Jump to content

Questions about RS Client security


Recommended Posts

Here's a scary thought: The RS client's purpose is to provide RS with LocalSystem access to the remote disk, protected only by a password. Even if the password is encrypted, it would be defeatable by a simple dictionary attack.


1. Doesn't this mean the RS client could potentially be used as a Trojan Horse?


2. All the people relying on Win XP ICF as their firewall, but passing port 497 for Retrospect, and using the same NIC for both LAN and WAN, are sharing their hard disk with the entire world, protected only by this flimsy (and optional) password, are they not?





Link to comment
Share on other sites

With a good password, a "dictionary search" is going to fail. Also, the client will only respond to a Retrospect inquiry, it will not communicate with anything that isn't Retrospect


Retrospect pass phrases are irreversibly reduced to an encrypted keyform for storage and use. The plain text pass phrase is never stored nor transmitted over the network. The encrypted keyform is transmitted over the network only once, during initial Client activation. On Windows Clients the encrypted keyform is stored in the system registry. Client connections are authenticated without sending any key information across the network

Link to comment
Share on other sites

OK, the attacker has to use Retrospect to back up and then restore the data. Or use a program written to fool the client into thinking it's Retrospect doing a backup or restore. Even a strong password can be broken, given enough time.


The RS "client" (which is misnamed...it's a server), therefore, is fairly easy to exploit, and represents a very large increase in the attack surface of a computer. Ironically, that increase comes in the name of protecting the data on the computer!


In my opinion, the RS client needs to generate a mandatory, unique, strong password for each computer on which it is installed. MS has often come under criticism for making passwords optional on its OS's; RS is no better.


But a better solution would be to eliminate the RS client and use MS networking to perform the backup using an account which is a member of Backup Operators. Then the exposure is the same as for a computer which is not being backed up by Retrospect, or being backed up by most other backup products.

Link to comment
Share on other sites

  • 3 weeks later...


This topic is now archived and is closed to further replies.

  • Create New...