HDTenEightyP/NetNews huggingface dataset:
From: peter@ferranti.com (peter da silva)
Subject: Re: UNIX Boxes, which is most secure
Organization: Xenix Support, FICC
Date: Tue, 29 Sep 1992 17:07:05 GMT

In article <15726@umd5.umd.edu> matthews@oberon.umd.edu (Mike Matthews) writes:
> If you get console access, security will not exist.  You can boot singleuser
> (after taking apart the machine and removing the battery to get rid of
> hardware monitor passwords, if need be) and you're root.

System V based boxes won't let you do this. You have to actually boot another
operating system (floppy-based UNIX or a foreign system such as DOS) and make
changes in one or more of /etc/passwd, /etc/inittab, /etc/rc*.d/*, or one of
the programs they call.

I have had to do this on more than one occasion. It usually simplest to make
init start up a shell at whatever the default run level is.

This is only slightly more secure, but it does reduce your vulnerability
some. Beyond this, I don't think there's any protection against someone
physically removing the hard disk. At that level you need to be using a
dataless system and something like kerberos, though even those are
susceptible to trojan horse password stealers.

I would recommend Xenix-386, personally. It's not only got a password on
single-user mode, but it's enough unlike System V or BSD that a would-be
cracker is likely to spend more time bitching about the OS than cracking it.
-- 
Peter da Silva                                               `-_-'
Ferranti Intl. Ctls. Corp.                                    'U` 
Sugar Land, TX  77487-5012
+1 713 274 5180                                   Har du kramat din varg idag?
From: atkinson@itd.nrl.navy.mil (Randall Atkinson)
Newsgroups: alt.security
Subject: Re: authenticating application code
Date: 30 Sep 92 01:18:52 GMT
Distribution: usa
Organization: Naval Research Laboratory, DC

In article <1992Sep28.163951.49718@ccvax.ucd.ie> soconnel@ccvax.ucd.ie writes:
>An interesting problem of which I have not found a solution. If I have an 
>application and can separate the application executable code from the 
>application data is there a way for the user to authenticate that he/she is
>using the correct application code to access the data.

  Depending on how you feel about various checksum algorithms, one can
use them to authenticate that the application binary you are using has
the same checksum as the one you want to use (modulo trusted path and
some fine points).  Aside from the usual CRCs or the Fletcher
checksum, algorithms such as MD5 (see the RFC) might be considered as
possibilities.
From: ifbb657@ccwf.cc.utexas.edu (Douglas Floyd)
Newsgroups: alt.security
Subject: UNIX Boxes, which is most secure
Date: 26 Sep 92 18:21:19 GMT
Reply-To: ifbb657@ccwf.cc.utexas.edu (Douglas Floyd)
Organization: The University of Texas at Austin, Austin TX
Originator: ifbb657@donald.cc.utexas.edu


  Between A/UX 3.0 which is the Apple Macintosh implementation of Unix,
NeXT which is natively UNIX based, and Sun OS, which is Windows NT based
[NOT!] :-), which OS is the most secure for resisting hacking attacks,
and which is the most secure if an unauthorized user gets console access?

-- 
ifbb657@ccwf.cc.utexas.edu (Douglas R. Floyd)

MS-Windows NT:             (Insert standard disclaimer here)
                           
Another reason to leave
your computer turned off.
From: barmar@think.com (Barry Margolin)
Newsgroups: alt.security
Subject: Re: authenticating application code
Date: 29 Sep 1992 19:36:51 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: telecaster.think.com

In article <1992Sep28.163951.49718@ccvax.ucd.ie> soconnel@ccvax.ucd.ie writes:
>An interesting problem of which I have not found a solution. If I have an 
>application and can separate the application executable code from the 
>application data is there a way for the user to authenticate that he/she is
>using the correct application code to access the data.

This generally requires system support for some kind of integrity service.

In Unix you can do this using the setuid/setgid mechanism.  The data should
only be readable by a specific user/group, and authentic applications would
be set-uid/gid.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: alt.security
From: splee@alchemy.tn.cornell.edu (Seng-Poh Lee)
Subject: Re: How safe is a setuid 'expect' script?
Organization: Alchemy International
X-Newsreader: TIN [version 1.1 PL6]
Date: Mon, 28 Sep 1992 22:23:09 GMT

Wietse Venema (wietse@wzv.win.tue.nl) wrote:
> splee@alchemy.tn.cornell.edu (Seng-Poh Lee) writes:
> 
> >Is a setuid 'expect' script safe, from a security standpoint? I know
> >a setuid shell script is a no no, but is an expect script any better?
> 
> This is FAQ stuff. I have sent a copy to the poster.
> 

I thank you for the FAQ, which I already have, but I wasn't talking
about a normal shell script.  I was asking about an 'Expect' program
script, which is a little bit like a Perl script.  It has its own set of
built in commands and such.

