HDTenEightyP/NetNews huggingface dataset:
Newsgroups: comp.security.misc
Date: Tue, 10 Nov 1992 22:26:34 -0500 
From: "Manu S. Kumar" <mk5a+@andrew.cmu.edu>
Subject: Re: need info on Morris'es Internet worm
Distribution: na


Excerpts from netnews.comp.security.misc: 10-Nov-92 need info on
Morris'es Inte.. by Damian Kanarek@nyx.cs.du 
> Hiya all,
> 
> I'm trying to get more info on the whole affair.  Is there an ftp site
>where I could get a copy of Cornell's report on this incident, and
>maybe some more details on how the worm worked? Really, now - this is
>a serious request; I have to fill 20 pages with this stuff :)
>Thanks in advance,
> 
>Damian
>--
>Damian R. Kanarek                      |"I am an insomniac-agnostic-egotist:
>Faculty of Libr. & Information Science | I lie awake nights trying to figure
>University of Toronto                  | out whether or not I believe that I'm
> 
>email -> kanarek@flis.toronto.edu      | as great as I am."   - Frank


    Hi!

        My first introduction to Unix and Viruses in general was when I
read Cliff Stoll's 'The Cuckoo's Egg'. I reccomend it to any and
everyone who is interested in computer security. It was due to this book
that I got interested in security and hats off to it. I loved the book
and would never mind reading it again. The Internet worm and the story
of Robert Morrison Jr. ( I think as far as I remember his father was the
head of National Security at the time!!) is also covered in it.


                                                    Manu Kumar
_____________________________________________________________________________
Class of 1992,Modern School,Barakhamba Road,New Delhi...MHS is the best!!
Freshman, Carnegie Mellon University, Electrical and Computer Engineering.
Campus Address: A-306 Hamerschalg House, Margaret Morrison St., Mail Box 
#4532, Pittsburgh,PA 15213,Tel(fax):(412)-268-4322,Email:mk5a@andrew.cmu.edu
Home Address: 13-A, Amrita Shergill Marg, New Delhi 110 003, India, 
Tel : (91-11)-611-624, (91-11)-462-6629, Fax : (91-181)-778-27
_____________________________________________________________________________
From: ifbb657@ccwf.cc.utexas.edu (Douglas Floyd)
Newsgroups: comp.security.misc
Subject: Computer security books
Date: 12 Nov 92 03:10:20 GMT
Reply-To: ifbb657@ccwf.cc.utexas.edu (Douglas Floyd)
Organization: The University of Texas at Austin, Austin TX
Originator: ifbb657@grumpy.cc.utexas.edu

What are some books that cover the basics of computer security, like
scavenging, risk control, piggybacking, etc?

ifbb657@ccwf.cc.utexas.edu
From: mas@dit.upm.es (Antonio Martinez Mas)
Subject: Information on Companies with Secure Data Network System (SDNS) based products
Organization: UUES, Asociacion de Usuarios de UNIX, Spain
X-Newsreader: Tin 1.1 PL4
Date: Sat, 7 Nov 1992 11:42:31 GMT

We are interested to contact companies that develop product based on
the US SDNS program standards. We would like to acquire software
products that implement the security protocols SP3 and SP4.

If you have any information on those companies, please send us the
company name, address, and contact person name. Our contact point is
the e-mail address laseca@crisa.es

Thank you,

A.Laseca
From: valdis@black-ice.cc.vt.edu (Valdis Kletnieks)
Newsgroups: comp.security.misc
Subject: Re: Setuid file
Date: 12 Nov 92 02:54:57 GMT
Organization: Virginia Tech, Blacksburg, VA

In article <1992Nov10.151709.5734@pool.info.sunyit.edu> buck@pool.info.sunyit.edu (Jesse Buckley) writes:
>In article <1992Nov9.183358.12335@nas.nasa.gov> jns@ace.nas.nasa.gov (John N. Stewart) writes:
>>There is a simple logic -- anything that is setuid has a potential --
>>it's intuitive. Sure, an empty file may not seem bad -- but there are
>>potential risks.
>
>Like a "hideing" place for suid stuff.

Of course, once you put something in it, the file isn't empty.

I wonder if there's any creative applications for a mode
4755 /dev/null?

/Valdis
From: barmar@think.com (Barry Margolin)
Newsgroups: comp.security.misc
Subject: Re: Grabbing your pw file from anonymous FTP
Date: 11 Nov 1992 00:19:38 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: telecaster.think.com

In article <83347@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>  What keeps any person who can anonymous ftp from going down your
>etc directory and grabbing the passwd file?  Does ftp log this?  I
>know that some Unix systems use a chroot system to lock anonymous
>ftp users into a restricted section of the directory.  Do all
>ftp systems do this?

