Inherent Risks

Abuse of Functionality vs. Unintended Consequences

• BackOrifice: using the API in the manner specified by the SDK

  • Everything except process-hiding in BO2K under Win95

• HK: capitalizing on an error in undocumented functionality

  • NtImpersonateClientOfPort():

Helpful Features Included At No Extra Charge

• Debugging Code: Some Examples

  • Client variable specifies target page
  • Client variable enables cross-site scripting

• TalentSoft Demo Apps: Highly Functional

  • Web+ Developer Page
  • Example: ping
  • Example: telnet to port
  • Scriptable with perl, wget (or perl HTTP module, or...)

• Route Servers: Mostly Locked Down

  • List of route servers
  • Example: ping
  • Scriptable, again.

What are these, really?

• Risks BUILT IN to applications