HDTenEightyP/NetNews huggingface dataset:
Newsgroups: comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: root-owned world-writable files
Date: 22 Jul 92 19:30:44 GMT

VESOFT@cup.portal.com (Michael D Hensley) writes:
>Agree/disagree/discussion: Any root-owned world-writable file should be
>considered a potential security loophole.

Strongly disagree.  The only difference between it being owned by root and
owned by someone else (discounting quotas) is that if it's owned by root,
someone else can't chmod or chown it.  This is an INCREASE in security.
Especially in these days of NFS, where people can become anyone other than root
with physical access to a workstation.  (Well, they can become root, but then
they're "nobody" over NFS.)

You could argue that files shouldn't be world-writable, but I don't see how you
can argue that given that a file is world-writable (but not set[ug]id), it's a
danger to have it be owned by root rather than daemon or nobody or something.

tar@math.ksu.edu (Tim Ramsey) writes:
>How do you get a complete list of files that are trusted by root, or by
>programs that root trusts (that is, are setuid root)?
>
>Much easier to simply not have world-writable files owned by root.

Not having world-writable files owned by root has nothing to do with this.  If
root or a setuid-root program trusts a world-writable file, the fact that it is
owned by someone else doesn't help you.
From: evansmp@uhura.aston.ac.uk (Mark Evans)
Newsgroups: comp.security.misc
Subject: Re: root-owned world-writable files
Date: 23 Jul 92 21:44:56 GMT
Organization: Aston University

flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
: But anyway, it's an extremely serious security hole to have "/" be world-
: writable.  The /.rhosts problem is a negligible portion of this problem.
: Just rename /etc and the system will let you login to root without asking
: for a password anyway.
This sounds like the same sort of philophicy used in VAX/VMS if it can't find
SYS$UAF (the equivalent of /etc/password)
It gives you all privs.
I think the assumption (on the part of the OS) is that the file system
is trashed and you need the privs to fix it.
(though I have a feeling that VMS will only allow a console login in
that situation)
-- 
-------------------------------------------------------------------------
Mark Evans                                   |evansmp@uhura.aston.ac.uk
+(44) 21 565 1979 (Home)                     |evansmp@cs.aston.ac.uk
+(44) 21 359 6531 x4039 (Office)             |
Newsgroups: comp.security.misc
From: jfowler@beta.lanl.gov (John C. Fowler)
Subject: Re: root-owned world-writable files
Organization: Los Alamos National Laboratory
Date: Tue, 21 Jul 1992 20:10:56 GMT

In article <62524@cup.portal.com> VESOFT@cup.portal.com (Michael D Hensley) writes:
>Agree/disagree/discussion: Any root-owned world-writable file should be
>considered a potential security loophole.
>What do you think?

Only if the system trusts the contents of the file, or root executes it,
or the uid or gid bit is set (on those weird variations of UNIX that don't
clear the bits when the file is modified).  Otherwise, what could you
possibly do that would create a security problem, just because the file is
owned by root and not, say, nobody?

(I am aware that the file could be used to get around quotas, if applicable,
but I don't really consider that a security loophole.  The worst a user could
do is fill up the file system, but that results in no permanent damage.
Just one less user.  :-))

-- 
John C. Fowler, jfowler@lanl.gov
Newsgroups: comp.security.misc
From: hsu@eng.umd.edu (Dagwood splits the Atom)
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Date: Tue, 28 Jul 92 04:13:26 GMT
Organization: University of Maryland, College Park, College of Engineering

In article <pkershaw-270792112759@192.94.50.51> pkershaw@dce.com (Peter Kershaw) writes:
>In article <15844@pitt.UUCP>, ansst11@icarus.lis.pitt.edu (Andy Solomon)
>wrote:
>> Can computer disks with data on them go thru the 
>> airport security x-ray machines.
>> 
>It has been known for years that xray has harmful effects on magnetic media
>and print film.

The fact that x-rays will expose print film to some degree is obvious to
the casual observer.  But where on earth is the evidence that x-rays will
damage magnetic media?  I thought NBS (now NIST) put this rumor to rest
years ago by thoroughly exposing several tapes and floppies in a research
reactor with no resultant loss of data.  Airport data loss is usually
attributable to either the metal detectors or to some x-ray machines' power
supplies.

