HDTenEightyP/NetNews huggingface dataset:
From: aclark@netcom.com (Al Clark)
Subject: Re: HELP! (Re: IBM password)
Organization: Netcom - Online Communication Services  (408 241-9760 guest) 
Date: Fri, 16 Oct 1992 21:31:48 GMT

In article <vanepp.719197327@sfu.ca> vanepp@fraser.sfu.ca (Peter Van Epp) writes:
>doug@cc.ysu.edu (Doug Sewell) writes:
>
>>If we do this, then the machine will boot completely from a floppy disk.
>>But we can't access the hard drive to fix it.  If the HD is configured
>>in, then the machine will NOT complete a floppy-disk boot.
>
>I sent a reply by mail, but maybe it didn't make it. If you can boot from a 
>floppy, then by using BIOS calls (specifically int26, Absolute disk write)
>you should be able to write either 0s or E5s (which I believe is the format
>data string) onto the first track of the hard disk. This of course will
>destroy any data on the hard disk, but I assume you don't care. Haveing done
>that, you should be able to enable the hard drive in the CMOS ram and 
>partition and format the disk manually.
>	If there is data you want on the disk, then you might try reading
>the first few sectors (with int25) to get the partition table and then
>write a valid partition table from another drive on a working machine onto
>the broken drive again using int26.
>
>Peter Van Epp / Operations and Technical Support 
>Simon Fraser University, Burnaby, B.C. Canada

If you can access the partition table with 'fdisk', the undocumented /mbr
flag on MSDOS 3.3 and 5.0 will rewrite the MBR, leaving the partition table
alone.  Just boot with a 3.3 or 5.0 floppy, and "fdisk /mbr".
-- 
Al - aclark@netcom.com - My opinions are my own.
From: gbs@comp.lancs.ac.uk (Gareth B Smith)
Newsgroups: comp.security.misc
Subject: Access Models
Date: 12 Oct 92 15:39:20 GMT
Organization: Department of Computing at Lancaster University, UK.


	Does anyone know of any role based access models?  Or can give me
	any info on access models in general?

	Thanks,
Gareth
____________________________________________________________________________
G B Smith		 | Department of Computing, University of Lancaster,
gbs@comp.lancs.ac.uk	 | Bailrigg, Lancaster, LA1 4YR , U.K. 
...!mcvax!ukc!dcl-cs!gbs | FAX: +44 524 381707 PHONE: +44 524 65201 Ext 3793
____________________________________________________________________________
From: ifbb657@ccwf.cc.utexas.edu (Douglas Floyd)
Newsgroups: comp.security.misc
Subject: Re: IBM password
Date: 9 Oct 92 17:32:34 GMT
Organization: The University of Texas at Austin, Austin TX

In article <BvGBGM.A0o@newcastle.ac.uk> D.J.Butcher@newcastle.ac.uk (Dave Butcher) writes:
>
>>seriously , I believe that the best secure computer is the one locked
>>in an empty room with all its plugs left alone and powered off :)
>>
>>	Massimo
>>-
>
>Dismantled, and stored in unmarked unsorted boxes as well.  Preferably
>distributed and buried across several square miles of marshland.
>
>Dave--
> 

For a REALLY secure computer, just low-level format the HD after use.

NOBODY will be able to crack the data "protection".   Not even the
user :-)

Total security.  (An oxymoron)

-- 
******* ifbb657@ccwf.cc.utexas.edu (Douglas R. Floyd) ******
             (Insert standard disclaimer here)

   I would rather have a frontal lobotomy than Windows NT!
Newsgroups: comp.security.misc
From: vanepp@fraser.sfu.ca (Peter Van Epp)
Subject: Re: B1security level
Organization: Simon Fraser University, Burnaby, B.C., Canada
Date: Thu, 15 Oct 1992 00:20:07 GMT

artur@morgaine.puug.pt (Artur Romao) writes:

>Does anyone know if there is any version of UNIX that implements the
>B1 level.

>thanks in advance.

From the paper "Is there a C2 UNIX System in the House" by Jeremy Epstein
of TRW (epstein@trwacs.fp.trw.com) at the Usenix Security III Conference 
last month:

AT&T System V/MLS: Evaluated at B1 on AT&T 3B2

SecureWare CMW+: Evaluated at B1 and CMW on Apple Macintosh II/CX

	Usenix will sell you a copy of the proceedings (and they are well
worth having!).

