HDTenEightyP/NetNews huggingface dataset:
From: dichter@chdasic.sps.mot.com (Carl Dichter)
Subject: Cheap Security Measures
Organization: Motorola ASIC Division, Chandler AZ
Date: Mon, 4 Jan 1993 23:59:00 GMT

I'm writing an article about security for UNIX Review.

I will be mentioning Shadow, Crack + UFC, SPI, COPS, NPasswd, Passwd+,
Tripwire, TCP wrappers, SecureLib, automating permission/path audits,
and other security tools/techniques. I'm also providing source
in the article for a basic password front-end that is like
NPasswd or Passwd+.

If you know of other freeware/cheap security measures, please
send me info. I'll post a summary.

If you have any interesting "horror" stories that you like to
share, send those also.

Vendors of commercial security products can also send me information
for use in future articles.

----------------------
Carl R. Dichter               "iwannanugui"
Motorola ASIC Division
email: dichter@chdasic.sps.mot.com
* A native of Phoenix-- that's why you can't place the accent. *
Newsgroups: comp.security.misc
From: odwyer@sse.ie (Frank ODwyer)
Subject: Re: Future OS virus immunity.
Organization: SSE Ltd, Dublin. Ireland
X-Newsreader: Tin 1.1 PL4
Date: Wed, 6 Jan 1993 12:19:20 GMT

kludge@grissom.larc.nasa.gov (Scott Dorsey) writes:
: In article <1993Jan4.163918.11360@PacBell.COM> jmcarli@srv.PacBell.COM (Jerry M. Carlin) writes:
[..]
: >Tandam Guardian has 'progid' which is morally equivalent to setuid.
: >MVS has something like 'privileged libraries'. In fact, every operating
: >system has some form of privilege mechanism and this mechanism is subject
: >to the universal problem of incorrect administration.
: 
: I believe the original point that was being made is that MacOS and MS-DOS
: do not have any such mechanism.  Therefore, security on them is not possible,
: or is limited entirely to the physical security of the machine.

The security of _any_ machine is limited to "the physical security of
the machine".  You got something better?  In fact there is no reason why,
in principle, an acceptably secure network of Macs or PCs should be considered
"impossible".  Difficult, yes, but no more so than constructing a similar
network of multi-user machines.

: --scott

Frank O'Dwyer.
-- 
odwyer@sse.ie
From: edelheit@smiley.mitre.org (Jeff Edelheit)
Subject: Re: Boycotting CERT because of the keystroke monitoring advisory?
Organization: The MITRE Corporation, McLean, VA
Date: Tue, 5 Jan 1993 13:44:22 GMT

In article <1993Jan4.212439.4278@nntp.hut.fi> jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>
>I have communicated about this with CERT, and they don't seem to think
>my interpretation of the advisory is incorrect.  Thus it seems that
>CERT really supports measures like this, and I repeat and clarify my
>proposal that if it continues to do so, people who value privacy
>rights should not cooperate with CERT and we as net.citizens should
>see if something can be done to get some of the CERT's functions
>implemented in a way that respects freedom and people's rights, and
>also see if a message can be posted to comp.security.announce
>announcing the recommendation not to cooperate with CERT, the reason
>for it, and possible alternatives what to do instead of communicating
>with CERT wrt security holes, vulnerabilities etc.
>
>I don't know who does CERT's policy decisions and how one might
>influence them via other means (possibly organizations like the EFF
>and CPSR could work on this) but I do think the most simple thing to
>do about an organization doing something you seriously disapprove of
>is to stop all support and cooperation with it and suggest others do
>the same.
>
>//Jyrki

While Jyrki has made his posting to all sorts of newsgroups, I have
restricted my response to comp.security.misc.  

It's clear that Jyrki thinks that keystroke monitoring is an invasion
of privacy.  It is also clear, to me, that many Europeans tend to take
a stronger perspective on individual privacy than most Americans tend
to.  (Just look at number and content of western European privacy laws
and compare that to the US statues.)  Also, I refuse to get into a
discussion that one country is better than another for what ever
reason (privacy laws, education statistics, life expectancy,
environmental concerns, etc.)