-dave

-- 
David Hsu    hsu@eng.umd.edu      "There you stand like a duck in a
U of Md Systems Research Ctr       thunderstorm again - aren't you ever
College Park, Md  20742-3311       going to understand?"
+1 301 405 3689                                        - W. A. Mozart
Newsgroups: comp.security.misc
From: imp@solbourne.com (Warner Losh)
Subject: Re: Pleasure.com mystery solved.
Keywords: n
Organization: Solbourne, User Interface Group
Date: Thu, 30 Jul 1992 20:15:29 GMT

In article <1992Jul29.215824.16932@anomaly.sbs.risc.net>, kd1hz@anomaly.sbs.risc.net (Michael P. Deignan (KD1HZ)) writes:
>atkinson@itd.nrl.navy.mil (Randall Atkinson) writes:
>>  The DDn Network Information Center is the ONLY official organisation
>>that can grant or delegate responsibility for domain names.
>Do you have the law which deligates them this authority?

Do you have the "law" that states that you must have a unique IP
address?  What?  No Law?  What a totally LAME and BOGUS argument.
There are many good techincal reasons for each machine to have its own
IP address, just as there are many good technical reasons to properly
register the domain via the correct channels.

It is in numerous RFC's that you ****MUST**** get your domain
registered with the NIC, or their delegated representive.  In the case
of the .COM part of the tree, the NIC has not delegated that
authority, so you ****MUST**** register the name with them.  To think
otherwise is just flat out wrong.

Warner


-- 
Warner Losh		imp@Solbourne.COM
Interview Horror Story #882: "It's pretty informal around here.
Thursdays are clothing optional.."
From: dik@cwi.nl (Dik T. Winter)
Newsgroups: comp.security.misc
Subject: Re: Pleasure.com mystery solved.
Date: 28 Jul 92 01:37:06 GMT
Organization: CWI, Amsterdam

In article <1992Jul27.135126.1626@drycas.club.cc.cmu.edu> greenie@drycas.club.cc.cmu.edu writes:
 > We were NOT "storing up passwords" as some users have suggested.  Rather, 
 > since *WE* are just as concerned about security as other people apparently
 > are, we set up our system so that it would FTP TO the users home site and
 > place files there, rather than allowing them to connect freely to our
 > machines using FTP.

Eh.  Possibly a stupid question.  But how do you ftp to the users home site
without storing the password of that users home site?
-- 
dik t. winter, cwi, kruislaan 413, 1098 sj  amsterdam, nederland
home: bovenover 215, 1025 jn  amsterdam, nederland
dik@cwi.nl
From: arf@maths.warwick.ac.uk (Anthony Iano-Fletcher)
Newsgroups: comp.security.misc
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Date: 28 Jul 92 12:43:10 GMT
Organization: Mathematics Institute, University of Warwick, UK.

In article <pkershaw-270792112759@192.94.50.51>, pkershaw@dce.com (Peter Kershaw) writes:
 
> It has been known for years that xray has harmful effects on magnetic media
> and print film. The level of xray is supposedly monitored and calibrated
> periodically, so that it will not fog film, or scramble bits on disk, tape,
> flash ROM, etc. Truth be known, airport xray machines are infrequently
> checked because of lax government oversight, and cost. Consequently, I
> never allow any "mission critical" items to be passed through airport xray,
> but insist they be hand checked. It should also be noted that checked
> baggage is routinely xrayed, especially at airports with any international
> traffic.

At Heathrow and Gatwick (and I guess at all of the UK airports) security will NOT
hand check anything. Everything must go through the hand-luggage xray machine.
I was told that this was a legal requirement. 

They also assure you that no possible damage can result from xraying disc/tapes/etc!
However .............

			Anthony.
-- 
INTERNET:   arf@maths.warwick.ac.uk
PHONE:      +44 203 523523 x2677
FAX:        +44 203 524182
POST:       Maths Institute, University of Warwick,  CV4 7AL, UK.
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
From: mjr@hussar.dco.dec.com (Marcus J. "will do TCP/IP for food" Ranum)
Subject: Re: Problem with npasswd??
Organization: Digital Equipment Corporation, Washington ULTRIX Resource Center
Date: Tue, 28 Jul 1992 19:25:23 GMT

hubcap@hubcap.clemson.edu (System Janitor) writes:

>Now now. Calm down. I don't think my logic makes me that much of a kook.
>I want an unCrackable password file. I haven't yet come up with how to 
>get one.

	Un-crackable password files are in principle a contradiction
in terms.
	How many users do you have? If you want to get paranoid enough,
just modify login to use a cryptographic calculator or something like
that. Slapping code around to try to keep your users from doing something
dumb is an endless race - the human capacity for doing dumb is much
greater than we'd like to think. If you care about security *that* much,
solve the problem, don't just keep throwing patches at it.

mjr.
Newsgroups: comp.security.misc
From: jfowler@beta.lanl.gov (John C. Fowler)
Subject: Re: root-owned world-writable files
Organization: Los Alamos National Laboratory
Date: Wed, 22 Jul 1992 13:47:45 GMT

In article <14htt0INNiep@hilbert.math.ksu.edu> tar@math.ksu.edu (Tim Ramsey) writes:
>How do you get a complete list of files that are trusted by root, or by
>programs that root trusts (that is, are setuid root)?

