PermaLinkThe Real Issue Regarding Security of Port 1352
10:44:55 PM

Wow... an actual technical post from The Power of The Schwartz! It sure has been a long time since I did one.


A pair of posts, yesterday and today by Luis Guirigay caught my attention on Planet Lotus this morning. They reminded me of a conversation I once had with Charlie Kaufman in the atrium outside the main conference room at Lotusphere, several years ago.


I told Charlie that I had come to the conclusion that there was no such thing as a security expert.  There are only insecurity experts, because no true expert will ever say "this solution is secure".


Charlie, ever so wise, responded that the mark of a true expert is someone who can say "this solution is secure against known threats, when properly configured".

 

Anyhow, in response to Luis, the question really isn't whether NRPC on port 1352 is secure. It isn't even whether it is secure against known threats when properly configured.


For all practical purposes, the question that matters is this: Is it possible, with reasonable effort and with proper references to independent security authorities, to convince an IT security staff -- whose professional standards specifically demand that they start with the assumption of insecurity -- that NRPC on port 1352 is secure against known threats when properly configured, and that the system will always be properly configured, and that the probability of unknown threats is close enough to zero to be ignored?  


There are numerous problems inherent in that question.


Problem number one is the lack of independent authorities. Although information about the authentication and encryption mechanisms used by NRPC has been made public, the protocol itself is not public and I don't know of any independent authority who is going to vouch for it.


The second problem is the requirement that the system must always be properly configured. Accidents do happen.


The third problem is the unknown threats, and even if the other two problems could be overcome, this one is the killer. The unknown threat scenario basically boils down to this: First, an attacker exploits a previously unknown Domino bug, a buffer overflow perhaps, inserting his own code into the Domino server to take over management of port 1352 communications. From this point on, all bets are off. The attacker has an open port 1352 through which he can talk to his own code and do just about anything he wants.,


And the fact that IBM, who of all organizations should definitely know how secure NRPC is, requires a VPN (last I heard, anyhow) for their employees to replicate, strongly suggests that the answer is that it isn't possible, with reasonable effort -- or perhaps with any level of effort -- to make the case.

This page has been accessed 395 times. .
Comments :v

1. Mick Moignard09/05/2008 03:47:22 AM
Homepage: http://www.mickmoignard.com


Richard
I think you'll find that the reason that IBM require a VPN for Notes replication is because large companies do that, and the VPN is there for security of other things that go on down the conection. I'd suggest that having a non-VPN connection for replication only and a VPN connection for other things and Notes traffic would just look absurd. And I'd not read any more than that from the statement.

Mick




2. vesoftware11/05/2013 10:20:40 PM
Homepage: http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html


Agen Bola Promo 100% SBOBET IBCBET Casino Poker Tangkas Online
http://vesoftware.blogspot.com/2013/10/agen-bola-promo-100-sbobet-ibcbet.html
ITUPOKER.COM AGEN POKER ONLINE INDONESIA TERPERCAYA
http://vesoftware.blogspot.com/2013/10/itupokercom-agen-poker-online-indonesia.html
alfaonline.com : Toko belanja online murah, Promo heboh jual barang hanya Rp 1,-
http://vesoftware.blogspot.com/2013/10/alfaonlinecom-toko-belanja-online-murah.html
BELAJAR SEO
http://balapseo.blogspot.com/