What distresses me is that Jyrki seems to be condemming (e.g., "stop
all support and cooperation with it and suggest that others do the same") an
organization that has done tremendous service to the international
computing community.   My perception of the original notice was that it
was oriented towards US organizations (public, private, educational) and
that the legal basis of the notice would not necessarily be applicable to the
UK, France, Germany, Finland, Canada or any other nation.  This perception is
based on the understanding that the wording came from a US Governmental
organization.  

You may not agree with the intent of the original message.  However,
does this mean that you should kill the messenger?

Jeff Edelheit		email:  edelheit@mitre.org
The MITRE Corporation	voice:  (703) 883-7586
7525 Colshire Drive	FAX:	(703) 883-1397
McLean, VA   22102
Newsgroups: comp.security.misc
From: rharmon@muon.srg (Bob Harmon x4964)
Subject: Re: Boycotting CERT because of the keystroke monitoring advisory?
Organization: /home/server/rharmon/.organization
Distribution: usa
Date: 5 Jan 93 08:52:23
	<1ib0grINNhq3@early-bird.think.com>
	<1993Jan5.045608.13381@eff.org>

In article <1993Jan5.045608.13381@eff.org> mnemonic@eff.org (Mike Godwin) writes:
   In article <1ib0grINNhq3@early-bird.think.com> barmar@think.com (Barry Margolin) write  >>We passed the CERT advisory on to our company lawyer.  His opinion is that
  >>the warning notice is unnecessary.  The warning is based on wiretapping
  >>statutes, which do not require a warning if the recording is being
  >>performed by one of the parties to the conversation.  He believes that when
  >>someone connects to one of our computers, our company is one of the
  >>parties, and therefore the company may record the conversation.

>> Assuming that you're talking about >>tapping<< a phone conversation... 
>> ..commonwealth bars this kind of conduct,

Tapping is when a 3rd party listens in on your phone.  The discussion is 
about if you simply record phone calls you make or receive.  I Remember that
Pres. Nixon recorded all his calls to/from the oval office, He is still 
fighting the court order to turn them over.  




   
--
rharmon@srg.uunet.uu.net      |
Robert B. Harmon  ms: 5-230   | Oh well...
Arinc Research: 2551 Riva Rd  |
Annapolid MD 21403            |
Newsgroups: comp.security.misc
From: cons@mercury.cern.ch (Lionel Cons)
Subject: Perl script started from inetd
Organization: CERN, European Research Center for Particle Physics
Distribution: comp
Date: Wed, 6 Jan 1993 11:24:16 GMT

Is it safe to start a script (especially a Perl script) from inetd ?
(by safe I mean that nobody can use the script to break my system)

If my script starts with #!, should I use '/path1/perl /path2/script'
or only '/path2/script' ?

What must I do to protect the script (signal handling, error
handling...) ?

Thanks for your help.
--

Lionel Cons

+------- CERN - European Laboratory for Particle Physics -------+
| E-mail: cons@dxcern.cern.ch                                   |
| Earth-mail: CN/SW/WS, CERN, CH-1211 GENEVE 23, Switzerland    |
| Phone: +41 22 767 49 13              Fax: +41 22 767 71 55    |
+---------------------------------------------------------------+
From: wietse@wzv.win.tue.nl (Wietse Venema)
Newsgroups: comp.security.misc
Subject: Re: Dangers in e-mail via UUCP?
Date: 9 Jan 93 23:13:16 GMT
Organization: Eindhoven University of Technology, The Netherlands

This depends strongly on the type of UUCP that you are using.

- V2 (comes with L.sys and so on) is worst.
- HDB (comes with Systems file and so on) is better.
- Taylor (style of config files is configurable) is best.

An important metric for UUCP security is whether or not the programs
use the shell to spawn commands. Taylor is the only one that does not
invoke the shell at all. You can find it at any GNU archive site.

