HDTenEightyP/NetNews huggingface dataset:
From: dave@jato.jpl.nasa.gov (Dave Hayes)
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
Subject: Re: Problem with npasswd??
Date: 27 Jul 92 20:17:12 GMT
Reply-To: dave@jato.jpl.nasa.gov
Organization: Jet Propulsion Lab - Pasadena, CA

hubcap@hubcap.clemson.edu (System Janitor) writes:
>The point is, even if you use npasswd, a cracker will still get some of
>your passwords. So what if they only get 10 instead of 200, they'll still
>have some userids from which to launch their nefarious plans.
>So, aren't you fooling yourself to think that npasswd like schemes 
>enhance your system security enough to make them worthwhile? 

This is a hard statement to agree with, given that it is only a matter 
of time before someone puts crack-like word scanning in npasswd. 

Keep in mind that scanning plaintext matches is far faster than scanning 
crypted ones.

-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

    If it works...use it. If it doesn't, find out why and use THAT. 
Newsgroups: comp.security.misc
From: dave@jato.jpl.nasa.gov (Dave Hayes)
Subject: Re: unhappy about overloading finger
Reply-To: dave@jato.jpl.nasa.gov
Organization: Jet Propulsion Lab - Pasadena, CA
Date: Tue, 21 Jul 1992 21:07:40 GMT

spaf@cs.purdue.EDU (Gene Spafford) writes:

>Finger can be replaced with something else, say, a simple Perl script.
>You might have something that prints out an appropriate message and
>then exits.  This means you can keep from printing user .plan files,
>thus cutting down on their attempts to use it as a "billboard".

What's wrong with this? Why is this bad?
-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

Better the demon that makes you improve than the angel who threatens.
From: pkershaw@dce.com (Peter Kershaw)
Newsgroups: comp.security.misc
Subject: Encryption Software-Mac/PC/UNIX
Date: 27 Jul 92 17:46:08 GMT
Followup-To: comp.security.misc
Organization: DCE

I posted a request recently, and later realized there were probably a bunch
of angry people with bounced e-mail, trying to answer my question. Oops, I
misspelled my e-mail address! What a dunderhead! Sorry.

I did get two responses, but not what I was looking for. Source code does
me no good right now. We don't have the time to deal with it. I'm looking
for applications, whether freeware, shareware, buyware, makes no
difference.

To reiterate: "Does anyone know of a multi-platform encryption package(s),
for Mac, PC, and UNIX, that have user definable keys? We would like to post
files to public
servers, for retrieval by our clients, without the risk of their being
decyphered. Recommendations appreciated."

Multi-platform was a bad choice of words. What we need are individual
packages that will run on Mac, PC, and UNIX, and function compatibly. DES
encryption would be fine, preferably with X.913 user definable or
psuedo-random keys. The requirement needs to support both ASCII and binary
files.

Peter Kershaw <pkershaw@dce.com>
Data Communication Engineering
2888 Bluff Street, Suite 161
Boulder, CO 80301
303-431-2233, 303-431-1140 fax, 303-829-5952 mobile
From: vulture@carrion.cc.ic.ac.uk (Thomas Sippel - Dau)
Newsgroups: comp.security.misc
Subject: Re: root-owned world-writable files
Date: 23 Jul 92 16:52:25 GMT
Reply-To: cmaae47@cc.ic.ac.uk
Organization: Imperial College of Science, Technology and Medicine

In article <14htt0INNiep@hilbert.math.ksu.edu>, tar@math.ksu.edu (Tim Ramsey) writes:
 -- How do you get a complete list of files that are trusted by root, or by
 -- programs that root trusts (that is, are setuid root)?
 -- 
 -- Much easier to simply not have world-writable files owned by root.

So does that mean we should cease to make /tmp world-writeable ? 
It certainly would induce people to stick closer to POSIX :-)

Otherwise, I disagree, world writeable files are not a security problem,
inappropriate use of information in files is the problem. It is also a
problem that people try to deduce the contents of files from the file names.
Unfortunately this is very deeply embedded in unix, or rather in the 
common usage that is made of unix facilities.