Peter Van Epp / Operations and Technical Support 
Simon Fraser University, Burnaby, B.C. Canada
From: eb@felix.Sublink.Org (Enrico Badella)
Newsgroups: comp.security.misc
Subject: Security checklist.
Date: 13 Oct 92 07:01:07 GMT
Organization: Soft*Star s.r.l, Torino, Italy

I remember seeing a security checklist but I don't remember where.
Was it an rfc, FAQ,.....?
Can someone kindly give me a pointer.

Thank you.

-- 
Enrico Badella				Internet: eb@felix.sublink.org
Soft*Star s.r.l.			          eb@icnucevx.cnuce.cnr.it
Via Camburzano 9			Phone:    +39-11-746092
10143 Torino, ITALY			Fax:      +39-11-746487
From: aegl@ossi.com (Tony Luck)
Newsgroups: comp.security.misc
Subject: Re: Secure shell by mail
Date: 13 Oct 1992 17:05:57 -0700
Organization: Open Systems Solutions Inc.
Distribution: usa
NNTP-Posting-Host: nym.ossi.com

barmar@think.com (Barry Margolin) writes:
>In article <1992Oct13.172459.28720@zip.eecs.umich.edu> ayman@eecs.umich.edu (Ayman I. Kayssi) writes:
>>I posted a question on comp.unix.questions about how to get a shell by email,
>>that is a shell that would execute what's in the body of an email message.
>>All the details have been worked out except for one thing: security.

>How about this:

>Include in the header a string in both plaintext and encrypted form.  The
>receiving system would decrypt the encrypted form and compare it to the
>plaintext.

>One problem with this is that it's quite amenable to known-plaintext
>attacks.  And it also requires a decryption key to be stored on the
>destination system, unless you use a public-key encryption system.

Such a system would be easily spoofed by a "replay" attack.  If I ever get
hold of one of the messages, I just take the header (which has a valid key
on it) attach a different shell script, and send it!  Bang!

To keep this kind of system secure you either need to encrypt the message,
or use some kind of digital signature stuff to provide a way of verifying
that the contents of the message have not been corrupted in transit.


-Tony Luck <aegl@ossi.com>
Newsgroups: comp.security.misc
From: rik@nella15.cc.monash.edu.au (Rik Harris)
Subject: Re: Can ftp be made to log outgoing calls ?
Reply-To: rik.harris@fcit.monash.edu.au
Organization: Monash University, Melb., Australia.
Date: Mon, 12 Oct 1992 05:51:41 GMT

ca393@cleveland.Freenet.Edu (Scott D. Wells) writes:
>>       So, I'm looking for a way of getting ftp (and possibly
>>telnet and rlogin, but these aren't so important) to log:
>>
>>	o who invoked it
>>	o from what machine it was invoked
>>	o where did it connect to
>>	o what was downloaded
>>
>>I've thought about doing this with by writing a shell script wrapper to
>>ftp but I'm sure someone somewhere must already have done it.
>>

>Yes, it can be done.  You will probably need to write a shell script
>that will write the useres uid toa file, then invoke the ftp/telnet/rlo
>programs.  

>I'm not a Unix buff, so I could be wrong.  I know it can be don, though,
>I have read some of the logs of it.

It depends if the logging is important, or not.  Ftp is not a privileged
program, so anyone can compile their own version, if they felt they
had a need to get around the logging.

rik.
--
Rik Harris - rik.harris@fcit.monash.edu.au
+61 3 571-2895 (AH & ans.mach) +61 3 573-2679 (BH)
Faculty of Computing and Information Technology,
Caulfield Campus, Monash University, Australia
-- 
Rik Harris - rik.harris@fcit.monash.edu.au
+61 3 571-2895 (AH & ans.mach) +61 3 573-2679 (BH)
Faculty of Computing and Information Technology,
Caulfield Campus, Monash University, Australia
Newsgroups: comp.security.misc
From: tom@uts.cc.wayne.edu (Thomas Richard Stevenson)
Subject: Re: B1security level
Organization: Wayne State Univ.
Date: Thu, 15 Oct 1992 15:21:54 GMT

artur@morgaine.puug.pt (Artur Romao) writes:

>Does anyone know if there is any version of UNIX that implements the
>B1 level.