3. dongdong811/17/2017 11:19:01 PM


http://www.mbtscarpe.it
http://www.montblanc.com.co
http://www.hollisterclothing.us.org
http://www.katespadeoutletsale.us.com
http://www.poloralph--lauren.us.com
http://www.giuseppe-zanotti.us.com
http://www.canadagoose-jacket.co.uk
http://www.michael-korsoutletstores.us.org
http://www.ugg.com.co
http://www.uggboots70off.us.com
http://www.oakley-sunglassesonsale.us.com
http://www.burberryscarf.com.co
http://www.adidasstansmith.co.uk
http://www.poloralphlauren-outletonline.us.com
http://www.hermesbirkinhandbags.us.com
http://www.ugg.co.nl
http://www.uknorthface.org.uk
http://www.moncler-jackets.us.org
http://www.nhlhockey-jerseys.us.com
http://www.nikeair-max.nl
http://www.canada-goosejackets.com
http://www.northfaceuk.me.uk
http://www.cheapjordansshoes.in.net
http://www.cheapuggsoutlet.us.org
http://www.newcoachoutlet.us.com
http://www.michael-korstaschen.ch
http://www.michael--kors.me.uk
http://www.nikeairmaxuk.co.uk
http://www.michaelkorsoutletmall.us.com
http://www.mbt.us.com
http://www.uggbootsstores.us.com
http://www.supreme-newyork.com
http://www.oakleysunglassessport.us.com
http://www.birkenstockoutlet.us.org
http://www.swarovski-jewelry.us
http://www.cheapjerseysnflwholesale.us
http://www.adidasfootballboots.org.uk
http://www.niketrainers.org.uk
http://www.truereligionjeans-outlet.us.com
http://www.monclerdoudounepascher.fr
http://www.ralph-laurens.co.uk
http://www.burberryscarfsale.in.net
http://www.pandora-jewelry.name
http://www.jordans-fusion.com
http://www.salvatoreferragamo.in.net
http://www.canadagooseoutlets.us.org
http://www.saleuggboots.co.uk
http://www.northfacejacketsclearance.us.com
http://www.redbottomsshoes.me.uk
http://www.uggschweiz.ch
http://www.ralphlaurenoutletofficial.us.com
http://www.coachoutlet70off.us.com
http://www.baseballjerseys.us.com
http://www.ralph-lauren.fr
http://www.longchamp-handbags.us.org
http://www.jordanfemmepascher.fr
http://www.cheapnfljerseyswholesale.us.com
http://www.burberryoutlet-canada.ca
http://www.nikeairmax90.com.de
http://www.coachoutletonsale.us.com
http://www.coachoutletonlinestore.ca
http://www.superdry.me.uk
http://www.nikeoutletstoreonline.us.com
http://www.basketballshoesstore.us.com
http://www.cheapraybans.ca
http://www.beatsbydreheadphones.in.net
http://www.uggbootsaustralia.us.org
http://www.uggboots.com.co
http://www.supremeclothing.us.com
http://www.coach-factoryonline.us.org
http://www.rayban-sunglassesonsale.us.com
http://www.ugg.me.uk
http://www.thenorthfaceoutletjackets.us.com
http://www.truereligion-jeans.us
http://www.ralplaurenuk.org.uk
http://www.monclerdunjacka.se
http://www.mulberry-handbags.uk
http://www.ukmulberry.co.uk
http://www.montblancpensale.us.com
http://www.jordanretro.us
http://www.fitflops.org
http://www.michaelkorscom.us.com
http://www.pradabags.in.net
http://www.airjordan-14.us
http://www.montblancpensonline.us.com
http://www.birkenstocksandals.us.org
http://www.coachhandbagsfactoryoutletonline.us.com
http://www.chaussuresnikeairmax.fr
201711.18wengdongdong