I seems however that the management problem that the use of filename 
'constants' (like /etc/passwd for the password file) gives people will
be felt before the security problem.

                                        Thomas

-- 
*** This is the operative statement, all previous statements are inoperative.
*   email: cmaae47 @ cc.ic.ac.uk (Thomas Sippel - Dau) (uk.ac.ic.cc on Janet)
*   voice: +44 715 895 111 x4937 or 4934 (day), or +44 718 239 497 (fax)
*   snail: Imperial College Center for Computing Services, Kensington SW7 2BX
Newsgroups: comp.security.misc
From: kd1hz@anomaly.sbs.risc.net (Michael P. Deignan (KD1HZ))
Subject: Re: Pleasure.com mystery solved.
Organization: The Rhode Island Internet Systems Cooperative Network
Date: Wed, 29 Jul 1992 21:58:24 GMT

atkinson@itd.nrl.navy.mil (Randall Atkinson) writes:

>  The DDn Network Information Center is the ONLY official organisation
>that can grant or delegate responsibility for domain names.

Do you have the law which deligates them this authority?

No? I thought so.

The NIC is a clearinghouse, which is generally accepted amoung sites to be
"the center" for registering a domain. There is no force-of-law behind this,
however.
 
>  The site "pleasure.com" was required to obtain a valid domain name
>(from the DDN NIC since *.com is not delegated) and did not do so.

Obtaining the "internet-number" template from the NIC, which is used to
request a network address assignment, contains no question for you to
indicate the domain name of an IP address you are registering. Therefore,
one can surmise that it is entirely legitimate to obtain an IP address
without a domain name.

MD
-- 
--  Dr. Michael P. Deignan (deg.pend.)      /   "Its okay dear,
--  Domain: kd1hz@anomaly.sbs.risc.net     /     you can show me...
--    UUCP: ..!uunet!anomaly!kd1hz        /      I'm a Doctor..."
Newsgroups: comp.security.misc
From: schwartz@roke.cs.psu.edu (Scott Schwartz)
Subject: Re: unhappy about overloading finger
Date: Wed, 22 Jul 1992 04:05:49 GMT

ggm@brolga.cc.uq.oz.au (George Michaelson) writes:
   To cover ourselves, we are increasingly using callback checks to
   have trace on who fingers us.

As long as you trust the other machine to tell you anything, why not
require that they use RFC 931 style authentication?
From: nelson@reed.edu (Nelson Minar)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 23 Jul 92 05:18:21 GMT
Organization: Reed College, Portland, OR

In article <dank.711867106@blacks.jpl.nasa.gov> dank@blacks.jpl.nasa.gov (Dan Kegel) writes:
>nelson@reed.edu (Nelson Minar) writes:
>>A far more common way for accounts to be cracked is for someone to
>>steal your YP password file 
>With Sun's latest patches, YP is supposed to be fairly secure;
>nobody can get your passwd map that you don't want to.

Did Sun provide patches for my Ultrix machines, my Dynix boxes, and my
stupid NeXT machines? How about patches to the bugs that probably
exist in NeXT's netinfo? And how about patches to the other devious
ways people can think to coerce password files out of YP?

I think it's safer to assume your password file is world readable.
-- 
                __
nelson@reed.edu \/                                            Love under will
From: reuter@venice.sedd.trw.com (Joseph Reuter)
Newsgroups: comp.security.misc
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Date: 28 Jul 92 14:52:10 GMT
Organization: TRW Systems Engineering & Development Division, Carson, CA

It appears that most of this discussion centers on the effect of X-rays on
magnetic media.  What about the *magnetic* environment around an airport
X-ray machine?  When I went to school (admittedly, a long time ago), X-rays
were generated by a high-current electron beam striking a metal target.
Airport X-ray machines appear to limit the X-ray exposure by limiting its
duration, which would involve switching this high-current electron beam on
and off.  I wonder what this *magnetic* pulse would do to a disk if the
*magnetic* shielding of the X-ray machine were inadequate or compromised?

