HDTenEightyP/NetNews huggingface dataset:
From: oneill@cs.ulowell.edu (Brian 'Doc' O'Neill)
Subject: Re: Pleasure.com mystery solved.
Organization: University of Massachusetts at Lowell Computer Science
Date: Mon, 27 Jul 1992 20:32:30 GMT

In article <1992Jul27.135126.1626@drycas.club.cc.cmu.edu> greenie@drycas.club.cc.cmu.edu writes:
>To settle the stories and quench the rumor mongers, "pleasure.com" was
>a test site that we had set up as a demonstration to determine the "market
>demand" for an adult service on the commercial internet.  It was only set
>up for a short period of time, and there were a number of users connecting
>to it.  But since it was a test and not expected to remain online forever,
>we did not bother registering the domain name - and we were under no obligation
>to do so because it was through the commercial Internet and therefor not
>under the auspices of the NIC and the NSF.
>

I'm not so sure about not being under the auspices of the NIC - the NSF, no,
but someone controls domain and IP allocations for the Commercial Internet
as well. I accept your explanations for what you did, I just feel it was
done poorly. Someone should have been made aware.

>We were NOT "storing up passwords" as some users have suggested.  Rather, 
>since *WE* are just as concerned about security as other people apparently
>are, we set up our system so that it would FTP TO the users home site and
>place files there, rather than allowing them to connect freely to our
>machines using FTP.  Users who are not happy with doing this are not being
>forced to transfer files this way.  They're not being forced to transfer
>files at all.
>

I didn't suggest that you were storing passwords, I was just concerned about
the mechanism to do so, which hasn't been explained. Is it the users
themselves which do the FTP? From what I saw, it seemed to be an automated
process, which would have required the storing of the password to connect to
the user's remote account. I could be wrong - I hope I am - but it sure
looked automated, and unsuccessful at that.

>Because of the original individuals negative comments and paranoia with the
>connections (rather than approaching us first), we will probably choose 
>another REGISTERED domain name in the future.
>

Security is inherently paranoid...

I don't think my comments were necessarily negative, just concerned. When
one has a system being broken in to, does one go to the cracker and ask what
they are doing? I went to the best resource available, UseNet, to find out
if anyone else knew about it and see what other concerns people had with the
practice. I would have contacted you afterwards, if you hadn't decided to
attack me first...

=======================================================================
Brian O'Neill - Systems Manager, Computer Science 	 (508) 934-3645
University of Massachusetts at Lowell
Internet: oneill@ulowell.edu		Moderator, comp.binaries.ibm.pc
From: evansmp@uhura.aston.ac.uk (Mark Evans)
Newsgroups: comp.security.misc
Subject: Re: Illegal Activities
Date: 23 Jul 92 21:47:29 GMT
Organization: Aston University

flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
: by411@cleveland.Freenet.Edu (Patrick Hoyt) writes:
: >How can I report a person I know to be preforming illegal and 
: >destructive acts on the internet?  I need to be able to to report
: >this activity without him knowing that I have because of the nature
: >of the people he works for.
: 
: Um, why don't you mail to the sysadmins of the systems he's attacking?
: Just request anonymity and you'll likely get it, although nothing is
: guaranteed.
If you give them the site(s) he is calling from, and possibly the IP
addresses if you know them to the respective sysadmins, then you should
find that that will do the trick.

-- 
-------------------------------------------------------------------------
Mark Evans                                   |evansmp@uhura.aston.ac.uk
+(44) 21 565 1979 (Home)                     |evansmp@cs.aston.ac.uk
+(44) 21 359 6531 x4039 (Office)             |
Newsgroups: comp.security.misc
From: hansm@cs.kun.nl (Hans Mulder)
Subject: Re: root-owned world-writable files
Organization: University of Nijmegen, The Netherlands
Date: Thu, 23 Jul 1992 01:33:54 GMT

In <61350001@otter.hpl.hp.com> sjmz@otter.hpl.hp.com (Stefek Zaba) writes:

>I can think of no useful purpose for root-owned world-writeable files; but
>I'm sure the net's collective wisdom can come up with a few plausible ones...

Many moons ago I had a login on a machine where the sysadmin couldn't think
of such a purpose either, so he used find(1) to take away world-write access
from anything root owned.  Including /dev/null....

Oh, well.

