HDTenEightyP/NetNews huggingface dataset:
From: ca393@cleveland.Freenet.Edu (Scott D. Wells)
Newsgroups: comp.security.misc
Subject: Re: Can ftp be made to log outgoing calls ?
Date: 9 Oct 1992 00:12:33 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
Reply-To: ca393@cleveland.Freenet.Edu (Scott D. Wells)
NNTP-Posting-Host: hela.ins.cwru.edu


In a previous article, psanders@srd.bt.co.uk (Paul Sanders) says:

>After a long fight I've managed to convince my higher powers that 
>connections to the outside world are a Good Thing. However, they
>want us to have a 6 month trial, after which we will review its
>usage. So, I'm looking for a way of getting ftp (and possibly
>telnet and rlogin, but these aren't so important) to log:
>
>	o who invoked it
>	o from what machine it was invoked
>	o where did it connect to
>	o what was downloaded
>
>I've thought about doing this with by writing a shell script wrapper to
>ftp but I'm sure someone somewhere must already have done it.
>
>Can someone point me in the right direction ?
>
>Thanks
>
>Paul.
>
>--
>   Paul Sanders      psanders@srd.bt.co.uk		Tel: +44 473 645716
>     Software Research, BT Laboratories, Martlesham Heath IPSWICH IP5 7RE
>       Is all that we or see or seem but a dream within a dream ?
>


Yes, it can be done.  You will probably need to write a shell script
that will write the useres uid toa file, then invoke the ftp/telnet/rlo
programs.  

I'm not a Unix buff, so I could be wrong.  I know it can be don, though,
I have read some of the logs of it.

Scott 
ca393@po.cwru.edu
-- 
Krynn - ca393@po.cwru.edu 
         CyberGod
Newsgroups: comp.security.misc
From: vince@ghost.dsi.unimi.it (David Vincenzetti)
Subject: ATP available (Was: Re: Beta testers needed for security tool)
Organization: Computer Science Dep. - Milan University
Date: Tue, 13 Oct 1992 21:38:54 GMT

I had written a program last year, its name is Anti Tampering Program (ATP).
I'm still working on it but a preliminary version is available via
anonymous ftp at the address:

	ghost.dsi.unimi.it		file: /pub/crypt/atp.tar.Z

I *suppose* it should be something like Tripwire...

Ciao,	David
-- 
David Vincenzetti                  TCP/IP : vince@ghost.dsi.unimi.it
                                   VOICE  : ++39 2 55006 392
                                   FAX    : ++39 2 55006 373
Newsgroups: comp.security.misc
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Subject: Re: HELP! (Re: IBM password)
Organization: Fachschaft Informatik, Uni Karlsruhe
Date: Fri, 16 Oct 1992 13:18:39 GMT
X-News-Reader: VMS NEWS 1.23

In <1992Oct15.153610.29280@news.ysu.edu> doug@cc.ysu.edu writes:

>  : Try to remove the hard disk *logically*: go SETUP and mark the hard
>  : disk as 'not installed' or the like. This will (should) prevent the
>  : possibly tampered master boot record from being read. (Still, you can
>  : try it with the disk taken out physically, this will guarantee that
>  : the boot record gets not read ;-)
>  
>  If we do this, then the machine will boot completely from a floppy disk.
>  But we can't access the hard drive to fix it.  If the HD is configured
>  in, then the machine will NOT complete a floppy-disk boot.

Oh yes, that's a Catch-22... but if you configure it out in the setup,
and the machine does boot from a floppy, you can still run some disk
utilities (maybe Speedstore or Norton? I don't know them exactly) on
the disk, if they don't care about the BIOS setup. (Some partitioning
uitilities - does anyone know better? - bypass the BIOS configuration
intentionally to enable the use of uncommon disks.) It should be
possible to at least write a clean master boot record to the disk,
enabling the machine to boot up with the disk configured in correctly.

>...  
>  The machines have tamper-resistant screws, and is a high-traffic student
>  lab, including student programming consultants, who would hopefully notice
>  if a machine is being opened by someone that shouldn't be.

Good for you; if someone had really replaced the BIOS you would not
be likely to get the machine working unless you caught him...

>...  
>  (2) We have observed students installing other software on the HD's -
>  mostly games that they didn't wish to carry around on floppy disk, but
that's what happens... :-(
>  also other commercial programs.  This makes a student the most likely
>  candidate for having installed this program, as well.