--
Seng-Poh Lee    <splee@alchemy.tn.cornell.edu>
Newsgroups: alt.security
From: casper@fwi.uva.nl (Casper H.S. Dik)
Subject: Re: How safe is a setuid 'expect' script?
Organization: FWI, University of Amsterdam
Date: Mon, 28 Sep 1992 16:50:44 GMT

splee@alchemy.tn.cornell.edu (Seng-Poh Lee) writes:

>Is a setuid 'expect' script safe, from a security standpoint? I know
>a setuid shell script is a no no, but is an expect script any better?

Any set-uid script is insecure because of the way interpreters work.
You can juggle with (sym)links and have the interpreter execute
the contents of a different script. When writing a set-uid script,
you must ask your self the question: ``Will it harm me when a user
replaces all the commands in this script?''

Casper
-- 
						|	Casper H.S. Dik
						|	casper@fwi.uva.nl
From: ranck@joesbar.cc.vt.edu (Wm. L. Ranck)
Newsgroups: alt.security
Subject: Re: Spysats and Red Flag
Date: 28 Sep 92 18:27:36 GMT
X-Newsreader: TIN [version 1.1 PL6]

Dave Williams (exudnw@exu.ericsson.se) wrote:
: Red Flag was an Air Force excercise (*not* Army) for air combat tactics.
: It's kinda hard to spot small planes going fast from space (but maybe not
: impossible ;).

OK, maybe the Red Flag exercises are Air Force (though I thought that 
was Top Gun) but the Army certainly did/does similar exercises.

--

*******************************************************************************
* Bill Ranck     DoD #496  ranck@joesbar.cc.vt.edu                            *
*******************************************************************************
Newsgroups: alt.security
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: Dialers
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Mon, 28 Sep 1992 08:59:37 GMT

In article <1992Sep26.063136.11676@ecst.csuchico.edu>, shawnb@ecst (Shawn Brown) writes:
>Of course
>they're legal... just as the possession of unix cracking software is 'legal'
>and the possession of self-replicating viruses. The trouble starts in the
>USE of the programs...           

Oh - you mean of course they're legal in the same way as guns,
"burglar tools" and controlled substances are legal, because the
trouble starts in the USE?

//Jyrki
Newsgroups: alt.security
From: casper@fwi.uva.nl (Casper H.S. Dik)
Subject: Re: Netware Security Inquiry
Organization: FWI, University of Amsterdam
Date: Mon, 28 Sep 1992 16:47:24 GMT

rob@wzv.win.tue.nl (Rob J. Nauta) writes:

>Why bother with netware security ?

>The Dutch magazine 'computable' (a trade mag, not a real computer mag) of
>sept. 26 1992 has an article 'NGN-member discovers serious bug in Novell's
>Netware'. (NGN is the Dutch Novell User Group). Here's an excerpt:

[ excerpt deleted ]

>One thing is curious, why would someone assume that discovering
>a bug is a disgraceful affair, like a crime, that requires
>anonimity of the person and his organization ?

I read the bit about preserving anonimity as ``we don't want everyone
asking them how''.

What surprised me about the article was the fact that it was treated as
something new. I should think that it is common knowledge that systems
that do not use some form of cryptography for authentication
cannot be secure. We also know that none of the PC/Mac filesystem
uses such protection. Therefor we can conclude that netware/appleshare
and the like cannot be secure. (AppleShare uses a challenge/response
exchange to authenticate the password, but doesn't do any further encryption.

NFS is, of course, vulnerable to eavesdropping/replay and worse, unless
secure RPC (with AUTH_DES or AUTH_KERB) is used.

The PC network vendors have been economical with the truth. They have
promised security but have delivered none. The article
also mentioned a program that can detect such attacks. 
All possible such attacks? Yeah, right.

