HDTenEightyP/NetNews huggingface dataset:
From: fitzgb@mml0.meche.rpi.edu (Brian Fitzgerald)
Subject: Re: Setuid script - is this unsecure?
Organization: Rensselaer Polytechnic Institute, Troy, NY
Date: Thu, 5 Nov 1992 14:59:37 GMT

Rick Tait writes:
>I recently installed these shell scripts on my machine (on which I am root),
>and I'd like to know if I'm compromising it's security. Basically, they
>just allow the users to mount/umount/eject the floppy disk (pcfs).
>
>#!/bin/sh --
..
>-rwSr-xr-x  1 root     staff         368 Oct 11 11:20 in*
>-rwSr-xr-x  1 root     staff          42 Oct 23 15:05 out*

Even though execute permission is denied for root, the link-race attack
succeeds, so yes, you are potentially giving away root.

There's a faq around that explains, or rtfm execve(2) about #!

Brian
From: op@holmes.acc.Virginia.EDU (Olaf  Pors)
Newsgroups: comp.security.misc
Subject: Re: Proactive password checkers
Date: 10 Nov 92 23:08:10 GMT
Article-I.D.: murdoch.1992Nov10.230810.19437
Organization: University of Virginia

In article <1992Nov6.202148.1587@cs.sandia.gov> wllarso@sandia.gov (William L Larson) writes:
>How long does it take to proactivly check passwords using npasswd,
>passwd+, or Larry Wall's passwd Perl script.  I would very much
>like to use this type of program, but I know I have very impatient
>users out there that will not stand for long waits.  Are we talking
>seconds or minutes for these programs to run using an "acceptable"
>password?

  We run a modified version of npasswd (modifications have
nothing to do with speed).  There is a barely perceptible
delay before a password is either accepted or rejected.

Olaf Pors
Academic Computing Center
University of Virginia
op@Virginia.EDU
Newsgroups: comp.security.misc
From: fitzgb@mml0.meche.rpi.edu (Brian Fitzgerald)
Subject: Re: Two hackers caught tapping into Boeing, federal computers
Organization: Rensselaer Polytechnic Institute, Troy, NY
Date: Thu, 12 Nov 1992 05:42:21 GMT

If anybody out there has any technical information about this, please
comment.  The UPI story uses the terms "root" which suggests that a
unix operating system may have been involved.

Does anybody know what operating systems were involved, and in general
terms, what methods were used to break in?

Brian

UPI writes:
>
>	SEATTLE (UPI) -- U.S. attorneys late Tuesday arrested and charged two
>young men with ``hacking'' their way into computer systems operated by
>Boeing, the U.S. District Court and the Environmental Protection Agency
>offices in Seattle.
>	Arrested were Charles M. Anderson, 19, a University of Washington
>student, and Costa George Katsaniotis, 21, of Seattle. Both were charged
>with fraud against the government, which carries a maximum penalty of a
>$10,000 fine and and five years in prison. The two were ordered to
>appear before a U.S. magistrate on Monday.
>	FBI Special Agent said espionage was not behind the unauthorized
>systems entries. Rather, he said, the two were motivated by the
>challenge or thrill factor involved, known among hackers as ``network
>navigating.''
>	A complaint filed in federal court charges that Anderrson and
>Katsaniotis gained access to the District Court computer by using a home
>computer to scan for telephone modem numbers. Modems are used to send
>data from one computer to another over telephone lines. 
>	``Once the system was accessed, Anderson copied the file containing
>the passwords controlling access to the computer system,'' an affidavit
>filed with the charges stated. ``He then transferred the password file
>to a Boeing Company computer, where he decrypted the passwords.''
>	That process gave Anderson the ``root'' password, which allowed him
>to have unrestricted access to the computer system at the courthouse,
>the affidavit said. Once inside, it said, ``the hackers were able to
>view numerous confidential records, including some grand jury material.''
>	Following the arrests, Boeing issued a statement saying it ``fully
>supports'' the FBI's investigation. Boeing alerted the FBI after the
>company determined someone had gained unauthorized access, then aided
>the investigation.
>	``Intrusion was limited due to effective security systems being in
>place, and no government-classified systems were entered,'' Boeing said.
>	Boeing also said that, based on its preliminary investigation, no
>company systems or data were damaged by the unauthorized access.
Newsgroups: comp.security.misc
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: NEED GENERAL INFORMATION ON WIRELESS LANS
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Fri, 6 Nov 1992 08:51:40 GMT