O.K., 'most likely' sounds much better. :-)


MfG,
        Olaf
-- 
    o     Olaf Titz - comp.sc.student - univ of karlsruhe - germany
 _ /<_    s_titz@iravcl.ira.uka.de - uknf@dkauni2.bitnet - praetorius@irc
(_)>(_)   +49-721-60439 - did i forget something?
The empires of the future are empires of the mind. - Churchill
Newsgroups: comp.security.misc
From: pmetzger@snark.shearson.com (Perry E. Metzger)
Subject: Re: Secure shell by mail
Organization: Lehman Brothers
Distribution: usa
Date: Wed, 14 Oct 1992 19:17:13 GMT

>>>>I posted a question on comp.unix.questions about how to get a shell by email,
>>>>that is a shell that would execute what's in the body of an email message.
>>>>All the details have been worked out except for one thing: security.
>>
>>>How about this:
>>
>>>Include in the header a string in both plaintext and encrypted form.  The
>>>receiving system would decrypt the encrypted form and compare it to the
>>>plaintext.
>>
>>>One problem with this is that it's quite amenable to known-plaintext
>>>attacks.  And it also requires a decryption key to be stored on the
>>>destination system, unless you use a public-key encryption system.
>>
>>Such a system would be easily spoofed by a "replay" attack.  If I ever get
>>hold of one of the messages, I just take the header (which has a valid key
>>on it) attach a different shell script, and send it!  Bang!
>
>How about encode a sequence number, and disallow repeated sequence numbers?
>
>The replay attack goes away.  However, a sysop on the route your message
>travels could copy your message, replace the commands, and send his message
>*before* your message.  Significantly harder, but it's not A1 security.

The right thing to do would be to use PGP to build a system that
required that the commands be send public key encrypted and signed. As
you noted, a sequence number is needed to stop replay attacks -- that
should be included in the plaintext. The only thing that an interloper
can do under those circumstances is stop your message from getting
through -- he can not see you message, replay it, or forge it.

--
Perry Metzger		pmetzger@shearson.com
--
		  Just say "NO!" to death and taxes.
			 Extropian and Proud.
From: faigin@aero.org (Daniel P. Faigin)
Newsgroups: comp.security.misc
Subject: Re: B1security level
Date: 15 Oct 92 06:34:00
Organization: The Aerospace Corporation, El Segundo, CA
NNTP-Posting-Host: solarium.aero.org
In-reply-to: artur@morgaine.puug.pt's message of Wed, 14 Oct 1992 11:25:36 GMT

> Does anyone know if there is any version of UNIX that implements the
> B1 level.

Looking through the EPL and PPL, I can see the following:

The only Unix EPL entries at the B1 level are the following:

	Secureware's CMW+ Version 1.0 running on Apple's A/UX Release 1.1 for
	the Mac IIx and Mac IIcx workstations.

	AT&T's System V/MLS version 1.1.2 running with UNIX System V Release
	3.1.1 on the AT&T 3B2/500 or AT&T 3B2/600 minicomputers.

Vendor assistance phase: UNIX or UNIX-like products from Control Data Corp.,
Intergraph Corporation, SecureWare, Inc., Sequent Computer,  and Trusted
Information Systems.  

Design Analysis Phase: UNIX or UNIX-like products from Amdahl Corporation
(UTS/MLS), Harris Corporation (CX/SX), and Silicon Graphics Inc. (IRIX).
  
Formal Evaluation: UNIX or UNIX-like products from Hewlett Packard (HPUX
B-Level System) and AT&T Unix System Laboratory Inc. (Unix System V Release
4.1) 

Daniel
--
[W]:The Aerospace Corp. M1/055 * POB 92957 * LA, CA 90009-2957 * 310/336-8228
[Email]:faigin@aerospace.aero.org              [Vmail]:310/336-5454 Box#13149
   "You can't be a rationalist in an irrational world. It isn't rational!"
	       Dr. Rance, in Joe Orton's "What the Butler Saw"
Newsgroups: comp.security.misc
From: dthomas@mcl.bdm.com (David Thomas)
Subject: SecureCard
Date: Mon, 12 Oct 92 15:48:24 GMT
Organization: BDM International, Inc.

I'm trying to verify the integrity of a product called SecureCard, by
Data Media Corp. (DMC).  Basically, it is a hardware product that goes
in a PC that requires the user to insert a card to verify his identity
and to establish what files/devices he has access to.  Does anyone out
there have any experience with this product?  If so, please send me
e-mail (I don't get to this group very much) describing your impressions
and any vulnerabilities you have found.

