HDTenEightyP/NetNews huggingface dataset:
From: barry@ferkel.ucsb.edu (Barry Brown)
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Organization: University of California, Santa Barbara
Date: Tue, 28 Jul 1992 15:06:55 GMT

hsu@eng.umd.edu (Dagwood splits the Atom) writes:

[...]
>>> Can computer disks with data on them go thru the 
>>> airport security x-ray machines.
>>> 
[...]
>the casual observer.  But where on earth is the evidence that x-rays will
>damage magnetic media?  I thought NBS (now NIST) put this rumor to rest
>years ago by thoroughly exposing several tapes and floppies in a research
>reactor with no resultant loss of data.  Airport data loss is usually
>attributable to either the metal detectors or to some x-ray machines' power
>supplies.

I've heard some of the same things about floppy damage, although my source
is somewhat less reliable.  A columnist for MacUser magazine once decided
to do a test to determine how Mac floppies are affected...  He found that
while a single pass through the machine at his local internation airport
did no damage, repeated passes eventually caused errors on all his floppies.
His conjecture was that is was probably not the x-rays themselves that
were causing the damage, but something else about the scanner.  It could
well be the power supply.

The answer?  Maybe they hurt floppies.  Why take the risk?
-- 
Barry E. Brown        --        \  Cal-Animage Beta publicity officer
bebrown@ucsd.{edu,uucp,bitnet}   \   Anime Stuff FTP Server administrator
Somewhere in San Diego, CA.....   \    (ftp network.ucsd.edu [128.54.16.3])
"Kaeshite! Kaeshite! Kaeshitekaeshitekaeshite!  -- Azusa (Ranma 1/2)
From: tar@math.ksu.edu (Tim Ramsey)
Newsgroups: comp.security.misc
Subject: Re: root-owned world-writable files
Date: 21 Jul 1992 16:00:16 -0500
Organization: Dept. of Mathematics, Kansas State University
NNTP-Posting-Host: hilbert.math.ksu.edu

jfowler@beta.lanl.gov (John C. Fowler) writes:

>Only if the system trusts the contents of the file, or root executes it,

How do you get a complete list of files that are trusted by root, or by
programs that root trusts (that is, are setuid root)?

Much easier to simply not have world-writable files owned by root.

-- 
    Tim Ramsey, 913.532.6750
    Department of Mathematics
    Kansas State University
Newsgroups: comp.security.misc
From: dank@blacks.jpl.nasa.gov (Dan Kegel)
Subject: Re: unhappy about overloading finger
Organization: Image Analysis Systems Group, JPL
Date: Wed, 22 Jul 1992 00:24:05 GMT

ggm@brolga.cc.uq.oz.au (George Michaelson) writes:

>dank@blacks.jpl.nasa.gov (Dan Kegel) writes:
>> But what about 'Horton'?  It fingers all the participating machines in
>> one's own domain hourly to update an e-mail address database,

>...I'd have preferred 'horton' to [use a different TCP/IP port than finger]
>That way I know that this traffic is constrained to just that context.

>> It would be impractical to make horton use something other than finger,
>> [because Horton by design requires no active cooperation from the sysops.]

>This is a dual-edged sword. Deploying something as sensitive as an information
>gatherer, without requiring active consent, and to close off access requiring
>local modification.... not social behaviour methinks.

OK, I'd like the next version of Horton to be socially correct ;-)
Would it suffice to send a mail message to postmaster@foo, with an offer to 
exclude foo from polling, before beginning to gather information from foo?

>On the whole, I think (mis)use of finger is doing more good than bad. I'd have
>preferred to see the various threads of functionality unravelled a bit more. 

I doubt that just moving Horton's polling activity to another well-known-
port would add any real security; hackers could just as well use that port. 
- Dan Kegel (dank@blacks.jpl.nasa.gov)
From: sjmz@otter.hpl.hp.com (Stefek Zaba)
Newsgroups: comp.security.misc
Subject: Re: Re: root-owned world-writable files
Date: 22 Jul 92 20:53:53 GMT
Organization: Hewlett-Packard Laboratories, Bristol, UK.

In comp.security.misc, jfowler@beta.lanl.gov (John C. Fowler) writes that
world-writeable root-owned files are only a problem if root trusts the
file contents.  This is false: sometimes an attack requirtes a root-owned
file to succeed, and by linking (hard or symbolic) to the carelessly-left
file, this attack will succeed.