>thanks in advance.

UTS with MLS has B1 level security.    UNIX System V Release 4.1ES 
(Enhanced Security) is being certified to the B2 security level.
-- 
     ____  __   __       Tom@UTS.CC.Wayne.Edu
      /   /_/  /_        Thomas_Richard_Stevenson@MTS.CC.Wayne.Edu
     /.  /\ . __/.       Tom@CMS.CC.Wayne.Edu
                         UserTom@WayneMTS.Bitnet
Newsgroups: comp.security.misc,alt.security,alt.sources.d,comp.sources.testers,comp.unix.admin
From: spaf@cs.purdue.EDU (Gene Spafford)
Subject: Re: Beta testers needed for security tool
Followup-To: comp.security.misc
Organization: Department of Computer Sciences, Purdue University
	<1992Oct9.090254.2285@nchud5.nchu.edu.tw>
Date: Sat, 10 Oct 1992 17:45:18 GMT

I have absolutely no idea why the previous poster quoted the entire
Tripwire beta test announcement without comment or change.

I do know that we got over 100 beta tester volunteers after the *real*
announcement last month, and the test is well under way. (Thanks to
those who responded.)

We are not accepting any more beta testers for the project.  A final
release of Tripwire is planned for (probably) next month.  It will be
announced here and in various other forums when ready.

Please do *NOT* send Gene Kim or me any messages asking to be added to
the Beta test.
From: brett@bambi.wg.waii.com (Marc Brett)
Newsgroups: comp.security.misc
Subject: Re: Secure shell by mail
Date: 14 Oct 92 19:09:43 GMT
Distribution: usa
Organization: Western Atlas International, Inc.

In article <1992Oct13.172459.28720@zip.eecs.umich.edu>, ayman@eecs.umich.edu (Ayman I. Kayssi) writes:
|> I posted a question on comp.unix.questions about how to get a shell by email,
|> that is a shell that would execute what's in the body of an email message.
|> All the details have been worked out except for one thing: security.
|> Currently, security is obtained using the following:
|> 1- the subject of the message is a certain (fixed) special string
|> 2- a header line is added which contains an encrypted string
|> You can see that the problem is that the message itself contains the security
|> keys, and therefore anyone can intercept the email and fake a message...
|> So, are there any suggestions on how to make this more secure?
|> Email or post...
|> Thanks,

How about running a unique checksum algorithm on the message (including
the source and destination addresses) and appending the result on the end
of the message.  Only the sender and receiver know the algorithm, and so
a third party could not construct a false message without knowing (or
stealing) the checksum algorithm.  

For extra points, change the algorithm periodically.

-- 
All opinions made from fresh ingredients.  No official additives.
                         ______  ______  ______
Marc Brett               \     \/     /\/     /\
Computer Science Dept.    \    /     / /     /  \ 
brett@wg.waii.com          \  /     / /     /    \    WESTERN
VOICE: (713) 963-2311       \/_____/\/_____/\_____\   GEOPHYSICAL
                          W e s t e r n   A t l a s   10001 Richmond Ave
                          I n t e r n a t i o n a l   Houston, TX 77042
From: bguest@ateam.ems.cdc.com (Brandon Guest)
Newsgroups: comp.security.misc
Subject: Re: C2 security specification - where to get a copy?
Date: 15 Oct 92 19:18:38 GMT
Distribution: na
Organization: Empros Systems International, a division of Control Data

In article <1992Oct15.145916.17210@julian.uwo.ca> koops@gaul.csd.uwo.ca (Luke Koops) writes:
>
>Does anyone know where I can get ahold of the C2-level specification?  
>An address and/or phone number would be great.  A source on the net would be
>more than great.
>
>Thanks.
>
>...Steve van der Burg
>
>-- 
>    /
>***/
>*\/* koops@csd.uwo.ca
>****

Excerpting from the book 'Computer Security Basics' (O'Reilly and 
Associates, 1991) by Deborah Russell and G.T. Gangemi Sr.