Thanks in advance,

David Thomas 
dthomas@mcl.bdm.com
Newsgroups: comp.security.misc
From: breinhar@access.digex.com (Robert B. Reinhardt)
Subject: Re: Conference in Baltimore MD
Organization: Express Access Online Communications, Greenbelt, Maryland USA
Date: Wed, 7 Oct 1992 23:38:23 GMT

In article <1992Oct6.142818.23717@cs.cornell.edu> wayner@cs.cornell.edu (Peter Wayner) writes:
>There is going to be a SEcurity Conference In Baltimore MD later
>this month. I would be obliged if someone could send me a copy of the
>electronic flyer announcing the fest. Thanks...
>
>-Peter Wayner
>(wayner@cs.cornell.edu)
>
>-- 
>Peter Wayner   Department of Computer Science Cornell Univ. Ithaca, NY 14850
>EMail:wayner@cs.cornell.edu    Office: 607-255-9202 or 255-1008
>Home: 116 Oak Ave, Ithaca, NY 14850  Phone: 607-277-6678
>

Sorry, don't have the electronic flyer, here's some info though:

15th National Computer Security Conference
October 13-16, 1992
Baltimore Convention Center
Baltimore, Maryland

If you haven't registered by now, you'll
have to pay when you get there:  $315.00

For more info. call Tammie Grice, registrar, at (301)975-2775
FAX is (301)926-1630

--------------------------------------------------------------------------
                                 Robert B. Reinhardt
  /                 /            -----------------------------------------
 /__,_  _  o ____  /_  __.  __   breinhar@access.digex.com
/_)  (_</_<_/ / <_/ /_(_/|_/ (_  -----------------------------------------
From: chet@odin.ins.cwru.edu (Chet Ramey)
Newsgroups: comp.security.misc
Subject: Re: Looking for UNIX SECURITY papers/reference
Date: 8 Oct 1992 19:59:56 GMT
Organization: Case Western Reserve University, Cleveland, OH (USA)
NNTP-Posting-Host: odin.ins.cwru.edu

>cwns2.ins.cwru.edu (129.22.8.44) has a unix-security.ps file
>(274262 bytes long) in it's /pub directory. I cannot seem to get at it
>as user anonymous, however...

Try ftp.cwru.edu:security/unix-security.ps.  cwns2 is no longer
ftp.cwru.edu.  (ftp.cwru.edu == po.cwru.edu == 129.22.4.2)



-- 
``The use of history as therapy means the corruption of history as history.''
	-- Arthur Schlesinger

Chet Ramey, Case Western Reserve University	Internet: chet@po.CWRU.Edu
Newsgroups: comp.security.misc
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: IBM password
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 13 Oct 92 21:31:36 GMT

steveb@inst-sun1.tmc.edu (Steve Bednarczyk) writes:

>  I just installed a small security card called the GATEKEEPER made
> by JDR Microdevices ($49). It intercepts the BIOS and will not allow
> the boot to continue until a password is entered by the keyboard.
> You cannot boot from a floppy or the hard drive. It can be disabled
> by removing the card however. I bought a security padlock/case bolt
> assembly to keep the case from being removed.
>  I agree that these measures can be defeated by a determined person
> but I hope that they will just find an easier target. Oh. The really
> sensitive material has been encrypted using Norton Diskreet DES.
> If they get through that - I'll offer them a raise in salary and put
> them on my security committee :}

Hmm, let me see... If I were THEY (i.e., if I needed to attack your
machine), I would write a simple master boot sector virus (like
Stoned) and will infect with it any diskette that I am giving to you.
Sooner or later, you'll forget one of them in drive A: when rebooting
the machine. Then the virus will infect your hard disk. From this
point, it's relatively easy for it to intercept the loading of
Norton's device driver, the password request, and your response from
the keyboard. The virus will save the password (trivially encoded) in
its body. Therefore, each diskette, infected with it, will contain
your password (encoded, so it won't be obvious). I then need only to
get an infected diskette from you, which is really easy - I just have
to ask you to access -any- diskette which is not write-protected with
the DIR command. Once I get the diskette, I can decode your password.
The virus on your disk could be even designed to automatically remove
itself some time after it has obtained the password and has written it
onto several diskettes...