In article <WCS.92Nov5231548@rainier.ATT.COM>, wcs@anchor (Bill Stewart +1-908-949-0705) writes:
>If you want a product plug, AT&T / NCR's WaveLAN product uses
>spread-spectrum radio, which is hard to intercept and relatively
>tolerant of noise and other LANs in the same area,
>and offers an optional DES encryption chip (US only, I assume)

Just a comment about semantics .. it hardly makes sense to talk about
"US only" encryption devices, since it is the USA who has the export
and use restrictions (via export laws, software patents and apparently
by control of law in the future), not the rest of the world.  You
probably mean "not to be exported from USA", assuming you are talking
about U.S. companies.

There are several DES chip and device manufacturers in Europe who are
glad to sell and glad about increased sales due to the export
restrictions.

//Jyrki
Newsgroups: comp.security.misc
From: jbotz@mtholyoke.edu (Jurgen Botz)
Subject: Re: Two hackers caught tapping into Boeing, federal computers
Organization: Mount Holyoke College
Date: Fri, 13 Nov 1992 12:57:14 GMT

In article <1992Nov12.142251.9131@hubcap.clemson.edu> stehman%citron.cs.clemson.edu@hubcap.clemson.edu writes:
>From article <1992Nov12.084549.5128@unix.brighton.ac.uk>, by ddv@unix.brighton.ac.uk (Domenico De Vitto):
>> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
>
>Would you like to require people to read c.s.m for a couple of months before
>they're allowed to purchase a computer?

Now that's just rediculous... at our site there are maybe two or three
people who read c.s.m, but 90% of our (hundreds of) users know not to
use dictionary words for passwords on their /personal/ accounts, never
mind the root account.  And we're talking here about users who barely
know enough to get in and out of mail and wouldn't know Unix from Messy
Dogs.

And that's completely beside the point that somebody charged with the
responsibility for administering a multi-user computer system has a
responsibility to acquire at least some basic knowlege about security
issues.  There are dozens of good books on the subject, plus several
highly readable short summary documents available freely on the Net...
in short, the level of negligence in evidence here is inexcusable.

--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629
From: barnett@grymoire.crd.ge.com (Bruce Barnett)
Newsgroups: comp.security.misc
Subject: Secure Ware Phone Number wanted....
Date: 12 Nov 92 16:05:53 GMT
Reply-To: barnett@crdgw1.ge.com
Distribution: usa
Organization: GE Corp. R & D, Schenectady, NY

I need to call SecureWare concerning the MaxSix product.
I've searched for a phone number, but can't find anything.
Does anyone have the number?
Any comments on MAXSIX 2.0?

Thanks bunch....
--
Bruce Barnett <barnett@crd.ge.com> uunet!crdgw1!barnett
From: dave@eram.esi.COM.AU (Dave Horsfall)
Newsgroups: comp.security.misc
Subject: Re: Setuid file
Date: 12 Nov 92 04:10:26 GMT
Organization: Pacific ESI, Sydney, AUSTRALIA

In article <1992Nov5.090120.14723@lut.ac.uk>,
    jon@hill.lut.ac.uk (Jon P. Knight) writes:

| >: |    -rwsr-xr-x  1 root            0 Apr  7  1992 file
| 
| Still, if you don't know what it is, back it up and then delete it. 