To find out if a file is trusted, go to the man directories and grep the
filename on everything, then read the associated man pages where the filename
turned up (important files usually have their own man pages as well).

To find setuid root files, use the "find" command.

>Much easier to simply not have world-writable files owned by root.

Agreed.  Much easier to simply not have world-writable files at all, unless
you can come up with a real reason for needing them.  With UNIX supporting
setuid and setgid programs, it's fairly easy to work around these days.

But I still contend that there's nothing "special" about root owning a
world-writable file that would allow a user to exploit it over anyone else
owning the same file, other than getting around quotas.

-- 
John C. Fowler, jfowler@lanl.gov
Newsgroups: comp.security.misc
From: bill@chaos.cs.umn.edu (Hari Seldon)
Subject: Re: Keeping track of a lot of passwords
Organization: University of Minnesota
Date: Thu, 23 Jul 1992 02:19:45 GMT

In <14jsa6INNd1a@iraul1.ira.uka.de> S_TITZ@iravcl.ira.uka.de (Olaf Titz) writes:

>In <62453@cup.portal.com> ts@cup.portal.com writes:
>[...]
>>  How do you keep track of all these passwords?  Using the same password
>>  all over the place is dangerous, but how can you remember several dozen
>>  or more passwords, especially if the systems enforce restrictions on
>>  the passwords?
>[...]
>>  --Tim Smith

>I know a guy who writes down all of his numerous passwords in his
>notebook, in plaintext. The catch: he does so in Japanese letters,
>assuming that hardly anyone (here in Germany) knows how to read them.
does this not fall into security by obscurity????

bill pociengel
--
bill@chaos.cs.umn.edu
Xref: sparky comp.security.misc:842 alt.security:4027 comp.unix.ultrix:5928
From: lemson@ux1.cso.uiuc.edu (David Lemson)
Subject: Re: unhappy about overloading finger
Organization: University of Illinois at Urbana
Date: Mon, 27 Jul 1992 05:45:44 GMT

nelson@reed.edu (Nelson Minar) writes:

>Did Sun provide patches for my Ultrix machines, my Dynix boxes, and my
>stupid NeXT machines? How about patches to the bugs that probably
>exist in NeXT's netinfo? And how about patches to the other devious
>ways people can think to coerce password files out of YP?

If you implement the Trusted_Networks: property in your root domain,
no one outside of networks that you specify will be able to connect
to your netinfo server and steal your maps.
-- 
David Lemson                                                 (217) 244-1205
University of Illinois NeXT Campus Consultant  / CCSO NeXT Lab System Admin
Internet : lemson@uiuc.edu                 UUCP :...!uiucuxc!uiucux1!lemson 
NeXTMail accepted                                   BITNET : LEMSON@UIUCVMD
Newsgroups: comp.security.misc
From: kd1hz@anomaly.sbs.risc.net (Michael P. Deignan (KD1HZ))
Subject: Re: System "pleasure.com"
Organization: The Rhode Island Internet Systems Cooperative Network
Date: Wed, 29 Jul 1992 01:03:18 GMT

lemson@ux1.cso.uiuc.edu (David Lemson) writes:

>I wonder if they're just setting up and collecting passwords...

Is this type of bullshit really necessary? I don't question your motives
with using the net, I don't think you have any right to project a negative
opinion on another system you have no knowledge of.

MD
-- 
--  Dr. Michael P. Deignan (deg.pend.)      /   "Its okay dear,
--  Domain: kd1hz@anomaly.sbs.risc.net     /     you can show me...
--    UUCP: ..!uunet!anomaly!kd1hz        /      I'm a Doctor..."
From: pkershaw@dce.com (Peter Kershaw)
Newsgroups: comp.security.misc
Subject: Encryption for Mac, PC, UNIX
Date: 24 Jul 92 23:13:55 GMT
Followup-To: comp.security.misc
Organization: DCE

Does anyone know of a multi-platform encryption package, for Mac, PC, and
UNIX, that has user definable keys? We would like to post files to public
servers, for retrieval by our clients, without the risk of their being
decyphered. Recommendations appreciated.