	Wietse
From: mju@mudos.ann-arbor.mi.us (Marc Unangst)
Newsgroups: comp.security.misc
Subject: Re: What new innovation, software or products do you want to see?
Date: 5 Jan 1993 01:36:51 -0500
Organization: The Programmers' Pit Stop, Ann Arbor MI
NNTP-Posting-Host: mudos.ann-arbor.mi.us

In article <sehari.726188412@bart.ecss.iastate.edu> sehari@iastate.edu (Babak Sehari) writes:
>What type of new innovation, software or products do you want to be
>introduced to the market place.  No answer is stupid.  The things
[...]
>P.S.  This message is being automatically posted to all unix wide bbs'. 
>This post does not mean that I approve or disapprove this newsgroup.  Also,
>the moderator of the moderated newsgroups, such as rec.humor.funny, should 
>decide if they want this posting in their newsgroup.

A software package to prevent people from using the net for their
moneymaking schemes.

Also, a software package to prevent people from posting advertisements
in separate messages to many newsgroups, especially newsgroups that
have no relevance to the content of the message.

Let me know when you release them.

-- 
Marc Unangst, N8VRH         | "Of course, in order to understand this you
mju@mudos.ann-arbor.mi.us   |  have to remember that the nucleus of the atom
                            |  is squishy."
                            |    -W. Scheider, from a Physics lecture
From: Jason_Mulligan@camelot.apana.org.au (Jason Mulligan)
Newsgroups: comp.security.misc
Subject: Test
Distribution: world
Date: 30 Dec 92 13:20:30 EST
Organization: The TOWER BBS



 -- AEd V1.36f/EvaA

-- Via DLG Pro v0.992

Xref: sparky comp.security.misc:2472 alt.security:5286
From: watrous@aramis.rutgers.edu (Don Watrous)
Newsgroups: comp.security.misc,alt.security
Subject: Breaking an encrypted file
Keywords: crypt, password forgotten, first words known
Date: 8 Jan 93 19:52:25 GMT
Followup-To: comp.security.misc
Organization: Rutgers Univ., New Brunswick, N.J.
Cc: watrous


I have a user who has encrypted a file using the unix crypt program
and then forgotten the password.  She's pretty sure she knows what the
first line of the file looks like since it was saved mail.

What software is available to try and decrypt the file and how much
effort will be involved?

Thanks,
Don Watrous
SysAdmin, cs.rutgers.edu
-- 
{backbone}!cs.rutgers.edu!watrous        watrous@cs.rutgers.edu
Newsgroups: comp.security.misc
From: peter@ferranti.com (peter da silva)
Subject: Re: Future OS virus immunity.
Organization: Xenix Support, FICC
Date: Mon, 4 Jan 1993 21:12:36 GMT

In article <1992Dec31.172536.16049@das.harvard.edu> adam@endor.uucp (Adam Shostack) writes:
> Does anyone care to comment on why there are so many more MS-Dos
> viruses out there,

There are more MS-DOS *systems* out there, which makes them more desirable
targets. Mac users tend to be less technically oriented, which further reduces
the pool of virus writers. If the systems were equally popular, I would expect
many more Mac viruses because the Mac has so many more interesting places to
hide viruses.

The Amiga has even fewer viruses out than the Mac, despite some *lovely*
hooks for viruses to hang from. It's simply a matter of popularity.

UNIX viruses are by no means impossible... neither are viruses hidden in
source code (do you REALLY read all of GCC?).
-- 
Peter da Silva                                            `-_-'
Ferranti International Controls Corporation                'U` 
Sugar Land, TX  77487-5012 USA
+1 713 274 5180                            "Zure otsoa besarkatu al duzu gaur?"
Newsgroups: comp.security.misc
From: ivory@e7sa.crd.ge.com (John Ivory)
Subject: Dangers in e-mail via UUCP?
Organization: Tower Concepts
Date: Fri, 8 Jan 1993 12:29:55 GMT

A site I've been working with is considering obtaining a UUCP e-mail feed
so that they can e-mail to/fro the world.  Myself and several others have
been strongly encouraging this.  This is new territory for the company
though, so they are cautious.  They are concerned that they are opening
themselves up to some level of danger, point to the Morris worm of a couple
years ago as an example.