Casper
-- 
						|	Casper H.S. Dik
						|	casper@fwi.uva.nl
Xref: sparky alt.security:4514 comp.security.misc:1325 news.answers:3201
From: edelheit@smiley.mitre.org (Jeff Edelheit)
Subject: Re: passwd replacement that works with Sun's shadow passwd file?
Organization: The MITRE Corporation, McLean, VA
Date: Mon, 5 Oct 1992 13:26:40 GMT

In article <2ACF2814.1799@news.service.uci.edu> iglesias@draco.acs.uci.edu (Mike Iglesias) writes:
>I'm looking for a passwd replacement that forces users to pick good
>passwords (like npasswd/passwd+/etc) that works with Sun's shadow
>passwd file, /etc/security/passwd.adjunct.  We're running SunOS 4.1.2
>if that makes a difference.
>
Sun has a product called "Account Resource Manager" (ARM) that
supports the following features:  Password aging, account
expiration/activation, disable lgoin after invalid attempts,
autologout, autolockscreen, dialpass and portpass passwords, access
hours and password qualification.  ARM works with "plain vanilla" Sun
O/S, with "c2convert" turned on and with the Basic Security Module.
ARM is an unbundled product.

The above posting is not an endorsement of the ARM and I have no
personal or professional relationship with Sun Microsystems other than
as a customer.

Jeff Edelheit		email:  edelheit@mitre.org
The MITRE Corporation	voice:  (703) 883-7586
7525 Colshire Drive	FAX:	(703) 883-1397
McLean, VA   22102
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 3 October 1992
Date: Sat, 3 Oct 1992 22:00:16 EDT
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<alt.security_717917068@aber.ac.uk> "alt.security FAQ"
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 26 September 1992
Date: Sat, 26 Sep 1992 22:00:19 EDT
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<25SEP199220091401@misvax.mis.arizona.edu> "product review of LJK/Security by Ray Kaplan"
From: dc91jld@brunel.ac.uk (John L Davies)
Newsgroups: alt.security
Subject: Re: DES - ENDORSED IN '92 ????
Keywords: DES, NSB, NSA
Date: 30 Sep 92 12:13:27 GMT
Organization: Brunel University, West London, UK

>
>DES (Data Encryption Standard) was re-endorsed in '87 for another 5 years.
>It was up for review in Jan. '92.
>
>Could anyone tell me whether it was re-endorsed again ??
>
>Thanks in advance!
>
>Cheers!
>
><GE> a.k.a. u9048979@wampyr.cc.uow.edu.au
>
I'd be very interested in this as well, please mail me if you
have any info.

Thanks.

-- 
"Therefore was the name of it called Babel;  because Jehovah
 did there confound the language of all the earth." -Genesis 11:9
.
  John L.S.Davies          dc91jld@brunel.ac.uk
.
.
Newsgroups: alt.security
From: cddukes@c00508-119rd.eos.ncsu.edu (PakRat's Anonymous)
Subject: Re: UNIX Boxes, which is most secure
Organization: North Carolina State University, Project Eos
Date: Mon, 28 Sep 1992 13:52:17 GMT

In article <15726@umd5.umd.edu> matthews@oberon.umd.edu (Mike Matthews) writes:
>If you get console access, security will not exist.  You can boot singleuser
>(after taking apart the machine and removing the battery to get rid of
>hardware monitor passwords, if need be) and you're root.
Actually this university has implemented a method of securing workstations from
the majority of users (students) who have access to the console at almost any
time.  sh was modified such that if it was running under singleuser mode
it would request a password before it would let you go into interactive mode.
It won't keep a determined individual out (One time the network installation
program was abused, the other time a suid script was abused, now I'm waiting
for someone to drag in a harddrive with a copy of the OS on it and boot from
that), but it'll stop most folks.
From: exudnw@exu.ericsson.se (Dave Williams)
Newsgroups: alt.security
Subject: Re: Spysats and Red Flag
Date: 28 Sep 92 16:59:41 GMT
Reply-To: exudnw@exu.ericsson.se
Organization: Ericsson Network Systems
X-Disclaimer: This article was posted by a user at Ericsson in North America.
              The opinions expressed are strictly those of the user and
              not necessarily those of Ericsson.

In article 7409@vtserf.cc.vt.edu, ranck@joesbar.cc.vt.edu (Wm. L. Ranck) writes:
>
>I got a note from a Michael C. who asked what "Red Flag" was.  I tried to
>reply in e-mail but my mailer couldn't parse the address out of the headers
>and neither could I.  Sorry.
>   Anyway, Red Flag is/was an Army exercise held (I think) in the desert
>Southwest of the USA.  Combat units are put up against an opposing force
>that uses Soviet style equipment and tactics.  Now, if *I* were running 
>a spysat operation I would certainly use those exercises to practice 
>providing real-time battlefield intelligence, so I would assume the
>NRO folks would have pictures of US territory based on those assumptions.
>--
>
>*******************************************************************************
>* Bill Ranck     DoD #496  ranck@joesbar.cc.vt.edu                            *
>*******************************************************************************

Red Flag was an Air Force excercise (*not* Army) for air combat tactics.
It's kinda hard to spot small planes going fast from space (but maybe not
impossible ;).