Just because you're paranoid doesn't mean they're not out to get you!

-- 
Joseph A. Reuter, Wizard-in-Training
Speaking for myself from reuter@venice.sedd.trw.com
From: evansmp@uhura.aston.ac.uk (Mark Evans)
Newsgroups: comp.security.misc
Subject: Re: root-owned world-writable files
Date: 23 Jul 92 18:46:38 GMT
Organization: Aston University

jon_care@hicom.lut.ac.uk writes:
: An exception occurs to me in the case of /etc/utmp under SunOS 4.1.1 - the mode
: this is set to by default is 666, hence it is world writeable.
: If you reedit this with a simple C Program, you can make yourself invisible to
: who commands etc. and also can evade certain accounting programs.
Also programs running in windows don't exit correctly then utmp is not tidyed
up, resulting in people appearing to still be on.
Also it makes it possible to completly fake who is actually using the machine
running finger to check who is on a SunOS machine is a complete waste of time.
: 
-- 
-------------------------------------------------------------------------
Mark Evans                                   |evansmp@uhura.aston.ac.uk
+(44) 21 565 1979 (Home)                     |evansmp@cs.aston.ac.uk
+(44) 21 359 6531 x4039 (Office)             |
From: valdis@vttcf.cc.vt.edu (Valdis Kletnieks)
Newsgroups: comp.security.misc
Subject: Re: Re: root-owned world-writable files
Date: 23 Jul 92 02:49:35 GMT
Organization: Virginia Tech, Blacksburg, VA

In article <61350001@otter.hpl.hp.com> sjmz@otter.hpl.hp.com (Stefek Zaba) writes:
>In comp.security.misc, jfowler@beta.lanl.gov (John C. Fowler) writes that
>world-writeable root-owned files are only a problem if root trusts the
>file contents.  This is false: sometimes an attack requirtes a root-owned
>file to succeed, and by linking (hard or symbolic) to the carelessly-left
>file, this attack will succeed.
>
>For example: a wannabe sysadmin leaves their home directory world-writeable.
>This allows the attacker to plant a .rhosts file which will allow them in.
Stefek:

I think you took a slight left turn while following John's logic.
Remember that in order to trust the .rhosts, there is an *implicit*
assumption that the *home directory* can itself be trusted.

If the system hadn't trusted that the home directory contain an
non-subverted .rhosts, the attack would have failed.  As John Fowler
said - it's only a problem if root trusts the file contents.

Does anybody have a good reference to Dennis Ritchie's analysis of the
Unix protection scheme, where he mathematically proved it secure modulo
the set-UID/GID bit?  Damned if I can remember the Bell Systems Tech
Journal that it appeared in tho.. ;)

				Valdis Kletnieks
				Computer Systems Engineer
				Virginia Tech
Newsgroups: comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: root-owned world-writable files
Date: 23 Jul 92 15:47:17 GMT

sjmz@otter.hpl.hp.com (Stefek Zaba) writes:
>For example: a wannabe sysadmin leaves their home directory world-writeable.
>This allows the attacker to plant a .rhosts file which will allow them in.
>However, the authentication mechanism requires that .rhosts be owned by
>the user.  If you find a world-writeable root-owned file on the same volume,
>you can now ln it to /root/wannabe/.rhosts...

hmmm... ok then, I think my argument may only apply to filesystems on which
you can chown files away.  On a SysV filesystem, you could just create that
/.rhosts file and then chown it to root anyway.

But anyway, it's an extremely serious security hole to have "/" be world-
writable.  The /.rhosts problem is a negligible portion of this problem.
Just rename /etc and the system will let you login to root without asking
for a password anyway.
From: atkinson@itd.nrl.navy.mil (Randall Atkinson)
Newsgroups: comp.security.misc
Subject: Re: Pleasure.com mystery solved.
Date: 29 Jul 92 12:27:40 GMT
Organization: Naval Research Laboratory, DC

To clarify:

  The DDn Network Information Center is the ONLY official organisation
that can grant or delegate responsibility for domain names.  They are
authoritative for both commercial and non-commercial sites.  All sites
MUST have a valid registered domain name, not just a valid IP number.
In the case of non-US country-oriented domains, the DDN NIC has
delegated authority for that domain to an organisation in that
country.  All members of the Commercial Internet Xchange (CIX)
recognise the authority of the DDN Network Information Center in this
regard.  Claiming commercial sites don't have to register there is
untrue.