Why back up an empty file?  Just write it down somewhere :-)

-- 
Dave Horsfall (VK2KFU)         VK2KFU @ VK2RWI.NSW.AUS.OC
dave@esi.COM.AU                ...munnari!esi.COM.AU!dave
           Disclaimer: "Me, speak for us?"
Newsgroups: comp.security.misc
From: ashley@citr.uq.oz.au (Ashley Beitz)
Subject: Distributed Systems Technology Research Position
Summary: Research Scientist Position for investigating encryption
Keywords: security distributed systems cryptology
Organization: Prentice Centre, University of Queensland
Date: Fri, 6 Nov 1992 06:07:02 GMT



                       Cooperative Research Centre for 

                        Distributed Systems Technology

                              Brisbane, Australia


                 trading as DSTC Pty Ltd, A.C.N. 052 372 577


----------------------------------------------------------------------------
                               RESEARCH SCIENTIST
----------------------------------------------------------------------------


The Cooperative Research Centre for Distributed Systems Technology has 
been established under an Australian Government programme with initial 
Government and industry funding of $A54 million over 7 years.  It will 
develop technologies that will form infrastructure for global 
distributed information systems and services.  


The Position:

The person employed in this position will be investigating the 
application of encryption for distributed and open systems.  You will be 
responsible for investigating the possible usage of encryption in 
distributed and open systems, determining the required algorithms, and 
designing appropriate protocols for the secure and efficient usage of 
these algorithms.  The research will be conducted as part of a team in 
the Management, Security and Performance Unit of the CRC for Distributed 
Systems Technology's site at the Queensland University of Technology.
Applicants should have a PhD with a strong background in cryptology, 
extensive programming experience and an interest in applying information 
security techniques to distributed systems.  Development or industrial 
experience is advantageous.


Terms:

The appointment will be for a initial period of 3 years, commencing in 
early 1993.  Salary: $A40,000 - $A50,000 per annum.  For further 
information, contact Assoc. Prof. Ed Dawson, Ph: +61(7)864.1937, Fax: 
+61(7)221.2384, Internet: e.dawson@qut.edu.au.

Written applications should include names, addresses and fax numbers for 
2 referees and should be addressed to Rob Cook, CEO, DSTC Pty Ltd, The 
University of Queensland, Queensland, 4072, Australia,
Fax: +61(7)365 4399.  Applications close on 4th December, 1992.
----------------------------------------------------------------------------
--
Ashley Beitz		  | CiTR			|ashley@citr.uq.oz.au
                          | University of Queensland	|voice: +61 7 365 4309
			  | St Lucia, Queensland 4072	|fax:   +61 7 365 4399
			  | Australia			|
From: murakami@hac2arpa.hac.com (Gary A. Murakami)
Newsgroups: comp.security.misc
Subject: Write protecting IDE drive
Date: 11 Nov 92 18:30:56 GMT
Organization: Hughes Training Inc.

A colleague of mine remembers reading that it was possible to write
protect an IDE hard disk by writing a value to one of the controller
registers.   This disables writes to the disk and the mode can only
be undone by booting or power cycling the computer.  Anyone have a
reference or know of where I can find information on this technique?

----
Gary Murakami       |  murakami@hac2arpa.hac.com
Hughes Training Inc.|  murky@hti.hac.com
West Covina, Calif. |
Newsgroups: comp.security.misc
From: rwhelan@gmuvax2.gmu.edu (Ryan A. Whelan)
Subject: Re: Setuid file
Organization: George Mason University, Fairfax, Va.
Date: Mon, 9 Nov 1992 07:30:26 GMT

In article <1992Nov3.211052.11569@ulysses.att.com> smb@ulysses.att.com (Steven Bellovin) writes:
>I've never heard of shells themselves running setuid, and I hope I never
                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

>do...  Ksh uses a setuid root intermediate program to implement setuid
>shell scripts on systems where the kernel doesn't do it.  It uses
>open file descriptors, rather than names, and so should be immune
>to the usual hack.
>
>So -- I don't know of any problems with that file.  But I confess that
>it makes me extremely nervous -- I just have a very bad feeling about it...


really? Never?