-- Begin excerpt (pg. 360) --

Most Technical publications are available from the Government Printing
Office or the National Technical Information Service.  Contact:

Superintendent of Document
U.S. Government Printing Office (GPO)
Washington, DC 20402
(202) 783-3238

Hours: 8:00 a.m.-4:00 p.m. EST

You can place an order automatically anytime if you know the GPO stock
number and intend to charge your order to a credit card.  Contact:

-- End excerpt --

The book you are interested in is from the 'Rainbow' series of 
documents.

The book listing C2 security requirements is called the 'Orange' book
and titled 'department of Defense (Dod) Trusted Computer System
Evaluation Criteris (TCSEC): DoD-5200.28-STD, GPO: 008-000-00461-7,
Dated 12/26/85.

My personal recommendation is save your money on the Orange Book and
go buy yourself a copy of Deborah Russell's book from O'Reilly.


Brandon
-- 
H. Brandon Guest                | bguest@ems.cdc.com
Empros Systems International    | (A division of Something)
2300 Berkshire Lane North       | Voice (612) 553-4529
Plymouth, MN 55441-3694         | Fax   (612) 553-4018
Newsgroups: comp.security.misc
From: msyrak@ruc.dk (Mads Syrak Larsen)
Newsgroups: comp.security.misc,alt.security
Subject: Looking for articles about Inet-worm
Keywords: Security, internetworm, morris
Date: 16 Oct 92 16:14:21 GMT
Organization: Roskilde Universitetscenter, Danmark


Hi!

We are a group of students at the university of Roskilde, Denmark.

We are writing on a thesis about internet security, and especially the
internet Worm. We have, however, had a hard time finding material on this
subject, so we would very much appreciate it if someone could help us
with references to books/articles or papers on the subject(s).

Thanks in advance..


Mads Larsen       Jesper Voetmann       Tina Sparre
msyrak@ruc.dk     jesperv@ruc.dk        sparre@ruc.dk

Snail-Mail:

Internet-gruppen, Mads, Tina og Jesper
Datalogi, hus 20.2
Roskilde universitetscenter
postbox 260
DK-4000 Roskilde
Denmark
Newsgroups: comp.security.misc
From: jim@math.psu.edu (Jim Duncan)
Subject: Re: Need reference for court case
Organization: Department of Mathematics, Pennsylvania State University
	<1992Oct5.024348.23203@msuinfo.cl.msu.edu> <Bvo9vF.JuL@cs.psu.edu>
	<1b2ikmINNr0l@usenet.INS.CWRU.Edu>
Date: Tue, 13 Oct 1992 21:38:41 GMT

In article <1b2ikmINNr0l@usenet.INS.CWRU.Edu> ca393@cleveland.Freenet.Edu
(Scott D. Wells) writes:
> Yes, there was a hacker indicted.  The case was dropped...
> The prosecuting attorneys said it was because there was a message on
> login that welcomed users...welcoming hackers.  That was not the real 
> reason though, they could not get anough log evidence to support their
> case and prove the hacker guilty.  The login message thing was just 
> said because they didn't want to admit they messed up.

Can you document this, please?  Telling us about this without documenting it
is the sort of thing that causes these urban legends to proliferate.

Thanks for the info.

	Jim

--
    Jim Duncan <jim@math.psu.edu> Penn State Math Dept Systems Administrator
 "[A computer is] like an Old Testament god, with a lot of rules and no mercy."
						Joseph Campbell
Newsgroups: comp.security.misc
From: doug@cc.ysu.edu (Doug Sewell)
Subject: HELP! (Re: IBM password)
Organization: Bush in 92 ? NOT!
X-Newsreader: Tin 1.1 PL4
Date: Wed, 14 Oct 1992 19:41:37 GMT

Help!

Since it's been brought up... we have a new lab of Gateway 486-33 machines
with IDE hard drives.  The BIOS (Phoenix 4.03 00) doesn't have a documented
way of password protecting the machine.

A student has installed some form of password protection on the machine.
If you boot from a floppy disk, the machine hangs.  If you boot from the
hard-drive, the screen clears and the word 'Password:' is displayed.

We suspect it's some form of commercial or shareware password protection
that imbeds itself in the partition table or some other place where it
will be activated during power-on self test.

Do you have any suggestions (besides removing the hard drives - which
we're considering ?)  How do we get rid of it ?