--
Have a nice day,

Hans Mulder			hansm@cs.kun.nl
Xref: sparky comp.security.misc:869 alt.security:4047 comp.unix.ultrix:5974
From: mleech@bnr.ca (Marcus Leech)
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
Subject: Re: Problem with npasswd??
Date: 30 Jul 92 15:25:09 GMT
Organization: Bell-Northern Research, Information Techology Division

In article <1992Jul28.012207.27248@news.uiowa.edu>, dsiebert@icaen.uiowa.edu (Doug Siebert) writes:
|> Why should that be time consuming?  Space consuming, yes?  But not time
|> consuming.  Ever hear of a binary search? ;-)
|> 
My locally-developed passwd/yppasswd replacement program does just that.
Searching a (currently 116K-word) dictionary with a binary search takes a
  small fraction of a second.

-- 
Marcus Leech, 4Y11             Bell-Northern Research  |opinions expressed
mleech@bnr.ca                  P.O. Box 3511, Stn. C   |are my own, and not
ml@ve3mdl.ampr.org             Ottawa, ON, CAN K1Y 4H7 |necessarily BNRs
From: cward@Think.COM (Chris Ward)
Newsgroups: comp.security.misc
Subject: Re: On beyond passwords
Date: 28 Jul 92 14:15:47 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: custard.think.com

In article <1992Jul14.200623.10360@news.cs.indiana.edu>, mvanheyn@mango.ucs.indiana.edu (Marc VanHeyningen) writes:
|> Thus said alan@ssd.ukpoit.co.uk (Alan Barclay):
|> >I've seen a film, I forget the exact title, something like runners or
|> >catchers or someother one word title. Stars Tom Selleck as a cop, who's
|> >job it is to disable malfunctioning robots. It had a computer accessed
|> >by retinal pattern. Bad guy comes along with an artifical eyeball, and
|> >puts it up to the sensor. The sensor picks up the artifical eyeball's
|> >retinal pattern. Bad guy is into system. 
|> >
|> >If a film can pick up on the obvious problem, then how long until
|> >the real bad guys pick it up?
|> 
|> Not only that, but there was a Bond movie, I think it was "You Only Live
|> Twice," way back in the 60s, where Bond has fake fingerprints put on
|> skinlike substance covering his real fingers so he can imitate somebody
|> else's fingerprints.  How long until the real bad guys pick it up?
|> Obviously dusting for prints at the scene of a crime is a waste and
|> should not be used.

The movie was "Diamonds are Forever". Also, an eyeball fake was done in
"Never Say Never".  Any security system is easy to bypass in Hollywood,
especially if you are a writer or have MCS (Main Character Syndrome).

Surely, you forgot a smiley in there somewhere?

-- 
==========================================================================
Christopher Ward                                     voice: (617) 243-4112
Applications Engineer, AMEX                            fax: (617) 867-1823
Thinking Machines Corporation                       email: cward@Think.COM
==========================================================================
Remember, I'm not just the AMEX AE ... I'm also a customer!
From: gt5870c@prism.gatech.EDU (Noah White)
Newsgroups: comp.security.misc
Subject: Re: System "pleasure.com"
Date: 29 Jul 92 20:55:41 GMT
Organization: Universal Exports

In article <janet.712298382@dunnart> janet@cs.uwa.oz.au (Janet Jackson) writes:
>In <64189@hydra.gatech.EDU> gt5870c@prism.gatech.EDU (Noah White) writes:
>
>>In article <1992Jul23.144712.547@ulowell.ulowell.edu> oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:
>
>So?  If you wanted this sysadmin to ftp to your account you would still have
>to give them your password.

   No, you are missing the point, the users give joe sysadmin an FTP request
which is probably batched by the sysadmin (similar to a firewall concept)
the requests are carried out and the files are given the proper ownerships
and placed in the proper user accounts on the system (at least that is how
I read it). Remember joe superuser can do anything to anyone's account
without their password.





----
From: dank@blacks.jpl.nasa.gov (Dan Kegel)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 22 Jul 92 16:58:05 GMT
Organization: Image Analysis Systems Group, JPL

ggm@brolga.cc.uq.oz.au (George Michaelson) writes:
>One idea which I have implemented on a box here, but which might impact
>on horton if deployed widely, is to replace fingerd by a paranoid shell
>script [ which simply says "Finger not supported; contact foo@bar for 
> info about this machine" ]
>This  provides minimal onward assistance so in the case of dire emergency
>somebody can proceed. I put it onto the box which is doing our mailhub and
>newshub work, which I particularly didn't want to be blasted by random
>finger requests.