For example: a wannabe sysadmin leaves their home directory world-writeable.
This allows the attacker to plant a .rhosts file which will allow them in.
However, the authentication mechanism requires that .rhosts be owned by
the user.  If you find a world-writeable root-owned file on the same volume,
you can now ln it to /root/wannabe/.rhosts...  Similarly for other "trusted"
files.  Granted, the "real" problem is the writeability of the affected
directory, but the world-writeable root-owned file is still an essential
element in allowing the attack to succeed.

[Any similarity to a FOR-LOCAL-DEMONSTRATION-PURPOSES-ONLY "attack" a good
few years ago as part of educating a new sysadmin is less than entirely
coincidental.]

I can think of no useful purpose for root-owned world-writeable files; but
I'm sure the net's collective wisdom can come up with a few plausible ones...

Toodle-pip, Stefek
Newsgroups: comp.security.misc
From: edelheit@smiley.mitre.org (Jeff Edelheit)
Subject: COPS-like packages for VMS
Organization: The MITRE Corporation, McLean, VA
Date: Thu, 23 Jul 1992 18:37:09 GMT

Does anyone have any recommendations for COPS-like software packages
for VMS?

Regards,

Jeff Edelheit		email:  edelheit@mitre.org
The MITRE Corporation	voice:  (703) 883-7586
7525 Colshire Drive	FAX:	(703) 883-1397
McLean, VA   22102
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
From: vanepp@fraser.sfu.ca (Peter Van Epp)
Subject: Re: Problem with npasswd??
Organization: Simon Fraser University, Burnaby, B.C., Canada
Date: Tue, 28 Jul 1992 00:34:48 GMT

dave@jato.jpl.nasa.gov (Dave Hayes) writes:

>hubcap@hubcap.clemson.edu (System Janitor) writes:
>>The point is, even if you use npasswd, a cracker will still get some of
>>your passwords. So what if they only get 10 instead of 200, they'll still
>>have some userids from which to launch their nefarious plans.
>>So, aren't you fooling yourself to think that npasswd like schemes 
>>enhance your system security enough to make them worthwhile? 

>This is a hard statement to agree with, given that it is only a matter 
>of time before someone puts crack-like word scanning in npasswd. 

>Keep in mind that scanning plaintext matches is far faster than scanning 
>crypted ones.

>-- 
>Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
>dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

>    If it works...use it. If it doesn't, find out why and use THAT. 

And given that you have that plaintext password at this point, you don't have
to search anything like the whole dictionary since after doing the transform
you can eliminate all entries that for instance don't match the first letter
of the word (assuming a sorted dictionary) cutting the work down to a managable
level.
	Even now when this isn't true, it reduces the number of bad passwords
that they have to find with Crack before you do. Npassword isn't an end in
itself, you still need to do a bunch more things, but it is one of the things
that helps.


Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada
Newsgroups: comp.security.misc
From: avalon@coombs.anu.edu.au (Darren Reed)
Subject: Re: System "pleasure.com"
Organization: Computer Services Centre, Australian National University
Date: 28 Jul 92 14:54:10 GMT

lemson@ux1.cso.uiuc.edu (David Lemson) writes:


>Yes, it's a commercial BBS that is only connectable through the
>'business' nets.  That is, if I go through my employer's PSI
>connection, I can telnet to it.  If I go through UIUC's NFSNET
>connection, I cannot.  So, there is some router somewhere that isn't
>allowing NSFNET traffic to their network.  I'm surprised that it
>allows traffic the other way!

More likely your route to it through NSFNET follows defaults until
you get to the NSFNET which says "network unreachable" (NSF routers
are no-default routers and know every net you may use them to reach).

Darren
Newsgroups: comp.security.misc
From: dave@jato.jpl.nasa.gov (Dave Hayes)
Subject: Re: root-owned world-writable files
Reply-To: dave@jato.jpl.nasa.gov
Organization: Jet Propulsion Lab - Pasadena, CA
Date: Tue, 21 Jul 1992 20:58:50 GMT

VESOFT@cup.portal.com (Michael D Hensley) writes:
>Agree/disagree/discussion: Any root-owned world-writable file should be
>considered a potential security loophole.

Only if it can somehow be executed OR it is something that a current
executable references as trusted information.

One can also ask: "Is it really necessary to have a world writable file
owned by root?"

-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

   There is no greater calamity for a nation or individual
                 than not finding contentment in one's sufficiency.
Newsgroups: comp.security.misc
From: ggm@brolga.cc.uq.oz.au (George Michaelson)
Subject: Re: unhappy about overloading finger
Organization: Prentice Centre, University of Queensland
Date: Wed, 22 Jul 1992 05:02:06 GMT

dank@blacks.jpl.nasa.gov (Dan Kegel) writes:

>OK, I'd like the next version of Horton to be socially correct ;-)
>Would it suffice to send a mail message to postmaster@foo, with an offer to 
>exclude foo from polling, before beginning to gather information from foo?