-- 
Ryan A. Whelan                      "Repetition does not establish validity."
rwhelan@gmuvax2.gmu.edu                                         - Souder's Law
Newsgroups: comp.security.misc
From: aclark@netcom.com (Al Clark)
Subject: Re: BAFFELED ??#@# !! CONFUSED !!#@@!!!!!
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Sat, 14 Nov 1992 01:29:59 GMT

In article <1992Nov13.091926.29460@unix.brighton.ac.uk> ddv@unix.brighton.ac.uk (Domenico De Vitto) writes:
>What does FTFRFC mean ??????
>
>Semi-seasoned unix guru is puzzled ?
>
>Dom

It was "RTFRFC".  Hint; consider RTFM.
-- 
Al - aclark@netcom.com - My opinions are my own.
Newsgroups: comp.security.misc
From: wllarso@sandia.gov (William L Larson)
Subject: npasswd/passwd+ Configuration Question
Organization: Sandia National Laboratories
Date: Fri, 6 Nov 92 20:54:26 GMT

In the npasswd/passwd+ configuration files, it is possible to compare a
password to be confirmed with the output of a program (ie., checking for
inclusion in a dictionary).  Is it possible to perform some editing of
the password under test prior to comparing it to the output of a
program?

My particular question is about checking for passwords of the form:

	[DIGITS] WORD [DIGITS]

I would like to disallow any password which is composed of a dictionary
word preceeded by (or followed by) digits.  
Newsgroups: comp.security.misc
From: dkanarek@nyx.cs.du.edu (Damian Kanarek)
Subject: need info on Morris'es Internet worm
Organization: Nyx, Public Access Unix @ U. of Denver Math/CS dept.
Distribution: na
Date: Tue, 10 Nov 92 06:03:27 GMT

 Hiya all,

 I'm trying to get more info on the whole affair.  Is there an ftp site
where I could get a copy of Cornell's report on this incident, and
maybe some more details on how the worm worked? Really, now - this is
a serious request; I have to fill 20 pages with this stuff :)
Thanks in advance,

Damian
--
Damian R. Kanarek                      |"I am an insomniac-agnostic-egotist:
Faculty of Libr. & Information Science | I lie awake nights trying to figure
University of Toronto                  | out whether or not I believe that I'm
email -> kanarek@flis.toronto.edu      | as great as I am."   - Frank

Newsgroups: comp.security.misc
From: jaegerwl@craft.camp.clarkson.edu (Bill Jaeger)
Subject: Re: need info on Morris'es Internet worm
Organization: Clarkson University
Distribution: na
Date: Tue, 10 Nov 1992 19:26:26 GMT

dkanarek@nyx.cs.du.edu (Damian Kanarek) writes:

> I'm trying to get more info on the whole affair.  Is there an ftp site
>where I could get a copy of Cornell's report on this incident, and
>maybe some more details on how the worm worked? Really, now - this is
>a serious request; I have to fill 20 pages with this stuff :)
>Thanks in advance,

You might want to check out two books that have been around for a while.  One
of them is "The Cukoos Egg" by Clifford Stall.  While most of this book deals
with his chasing after a hacker, towards the end of the book is a section that
deals with RTM and his worm.  The is related from the standpoint of Cliff's
involvement with combating the worm, as I recall.

Another book that's out is called "Cyberpunk" (I don't remember the subtitle).
This book has recounts of 4 or 5 hacker stories.  One of them deals with RTM,
and as I recall that section is called "RTM"!

Even if these books don't have specifically what you're looking for, they make
good reading.

If you find out about any other books on the hacking/cracking/RTM subject, I'd
be interested in finding out.

					Hope this helps,
					-Bill


------------------------------------------------------------------------------
-Bill Jaeger
 jaegerwl@logic.camp.clarkson.edu	Clarkson University, Potsdam New York

 "Only by attempting the absurd can we achieve the impossible"
					- Pyro to The Illuminator, 1990
------------------------------------------------------------------------------
Newsgroups: comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Setuid file
Date: 9 Nov 92 18:14:37 GMT

jon@hill.lut.ac.uk (Jon P. Knight) writes:
>>: |    -rwsr-xr-x  1 root            0 Apr  7  1992 file
                                       ^
>
>Still, if you don't know what it is, back it up and then delete it. 
                                      ^^^^^^^^^^