This won't impact Horton at all if it's only deployed on mailservers
which don't allow user logins; Horton only needs finger where users
might be logged in.
- Dan K.
Newsgroups: comp.security.misc
From: ignatz@chinet.chi.il.us (Dave Ihnat)
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Summary: Probably no harm; discussed to death in other groups
Organization: Chinet - Public Access UNIX
Date: Tue, 28 Jul 1992 17:14:45 GMT

In article <15844@pitt.UUCP>, ansst11@icarus.lis.pitt.edu (Andy Solomon)
wrote:
> Can computer disks with data on them go thru the 
> airport security x-ray machines.

This has been discussed to death in other groups, esp. comp.sys.laptops.
The general consensus is that you stand little or no chance of loss due to
X-rays; this has been determined both by a tremendous amount anecdotal evidence,
and the fact that there was a study (by NBS?  I can't recall) which attempted
to resolve the issue, and indicated no X-ray damage at levels higher than those
encountered in even poorly-maintained airport machines.  On the other hand,
many of both the X-ray machines and the metal detectors can produce powerful
EM-fields (from power supplies, etc.) that *can* scramble data.  It is
conceivable that even though going through the X-ray machine would do no damage,
collateral fields in the machine could.  Similarly, walking the media through
the metal detector is not necessarily a good idea.

You've several choices; first, you can trust the machine.  Anecdotal evidence
indicates that you stand little chance of data loss.  You can request hand-
inspection of the machine and disks; simply be careful not to hand them around
the X-ray cabinet or metal detectors in such a manner that you could expose 
them to magnetic fields.  You may get shielded bags for the disks, machine,
or both (although be aware that if the shielding is lead foil, it won't do
anything for EM protection), although this probably assures a hand inspection
after going through the X-ray machine.  (You should have seen the response a
friend got when a ranked set of lead-foil paint tubes went through and looked
like the magazine from a large-calibre weapon...)

Hope this helps,

		Dave Ihnat
		ignatz@homebru.chi.il.us (preferred return address)
		ignatz@chinet.chi.il.us
Newsgroups: comp.security.misc
From: janet@cs.uwa.oz.au (Janet Jackson)
Subject: Re: System "pleasure.com"
Organization: Dept. Computer Science, University of Western Australia.
Date: Tue, 28 Jul 1992 04:39:42 GMT

In <64189@hydra.gatech.EDU> gt5870c@prism.gatech.EDU (Noah White) writes:

>In article <1992Jul23.144712.547@ulowell.ulowell.edu> oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:
>>Apparently a user can have that system
>>ftp files to their own account, which is why I see the FTP connections. 
>>however I am concerned about the methods used to do this, as it may require
>>the divluging of the users password.

>Oh well oh it does not require divulging
>passwords because the SYSADMIN there is the one who takes the FTP requests.

So?  If you wanted this sysadmin to ftp to your account you would still have
to give them your password.


Janet Jackson
<janet@cs.uwa.edu.au>
Systems Administrator
Department of Computer Science
The University of Western Australia
From: gt5870c@prism.gatech.EDU (Noah White)
Newsgroups: comp.security.misc
Subject: Re: System "pleasure.com"
Date: 29 Jul 92 20:51:37 GMT
Organization: Universal Exports

In article <14qpc7INNore@agate.berkeley.edu> alanc@ocf.berkeley.edu (Alan Coopersmith) writes:
>In article <64189@hydra.gatech.EDU> gt5870c@prism.gatech.EDU (Noah White) writes:
>)In article <1992Jul23.144712.547@ulowell.ulowell.edu> oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:
>
>Wait a minute...if I log in to pleasure.com and ask the sysadmin to put a
>file in my account here, how is he going to get into my account here without
>divulging my password?  Or am I misunderstanding what's happening?
>
  If the sysadmin is running Unix, a simple chown, chgrp make it yours, 
remember the super user can go anywhere and do anything without others 
passwords.








-----
.sig
From: greenie@drycas.club.cc.cmu.edu
Newsgroups: comp.security.misc
Subject: Pleasure.com mystery solved.
Date: 27 Jul 92 13:51:25 -0500
Organization: Carnegie Mellon Computer Club

To settle the stories and quench the rumor mongers, "pleasure.com" was
a test site that we had set up as a demonstration to determine the "market
demand" for an adult service on the commercial internet.  It was only set
up for a short period of time, and there were a number of users connecting
to it.  But since it was a test and not expected to remain online forever,
we did not bother registering the domain name - and we were under no obligation
to do so because it was through the commercial Internet and therefor not
under the auspices of the NIC and the NSF.