Most Unix anonymous FTP servers use chroot() to limit the access of
anonymous FTP.  The /etc/passwd file it has access to is usually a minimal
version.

If you have a system that doesn't use chroot() for anonymous FTP, maybe it
has shadow passwords.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: comp.security.misc
From: syscrc@pickle.gsu.edu (Randy Carpenter)
Subject: Logging outgoing telnet(1) sessions.
Organization: Georgia State University
Date: Thu, 5 Nov 1992 22:30:34 GMT

Is it possible with standard BSD telnet(1) and syslogd(1m) to create
a log entry for outgoing telnet sessions.  I know that incoming login(1)
sessions can be logged but I'm interested in the other way.  Something
like a...

  Nov  5 17:24:42 pickle telnet[1234]: johnd executed "telnet 131.96.1.6".

This would be helpful while tracing intrusions.

I'm on a SGI (IRIX 4.0) which is System V based and the only way I know of
telling if another person has telneted out of the system is to dig around
in the accounting records which is cumbersome and still doesn't tell me
the outging host.  IRIX has a BSD-type telnet(1) and syslogd(1m).

-- 
===========================================================================
Randy Carpenter                    rcarpent@gsu.edu          % Got a light?
Georgia State University           (404) 651-2648            No match.
Wells Computer Center                                        %
Newsgroups: comp.security.misc
From: aharris@alfred.carleton.ca (Andrew Harris)
Subject: Comp crime
Keywords: security
Organization: Carleton University
Date: Wed, 11 Nov 1992 23:20:41 GMT

Book: Cyberpunk: Outlaws and Hackers on the computer frontier

      (1991)   Hafner, K. & Markoff, J.
               Simon and Schuster

               368 pages
               $23 Canadian

Andrew
From: mgream@acacia (Matthew Gream)
Newsgroups: comp.security.misc
Subject: Re: Setuid file
Date: 7 Nov 1992 06:17:01 GMT
Organization: University of Technology, Sydney
NNTP-Posting-Host: acacia.ccsd.uts.edu.au
X-Newsreader: Tin 1.1 PL5

Jon P. Knight (jon@hill.lut.ac.uk) wrote:

: But you'd need to be root to write to this file anyway...

Correct you are, I realised this not long after my post. Something on
that day occured that didnt have me thinking straight.  ho hum ..

: Still, if you don't know what it is, back it up and then delete it. 
: Better safe than sorry.

Yes, if you dont need it, remove it. But possibly it means someone 
was experimenting with the system, either not succeeding, or failing
to clean up his/her trash. Whatever case, it should be the cause of
some investigation (using its ctime for a start).

Matthew.
--
M.Gream@uts.EDU.AU - Matthew Gream - 'Edges have holes next to them .. '
Newsgroups: comp.security.misc
From: vanepp@fraser.sfu.ca (Peter Van Epp)
Subject: Re: Logging outgoing telnet(1) sessions.
Organization: Simon Fraser University, Burnaby, B.C., Canada
Date: Fri, 6 Nov 1992 16:25:00 GMT

syscrc@pickle.gsu.edu (Randy Carpenter) writes:

>Is it possible with standard BSD telnet(1) and syslogd(1m) to create
>a log entry for outgoing telnet sessions.  I know that incoming login(1)
>sessions can be logged but I'm interested in the other way.  Something
>like a...

>  Nov  5 17:24:42 pickle telnet[1234]: johnd executed "telnet 131.96.1.6".

>This would be helpful while tracing intrusions.

>I'm on a SGI (IRIX 4.0) which is System V based and the only way I know of
>telling if another person has telneted out of the system is to dig around
>in the accounting records which is cumbersome and still doesn't tell me
>the outging host.  IRIX has a BSD-type telnet(1) and syslogd(1m).

>-- 
>===========================================================================
>Randy Carpenter                    rcarpent@gsu.edu          % Got a light?
>Georgia State University           (404) 651-2648            No match.
>Wells Computer Center                                        %

Well, every 30 seconds, I have a perl script that wakes up and does an lsof
(the beta version of which happens to work on SGIs under 4.05), which gives
me all the open sockets on the machine, which it then runs into a filter
script that ignores (or doesn't ignore if I choose) local addresses and then
logs all external incoming and outgoing telnet connections to syslog. There
is a ps in the loop to get an idea of what is being done as well, and absolutly
no comments in the code which is pretty rough (I'm a perl novice). It is
not all that clean yet, and probably still has a bug or 10, but it would give
you a place to start. If you are interested send e-mail.