Yes, I think that would be fine. Apart from anything else, it probably alerts
fellow sysops to the local interest, and might do some 'conciousness raising'
as well. Gosh... not only socially correct but politically correct as well.
what a warm fuzzy glow.

	-George

One idea which I have implemented on a box here, but which might impact
on horton if deployed widely, is to replace fingerd by a paranoid shell
script as follows:

(this came from Randall Atkinson, who I hope will excuse me for posting
in news an instance of his e-mailed suggestion)


	#!/bin/sh
	trap "exit 0;" 0 1 2 13 15
	#
	# the text isn't real, but gives a feel for the idea
	#
	/bin/cat << burflydick
		
		This host does not directly support finger.

		If you require further information about our
		services, or have a problem to discuss please 
		contact:
				
				postmaster@xx.xx.xx.xx
				      Tel: zz zzz zzzz
				      Fax: yy yyy yyyy
	burflydick
	#
	# small pause for anyone who moves their lips when they read
	#
	sleep 2
	#
	exit 0
	#


This  provides minimal onward assistance so in the case of dire emergency
somebody can proceed. I put it onto the box which is doing our mailhub and
newshub work, which I particularly didn't want to be blasted by random
finger requests.

The problem with this approach is that said boxen will also usually look
like the appropriate place to finger if you're doing some heuristics on
mail and news addresses or routing.

	-George
--
                         George Michaelson
G.Michaelson@cc.uq.oz.au The Prentice Centre      | There's no  market for
                         University of Queensland | hippos in Philadelphia
Phone: +61 7 365 4079    QLD Australia 4072       |          -Bertold Brecht
From: barmar@think.com (Barry Margolin)
Newsgroups: comp.security.misc
Subject: Re: Pleasure.com mystery solved.
Date: 30 Jul 1992 20:55:57 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: telecaster.think.com
Keywords: n

In article <1992Jul30.053413.27574@nntp.uoregon.edu> johnm@cajal.uoregon.edu (John Martin) writes:
>In article <1992Jul29.215824.16932@anomaly.sbs.risc.net>, kd1hz@anomaly.sbs.risc.net (Michael P. Deignan (KD1HZ)) writes:
>>The NIC is a clearinghouse, which is generally accepted amoung sites to be
>>"the center" for registering a domain. There is no force-of-law behind this,
>>however.
>  There is no force of law, as you
>put it, but it is a very strongly rooted convention, not to mention just
>plain old good manners.

It's more than just a convention and good manners, it's simply "the way
things work."  The NIC is the master server for the .COM zone (as well as
all the other non-country domains).  It's simply not possible to
legitimately create a 2nd level domain in .COM without going though them.
Their master file is the definition of the .COM domain; if it's not in
there, it doesn't really exist.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
From: VESOFT@cup.portal.com (Michael D Hensley)
Newsgroups: comp.security.misc
Subject: root-owned world-writable files
Date: Tue, 21 Jul 92 10:27:28 PDT
Organization: The Portal System (TM)

COPS doesn't seem to report ALL root-owned world-writable files.

Agree/disagree/discussion: Any root-owned world-writable file should be
considered a potential security loophole.

What do you think?
Newsgroups: comp.security.misc
From: jgd@csd4.csd.uwm.edu (John G Dobnick)
Subject: Re: Pleasure.com mystery solved.
Originator: jgd@csd4.csd.uwm.edu
Reply-To: jgd@csd4.csd.uwm.edu
Organization: University of Wisconsin - Milwaukee
Date: Tue, 28 Jul 1992 20:33:24 GMT

From article <1992Jul27.135126.1626@drycas.club.cc.cmu.edu>, by greenie@drycas.club.cc.cmu.edu:

>to it.  But since it was a test and not expected to remain online forever,
>we did not bother registering the domain name - and we were under no obligation
                                                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>to do so because it was through the commercial Internet and therefor not
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>under the auspices of the NIC and the NSF.


Three items.

 1.  What is the "Commercial Internet", and where is the "central
     contact point" for it, if such a thing exists.

 2.  Assuming you really _have_ no obligation to register a temporary
     domain name with "The NIC", how do you prevent collisions in the
     domain name-space?  It would seem that there has to be _some_
     central clearinghouse to prevent such collisions.

