
>> running the Messenger service. This is a great example why you should
>> absolutely turn any services off that you don't need.
>>
>>
>>
>> ---------------------------------------
>> What could possibly go wrong?

>And who by now has not installed sp1 for xp ..... You are protected if
>you installed sp1 .... Total

It is obvious that you guys are still missing the point. Now I
suppose for some reason you are TOTALLY convinced that there is no
chance that there are any more vulnerabilities in the Messenger
Service. Just like since MS has release all these fixes to IE that
there must not be any more vulnerabilities in it either. This is a
very deluded position to adopt.

Bottom line it's just a good basic security practice - if you're not
using the service, disable it. I can't believe people are still
arguing against this.



---------------------------------------
What could possibly go wrong?

On Fri, 17 Oct 2003 10:50:52 -0400, "Lanwench [MVP - Exchange]"
<lanwench@heybuddy.donotsendme.unsolicitedmail.aty ahoo.com> wrote:

>If someone got through your firewall, the messenger service is the least of
>your worries.
>

You're still not getting it. Yes, you have significant concern if
someone gets through your firewall. However, if you have disabled the
Messenger Service (assuming you don't need it), it's one less major
concern you have to deal with.

If you have $10,000 cash in a bag in your house and you have good
locks on your door, are you comfortable in leaving that bag out on
your living room coffee table?



---------------------------------------
What could possibly go wrong?

Not all MVP's are equal. There are helpers immensely patient to repeat good
advices again and again. And there are guys with immense ego, belittling
good advices to display they know more.

Until MS does not document its software especially its operating systems,
the whole thing remains in the hands of gurus. Instead of looking into the
documentation, one shall rely on secondary means like asking questions in
newsgroups. The present newsgroup is especially good. However it can not
replace a good documentation.

Sure it is cheaper than document,


"Kevin Davis³" <zkevindavisz@cfl.rr.com> wrote in message
news:0e40pv4vbl023df0epqb1ep37io3r8eeo7@4ax.com...

> On Fri, 17 Oct 2003 10:50:52 -0400, "Lanwench [MVP - Exchange]"
> <lanwench@heybuddy.donotsendme.unsolicitedmail.aty ahoo.com> wrote:
>

> >If someone got through your firewall, the messenger service is the least

of

> >your worries.
> >

>
> You're still not getting it. Yes, you have significant concern if
> someone gets through your firewall. However, if you have disabled the
> Messenger Service (assuming you don't need it), it's one less major
> concern you have to deal with.
>
> If you have $10,000 cash in a bag in your house and you have good
> locks on your door, are you comfortable in leaving that bag out on
> your living room coffee table?
>
>
>
> ---------------------------------------
> What could possibly go wrong?