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada
Newsgroups: comp.security.misc
From: stehman%citron.cs.clemson.edu@hubcap.clemson.edu (Jeff Stehman)
Subject: Re: Two hackers caught tapping into Boeing, federal computers
Reply-To: stehman%citron.cs.clemson.edu@hubcap.clemson.edu
Organization: Clemson University
Date: Thu, 12 Nov 1992 14:22:51 GMT

From article <1992Nov12.084549.5128@unix.brighton.ac.uk>, by ddv@unix.brighton.ac.uk (Domenico De Vitto):
> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.


Would you like to require people to read c.s.m for a couple of months before
they're allowed to purchase a computer?

--
Jeff Stehman			Systems Staff, G-18A Jordan
stehman@cs.clemson.edu		Dept. of Computer Science
(803)656-2639			Clemson University
Newsgroups: comp.security.misc
From: syscrc@pickle.gsu.edu (Randy Carpenter)
Subject: Experiences with John Haugh's Shadow Suite
Organization: Georgia State University
Date: Fri, 13 Nov 1992 20:51:04 GMT

We are considering installing John Haugh's shadow password suite on our
Silicon Graphics systems because of all the grief we get from our users
about the proactive password program we installed.  We're looking for any
experiences you have had installing this package and whether it affected
other programs on your system (i.e. does getpwent(3) still work?).  
I'll post a summary if there is enough interest.

P.S. I wish vendors would hurry up and support shadow password files.

-- 
===========================================================================
Randy Carpenter                    rcarpent@gsu.edu          % Got a light?
Georgia State University           (404) 651-2648            No match.
Wells Computer Center                                        %
Newsgroups: comp.security.misc
From: cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi)
Subject: Re: Setuid file
Organization: Computer Science Dep. - Milan University
Date: Fri, 6 Nov 1992 09:44:21 GMT

jon@hill.lut.ac.uk (Jon P. Knight) writes:

>In article <1d9ggiINNsfb@sequoia.ccsd.uts.EDU.AU> mgream@acacia (Matthew Gream) writes:
>>Robert Earl (chupchup@ferkel.ucsb.edu) wrote:
>>: 
>>: |    Found this on one of our systems.  Anyone know if there is any way
>>: |    this could be used to obtain root access?
>>: |    -rwsr-xr-x  1 root            0 Apr  7  1992 file
>>: 
>>No one yet asked what OS this was, HP-UX doesnt clear the setuid-bit on
>>an append (at least It didnt in one of its installed versions ive seen),
>>so appending a shell script to make a setuid shell is a trivial job.
>>

>But you'd need to be root to write to this file anyway...

But you'd need to be root to CREATE this file anyway...

( If nobody created it then sorry, machine was cracked .. )

-- 
 -- Massimo Cotrozzi  Computer Science Dept. Milan Italy
            cotrozzi@ghost.dsi.unimi.it  +39-2-27201253
 #include     <std/disclaimer.h>
From: lwall@netlabs.com (Larry Wall)
Newsgroups: comp.security.misc
Subject: Re: Proactive password checkers
Date: 9 Nov 92 18:32:43 GMT
Organization: NetLabs, Inc.

In article <1992Nov6.202148.1587@cs.sandia.gov> wllarso@sandia.gov (William L Larson) writes:
: How long does it take to proactivly check passwords using npasswd,
: passwd+, or Larry Wall's passwd Perl script.  I would very much
: like to use this type of program, but I know I have very impatient
: users out there that will not stand for long waits.  Are we talking
: seconds or minutes for these programs to run using an "acceptable"
: password?

The overhead of the Perl passwd program is one to four seconds on a
Sparc 1, depending on such vagaries as whether the proposed password is
all alphanumeric or is longer than 8 characters.  (Of course, it's even
faster for the really obvious passwords like "qwerty" and "abcddcba"...  :-)

Most of that overhead is in looking for two-word combinations, by the
way.  That could be sped up at the expense of some disk space, but it
didn't seem worthwhile at the time.  Generally, by the time they've
read the comment "(Checking for lousy passwords...)" it has already
finished checking and issued the doleful news.

Larry Wall
lwall@netlabs.com
Newsgroups: comp.security.misc
From: thecure@mullian.ee.mu.OZ.AU (matthew aardvarkious)
Subject: Re: Setuid script - is this unsecure? (perl)
Organization: Computer Science, University of Melbourne, Australia
Date: Wed, 11 Nov 1992 09:47:28 GMT

jbotz@mtholyoke.edu (Jurgen Botz) writes:

>In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes:
>>If you want an suid programme write it in C (even if it does dumb things) and
>>don't use the system(3) and popen(3) functions because they call /bin/sh and
>>hance it's almost like writing a shell script.  I bet people can find some more
>>rules-of-thumb but these are the very basic ones you should follow.