---
= exudnw@exu.ericsson.se                                                =
= David Williams              "You can't win, you can't break even,     =
= Ericsson Network Systems     and you can't quit"                      =
= Richardson, TX 75081                                  my opinions...  =
From: iiitac@PYR.SWAN.AC.UK (Alan Cox)
Newsgroups: alt.security
Subject: Xenix
Date: 30 Sep 92 09:13:56 GMT


Xenix isn't exactly secure either. There are standard tools floating
around the dos/unix world which just scan hard disks for sectors
beginning 
root:
print them out and ask if you want to kill the root password. I've used
it several times before now to break into Xenix286 and other machines
that people have discarded or lost the passwords (normally after its
been in the cupboard for 9 months and they decide to sell it...)

Quite literally if you can't physically lock the machine away you don't
have a chance of making a machine secure. What you can do is make
the machine unusable without the security (encrypted disks for example),
and make it unable to use your network properly(kerberos). 

I'd be happy to be proved wrong, but while someone can pull the plug or
unplug the ethernet and plug in a pc running soss to fake its fileserver
feed it a setuid root shell and then switch to the real network or 
a million other variants, what can you do /

----------------------------
Before you hug any wolves - remember little red riding hood

Hail Eric!
From: soconnel@ccvax.ucd.ie
Newsgroups: alt.security
Subject: authenticating application code
Date: 28 Sep 92 16:39:51 GMT
Organization: University College Dublin

An interesting problem of which I have not found a solution. If I have an 
application and can separate the application executable code from the 
application data is there a way for the user to authenticate that he/she is
using the correct application code to access the data. I know that it is
possible to authenticate the stored application data to the application code
but what about the other way round. I would be interested in finding a solution
to this.

Sean
From: barmar@think.com (Barry Margolin)
Newsgroups: alt.security
Subject: Re: Dataless system
Date: 6 Oct 1992 04:35:08 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
Distribution: usa
NNTP-Posting-Host: gandalf.think.com

In article <81116@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>  I heard this mentioned a couple of times.  What is a dataless system?

A workstation with no user files, only OS-related files; it gets all user
files (e.g. home and project directories) from file servers.  This
contrasts with diskless workstations, which also get OS-related files (the
kernel, swap space, system binaries, etc.) from a file server.	

>Is a dataless system encrypted?

Since there's no data on it, there's nothing to encrypt.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: alt.security
From: tim@ais.org (Tim Tyler)
Subject: Re: Spysats and Red Flag
Organization: UMCC
Date: Tue, 29 Sep 1992 06:15:50 GMT

In article <7508@vtserf.cc.vt.edu> ranck@joesbar.cc.vt.edu (Wm. L. Ranck) writes:
>Dave Williams (exudnw@exu.ericsson.se) wrote:
>: Red Flag was an Air Force excercise (*not* Army) for air combat tactics.
>: It's kinda hard to spot small planes going fast from space (but maybe not
>: impossible ;).
>
>OK, maybe the Red Flag exercises are Air Force (though I thought that 
>was Top Gun) but the Army certainly did/does similar exercises.

 Sorry guy, TOP GUN is the USN Fighter Weapons/Tactics School!
 
    The Army teaches a lot of tactical combat strategy at their National
Training Center, Ft. Irwin, California...   USMC has the Marine Air Ground
Combat Training Center at MCB Twenty-Nine Palms...


-- 
 Tim Tyler   Internet: tim@ais.org  MCI Mail: 442-5735  C$erve: 72571,1005
P.O. Box 443     Packet: KA8VIR @KA8UNZ.#SEMI.MI.USA.NA
Ypsilanti MI
48197-0443                  PADI, USPA, AFCEA, INEOA, P226, VFR700, etc.
Newsgroups: alt.security,comp.security.misc,alt.sys.sun,alt.religion.computers
From: peter@merlin.acadiau.ca (Peter Steele)
Subject: Re: passwd replacement that works with Sun's shadow passwd file?
Organization: Acadia University
Date: Mon, 5 Oct 1992 21:44:46 GMT

tchrist@convex.COM (Tom Christiansen) writes:

>Don't you love the trend to ship shoddy systems and then charge
>money to get the reasonable behaviour you're otherwise expecting
>from the system?

