RE: Hidden Shares

From: Eric Chien <ecchien(at)yahoo.com>
Date: Wed Apr 30 2003 - 04:37:44 EDT

At 02:35 PM 4/29/2003 -0700, john.scrimsher@hp.com wrote:
>If a system has the default permissions / policies, then the Windows API

Not exactly. The vast majority of network share worms utilize WNetEnumResource which does NOT enumerate hidden shares. One must use NetShareEnum and off the top of my head there isn't any 'high-profile' threats that actually do this. The ones that do utilize hidden dollar shares do so in a hardcoded method.

...Eric

---

Attend Black Hat Briefings & Training Europe, May 12-15 in Amsterdam, the world's premier event for IT and network security experts. The two-day Training features 6 hand-on courses on May 12-13 taught by professionals. The two-day Briefings on May 14-15 features 24 top speakers with no vendor sales pitches. Deadline for the best rates is April 25. Register today to ensure your place. http://www.securityfocus.com/BlackHat-focus-virus

---

Received on Wed Apr 30 18:55:44 2003