>Or better yet, use Perl, which won't allow you to perform "unsafe" operations
>when running setuid.

2 points!
--
These are my personal views and do not reflect those of Melbourne University.
Anything I may say that may be deemed offensive and/or damaging should NOT
be redirected to administration, as they have had nothing to do with it. 
Please direct any/all complaints/enquiries to thecure@ee.mu.oz.au
From: wietse@wzv.win.tue.nl (Wietse Venema)
Newsgroups: comp.security.misc
Subject: Re: Setuid script - is this unsecure?
Date: 6 Nov 92 08:44:16 GMT
Organization: Eindhoven University of Technology, The Netherlands

rickt@bnr.co.uk (Rick Tait) writes:

>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).

I suggest that you read the FAQ which is posted at regular intervals,
and which can be ftp-ed from many sites (ask archie). 

A trivial hole:  the scripts do not set PATH, and /usr/etc/mount relies
on PATH to execute other commands. The non-trivial hole:  switching
files after the kernel has started a root shell, but before that shell
has opened the the shell script file. This, and more, is discussed in
the FAQ document.

The alternative: the MTOOLS package that does not require the mounting
of MS-DOS disks.

	Wietse
Newsgroups: comp.security.misc
From: ckd@eff.org (Christopher Davis)
Subject: Re: Window watching programs
Organization: Electronic Frontier Foundation Tech Central
	<CKD.92Nov4141022@loiosh.eff.org> <Bx90w2.L2u@cs.dal.ca>
Distribution: na
Date: Sat, 7 Nov 1992 00:00:43 GMT

Scott> == Scott King <gordon@ug.cs.dal.ca> 

 Scott> This seems that it would fix the problem on a Sun.  What about
 Scott> an HP.  In my original post, I neglected to mention that the
 Scott> machine that I was able to "watch" without even an account on
 Scott> the machine was an HP.  I am not to familiar with HP's so I'm
 Scott> not sure what is going on.  Does anyone have any insights that
 Scott> they could add to make this problem a little clearer?

It was probably xhost +'ed by default (i.e. access to the world).  I
don't know, I don't use HPs.

 Scott> On the Sun I found that you had to set xhost to be able to watch
 Scott> the screen.  The problem was that someone logged in to the
 Scott> machine from another one could set the DISPLAY environment
 Scott> variable to the machine they logged into, setup xhost and watch
 Scott> the display remotely using the window watching program.

 Scott> Does the suggestion that Mr. Davis presented above prevent users
 Scott> not logged in to the console from setting up xhost and their
 Scott> DISPLAY variable and then directing output to the console (or
 Scott> reading it)?

The answer is to use MIT-MAGIC-COOKIE-1 or something better.  xhost
access control can be changed from the "controlling host" (normally the
workstation running the X server).  If the "controlling host" is a
multiuser machine, by default X will allow all processes on that machine
to connect, and therefore any user can use xhost to change the access
list.  The entire xhost model of "security" is almost entirely useless,
since you can almost never trust an entire host (even barring DNS
spoofing attacks).

See Xsecurity(1) and xauth(1) (as well as fbtab(5) on Sun systems).
--
Christopher K. Davis      | ``Usenet seems to run much like the Kif (or,
<ckd@eff.org>   EFF #14   |   for the TV generation, Klingon) high command.
System Administrator, EFF |   Whoever takes action and can be heard wins.''
+1 617 864 0665  [CKD1]   |   --Peter da Silva <peter@ferranti.com>
From: shipley@merde.tcs.com (Pete Shipley)
Newsgroups: comp.security.misc
Subject: Re: Setuid script - is this unsecure?
Date: 6 Nov 92 09:05:15 GMT
Organization: Processed People for a Processed America

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk> rickt@bnr.co.uk (Rick Tait) writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).

instead of a shell script try this C program:

Note the the real way it to run "check -s" on the unix file system first
also an attack is still possible if you edit (adb) the raw device
after the floppy is mounted and create a specal device (eg: mem of kmem)



#include <stdio.h>

/*

Note: /etc/fstab should contain the following:

/dev/fd0   /pcfs       pcfs rw,noauto 0 0
/dev/fd0   /floppy  4.2 rw,noauto,nosuid 0 0
*/



static char by[] = "@(#) pcfs.c Pete Shipley [1991]\n";

static char *mount = "/usr/etc/mount";
static char *umount = "/usr/etc/umount";

static char *where = "/pcfs";
static char *what = "/dev/fd0";

static char *use ="Usage: %s [ -u | -d | -m ]\n\
\t-d\tmount MS-DOS diskette\n\
\t-m\tmount unix diskette\n\
\t-u\tunmount diskette\n";

extern int strncmp(), setuid(), perror(), fprintf(), getuid();
extern void execl();

int
main(ac, av)
char *av[];
int ac;
{
char *cp;
char  **cpp;
extern char **environ;

    if(ac != 2) goto error;


    for (cpp = environ; cp = *cpp; /* void */) {
        char  **xpp;

        if(strncmp(cp, "LD_", 3) == 0) {
            for (xpp = cpp; xpp[0] = xpp[1]; xpp++);
        } else {
            cpp++;
        }
    }


    /* not nessary
    if( setuid(getuid()) == -1) {
	(void) perror("setuid");
	exit(1);
    } */

    switch(av[1][1]) {
	case 'u':
	    execl(umount, umount, where, (char *)0);
	case 'd':
	    execl(mount, mount, "-t", "pcfs", what, where, (char *)0);
	case 'm':
	    execl(mount, mount, "-t", "4.2", "-o", "nosuid", what, where, (char *)0);
error:
	default:
	    (void) fprintf(stderr, use, av[0]);
	    exit(1);
    }
    exit(0);
}

-- 
---------------
Pete Shipley:
email: shipley@berkeley.edu             Flames:  cimarron@postgres.berkeley.edu
Spelling corections: /dev/null          Quote: "Anger is an energy"
From: vanzwol@bcstec.ca.boeing.com (Ted Van Zwol)
Newsgroups: comp.security.misc
Subject: Re: BAFFELED ??#@# !! CONFUSED !!#@@!!!!!
Date: 13 Nov 92 15:51:28 GMT
Organization: Boeing

>
>It's trivial, but we're not going to tell you how to do it.
>
OK, so if you won't say how to do it (possibly reasonable enough...).
Can you say how to prevent it?
Can you say how to detect it?
Is it truly that trivial and foolproof?  Or does it just make the header *look*
like it came from someone else (read root) to the non-attentive eye?

						-tcvz

-- 
Ted C Van Zwol                           |    Genius does what it must,
uucp:      {...!}uunet!bcstec!vanzwol    |    Talent does what it can.
internet:  vanzwol@bcstec.ca.boeing.com  |                  -Emerson
                         ^^^^ new...
Newsgroups: comp.security.misc
From: paulc@plume.mit.edu (Paul Cloke)
Subject: Re: Window watching programs
Organization: CMPO at MIT
Distribution: na
Date: Fri, 6 Nov 1992 15:43:18 GMT

It is interesting to note that the window watching program
I have a copy of does not work if you change your xterm to
run in "Secure Keyboard" mode (Press control and left mouse
in an xterm and select the top item). I always use this mode
when typing in passwords, although I'm not sure whether it could
be circumvented by a knowledgable hacker.

Paul Cloke
Newsgroups: comp.security.misc
Subject: Re: Two hackers caught tapping into Boeing, federal computers
From: ericd@gaudi.CSUFresno.EDU (Eric Douglas)
Date: 13 Nov 92 17:33:48 PST
Organization: CSU Fresno
X-Nntp-Posting-Host: gaudi.csufresno.edu
Originator: news@gaudi.CSUFresno.EDU

In article <6pq1n6h@rpi.edu> fitzgb@mml0.meche.rpi.edu (Brian Fitzgerald) writes:
[ brian's request deleted ... ]
>UPI writes:
>>
>>	SEATTLE (UPI) -- U.S. attorneys late Tuesday arrested and charged two
>>young men with ``hacking'' their way into computer systems operated by
>>Boeing, the U.S. District Court and the Environmental Protection Agency
>>offices in Seattle.
[ deletions ]
>>	``Once the system was accessed, Anderson copied the file containing
>>the passwords controlling access to the computer system,'' an affidavit
>>filed with the charges stated. ``He then transferred the password file
>>to a Boeing Company computer, where he decrypted the passwords.''
>>	That process gave Anderson the ``root'' password, which allowed him
>>to have unrestricted access to the computer system at the courthouse,
>>the affidavit said. Once inside, it said, ``the hackers were able to
[ rest of story deleted ]

I would certainly hope that by now system administrators would know better
than to pick words which appear in numerous dictionaries as their privledged
passwords.

--eric
* | Eric W. Douglas                                      +1 209 278 3923 | *
* | CalState Fresno Computer Services         eric_douglas@csufresno.edu | * 
* |                "if q -> p, and not p, then not q. NOT!"              | * 
Newsgroups: comp.security.misc,alt.security,comp.unix.admin