We were NOT "storing up passwords" as some users have suggested.  Rather, 
since *WE* are just as concerned about security as other people apparently
are, we set up our system so that it would FTP TO the users home site and
place files there, rather than allowing them to connect freely to our
machines using FTP.  Users who are not happy with doing this are not being
forced to transfer files this way.  They're not being forced to transfer
files at all.

Because of the original individuals negative comments and paranoia with the
connections (rather than approaching us first), we will probably choose 
another REGISTERED domain name in the future.

Any further comments can be addressed to this account.

Greenie@drycas.club.cc.cmu.edu
Xref: sparky comp.security.misc:838 alt.security:4023 comp.unix.ultrix:5922
From: nelson@reed.edu (Nelson Minar)
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
Subject: Re: Problem with npasswd??
Date: 28 Jul 92 03:59:51 GMT
Organization: Reed College, Portland, OR

In article <1992Jul27.184324.14697@hubcap.clemson.edu> hubcap@hubcap.clemson.edu (System Janitor) writes:
>Unless I am mistaken, npasswd doesn't check for everything crack
>does.  Even dropping the time consuming crypt part, it seems like it
>would take an unacceptable amount of time to change your password if
>it were checked against, say, an 800,000 word dictionary with 300
>transmogrification rulesets.

But remember - if n is the number of words you want to check against
(say, 20000 words * 15 transformations = 300k words), you only have to
do O(log n) comparisons. Your password cracker is going to be doing
O(n) comparisons, and she's going to be doing it through a slow crypt
function. You win.

Furthermore, there's no reason in principle that the crack 4.1 word
generation engine (which is excellent) can't be grafted into npasswd.
I keep hoping someone else will do the work for me.

>The point is, even if you use npasswd, a cracker will still get some
>of your passwords. So what if they only get 10 instead of 200, they'll 
>still have some userids from which to launch their nefarious plans.

yes, but if you have 2000 users and only 10 of the passwords are
crackable, then it will take a *long* time for the "nefarious cracker"
to get at those passwords.

Security is a game of staying ahead, not being perfect.
-- 
                __
nelson@reed.edu \/   Delicious & Nutritious breakfast cereals shot from guns!
From: emv@msen.com (Edward Vielmetti)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Followup-To: alt.gopher
Date: 21 Jul 1992 18:59:15 -0400
Organization: Msen, Inc. -- Ann Arbor, Michigan
NNTP-Posting-Host: nigel.msen.com
X-Newsreader: Tin 1.1 PL3

ggm@brolga.cc.uq.oz.au (George Michaelson) writes:
: 
: I see an increasing amount of stuff being done using finger as a
: method of distributed information-getting.

finger is a very easy to understand protocol, clinets are cheap and
ubiquitous, servers equally so.  unlike x.500 and other "big" projects
with real backing you don't need to get special funding to be able
to afford a finger-based server.  so I think it's a thing you'll need
to deal with.
 
: I would prefer
: to see an explicit 'distributed information' protocol to replace finger
: being used for:
: 
: 	email address lookup
: 	directory service call
: 	generalised information checks

A number of people are using gopher (viz. alt.gopher, wiht a vote for
comp.infosystems.gopher in progress) as a distributed information
system.  The protocol per se is very simple, and in fact you can
point a gopher client at a finger-based service and have it work the
first time.  

gopher has had its own share of security pitfalls, mostly regarding
holes in telnet based gateways, but for a general lookup and information
scheme it's pretty good.

(followups to alt.gopher, see also boombox.micro.umn.edu:/pub/gopher/
if you don't get alt groups)

--Ed
Newsgroups: comp.security.misc
From: dank@blacks.jpl.nasa.gov (Dan Kegel)
Subject: Re: unhappy about overloading finger
Organization: Image Analysis Systems Group, JPL
Date: Tue, 21 Jul 1992 17:57:43 GMT

ggm@brolga.cc.uq.oz.au (George Michaelson) writes:
>I see an increasing amount of stuff being done using finger as a
>method of distributed information-getting.
>...  I would prefer to see an explicit 'distributed information' protocol 
>to replace finger being used for:
>	email address lookup ...
>leaving finger alone to be used for what it was designed for.

I certainly agree that 'netfind', which does massive
numbers of 'finger's whenever anybody uses it, is a bad idea.