(chuckle) he already has backed it up, an infinite number of times
Newsgroups: comp.security.misc
From: syscrc@pickle.gsu.edu (Randy Carpenter)
Subject: Re: Proactive password checkers
Organization: Georgia State University
Date: Sat, 7 Nov 1992 17:28:19 GMT

barmar@think.com (Barry Margolin) writes:

>In article <1992Nov6.202148.1587@cs.sandia.gov> wllarso@sandia.gov (William L Larson) writes:
>>How long does it take to proactivly check passwords using npasswd,
>>passwd+, or Larry Wall's passwd Perl script.
>
>We use npasswd and the overhead is imperceptible on a Sparcstation.
>-- 
>Barry Margolin
>System Manager, Thinking Machines Corp.
>
>barmar@think.com          {uunet,harvard}!think!barmar

We use the ndbm(1) feature of both passwd+ and npasswd with SGI's IRIX 4.0  
and have favorable performance.

-- 
===========================================================================
Randy Carpenter                    rcarpent@gsu.edu          % Got a light?
Georgia State University           (404) 651-2648            No match.
Wells Computer Center                                        %
Newsgroups: comp.security.misc
From: vhc@abacus.hgs.se (Mikael Larsson)
Subject: Passwd programs!
Organization: Solace Computer Club, Sundsvall, Sweden
Date: Mon, 9 Nov 1992 02:41:47 GMT


I've heard about different passwprograms like npasswd and passwd+
but haven't been able to find them. Someone wanna help me, and
tell me where to look? :-)

						Rgds,

						MiL


Newsgroups: comp.security.misc
From: peter@ferranti.com (peter da silva)
Subject: Re: Forging E-mail from root to get users to change passwords
Organization: Xenix Support, FICC
Date: Fri, 6 Nov 1992 22:14:48 GMT

In article <ratner.720811773@ficus.cs.ucla.edu> ratner@ficus.cs.ucla.edu (Dave "Van Damme" Ratner) writes:
> Yes, it is true that root never needs to know a user's password ---
> root can always su to the user without knowing the password.

Not if root is trying to debug a problem in login or rlogin where the user's
password is entered. I had one case where a user's password included a pound
sign... which worked fine on the Suns but he couldn't login on Xenix for some
reason.

Generally I get the *user* to type in his password in cases like this, and
make a point of not watching. If I  ask the user his password it's always in
person and I tell them to change it immediately.

This sort of social engineering attack is hard to foil in the general case.
See alt.shenanigans for more ideas... :->
-- 
% Peter da Silva % 77487-5012 % +1 713 274 5180 %
true(<<VV$@\\$'&O 9$O%'$LT$&$"V6"$&$<4$?'&$ #I&&?$=$<<@)24 24 scale 3 21 moveto
{dup 36 eq{pop not}{dup 7 and 4 sub exch 56 and 8 div 4 sub 2 index{rlineto}{
rmoveto}ifelse}ifelse}forall stroke pop showpage % Har du kramat din varg idag?
Newsgroups: comp.security.misc
From: newsham@wiliki.eng.hawaii.edu (Timothy Newsham)
Subject: Re: Setuid file
Summary: Expires: 
Organization: University of Engineering, College of Engineering
Date: Sat, 7 Nov 1992 20:39:23 GMT

>>Robert Earl (chupchup@ferkel.ucsb.edu) wrote:
>>: 
>>: |    Found this on one of our systems.  Anyone know if there is any way
>>: |    this could be used to obtain root access?
>>: |    -rwsr-xr-x  1 root            0 Apr  7  1992 file
>>: 
>
>Still, if you don't know what it is, back it up and then delete it. 
>Better safe than sorry.
>
>Jon