Please email pkerhsaw@dce.com
From: newsham@wiliki.eng.hawaii.edu (Timothy Newsham)
Newsgroups: comp.security.misc
Subject: Re: root-owned world-writable files
Date: 24 Jul 92 04:52:49 GMT
Organization: University of Engineering, College of Engineering

root owned world writeable files can be a problem on systems without
chown...  the problem is that a user who has a world writeable directory
could be invaded by writing the root file, and linking they guys dot files
to it.  The security mechanism to stop such acts is that the file must be
owned by root or the person whos home directory it is (ie. .rhosts).
The guy shouldnt have a world writeable home directory in the first place 
anway...
Newsgroups: comp.security.misc
From: dhesi@cirrus.com (Rahul Dhesi)
Subject: Re: unhappy about overloading finger
Organization: Cirrus Logic Inc.
Date: Sun, 26 Jul 1992 21:17:35 GMT

In <dag.712016415@ossi.com> dag@ossi.com (Darren Alex Griffiths) writes:

>This allows the pond scum who try and 
>break into systems to get a list off all users and then attempt to crack the
>password for each of these users.  Even worse, [you can find idle usernames].

Isn't this carrying security by obscurity just a bit too far?  In
today's networking world, finding usernames is too easy.  Just scan
Usenet and collect email addresses -- you can build up a HUGE
collection in a day.  If you want idle usenames, well, do another scan
a month later, and look for the ones that aren't found any more.
-- 
Rahul Dhesi <dhesi@cirrus.com>
also: dhesi@rahul.net
"He's metabolically challenged, Jim."
Newsgroups: comp.security.misc
From: john@iastate.edu (John Hascall)
Subject: Re: unhappy about overloading finger
Organization: Iowa State University, Ames, IA
Date: Sat, 25 Jul 1992 02:38:51 GMT

dag@ossi.com (Darren Alex Griffiths) writes:
}coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:
}>    So what's supposed to happen?  I'm running a system with standard ULTRIX
}>    (other than modified FTP), and all this does is a full finger of the
}>    passwd file of the remote system.  Is that the screwup? ...
}It's definately a major screwup.  This allows the pond scum who try and 
}break into systems to get a list off all users and then attempt to crack the
   ...
}Instead it should complain about the bogus user not existing.

I like our fix better, try: finger @@iastate.edu
(a bunch of gotta-try-it students doing this on a system with 7000 passwd
entries convinced us to fix this in a hurry before system meltdown).

John
-- 
John Hascall                                       ``Live with it pink-boy!''
Project Vincent                                                              
Iowa State University Computation Center                     john@iastate.edu
Ames, IA  50011                                      515/294-9551 [fax -1717]
From: spaf@cs.purdue.EDU (Gene Spafford)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 22 Jul 92 02:24:12 GMT
	<19107@ector.cs.purdue.edu> <1992Jul21.210740.22162@jato.jpl.nasa.gov>
Organization: Department of Computer Science, Purdue University

In article <1992Jul21.210740.22162@jato.jpl.nasa.gov> dave@jato.jpl.nasa.gov (Dave Hayes) writes:

   spaf@cs.purdue.EDU (Gene Spafford) writes:
   >Finger can be replaced with something else, say, a simple Perl script.
   >You might have something that prints out an appropriate message and
   >then exits.  This means you can keep from printing user .plan files,
   >thus cutting down on their attempts to use it as a "billboard".

   What's wrong with this? Why is this bad?

It's not necessarily bad.  It might be against site policy, however.

If users wish to advertise something to the world at large, perhaps
there are better ways of doing it...like using Usenet.
-- 
Gene Spafford
Software Engineering Research Center & Dept. of Computer Sciences
Purdue University, W. Lafayette IN 47907-1398
Internet:  spaf@cs.purdue.edu	phone:  (317) 494-7825
From: pkershaw@dce.com (Peter Kershaw)
Newsgroups: comp.security.misc
Subject: Re: COMPUTER DISKS THRU AIRPORT X-RAY ? ASAP
Date: 27 Jul 92 17:27:35 GMT
Followup-To: comp.security.misc
Organization: DCE

In article <15844@pitt.UUCP>, ansst11@icarus.lis.pitt.edu (Andy Solomon)
wrote:
> 
> Can computer disks with data on them go thru the 
> airport security x-ray machines.
> 
It has been known for years that xray has harmful effects on magnetic media
and print film. The level of xray is supposedly monitored and calibrated
periodically, so that it will not fog film, or scramble bits on disk, tape,
flash ROM, etc. Truth be known, airport xray machines are infrequently
checked because of lax government oversight, and cost. Consequently, I
never allow any "mission critical" items to be passed through airport xray,
but insist they be hand checked. It should also be noted that checked
baggage is routinely xrayed, especially at airports with any international
traffic.
Newsgroups: comp.security.misc
From: jgd@csd4.csd.uwm.edu (John G Dobnick)
Subject: Re: unhappy about overloading finger
Originator: jgd@csd4.csd.uwm.edu
Reply-To: jgd@csd4.csd.uwm.edu
Organization: University of Wisconsin - Milwaukee
Date: Fri, 24 Jul 1992 02:11:47 GMT

From article <1992Jul23.032058.3292@reed.edu>, by nelson@reed.edu (Nelson Minar):
> I think the "spousal name" thing is apocryphal, at least in the case
> of UNIX machines on the Internet. 