These are open minded and intelligent people, but they want more than just
my word that they really are not that much in danger.  What documents can
I bring down from the net to help validate my argument?  My spin is that
their greatest danger is themselves; bringing in and casually running things.

Any help is appreciated.  Thanks.

-----------------------------  R A Z O R ...  --------------------------- \ \ \ 
   Tower Concepts                                          John E. Ivory   \ \
   103 Sylvan Way                                        ivory@tower.com    \ \
   New Hartford, NY  13413                                                   \
   (315) 724-1471                                                             \
-----------------------  A Configuration Management  --------------------------
                         & Problem Tracking System
Newsgroups: comp.security.misc
From: nikb@cix.compulink.co.uk (Nick Barron)
Subject: Unix networking security in practice - help wanted
Reply-To: nikb@cix.compulink.co.uk
Date: Tue, 5 Jan 1993 22:35:00 +0000

Hi!

I have the dubious pleasure (!??) of writing a security manual for one of
our customers (I'm a technical author by trade).  This will be heavily
based on existing policies/procedures.  The system in question is a
worldwide network of Sun SPARCs running a mixture of TCP/IP and X.25.  The
operating system is vanilla SunOS (no C2).

I would be interested in any document references relating to network 
security (I've got most of the "common" ones such as RFC1244, SRI's white
paper etc).  I would also be interested in hearing practical advice from
anyone who has implemented a security policy for a similar system, and what
problems they have come across.

Please e-mail me if you don't want to publicise on the 'net.  All info
will be treated as "Commercial-in-confidence" and I would be happy to sign
non-disclosure agreements or provide a written request on headed paper if
anyone doubts my motives!

I will summarise what I can if anyone's interested.

Thanx in advance,

Nik. [nikb@cix.compulink.co.uk]

PS Email me for company details/snail-mail/phone no.
Newsgroups: comp.security.misc
From: ji@cs.columbia.edu (John Ioannidis)
Subject: Re: Breaking an encrypted file
Keywords: crypt, password forgotten, first words known
Organization: Columbia University Department of Computer Science
Date: Sat, 9 Jan 1993 06:07:57 GMT

In article <Jan.8.14.52.25.1993.25723@aramis.rutgers.edu> watrous@aramis.rutgers.edu (Don Watrous) writes:
>
>I have a user who has encrypted a file using the unix crypt program
>and then forgotten the password.  She's pretty sure she knows what the
>first line of the file looks like since it was saved mail.
>
>What software is available to try and decrypt the file and how much
>effort will be involved?
>

cwb, the crypt-breaker's workbench, was posted a while back on
comp.sources.unix or comp.sources.misc. Check the archives on uunet.

/ji
From: yedidya@bimacs.BITNET (Yedidya Israel)
Newsgroups: comp.security.misc
Subject: 666
Date: 6 Jan 93 17:27:05 GMT
Organization: Math department, Bar-Ilan University, Ramat-Gan, ISRAEL


I wonder why /dev/tty?? (esp. ptys) must have 666 permissions.
Do not email, please post.
--
Israel Yedidya,         Phone:  972-3-5318682 or 972-3-5318407/8
System Administrator,   Fax:    972-3-5353325
Math & CS Department,   Email:  yedidya@bimacs.cs.biu.ac.il
Bar-Ilan University,    Bitnet: yedidya@bimacs
Ramat-Gan, ISRAEL.      Uucp:   ...!uunet!pucc.princeton.edu!bimacs!yedidya
If someone proves there is no God, I'll stop being religious!
Xref: sparky comp.security.misc:2421 alt.security:5257
From: deswarte@laas.fr (Yves Deswarte)
Newsgroups: comp.security.misc,alt.security
Subject: ESORICS Proceedings
Date: 4 Jan 93 14:52:35 GMT
Followup-To: comp.security.misc
Organization: LAAS-CNRS & INRIA
X-UserAgent: Nuntius v1.1.1d13
X-XXMessage-ID: <A76E0E704D011506@tsfyd.laas.fr>
X-XXDate: Mon, 4 Jan 93 14:55:28 GMT