     A possibility comes to mind -- the NIC has delegated "domain
     registry authority" to the "Commercial Internet", who has full
     control over the "COM" domain.  "Is this the true state of
     things?", he asked curiously.  If this is not the case, I can see
     a situation where the "Commercial" Internet registers a particular
     domain [e.g, xyzzy.com], and someone else registers this same
     domain with the NIC.  Who wins when these are advertised by the
     nameservers?

 3.  Similar to the above, but with no easily apparent resolution, is
     the question of how one prevents IP address collisions.  Since the
     "NSF/MIL Internets" seem to be interconnected with the
     "Commercial" Internet, and they _are_, aren't they? :-), they must
     needs share that same address space.  It seems to me that there
     thus must be _a_ central clearinghouse for assigning IP addresses,
     in order to prevent collisions.  (The NIC comes to mind here as a
     reasonable site for such a clearinghouse.)  This leads me to
     believe that there _is_ an obligation to register domains.  (The
     only exception I can think of is if the registration authority
     'lends' one of its _own_ IP addresses to this new entity.)

Or am I missing something very obvious in what transpired here?

Confused and puzzled by the situation,
-- 
John G Dobnick                          ATTnet: (414) 229-5727
Computing Services Division             INTERNET: jgd@uwm.edu
University of Wisconsin - Milwaukee     UUCP: uunet!uwm!jgd

"Knowing how things work is the basis for appreciation,
and is thus a source of civilized delight."  -- William Safire
Newsgroups: comp.security.misc
From: dooley@helios.physics.utoronto.ca (Kevin Dooley)
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Organization: University of Toronto Physics/Astronomy/CITA
Date: Mon, 27 Jul 1992 16:16:18 GMT

In article <15844@pitt.UUCP> ansst11@icarus.lis.pitt.edu (Andy Solomon) writes:
>I am noy sure where to post this.
>
>Can computer disks with data on them go thru the 
>airport security x-ray machines.
>
>I need to know ASAP.
>
>Thanks,
>
>Andy ansst11@icarus.lis.pitt.edu
>

I have taken a box of disks containing my thesis and lots of data files
through such machines a couple of weeks ago and lost no information either
time.  Note, however, that the power output and spectrum of airport 
security x-ray machines in North America is a lot easier on magnetic
and photographic media than the older clunkier machines used in many
less-developed parts of the world, so it may depend on where you're going.
		Kevin
From: jfowler@beta.lanl.gov (John C. Fowler)
Newsgroups: comp.security.misc
Subject: Re: Re: root-owned world-writable files
Date: 23 Jul 92 14:11:05 GMT
Organization: Los Alamos National Laboratory

In article <61350001@otter.hpl.hp.com> sjmz@otter.hpl.hp.com (Stefek Zaba) writes:
>For example: a wannabe sysadmin leaves their home directory world-writeable.
>This allows the attacker to plant a .rhosts file which will allow them in.

And if there are no root-owned world-writable files, then the attacker could
mv the old /etc directory out of the way, mkdir a new /etc directory, copy
the appropriate files, and change root's password in /etc/passwd.  Or maybe
they'll just delete the kernel (any system administrator dumb enough to
leave / world-writable is not likely to know how to recover).

But I see the point you're trying to make.  Thanks for bringing it up!

-- 
John C. Fowler, jfowler@lanl.gov
Newsgroups: comp.security.misc
From: oneill@cs.ulowell.edu (Brian 'Doc' O'Neill)
Subject: System "pleasure.com"
Organization: University of Massachusetts at Lowell Computer Science
Date: Thu, 23 Jul 1992 14:47:12 GMT

Has anyone else heard of this system? I'm getting tons of FTP connections
from it.

The domain "pleasure.com" does not actually exist. The IP address used is
192.160.196.5, which is mapped to "pleasure.com". The IP address actually
belong to InteleCom Data Systems (NET-NET-IDS-COM).

Isn't mapping to a false name against the rules?

This site appears to a BBS for erotica gifs and such, which may violate some
of the regulations of some networks. Apparently a user can have that system
ftp files to their own account, which is why I see the FTP connections. 
however I am concerned about the methods used to do this, as it may require
the divluging of the users password.