Yes, it burns me too, and it will probably always be that way. It
always annoyed me how Sun sold "Quickcheck" as a separate product,
using the line that "quickcheck is for those who need to recover from
system crashes more quickly than the normal fsck allows." What a
joke. Fortunately Quickcheck is now a standard part of SunOS....
--
Peter Steele        Unix Services Manager            peter.steele@acadiau.ca 
Acadia Univ., Wolfville, NS, Canada B0P 1X0  902-542-2201  Fax: 902-542-4364
Newsgroups: alt.security
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: AIX and Crack..
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Mon, 28 Sep 1992 08:57:24 GMT

In article <CKCLARK.92Sep25141617@portnoy.mit.edu>, ckclark@athena (Calvin Clark) writes:
>When I saw the subject of this thread, the first reactions were "What
>does drug abuse have to do with AIX?" and "It would explain a lot."

ObAntiOrwellianMessage: the drug "crack" doesn't have any more
relation to "drug abuse" than the drug "booze".

ObAidxComment: excessive solvent use would seem like a more probable
explanation.
Newsgroups: alt.security
From: shawnb@ecst.csuchico.edu (Shawn Brown)
Subject: Re: Dialers
Organization: California State University, Chico
Date: Sat, 26 Sep 1992 06:31:36 GMT

In article <hotzc.21.0@columbia.dsu.edu> hotzc@columbia.dsu.edu (CHRISTOPHER HOTZ) writes:
>Obviously, I'm new aroun here.
>	Anyway, I had two questions.
>	1. Are any 'wardialers' legal?
>	2. If any are legal where can I get one?
>
>--- Chris Hotz
>address:  hotzc@columbia.dsu.edu

This whole thread about the 'legality' of 'wardialers' (hehe, haven't heard
them referred to by this name in a LONG while) is ridiculous.  Of course
they're legal... just as the possession of unix cracking software is 'legal'
and the possession of self-replicating viruses. The trouble starts in the
USE of the programs...           

Newsgroups: alt.security.pgp,sci.crypt
From: billmcc@seanews.akita.com (Bill McCormick)
Subject: Re: Info-PGP Mailing List
Organization: SEANEWS - Seattle Public Access News & Mail
Date: Sun, 4 Oct 1992 18:14:04 GMT
Keywords: info-pgp mailing list

In article <jasper.42.0@bcl.santarosa.edu> jasper@bcl.santarosa.edu (Dane Jasper) writes:
>Mathew - most of use have given up on putting our keys in sigs, and are 
>instead using our .plan files, or just putting something in our sig to the 
>affect of 'PGP key available by request'.

I have taken the additional step of adding the MD5 hash of my unsigned
public key.  This gives the benefits of the Usenet wide distribution along
with following accepted nettiquette.

Bill
-- 
SEANEWS  []  Seattle News + Mail  []  Public Access  []  +1 206 937 9529
E-mail for PGP key.   MD5 (no sigs) is: 8e253e95133365a292261c7d0da58bcb
Xref: sparky alt.security.pgp:65 sci.crypt:3583
From: xexeo@dxcern.cern.ch (Geraldo Xexeo)
Newsgroups: alt.security.pgp,sci.crypt
Subject: FAQ with Key Directory (WAS:Re: here is my key
Keywords: pgp
Date: 1 Oct 92 15:44:53 GMT
Organization: CERN European Lab for Particle Physics

I thought the point of having a Public Key system was to 
HAVE an public directory!

I think the FAQ is a good idea. Maybe even better if someone
could sign it. 

Suppose we start the FAQ and Alice sign
it. So, we can trust the FAQ, since we trust Alice. Then,
later, other parts of the FAQ could be signed by persons
that were certified by the first FAQ. 

It is a kind of "exponential growing" distributed CA.

                  Jerry
-- 
-----------------------------------------------------------------------------
Geraldo Xexeo      |internet: xexeo@dxcern.cern.ch | "Cristo Redentor,    
CERN - PPE Division|bitnet:   gxexeo@cernvm.bitnet |  Bracos abertos sobre a
1211 Geneve 23     |decnet:   vxcern::xexeo        |  Guanabara...
Switzerland        |FAX:      (41) (22) 785 - 0207 |  Rio, eu gosto de voce!"
-----------------------------------------------------------------------------
Xref: sparky alt.security.pgp:27 sci.crypt:3488
From: gtoal@ibmpcug.co.uk (Graham Toal)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: here is my key
Keywords: pgp
Date: 26 Sep 92 22:11:08 GMT
Organization: The IBM PC User Group, UK.

In article <402@tnl.com> norstar@tnl.com (Daniel Ray) writes:
>Not sure if this is worth much, but here is my public key for those
>who collect them.

Hmmm - there's an idea - a regular FAQ-like posting with collected
public keys?

G
-- 
Newsgroups: alt.security.pgp,sci.crypt