OK, so will you accept me in your security committee and how about my
salary? :-)

(Note: this is only a hypothetical attack, to show how a computer virus
could be used to defeat the security (in fact, the secrecy) of a
system. In the real life I am fighting viruses and not writing
them...)

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: bill@chaos.cs.umn.edu ( Hari Seldon ... psychohistorian )
Newsgroups: comp.security.misc
Subject: Re: HELP! (Re: IBM password)
Date: 15 Oct 92 18:16:31 GMT
Article-I.D.: chaos.bill.719172991
Organization: University of Minnesota

In <1992Oct15.153610.29280@news.ysu.edu> doug@cc.ysu.edu (Doug Sewell) writes:

>S_TITZ@iravcl.ira.uka.de (Olaf Titz) writes:
>: In <1992Oct14.194137.26262@news.ysu.edu> doug@cc.ysu.edu writes:
>: 
>: >...
>: >  If you boot from a floppy disk, the machine hangs.  If you boot from the
>: >  hard-drive, the screen clears and the word 'Password:' is displayed.
>: >  
>: >  We suspect it's some form of commercial or shareware password protection
>: >  that imbeds itself in the partition table or some other place where it
>: >  will be activated during power-on self test.
>: >  
>: >  Do you have any suggestions (besides removing the hard drives - which
>: >  we're considering ?)  How do we get rid of it ?
>: 
>: Try to remove the hard disk *logically*: go SETUP and mark the hard
>: disk as 'not installed' or the like. This will (should) prevent the
>: possibly tampered master boot record from being read. (Still, you can
>: try it with the disk taken out physically, this will guarantee that
>: the boot record gets not read ;-)

>If we do this, then the machine will boot completely from a floppy disk.
>But we can't access the hard drive to fix it.  If the HD is configured
>in, then the machine will NOT complete a floppy-disk boot.

then fire up ontracks (or your favorite) disk manager and reinstall the
drive, or refprmat it, or whatever you want to do.

bill pociengel
--
llbi locgeenpi " i'm a little confused right now"
Newsgroups: comp.security.misc
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: HELP! (Re: IBM password)
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 16 Oct 92 16:07:08 GMT

S_TITZ@iravcl.ira.uka.de (Olaf Titz) writes:

> >  floppy, then by using BIOS calls (specifically int26, Absolute disk write)

> Sorry, but I think this is wrong. int25/26 do not work without the
> disk properly configured, as they need the disk geometry as background

Indeed, if the BIOS is not told that the disk exists (and is properly
configured), then it will not be able to access the disk. BTW, INT
25h/26h are DOS interrupts, not BIOS. BIOS uses INT 13h, but even this
will not be able to access a disk which is not properly installed.

> >  	If there is data you want on the disk, then you might try reading
> >  the first few sectors (with int25) to get the partition table and then
> >  write a valid partition table from another drive on a working machine onto
> >  the broken drive again using int26.

> I'm not absolutely sure, but I think that you can't access the
> partition table with int25, only the logical drives.

You are right, the master boot sector (where the partition table
resides) CANNOT be accessed with INT 25h. You need INT 13h for that.

To the original poster: I initially thought that you want just to
remove the password protection (wihout losing any data). If you don't
care about the contents of the disk and are ready to accept its lost,
just drop me a message and I'll explain you what to do, in order to
get the hard disk working again.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.0 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: barmar@think.com (Barry Margolin)
Newsgroups: comp.security.misc
Subject: Re: Secure shell by mail
Date: 13 Oct 1992 20:23:35 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
Distribution: usa
NNTP-Posting-Host: telecaster.think.com

In article <1992Oct13.172459.28720@zip.eecs.umich.edu> ayman@eecs.umich.edu (Ayman I. Kayssi) writes:
>I posted a question on comp.unix.questions about how to get a shell by email,
>that is a shell that would execute what's in the body of an email message.
>All the details have been worked out except for one thing: security.

How about this:

Include in the header a string in both plaintext and encrypted form.  The
receiving system would decrypt the encrypted form and compare it to the
plaintext.

One problem with this is that it's quite amenable to known-plaintext
attacks.  And it also requires a decryption key to be stored on the
destination system, unless you use a public-key encryption system.