I just made an empty file with +x perms and typed in its
name at the shell prompt.  It apparently tried to execute it
and for some reason sourced my .cshrc.  This is on an older
HPUX system.  I didnt however set it suid since I am a non-priveledged
user so I cant tell you if it would work as suid.  (I think i
remember that hpux wouldnt run shell scripts with out the '#!' in
them as suid, maybe just a local patch?)
From: misar@rbg.informatik.th-darmstadt.de (walter misar)
Newsgroups: comp.security.misc
Subject: Re: Setuid script - is this unsecure?
Date: 5 Nov 92 20:46:01 GMT
Organization: TU Darmstadt

In article <1d6fdiINNf5q@bnsgd245.bnr.co.uk>, rickt@bnr.co.uk (Rick Tait) writes:
> I recently installed these shell scripts on my machine (on which I am root),
> and I'd like to know if I'm compromising it's security. Basically, they
> just allow the users to mount/umount/eject the floppy disk (pcfs).
> 
> In: (mount script)
> 
> #!/bin/sh --
> if ( test ${#} -eq 0 ) then
>     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
>     else
>        if ( test ${1} = "ro" ) then
>          /usr/etc/mount -t pcfs -o ro /dev/fd0 /pcfs
>        else
>          if ( test ${1} = "rw" ) then
>            /usr/etc/mount -t pcfs /dev/fd0 /pcfs
>          else
>            echo Invalid argument -- not mounted
>          fi
>        fi
> fi
> 
> Out: (unmount/eject script)
> #!/bin/sh -- 
> /usr/etc/umount /pcfs
> eject
> 
> So do these make my system insecure? How? How the hell would a user
> turn these simple scripts over into something to compromise my IPX?

I don't think there will ever be a secure setuid shellscript:

Despite the fact  #!/bin/sh -- is much more better than #!/bin/sh
there are at least to holes in the script: 
First eject has no PATH so a user could write a malicious shellscript
with name /tmp/eject, cd to /tmp and set PATH to . :his shellscript will
then run under root.
Second you can fool /bin/sh to take every / as an blank and do the trick
above even if all cmds are preceeded by their full path.

Moral: don't use setuis shellscripts - write it in C or pearl instead.

Walter
Newsgroups: comp.security.misc
Subject: Re: Setuid script - is this unsecure?
From: amoss@shuldig.cs.huji.ac.il (Amos Shapira)
Date: 6 Nov 92 10:25:49
Organization: Inst. of Comp. Sci., Hebrew University, Jerusalem, Israel
NNTP-Posting-Host: shuldig.cs.huji.ac.il
In-reply-to: paf@cyklop.nada.kth.se's message of 5 Nov 92 07:13:54 GMT

In article <1992Nov5.071354.24042@kth.se> paf@cyklop.nada.kth.se (Patrik Fltstrm) writes:

   chiner@nova.gmi.edu writes:
   >(Rick Tait) writes:
   >: I recently installed these shell scripts on my machine (on which I am root),
   >: and I'd like to know if I'm compromising it's security. Basically, they
   >: just allow the users to mount/umount/eject the floppy disk (pcfs).
   >
   >:     /usr/etc/mount -t pcfs /dev/fd0 /pcfs
   >                            ^-o nosuid
   >:
   >and some other problems...  I'll point out, that all the mount commands
   >need a -o nosuid...  otherwise, anyone who can get a root shell on a disk,
   >can get root on your system...

I didn't see the entire thread from the beginning, but it seems to me you are
all missing the main problem with suid shell scripts, which is the bug in the
shell itself and the flexibility it offers with environment variables.

I can become root on your system using your /bin/sh script without even having
to know what it does or what programmes it calls.

suid shell script is a no-no. period.

If you want an suid programme write it in C (even if it does dumb things) and
don't use the system(3) and popen(3) functions because they call /bin/sh and
hance it's almost like writing a shell script.  I bet people can find some more
rules-of-thumb but these are the very basic ones you should follow.

A general suggestion for a programme which will do what you want would be:

main (ac, av)
	int ac;
	char **av;
{
	exec ("/usr/etc/mount", av);
}

and have the object of this C programme suid root.

Hope this helps,
--
--Amos Shapira (Jumper Extraordinaire)
C.S. System Group, Hebrew University, Jerusalem, Israel
amoss@cs.huji.ac.il