Replying to several requests for information concerning the Proceedings
of the European Symposium on Research in Computer Security (ESORICS):

ESORICS 92 proceedings are published by Springer-Verlag in their
Lecture Notes in Computer Science series, vol. 648, 451 pages,
ISBN 3-540-56246-X or ISBN 0-387-56246-X
They are available now, price is 86 DM in Germany (about US$55).

ESORICS 90 proceedings have been reprinted (in full page format).
Their price is 200 French Francs, and they are available from:
AFCET
156 boulevard Pereire
75017 Paris (France)
Tel. +33 1 47 66 24 19     Fax: +33 1 42 67 93 12

===== Yves Deswarte - LAAS-CNRS & INRIA - 31077 Toulouse (France) =====
==== E-mail:deswarte@laas.fr - Tel:+33/61336288 - Fax:+33/61336411 ====
From: ian@cygnus.com (Ian Lance Taylor)
Newsgroups: comp.security.misc
Subject: Re: Dangers in e-mail via UUCP?
Date: 8 Jan 1993 15:18:28 -0500
Organization: Cygnus Support
NNTP-Posting-Host: tweedledumb.cygnus.com

ivory@e7sa.crd.ge.com (John Ivory) writes:

>A site I've been working with is considering obtaining a UUCP e-mail feed
>so that they can e-mail to/fro the world.  Myself and several others have
>been strongly encouraging this.  This is new territory for the company
>though, so they are cautious.  They are concerned that they are opening
>themselves up to some level of danger, point to the Morris worm of a couple
>years ago as an example.

>These are open minded and intelligent people, but they want more than just
>my word that they really are not that much in danger.  What documents can
>I bring down from the net to help validate my argument?  My spin is that
>their greatest danger is themselves; bringing in and casually running things.

The documentation for Taylor UUCP has a section on UUCP security.  It
is, naturally, oriented toward Taylor UUCP, but is fairly applicable
to other packages.

Basically, UUCP does not provide much security for the users of a
system against users of the same system (for example, there are often
ways for one user to look at any files that another user is receiving
via uucp).  Mail is usually fairly secure.

Assuming that that is not an issue (users at the site mostly trust
one another), then UUCP can be very secure.  It is obviously better
for them to dial out, rather than to accept phone calls, because if
another system can dial in then they must protect all their accounts
from intruders.  However, assuming they do that, or assuming that they
always place the call, UUCP can be configured to eliminate any
possibility of remote access to their files.  In fact, it is normally
configured this way by default.

Ian Taylor
Newsgroups: comp.security.misc
From: elmar@gulasch.hanse.de (Elmar Folba)
Subject: Re: Dangers in e-mail via UUCP?
Keywords: uucp security
Organization: Spare-time Hacker, Hamburg, Germany
Date: Sat, 9 Jan 1993 19:41:17 GMT

In article <1iknikINN51@tweedledumb.cygnus.com> ian@cygnus.com (Ian Lance Taylor) writes:
>ivory@e7sa.crd.ge.com (John Ivory) writes:
>....
>Assuming that that is not an issue (users at the site mostly trust
>one another), then UUCP can be very secure.  It is obviously better
>for them to dial out, rather than to accept phone calls, because if
>another system can dial in then they must protect all their accounts
>from intruders.  However, assuming they do that, or assuming that they
>always place the call, UUCP can be configured to eliminate any
>possibility of remote access to their files.  In fact, it is normally
>configured this way by default.
A related experience - I finally got my management to agree to uucp when I
acquainted them with password-protected callback modems (a caller has to enter
a password and is then called back, at a phone number preset by the manager
of the host system).
Many or most uucp implemntations provide a similar feature in software.
-- 
Kind regards,			Elmar Folba
				Hamburg, Germany
				elmar@gulasch.hanse.de
From: hwt@bcarh11a.BNR.CA (Henry Troup)
Newsgroups: comp.security.misc
Subject: Re: software piracy question
Keywords: laws, software piracy
Date: 5 Jan 93 05:47:28 GMT
Reply-To: Henry.Troup@BNR.CA
Distribution: na
Organization: Bell-Northern Research Ltd., Ottawa, Canada