  The site "pleasure.com" was required to obtain a valid domain name
(from the DDN NIC since *.com is not delegated) and did not do so.
This is at best uncivilised behaviour by the folks who ran that site.

Ran
atkinson@itd.nrl.navy.mil
From: nelson@reed.edu (Nelson Minar)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 23 Jul 92 03:20:58 GMT
Article-I.D.: reed.1992Jul23.032058.3292
Organization: Reed College, Portland, OR

In article <199207230140.AA18677@fnord.wang.com> fitz@wang.com (Tom Fitzgerald	) writes:
>The advantages of finger to crackers is it lets them find login names,
>identify accounts that haven't been used for a while, and get the human
>name for the account so they can try looking up spousal names and such in
>the phone book, as potential passwords.

I think the "spousal name" thing is apocryphal, at least in the case
of UNIX machines on the Internet. It looked great on Wargames, and it
might work for your friend Joe, but if I'm hacking blegga.cac.washington.edu 
I'm not going to go to a Seattle phonebook.

A far more common way for accounts to be cracked is for someone to
steal your YP password file (not too hard to do if you're running yp
and are on the internet) and run a fine cracking tool like Crack 4.1
with a fast crypt().

How do you, as a sysadmin, prevent this? Crack your password file
yourself. Don't let users have crackable passwords. 

If you want to be butch try to fix yp, or use a shadow scheme that
works. That's a lot of trouble, and the best you'll probably do is
security through obscurity.

>I'm wondering what to do about the person who ran "finger
>\*@das.wang.com" from an outside site today.  Anybody know if there
>are finger daemons that screw up on user "*"?

Dunno, but Ultrix finger joyfully screws up on user "@". Try "finger
@@some.ultrix.machine.army.mil" - it's quite fun.
-- 
                __
nelson@reed.edu \/       Before the cream sits out too long, you must whip it
Newsgroups: comp.security.misc
From: coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size)
Subject: Re: unhappy about overloading finger
Organisation: Employed by (*NOT* speaker for) DEC, Boxborough, MA, U.S.A.
Organization: Digital Equipment Corp.
Distribution: comp
Date: Fri, 24 Jul 1992 11:03:39 GMT


>From article <1992Jul23.032058.3292@reed.edu>, by nelson@reed.edu (Nelson Minar):
> 
>> Dunno, but Ultrix finger joyfully screws up on user "@". Try "finger
>> @@some.ultrix.machine.army.mil" - it's quite fun.
> 
>Only if you use DEC's old, ancient, decrepit, (oh, and BROKEN) finger. 
>(It's a real "neat" screwup, too! :-) )  Seems like most DEC sites don't
>even use their own software anymore.  Interesting.

    So what's supposed to happen?  I'm running a system with standard ULTRIX
    (other than modified FTP), and all this does is a full finger of the
    passwd file of the remote system.  Is that the screwup?  What should it do
    instead?

    #ken    :-)}	Jeratol the Chaotic

Coar@Nephi.Enet.DEC.Com	 | All opinions herein contained, stated or implied,
Coar@DECUS.Org		 | are solely those of the author.  And he's fullovem.
Coar@Eisner.DECUS.Org	 | `... it was mine art, ... that made gape the pine 
Massachusetts, USA       | and let thee out.'  - Prospero (_The Tempest_)
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Newsgroups: comp.security.misc
Subject: Re: Keeping track of a lot of passwords
Date: 22 Jul 1992 14:45:26 GMT
Organization: Fachschaft Informatik, Uni Karlsruhe
Distribution: world
NNTP-Posting-Host: irav1.ira.uka.de
X-News-Reader: VMS NEWS 1.23

In <62453@cup.portal.com> ts@cup.portal.com writes:
[...]
>  How do you keep track of all these passwords?  Using the same password
>  all over the place is dangerous, but how can you remember several dozen
>  or more passwords, especially if the systems enforce restrictions on
>  the passwords?
[...]
>  --Tim Smith

I know a guy who writes down all of his numerous passwords in his
notebook, in plaintext. The catch: he does so in Japanese letters,
assuming that hardly anyone (here in Germany) knows how to read them.