BTW, it's quite possible that the student responsible is reading this
forum.
--
Doug Sewell, Tech Support, Computer Center, Youngstown State University
doug@cc.ysu.edu	   doug@ysub.bitnet	<internet>!cc.ysu.edu!doug
Family Values: the sexist, racist, homophobic, classist, "Christian" values
of the 50's.
From: mbm@dsbc.icl.co.uk (Malcolm Mladenovic)
Newsgroups: comp.security.misc
Subject: Re: Unix Security Classification
Date: 16 Oct 92 18:45:09 GMT
Distribution: comp
Organization: UNIX Centre, ICL, Bracknell, UK

In article <FAIGIN.92Oct15045748@solarium.aero.org> faigin@aero.org (Daniel P. Faigin) writes:
>Without rewriting, Unix cannot get above B2. Without
>redesign, it can't get B3 and above, because ACLs (access control lists) are
>required.

Note that although USL's SVR4.1ES product on 3b2 (mentioned by someone else)
is being certified at B2 level it includes ACLs.

-Malcolm
Newsgroups: comp.security.misc
From: steveb@inst-sun1.tmc.edu (Steve Bednarczyk)
Subject: Re: IBM password
Organization: Jet Propulsion Laboratory, Pasadena, CA, USA
Date: Tue, 13 Oct 1992 17:09:57 GMT

In article <1992Oct8.205307.4459@ariel.ec.usf.edu> adair@eggo.tmc.edu (Jonathan Adair) writes:
>In article <1992Sep29.095334.20666@ghost.dsi.unimi.it> cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi) writes:
>>bill@chaos.cs.umn.edu ( Hari Seldon     psychohistorian ) writes:
          >> Stuff Deleted<<

>>There's no way to protect a PC from use by unauthorized users ..

agreed!

>>( I am not talking just for DOS, for UNIX too . Think about it !!!)
>
>
>I used to use some cheap password program that went in the config.sys.
>I didn't think of it, but they suggested it in the docs for the program,
>but if you rearrange the jumpers/cables for the floppy drive(s), you
>can move your A: drive to B: (if you only have one drive), and then
>someone can't boot your machine off of floppy without actually opening 
>it up.  It's not tremendously secure, but I think someone is a lot less 
>likely to open a machine up than they are to put a bootable floppy in 
>a drive.  And if you get seriously wierd with your case, like arc-welding
>a new case from 1/4" steel...I guess you could actually approach real 
>security.

 I just installed a small security card called the GATEKEEPER made
by JDR Microdevices ($49). It intercepts the BIOS and will not allow
the boot to continue until a password is entered by the keyboard.
You cannot boot from a floppy or the hard drive. It can be disabled
by removing the card however. I bought a security padlock/case bolt
assembly to keep the case from being removed.
 I agree that these measures can be defeated by a determined person
but I hope that they will just find an easier target. Oh. The really
sensitive material has been encrypted using Norton Diskreet DES.
If they get through that - I'll offer them a raise in salary and put
them on my security committee :}
 
--
=====================================================================
== steveb@inst-sun1.jpl.nasa.gov  Amateur Callsign : NJ6J          ==
== (818) 354-8045                 Packet: NJ6J@WB6YMH.#SOCA.CA.USA ==
===================================================================== 
Newsgroups: comp.security.misc
From: pasq@cup.hp.com (Mark Di Pasquale)
Subject: B1 Security
Summary: HP-UX BLS (B-Level Security)
Date: Thu, 15 Oct 1992 00:32:11 GMT
Organization: Hewlett-Packard
X-Newsreader: TIN [version 1.1.4 PL6]


HP has B1-Level security on the HP9000 Series 8x7 systems and the
HP 9000 Series 7xx systems.  The operating system releases are
HP-UX BLS Release 8.08 (for Series 800s) and HP-UX BLS 8.09 (for
Series 700s).