Maybe so, maybe not so.  At our site we _have_ found instances of 
users setting their password to their firsst name, as recorded in the
GECOS field of the password file.  Crack found these *really* quickly.
Then _we_ found the users really quickly! :-)

> Dunno, but Ultrix finger joyfully screws up on user "@". Try "finger
> @@some.ultrix.machine.army.mil" - it's quite fun.

Only if you use DEC's old, ancient, decrepit, (oh, and BROKEN) finger. 
(It's a real "neat" screwup, too! :-) )  Seems like most DEC sites don't
even use their own software anymore.  Interesting.

-- 
John G Dobnick                          ATTnet: (414) 229-5727
Computing Services Division             INTERNET: jgd@uwm.edu
University of Wisconsin - Milwaukee     UUCP: uunet!uwm!jgd

"Knowing how things work is the basis for appreciation,
and is thus a source of civilized delight."  -- William Safire
From: gt5870c@prism.gatech.EDU (Noah White)
Newsgroups: comp.security.misc
Subject: Re: System "pleasure.com"
Date: 23 Jul 92 18:30:36 GMT
Organization: Universal Exports

In article <1992Jul23.144712.547@ulowell.ulowell.edu> oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:
>Has anyone else heard of this system? I'm getting tons of FTP connections
>from it.
>
>The domain "pleasure.com" does not actually exist. The IP address used is
>192.160.196.5, which is mapped to "pleasure.com". The IP address actually
>belong to InteleCom Data Systems (NET-NET-IDS-COM).
>
>Isn't mapping to a false name against the rules?
>
>This site appears to a BBS for erotica gifs and such, which may violate some
>of the regulations of some networks. Apparently a user can have that system
>ftp files to their own account, which is why I see the FTP connections. 
>however I am concerned about the methods used to do this, as it may require
>the divluging of the users password.
>

  Is this system located in Rhode Island? If so I know the system personally, 
as I am an occasional users of it although I am not a memeber so I can not use
the FTp and other Net gizmo's they have connect (and I don't need it esp. for 
$50 a year). Well is this is the same system, as far as I know there are no
erotic gifs on it, unless it's in some private section. It started out as a
muilti-dialin BBS running on a VAX (sick huh ;-) then they recently got a 
19,200 BPS I-Net connection via one of those commercial companies. They carry
RIME (Relay-Net Internation Message Exchange) conferences which is sort of a
PC BBS UUCP style network around the world.  I dunno if this is the same place
but they do have the same names. Oh well oh it does not require divulging
passwords because the SYSADMIN there is the one who takes the FTP requests.










----
I hope our stupid inews likes the amount of "new" text this time.
From: shoham@enel.ucalgary.ca (Idan Shoham)
Subject: Simulation Benchmarks
Date: Fri, 24 Jul 92 22:23:20 GMT
Organization: ECE Department, U. of Calgary, Calgary, Alberta, Canada

Hi all,

We've developed a home-grown logic and functional-level digital circuit
simulator here in our department, and are looking for appropriate
benchmarks (ie. combinational and sequential circuits) to see how fast
it is relative to other software out there.

We've been comparing it to Verilog (by Cadence), and at the gate level 
of abstraction it compares quite favourably.  However, we would like to
know if there are any standard circuits we can use to get results which
are easier to compare to other authors' results.

Thanks for any help that can be provided,

Idan
---------------------------------------------------------------------------
shoham@enel.ucalgary.ca

-- 
Idan
---------------------------------------------------------------------------
shoham@enel.ucalgary.ca
From: dermer@ssd.intel.com (Greg Dermer)
Subject: Re: spice info at cad.berkeley.edu ?
Keywords: Thanks for the help
Organization: Supercomputer Systems Divison, Intel Corp.
Date: Wed, 22 Jul 1992 18:00:45 GMT

Thanks to all that responded; I've got what I need

Greg

Newsgroups: comp.lsi.cad,comp.lsi.testing,comp.lang.vhdl,comp.cad.cadence