From: merlin@neuro.usc.edu (merlin)
Newsgroups: alt.security
Subject: Re: Lan watchers and sniffers
Date: 13 Nov 1992 02:30:55 -0800
Organization: University of Southern California, Los Angeles, CA
Distribution: alt
NNTP-Posting-Host: neuro.usc.edu

>How would you  like  if the state was   to issue a  law tomorrow  that
>exceeeding speed limit  results  in capital  punishment?  That's about
>what you suggest. I would disable an account for a couple  of weeks --
>unless a person has really damaged important files, etc.

In the first place, with promiscuous mode PC based ethernet boards, the
fact is that there is no absolute physical control over ether snooping.
There is simply no account to disable in such cases.  Moreover, in some
few environments where password snooping might be controlled by simply
shutting down some individual user's access code, such minor treatment
has proven generally ineffective in controlling snooping.

>It's a frustration to see how  sites are adopting policies just design
>to say  that users have no  rights and  {college, university, company}
>has all priviliges  to erase there files,  read their love letters and
>kick them  out of {}  if they don't like their  face.  Rather than  to
>reflect real life.

At USC it is my understanding our official policy is to pursue systems
administrative staff who snoop through user files and personal data as
virgorously if not more so than we pursue outside penetrators.  Our VP
for computing considers inside or ourside snooping a capital offense--
you get fired || suspended || excommunicated.

>> ... put known snoopers on their own isolated leg.
>Aren't they supposed to be shot  by now :). Seriously, this  is likely
>to take a lot of time and money  - potentially much  more that to deal
>with security break-in.

Depends on what your threshold for damage from penetration may be.  If
you deal in private medical records, engineering design systems which
may be subject to industrial espionage, and/or defense || intelligence
data || sources || methods -- then you are going to be more sensitive
to the hazards of penetration attempts than if you run a public BBS.
In the case of our university, with sensitive personal information in
online email records and occasional accidental || determined efforts
to either steal other student's projects || disrupt computing facility
so no one can complete their homework on time we get very sensitive.

>I don't remember what original article said, but I recall that software
>used for debugging was PC based. 

If you recall this detail then what's your point about shutting down the
perpetrator's computer account?  Most PC's run DOS based snooper codes
which require no individual access authorization.

>Anyway, fascist measures above will hardly prevent a person interested
>enough to   do snooping anyway and  will  certainly make bull.it users
>hate Alessandro Bottonelli. It looks  for me is the  only way to avoid
>password  snooping but still  permit  network debugging  is end-to-end
>encryption. If network  is  using TCP/IP, original  poster may want to
>look at latest version of BSD  telnet[d] ( @gatekeeper.dec.com  ) that
>has built-in encryption.

I hate fascist rules.  However, in the absence of adequate funding to do
a better job of securing our campus systems against intentional and / or
unintentional penetration/disruption we have to rely on administrative
controls (what you call fascist rules) and the integrity of our people.
We cannot afford effective end to end encryption today.  Believe me, I've
done everything possible in our environment to try to adopt tecxhniques
which would better secure our ethernet without relying on administrative
controls -- but the only response I get from senior campus administration
is that we can't afford the cost of implementing these procedures today.

------------------------------------------------------------------------------
Alexander-James Annala
Principal Investigator
Neuroscience Image Analysis Network
HEDCO Neuroscience Building, Fifth Floor
University of Southern California
University Park
Los Angeles, CA 90089-2520
------------------------------------------------------------------------------
Newsgroups: alt.security