4. lzm00312/27/2017 01:12:07 AM


http://www.katespade-outletonline.com kate spade outlet online
http://www.pandora-bracelet.co pandora jewelry
http://www.tory-burch.net tory burch
http://www.jewelry-armoire.us Jewelry Armoire - Official
http://www.outlet-shop.us Wholesale Outlet Sale
http://www.Coach-Outlet.info coach outlet
http://www.burberryoutletw.com burberry outlet
http://www.katespadeoutletonline.org kate spade outlet online
http://www.coach-outlet-online.ca coach outlet online
http://www.katespadeoutlet.us kate spade outlet
http://www.jimmy-choo-shoes.us jimmy choo shoes
http://www.yeezy-boost350.us yeezy boots 350
http://www.boutique-cosmetique-bio.fr Nike Air Max Enfant
http://www.mizunoshop.us Wave Prophecy 2 Shoes
http://www.mlbshop.us.org shop mlb
http://www.oakley-outlet.us oakley outlet
http://www.chrome-store.us chrome store
http://www.nikeoutlet.co.uk nike outlet
http://www.outlet-michaelkors.org michael kors outlet
http://www.rayban-sunglasses-sale.us ray ban sunglasses sale
http://www.rayban-outlet.us Ray Ban sunglasses
http://www.chaussurespourfemme.fr Chaussures pour Femme
http://www.ray-ban-sunglasses.us ray-ban sunglasses
http://www.pradaoutletonline.net prada outlet sale
http://www.splaash.fr Nike Air Max Enfant
http://www.coach-outlet.us coach outlet
http://www.bookmarkvine.com Air Jordan 11 Femme
http://www.joebuy.com/womens-autumn-n-witer-clothing-c-38_173.html Wholesale womens autumn winter clothing
http://www.jimmychoouk.co.uk jimmy choo uk
http://www.coachoutletlove.us coach outlet
http://www.jimmychooshoesaustralia.net jimmy choo australia
http://www.runecheatz.com Nike Air Jordan Enfants
http://www.rayban-australia.com ray ban australia
http://www.coach-outlet.co.uk coach outlet
http://www.nikejordanpascher.fr Nike Air Max Femme
http://www.stsprepaid.com Nike Free Run
http://www.burberry-sale.com burberry sale
http://www.yeezyshoes.co yeezy shoes
http://www.bouldershoesewrepair.com boulder shoes sew repair
http://www.usito.fr Nike Air Max 1
http://www.coach--outlet.net coach outlet online
http://www.michael-korshandbags.com michael kors handbags
http://www.pumasneakers.ca puma sneakers
http://www.michaelkors-bags.info michael kors bags
http://www.coach-outlet.net.co coach outlet online
http://www.katespadeoutletsale.net kate spade outlet sale
http://www.ray-ban-outlet.us rayban sunglasses
http://www.culinar-hannover.de Air Max 90
http://www.raybanprescriptionglasses.us rayban prescription glasses
http://www.birkenstocksandals.net birkenstock sandals
http://www.canadagoose-outlet.org canada goose outlet
http://www.get-free-back-links.com backlink
http://www.outletsale.us burberry outlet sale
http://www.armanioutlet.org armani outlet
http://www.louisvuittonoriginal.com Louis Vuitton handbags
http://www.louis-vuitton-outlet.co louis vuitton outlet
http://www.coachoutletstore.ca coach outlet store
http://www.michael-kors--outlet.com michael kors outlet online
http://www.ugg.org.au ugg boots
http://www.coolraoul.fr Jordan Fusion Femme
http://www.nikeoutlet.net nike outlet
http://www.wedding--rings.us Wedding Rings- Official
http://www.rolex--watch.us rolex watch
http://www.pradaoutletonline.us prada outlet online
http://www.schuhe-infoblog.de Nike Air Max 2017
http://www.hermesoutlet.net hermes outlet
http://www.michaelkors-bags.net michael kors bags online
http://www.nikejordanshoes.us nike jordan shoes
http://www.pumashoes.us puma shoes
http://www.breitling-watches.us breitling watches
http://www.prada-outlet-online.com prada outlet online
http://www.clearanceoutlet.us/ clearance
http://www.school-bags.us school bags on sale
http://www.michael-kors-outlet.co michael kors outlet
http://www.pandora-australia.com pandora australia
http://www.oz-e-wahm.com Nike Air Force 1 Homme
http://www.nikefactoryoutlet.net nike factory outlet
http://www.rustyristine.com Nike Free Run
http://www.sp-lunettes.fr Lunette Oakley
http://www.conseil-invest.fr Nike Air Max Chase
http://www.blackfridaymichaelkors.us black friday michael kors
http://www.grandregency.fr Air Max Enfants
http://www.under-armour.ca under armour
http://www.burberry-factoryoutlet.com burberry factory outlet
http://www.burberry-outletstore.us burberry outlet
http://www.brighton-jewelry.us Brighton Jewelry - Official
http://www.brightonjewelry.us Brighton Jewelry - Official
http://www.katespadeoutlet1993.com kate spade outlet
http://www.va-bene-shoes.de Nike Air Max
http://www.chaussurespascheres.fr chaussure pas cher
http://www.pandora-bracelets.us pandora bracelets charms
http://www.pandora-bracelet-charms.us pandoracharms
http://www.katespadeoutletonline.net kate spade outlet online
http://www.handbags-online.us handbags online sale
http://www.raybanaustralia.com ray ban australia
http://www.michaelkorsoutlet.cc michael kors
http://www.gucci-watches.us gucci watches
http://www.michaelkorsbags.net.co michael kors bags
http://www.black-friday-deals.us black friday
http://www.katespadeoutletbags.com kate spade outlet bags
http://www.pandora-box.co.uk pandora jewelry uk
http://www.timberland-outlet.co.uk timberland outlet
http://www.michaelkorsfactoryoutlet.net michael kors factory outlet
http://www.premierjewelry.us Premier Jewelry - Official
http://www.greencleaned.net Green Cleaned
http://www.therca.org The Retail Compliance Association
http://www.eznara.com China wholesale
http://www.kate-spade-outlet-online.com kate spade outlet
http://www.cheapraybans.co cheap ray bans
http://www.puresoie.fr Nike Air Max 90
http://www.pandoraaustralia.com.au pandora australia
http://www.louisvuittonoutlet.co.uk louis vuitton outlet
http://www.raybanpolarized.us ray ban polarized
http://www.coach-outlet.com.co coach outlet online sale
http://www.nike-outlet.us nike running
http://www.nike-outlet-online.nl nike outlet online
http://www.versaceoutlet.org versace outlet
http://www.payless-shoes.org payless shoes online
http://www.stonesandbones.us Family Name Research
http://www.katespadeoutletsstore.us kate spade outlet store
http://www.spielen-roulette55.de Adidas Outlet
http://www.pandoraaustralia.net pandora australia
http://www.mode-damenschuhe.de mode damenschuhe
http://www.tory-burch.org tory burch
http://www.destiny-france.com Nike Air Jordan Enfants
lzm12.27




Enter Comments^


Email addresses provided are not made available on this site.





You can use UUB Code in your posts.

[b]bold[/b]  [i]italic[/i]  [u]underline[/u]  [s]strikethrough[/s]

URL's will be automatically converted to Links


:-x :cry: :laugh: :-( :cool: :huh: :-) :angry: :-D ;-) :-p :grin: :rolleyes: :-\ :emb: :lips: :-o
bold italic underline Strikethrough





Remember me    

Monthly Archive
Responses Elsewhere



About The Schwartz

rss.jpg


All opinions expressed here are my own, and do not represent positions of my employer.