=======================================================================
Brian O'Neill - Systems Manager, Computer Science 	 (508) 934-3645
University of Massachusetts at Lowell
Internet: oneill@ulowell.edu		Moderator, comp.binaries.ibm.pc
From: evansmp@uhura.aston.ac.uk (Mark Evans)
Newsgroups: comp.security.misc
Subject: Re: System "pleasure.com"
Date: 23 Jul 92 21:36:50 GMT
Organization: Aston University

oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:
: Has anyone else heard of this system? I'm getting tons of FTP connections
: from it.
: 
: The domain "pleasure.com" does not actually exist. The IP address used is
: 192.160.196.5, which is mapped to "pleasure.com". The IP address actually
: belong to InteleCom Data Systems (NET-NET-IDS-COM).
Oddly I can't resolve the name at all.
Both attempting a forward mapping of pleasure.com
and a reverse mapping of 192.160.196.5.
What nameserver are you using?
(I am trying with a root of ns.nic.ddn.mil)
ids.net resloves to 155.212.1.2 and 192.67.241.11
The later fails a reverse mapping.
ids.com
gives an MX record to idsvax.ids.risc.net, which resolves to 155.212.1.2
the same as ids.net, but not an alias
: 
: Isn't mapping to a false name against the rules?
: 
: This site appears to a BBS for erotica gifs and such, which may violate some
: of the regulations of some networks. Apparently a user can have that system
: ftp files to their own account, which is why I see the FTP connections. 
: however I am concerned about the methods used to do this, as it may require
: the divluging of the users password.
I have seen this method used on other BBS's personally I don't like it,
as it involves entering a password for another system to get it to work.
BBS downloading should be done by connecting to an FTP server on the 
BBS machine, loging into the BBS, then running an FTP client to connect to
your machine is the WRONG way to do it.
Also it dosn't work with packages like NCSA telnet, which use a one time
password system, entered at the time the server prompts you.
Taking all the parameters, then firing up an ftp process is braindead!
Also connections in to a machine, from unexpected places tend to alarm
sys-admins.
-- 
-------------------------------------------------------------------------
Mark Evans                                   |evansmp@uhura.aston.ac.uk
+(44) 21 565 1979 (Home)                     |evansmp@cs.aston.ac.uk
+(44) 21 359 6531 x4039 (Office)             |
From: gdmr@dcs.ed.ac.uk (George Ross)
Newsgroups: comp.security.misc
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Date: 28 Jul 92 13:45:56 GMT
Organization: Department of Computer Science, Edinburgh University

In article <1992Jul28.124310.831@dcs.warwick.ac.uk>, arf@maths.warwick.ac.uk (Anthony Iano-Fletcher) writes:
> At Heathrow and Gatwick (and I guess at all of the UK airports) security will NOT
> hand check anything. Everything must go through the hand-luggage xray machine.

Just get a motorcycle courier to hand it in for you 8-(.
-- 
George D M Ross, Department of Computer Science, University of Edinburgh
     Kings Buildings, Mayfield Road, Edinburgh, Scotland, EH9 3JZ
Tel: 031-650 5147   Internet: gdmr@dcs.ed.ac.uk   JANET: gdmr@uk.ac.ed.dcs
Newsgroups: comp.security.misc
From: dank@blacks.jpl.nasa.gov (Dan Kegel)
Subject: Re: unhappy about overloading finger
Organization: Image Analysis Systems Group, JPL
Date: Thu, 23 Jul 1992 04:51:46 GMT

nelson@reed.edu (Nelson Minar) writes:
>A far more common way for accounts to be cracked is for someone to
>steal your YP password file (not too hard to do if you're running yp
>and are on the internet) and run a fine cracking tool like Crack 4.1
>with a fast crypt().

>How do you, as a sysadmin, prevent this? Crack your password file
>yourself. Don't let users have crackable passwords. 

>If you want to be butch try to fix yp, or use a shadow scheme that
>works. That's a lot of trouble, and the best you'll probably do is
>security through obscurity.

With Sun's latest patches, YP is supposed to be fairly secure;
nobody can get your passwd map that you don't want to.
From: smee@bristol.ac.uk (Paul Smee)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 23 Jul 92 14:11:46 GMT
Reply-To: P.Smee@bristol.ac.uk (Paul Smee)
Organization: University of Bristol

In article <brtfh6.jix@wang.com> fitz@wang.com (Tom Fitzgerald) writes:
>What's wrong with using finger as a billboard?  It's great for
>going-on-vacation notices, new-phone-number notices, etc.

Well, among other things, unless you've got a really good home burglar
alarm, you might not want every random Fred in town to know that your
home is going to be empty for the next 2 weeks because you're going to
be off on vacation.  Networking has grown to the point where it's
probably not a good idea to put anything into your .plan file unless
you'd also be happy to have it printed up on big posters and hung
around downtown.

-- 
Paul Smee, Computing Service, University of Bristol, Bristol BS8 1UD, UK
 P.Smee@bristol.ac.uk - ..!uunet!uknet!bsmail!p.smee - Tel +44 272 303132
Xref: sparky comp.security.misc:832 alt.security:4018 comp.unix.ultrix:5908