In article <1992Dec29.223547.28592@cbfsb.cb.att.com>,
dlove@cbnewsf.cb.att.com (Dave Love) writes:
|>S 893 was signed by George Bush on October 28th, 1992.  My understanding
|>is that it makes all copyrighted works subject to Title 18 (?) Felony
|>sanctions.  The penalties include:
|>
|> 1.  up to five years imprisonment for at least 10 copies made during
|>     a 180-day period where the copies have a retail value in excess
|>     of $2,500,

Is there a proper exemption for backup copies?

Canada's equivalent law allows one (1) backup.  
                                    
Henry Troup - H.Troup@BNR.CA (Canada) - BNR owns but does not share my opinions
	       Legislated morality is the enemy of true morality
Newsgroups: comp.security.misc
From: davy@harbor.ecn.purdue.edu (Dave Curry)
Subject: Re: Future OS virus immunity.
Organization: Purdue University Engineering Computer Network
Date: Mon, 4 Jan 1993 21:12:07 GMT

In article <eronald.726016050@ruble> eronald@fml.tuwien.ac.at (Edmund Ronald) writes:
>  Several people remarked that virues on Unix machines were "impossible"
>because of the access control separating accounts.

Yes, and all these folks are just plain wrong.  Viruses are easy to
write for UNIX.  What's hard is (1) getting them to propagate, (2)
hiding them, and (3) making them do more than trivial things.  In
particular, (2) and (3) tend to be somewhat mutually exclusive.

See Tom Duff's "Viral Attacks on UNIX System Security" in the Winter
'89 USENIX Proceedings, and Doug McIlroy's "Virology 101" in the Spring
1989 issue of Computing Systems.  (Or buy a copy of my UNIX security
book, which has summaries of them both.  :-)

>No one bothered to 
>remember that the past ten years have proven Unix system security to be an
>oxymoron, a topic that keeps graduate students entertained nights.

While this is a semi-true statement, it does not answer the claims
about viruses being "impossible" on UNIX.  Although there have been
numerous security problems discovered in UNIX in the last ten years,
*none* of them have been related to viruses.  (Sorry, Morris' little
excursion was not a virus.)  I would challenge you to cite a single
instance of a successful virus attack on UNIX outside of the
laboratory.

>In fact,
>if I may venture some sarcasm, if administrators and vendors did not make
>such exagerated claims about Unix security, then there would probably be
>fewer attacks :)

If I may venture some sarcasm in return, if people did not make such
irresponsible statements as, "UNIX security is an oxymoron," we might
not have so many newbie sys admins who don't even bother to read the
security section in their vendors' manuals, thinking the situation
hopeless.

UNIX security is *not* an oxymoron, and the careful sysadmin can do
some very simple things to make his system relatively difficult to
penetrate.  There are two good, comprehensive books on UNIX security
out there (Spafford/Garfinkel and Curry); buy one of them, *read* it,
and *do* what it says!

>PS. I personnally use a NeXT computer, a Unix box with a wysiwyg GUI built
>on top of a Display Postscript server that handles screen and keyboard, and
>mouse. Mail on these can contain embedded Postscript, which is executed at
>read-time by the server. Need I say more about how un-security can be buit
>into a system?

Yes, you need say more.  It should also be pointed out that this has
nothing to do with the UNIX-ness of the NeXT.  Put the same Display
PostScript and embedded-PS mail on an MS-DOS or Mac box, and you have
the same problem.  In fact, the problem is probably *worse* than on a
UNIX box, because of UNIX's file access permissions.

Dave Curry
Newsgroups: comp.security.misc,comp.sys.sun.admin,comp.unix.admin