But what about 'Horton'?  It fingers all the participating machines in
one's own domain hourly to update an e-mail address database,
which users then access via whois.
Since all the finger requests it generates are between two sites inside 
your own domain, they should be easy to distinguish as benign.
Do you consider this a 'bad' use of finger?

It would be impractical to make horton use something other than finger,
since it's whole reason for being is that it makes use of a universally 
available protocol for gathering information & thus requires no
active cooperation from the participating (but anarchic) sites.

- Dan Kegel (dank@blacks.jpl.nasa.gov)
From: alanc@ocf.berkeley.edu (Alan Coopersmith)
Newsgroups: comp.security.misc
Subject: Re: System "pleasure.com"
Date: 25 Jul 92 05:38:15 GMT
Organization: U.C. Bezerkeley Overloaded Computing Facility
NNTP-Posting-Host: hailstorm.berkeley.edu

In article <64189@hydra.gatech.EDU> gt5870c@prism.gatech.EDU (Noah White) writes:
)In article <1992Jul23.144712.547@ulowell.ulowell.edu> oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:
)>
)>This site appears to a BBS for erotica gifs and such, which may violate some
)>of the regulations of some networks. Apparently a user can have that system
)>ftp files to their own account, which is why I see the FTP connections. 
)>however I am concerned about the methods used to do this, as it may require
)>the divluging of the users password.
)>
)
)Oh well oh it does not require divulging
)passwords because the SYSADMIN there is the one who takes the FTP requests.

Wait a minute...if I log in to pleasure.com and ask the sysadmin to put a
file in my account here, how is he going to get into my account here without
divulging my password?  Or am I misunderstanding what's happening?

)----
)I hope our stupid inews likes the amount of "new" text this time.

(Try replacing the >'s at the beginning of the line with something else, say
}'s or )'s....)
-- 
------------------------------------------------------------------------
Alan Coopersmith			Internet: alanc@ocf.berkeley.edu
University of California, Berkeley	Bitnet:   alanc@UCBOCF.BITNET
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
From: dsiebert@icaen.uiowa.edu (Doug Siebert)
Subject: Re: Problem with npasswd??
Date: Tue, 28 Jul 1992 01:22:07 GMT
Organization: ISCA

In article <1992Jul27.184324.14697@hubcap.clemson.edu> hubcap@hubcap.clemson.edu (System Janitor) writes:
>Unless I am mistaken, npasswd doesn't check for everything crack does.
>Even dropping the time consuming crypt part, it seems like it would
>take an unacceptable amount of time to change your password if it were 
>checked against, say, an 800,000 word dictionary with 300 transmogrification 
>rulesets.

Why should that be time consuming?  Space consuming, yes?  But not time
consuming.  Ever hear of a binary search? ;-)

>
>The point is, even if you use npasswd, a cracker will still get some of
>your passwords. So what if they only get 10 instead of 200, they'll still
>have some userids from which to launch their nefarious plans.
>So, aren't you fooling yourself to think that npasswd like schemes 
>enhance your system security enough to make them worthwhile? 

With that kind of logic why bother with security at all?  If you figure that
unless you have extreme measures any given site on the Internet will be hit by
crackers eventually you could just chuck all the security checking altogether,
couldn't you?  If you really do check a 800,000 word dictionary with 300
transmorgrifications each a cracker would have to work a REALLY long time to
get even one password, making it more likely for someone to notice him.  Its
certainly an improvement over the alternative, isn't it?

-- 
/-----------------------------------------------------------------------------\
| Doug Siebert                             | "I don't have to take this abuse |
| Internet:  dsiebert@icaen.uiowa.edu      |  from you - I've got hundreds of |
| NeXTMail:  dsiebert@chop.isca.uiowa.edu  |  people waiting in line to abuse |
|     ICBM:  41d 39m 55s N, 91d 30m 43s W  |  me!"  Bill Murray, Ghostbusters |
\-----------------------------------------------------------------------------/
Hi, I'm a .signature worm.  I've already copied myself into your .signature.
From: dave@jato.jpl.nasa.gov (Dave Hayes)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 27 Jul 92 17:03:45 GMT
Reply-To: dave@jato.jpl.nasa.gov
Organization: Jet Propulsion Lab - Pasadena, CA

john@iastate.edu (John Hascall) writes:

>I like our fix better, try: finger @@iastate.edu

Cute.

-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

  "Every extreme attitude is a flight from the self."  -- Eric Hoffer.
Newsgroups: comp.security.misc