Security analysis is left to the reader ;-)

MfG,
        Olaf
--
                                                             o
 Olaf Titz           \    s_titz@iravcl.ira.uka.de \        _/\
                      \   uknf@dkauni2.bitnet       \      _//|_.
y.a. comp.sc.student   \  +49-721-60439@voice        \    (_)`(_) 
Uni Karlsruhe, Germany  \ praetoriu@irc               \~~~~~~~~~~~~~
BUGS: As given by the -roaches option. Default is 10. - man xroach
Xref: sparky comp.security.misc:879 alt.security:4063 comp.dcom.lans.misc:615
From: slf@netcom.com (Sharon Fisher)
Newsgroups: comp.security.misc,comp.dcom.lans.novell,alt.security,comp.dcom.lans.misc
Subject: Looking for recent LAN security announcements
Date: 31 Jul 92 20:08:03 GMT
Followup-To: comp.dcom.lans
Distribution: na
Organization: Netcom - Online Communication Services  (408 241-9760 guest)


I'm doing a story for Communications Week about security products for
LANs that have been announced within the past six months or so --
let's say anytime in 1992.  If you are a vendor of such a product,
please send me email to slf@netcom.netcom.com or call me at (415)
864-5987.  Thanks!
Newsgroups: comp.security.misc
From: jgd@csd4.csd.uwm.edu (John G Dobnick)
Subject: Re: System "pleasure.com"
Originator: jgd@csd4.csd.uwm.edu
Reply-To: jgd@csd4.csd.uwm.edu
Organization: University of Wisconsin - Milwaukee
Date: Sat, 25 Jul 1992 01:59:29 GMT

From article <1992Jul23.144712.547@ulowell.ulowell.edu>, by oneill@cs.ulowell.edu (Brian 'Doc' O'Neill):
> Has anyone else heard of this system? I'm getting tons of FTP connections
> from it.
> 
> The domain "pleasure.com" does not actually exist. The IP address used is
> 192.160.196.5, which is mapped to "pleasure.com". The IP address actually
> belong to InteleCom Data Systems (NET-NET-IDS-COM).
> 
> Isn't mapping to a false name against the rules?


nslookup on 192.160.196.5 tells me this is host  "pleasure.com", _and_
that authoritative answers can be found at  idsvax.ids.risc.net (155.212.1.2).

The "whois" database at nic.ddn.mil tells me that

  o risc.net is Rhode Island Internet Systems

  o idsvax.ids.risc.net is one of their nameservers

  o the _domain_ pleasure.com does not exist (or at least is not 
    registered with the NIC)


nslookup, using idsvax.ids.risc.net as the nameserver, tells me such
(typ=any, class=in):

pleasure.com   origin = pleasure.com
	mail addr = sysadmin.pleasure.com
	serial=1, refresh=7200, retry=7200, expire=12096000, min=86400
pleasure.com    nameserver = pleasure.com

Other info requests come up empty.

*Still*...  there _are_ vestiges of "pleasure.com" in nameserver(s), even
if a lookup of the name "pleasure.com" fails to resolve to an address.

Now, to the point.  What are the "rules" on domain names?  Aren't they
supposed to be registered, perhaps with _the_ NIC?   If risc.net acts
as a "local" registration agency, is it required to pass the domain
info "up the line"?  And what happens here is some other organization
_does_ attempt to register with nic.ddn.mil's HOSTMASTER?  Won't _some_
people get confusing/conflicting nameserver responses?