--
Regards,
Mark DiPasquale, GSY Technical Marketing

 _______       ________________________________________________________________
            /     
           /                   Mark DiPasquale c/o Hewlett-Packard
          ____       ___  /    19111 Pruneridge Avenue, MS 44M9
         /     /    /    /     Cupertino, CA  95014
      __/   __/    _____/      Email: pasq@cup.hp.com
                  /            Phone: (1/408) 447-0911  FAX: (1/408) 447-0177
 ___________   __/   __________________________________________________________
Newsgroups: comp.security.misc
From: breinhar@access.digex.com (Robert B. Reinhardt)
Subject: Re: B1security level
Organization: Express Access Online Communications, Greenbelt, Maryland USA
Date: Thu, 15 Oct 1992 00:19:50 GMT

In article <1992Oct14.181804.27246@burns.jpl.nasa.gov> rbalkenh@sookit.jpl.nasa.gov (robert balkenhol) writes:
>Artur Romao (artur@morgaine.puug.pt) wrote:
>: Does anyone know if there is any version of UNIX that implements the
>: B1 level.
>: 
>: thanks in advance.
>
>Harris Computers offers the "Nighthawk" system
>with their own flavor of UNIX.  I may be wrong, but I seem to recall
>that it was either B1 or B2.
>--
>****************************
>Robert Balkenhol
>Jet Propulsion Laboratory
>rbalkenh@sookit.jpl.nasa.gov
>
>
>

Also, USL and Secureware each have versions of UNIX
at B1, B1+, B2, etc...

USL SVR4.1ES (enhanced security)
UNIX System Laboratories, Inc.
190 River Road
Summit, NJ. 07901
1-800-828-UNIX

---or---

SecureWare, Inc.
2957 Clairmont Avenue
Suite 200
Atlanta, GA. 30329
1-404-315-6296
(POC - David Luterancik (sp))
From: s907175@otto (Hung Cheng Chiang)
Newsgroups: comp.security.misc
Subject: TEST!
Date: 9 Oct 92 07:36:02 GMT
Organization: RMIT Computer Centre
NNTP-Posting-Host: otto.bf.rmit.oz.au

TEST!

Newsgroups: comp.security.misc,alt.security
From: kornele@a.cs.okstate.edu (KORNELE BRYAN WAYN)
Subject: Re: Looking for articles about Inet-worm
Organization: Oklahoma State University
Date: Fri, 16 Oct 92 19:52:39 GMT

> 
> We are a group of students at the university of Roskilde, Denmark.
> 
> We are writing on a thesis about internet security, and especially the
> internet Worm. We have, however, had a hard time finding material on this
> subject, so we would very much appreciate it if someone could help us
> with references to books/articles or papers on the subject(s).
> 
> Thanks in advance..
> 
One of my favorites is "Computers Under Attack: intruders, worms, and
viruses" , edited by Peter J. Denning.  Has many articles from past
Journals and other publications.  

Bryan
kornele@a.cs.okstate.edu
From: Mark%FDC@Arizona.edu (Mark R. Toth)
Newsgroups: comp.security.misc
Subject: Re: SecureCard
Date: 13 Oct 92 21:06:32 GMT
Organization: Facilities Design & Construction, Univ. of Arizona

In article <tnmpl1n@lynx.unm.edu> dthomas@mcl.bdm.com (David Thomas) writes:

>I'm trying to verify the integrity of a product called SecureCard, by
>Data Media Corp. (DMC).  Basically, it is a hardware product that goes
>in a PC that requires the user to insert a card to verify his identity
>and to establish what files/devices he has access to.  Does anyone out
>there have any experience with this product?  If so, please send me
>e-mail (I don't get to this group very much) describing your impressions
>and any vulnerabilities you have found.

>Thanks in advance,

>David Thomas 
>dthomas@mcl.bdm.com

I've seen the glossy sheet and looked like one method, but at our location
the question became one of incorporation with present student/staff id
cards -- did not want another layer of cards/decoder rings/secret handshakes
than what could be easily managed. What is the extent of your project scope?

E-mail

8{)
.............................................................................
                                                            ##   
Mark R. Toth                                      |        ####
University Of Arizona                           | |         ##     
Facilities Design & Construction                | | |             
Physical Resources Bldg #49, Rm 140A            `-| |             
Tucson, Arizona, USA 85721                        |-'            
(602) 621-5281 fax:621-5668          _____________|_______________________
Internet: mark%fdc@arizona.edu         {Not a spokesperson/My views only}
.............................................................................
  Anybody seen my submarine?  I tied it up over there by the cactus...
Newsgroups: comp.security.misc