-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: comp.security.misc
From: marc@watson.ibm.com (Marc Auslander)
Subject: Re: IBM password
Date: Tue, 13 Oct 1992 18:24:06 GMT
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
	<1992Sep29.095334.20666@ghost.dsi.unimi.it>
	<1992Oct8.205307.4459@ariel.ec.usf.edu>
Organization: IBM T.J. Watson Research Center, Hawthorne, New York

In article <1992Oct8.205307.4459@ariel.ec.usf.edu> adair@eggo.tmc.edu (Jonathan Adair) writes:

>In article <1992Sep29.095334.20666@ghost.dsi.unimi.it> cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi) writes:
..
>>There's no way to protect a PC from use by unauthorized users ..
>>( I am not talking just for DOS, for UNIX too . Think about it !!!)


Not always true.  For example, the IBM RS/6000 has a key lock.  In the
locked position, the system will only boot from the internal hard
drive.  It doesn't matter what you put in the diskette slot.  So if
its unix, and you don't know the root password, you can't easily break
in.  Since the key lock also physically locks the box, you can't mess
with the disk drives either.

Can you overcome this.  OF COURSE.  But not without some skill and
effort and time.
--


Marc Auslander       (IBM)<marc@marc.watson.ibm.com>      914 784-6699
                     (Internet)<marc@watson.ibm.com>
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Newsgroups: comp.security.misc
Subject: Re: HELP! (Re: IBM password)
Date: 16 Oct 92 13:45:23 GMT
Organization: Fachschaft Informatik, Uni Karlsruhe
X-News-Reader: VMS NEWS 1.23

In <vanepp.719197327@sfu.ca> vanepp@fraser.sfu.ca writes:

>  doug@cc.ysu.edu (Doug Sewell) writes:
>  
>  >If we do this, then the machine will boot completely from a floppy disk.
>  >But we can't access the hard drive to fix it.  If the HD is configured
>  >in, then the machine will NOT complete a floppy-disk boot.
>  
>  I sent a reply by mail, but maybe it didn't make it. If you can boot from a 
>  floppy, then by using BIOS calls (specifically int26, Absolute disk write)

Sorry, but I think this is wrong. int25/26 do not work without the
disk properly configured, as they need the disk geometry as background
information for calculation of sector numbers. For the same reason,
you can't use DEBUG for raw-read/write on a logically uninstalled
disk. Int13 should do, but best use the already mentioned disk
managers which can access the hardware directly.


>  you should be able to write either 0s or E5s (which I believe is the format
>  data string) onto the first track of the hard disk. This of course will
>  destroy any data on the hard disk, but I assume you don't care. Haveing done

probably you want to save the master boot record (and preferrably the
whole 0th track, which is normally unused but sometimes stores
additional information or boot programs if the master block doesn't
suffice) for later off-line analysis, to see what really happened.

>  that, you should be able to enable the hard drive in the CMOS ram and 
>  partition and format the disk manually.
>  	If there is data you want on the disk, then you might try reading
>  the first few sectors (with int25) to get the partition table and then
>  write a valid partition table from another drive on a working machine onto
>  the broken drive again using int26.

I'm not absolutely sure, but I think that you can't access the
partition table with int25, only the logical drives.

MfG,
        Olaf
-- 
    o     Olaf Titz - comp.sc.student - univ of karlsruhe - germany
 _ /<_    s_titz@iravcl.ira.uka.de - uknf@dkauni2.bitnet - praetorius@irc
(_)>(_)   +49-721-60439 - did i forget something?
He thinks too much, such men are dangerous. - Shakespeare, Caesar
From: s897336@otto (Soh Lip Meng)
Newsgroups: comp.security.misc
Subject: IBM PC logical drive password
Date: 9 Oct 92 05:36:39 GMT
Organization: RMIT Computer Centre
NNTP-Posting-Host: otto.bf.rmit.oz.au


Does anyone know of any PC security program that assigns password to logical
drives ? 
Any help will be highly appreciated ! Thanks !!

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

Please email to : s897336@otto.bf.rmit.oz.au 


@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
From: CC024NAC01@trent-poly.ac.uk (Neil Chick)
Newsgroups: comp.security.misc
Subject: TCP/IP and Security
Date: 15 Oct 1992 12:07:40 -0500
Organization: UTexas Mail-to-News Gateway

I want to write a document on TCP/IP and Security.... Can anyone give me any
ideas to ftp sites which already contain documents/programs similar to this?

Please Email replies since I haven't got access to News :-( well not reading it

Cheers,
Neil Chick.
Nottingham Polytechnic, UK.
cc024nac01@trent.ac.uk