I'm probably just _very_ confused on this issue (which is why I'm asking),
but it all seems a little "off" to me.   Anyone care to "unconfuse" me?

-- 
John G Dobnick                          ATTnet: (414) 229-5727
Computing Services Division             INTERNET: jgd@uwm.edu
University of Wisconsin - Milwaukee     UUCP: uunet!uwm!jgd

"Knowing how things work is the basis for appreciation,
and is thus a source of civilized delight."  -- William Safire
Newsgroups: comp.security.misc
From: hards4@ee.adfa.oz.au (Brad Hards)
Subject: Re: System "pleasure.com"
Organization: ADFA Vortex
Date: Fri, 31 Jul 1992 01:23:19 GMT

In article <64629@hydra.gatech.EDU>, gt5870c@prism.gatech.EDU (Noah White) writes:
> >Wait a minute...if I log in to pleasure.com and ask the sysadmin to put a
> >file in my account here, how is he going to get into my account here without
> >divulging my password?  Or am I misunderstanding what's happening?
>
>   If the sysadmin is running Unix, a simple chown, chgrp make it yours, 
> remember the super user can go anywhere and do anything without others 
> passwords.

You've missed the point. If you ask the sysadmin of System X to put a file
on your account on system Y, either sysadmin of X must have your password
on System Y, or must have sysadmin type permissions on Y.
From: brian@ucsd.edu (Brian Kantor)
Newsgroups: comp.security.misc
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Date: 28 Jul 92 15:51:42 GMT
Organization: The Avant-Garde of the Now, Ltd.
NNTP-Posting-Host: ucsd.edu

X-rays don't affect magnetic media.  It's nearly impossible for the
power supplies, deflection magnetics, and other parts of the machine to
affect a floppy or mag tape.  If you're really worried about it, put one
copy in your checked luggage and one in your hand luggage.  The extra
media cost is infinitesmal compared to the cost of your plane ticket and
lodging.

If you're worried about really high-speed film, wrap it in a lead foil
bag.  If you have a puckish sense of humour, take some lead foil (cut
up a bag, eh?) and make a stencil that says 'stupid git' or 'how about
a kiss' or your favourite imprecation and glue it to the inside of the bag.
	- Brian
Newsgroups: comp.security.misc
From: oneill@cs.ulowell.edu (Brian 'Doc' O'Neill)
Subject: Re: System "pleasure.com"
Organization: University of Massachusetts at Lowell Computer Science
Date: Thu, 30 Jul 1992 01:47:24 GMT

In article <64632@hydra.gatech.EDU> gt5870c@prism.gatech.EDU (Noah White) writes:
>In article <janet.712298382@dunnart> janet@cs.uwa.oz.au (Janet Jackson) writes:
>>So?  If you wanted this sysadmin to ftp to your account you would still have
>>to give them your password.
>
>   No, you are missing the point, the users give joe sysadmin an FTP request
>which is probably batched by the sysadmin (similar to a firewall concept)
>the requests are carried out and the files are given the proper ownerships
>and placed in the proper user accounts on the system (at least that is how
>I read it). Remember joe superuser can do anything to anyone's account
>without their password.
>

Nope. Joe Superuser from foo.bar.com cannot do anything to anyone's
account on _my_ systems without their password. This is what appears to be
happening. Jim Luser from ubudweiser.edu requests that a file stored on
foo.bar.com be ftp'd _to_ his account on ubudweiser.edu when available. At a
later time, foo.bar.com ftp's the file to ubudweiser.edu and deposits it in
Jim Luser's account. Now, how does this get accomplished without Luser
giving away his password on ubudweiser.edu?

I'm not sure if this is what happens in the case of pleasure.com, but that
_appears_ to be what is happening, and it hasn't been denied, but they do
deny storing passwords.

=======================================================================
Brian O'Neill - Systems Manager, Computer Science 	 (508) 934-3645
University of Massachusetts at Lowell
Internet: oneill@ulowell.edu		Moderator, comp.binaries.ibm.pc
Newsgroups: comp.security.misc