HDTenEightyP/NetNews huggingface dataset:
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Subject: Re: IBM password
Organization: Fachschaft Informatik, Uni Karlsruhe
Date: Tue, 29 Sep 1992 13:55:01 GMT
X-News-Reader: VMS NEWS 1.23

In <bontchev.717757754@fbihh> bontchev@fbihh.informatik.uni-hamburg.de writes:

>...  
>  3) The login password protection in DR-DOS 6.0 can be bypassed with
>  just a bootable diskette and DEBUG. Of course, if you have something
>  more convenient, like Norton Utilities, the task becomes really easy.

Just ANY sort of password protection scheme can be bypassed if you are
able to boot the machine from a diskette. No matter if you use UNIX
SVR4 or CP/M with a login add-on :-)

If you want to make your machine secure against boot disks, you have
to lock it up. Give a cracker physical access to the hardware and he
can do anything he wants.

For the original poster: There are many programs around for MS-DOS
password protection at boot, CONFIG or AUTOEXEC level. Check an
archive, surely you'll find something sooner or later ;-)
(Sorry I don't know names of appropriate programs but I don't use DOS
any more for other reasons :-)


MfG,
        Olaf
-- 
    o     Olaf Titz - comp.sc.student - univ of karlsruhe - germany
 _ /<_    s_titz@iravcl.ira.uka.de - uknf@dkauni2.bitnet - praetorius@irc
(_)>(_)   +49-721-60439 - did i forget something?
The government of the people, by the people, for the people. - Lincoln
Newsgroups: comp.security.misc
From: erc@unislc.uucp (Ed Carp)
Subject: Re: IBM password
X-Newsreader: TIN [version 1.1 PL6]
Organization: Unisys Corporation SLC
Date: Mon, 5 Oct 1992 18:31:29 GMT

Vesselin Bontchev (bontchev@fbihh.informatik.uni-hamburg.de) wrote:

: DEBUG can access the disk only as logical sectors, so in order to
: access it on a physical level, you'll have to write a short program,
: using INT 13h - the BIOS service, used to access the disk. However,
: people who know how to do that, usually don't ask why booting from a
: floppy can bypass the hard disk protection, so I'll describe an easier

You can also use such a program to erase one's hard disk.

The only security in this case is to physically remove the floppy drives from
the system.  In my secure testbed I have such a system which is connected
to other systems via serial port only, and it polls other systems for stuff.
-- 
Ed Carp, N7EKG     erc@apple.com                801/538-0177
"This is the final task I will ever give you, and it  goes  on  forever.   Act
happy, feel happy, be happy, without a reason in the world. Then you can love,
and do what you will."           -- Dan Millman, "Way Of The Peaceful Warrior"
Newsgroups: comp.security.misc
From: aharris@alfred.carleton.ca (Andrew Harris)
Subject: computer crime
Keywords: computer crime
Organization: Carleton University
Date: Sun, 4 Oct 1992 23:43:05 GMT

I am looking for information on computer crime - not on how to do it,
or how to stop it, or on the economic costs -- but on who does it and
why (though I realize that my questions can not be divorced from the
above areas) If anybody has any references or suggestions of where I
might look  for information on who does computer crime - Is there
anyone out there who has never used copied something or stolen time
from a system???????  I think not --- but I,m looking for something a
little bit more ostentatious -- any information would be helpfull -
suggestions of where else I should post this??????
                           Thanks     Andy

Newsgroups: comp.security.misc
From: alawrenc@sobeco.com (a.lawrence)
Subject: Re: IBM password
Reply-To: alawrenc@sobeco.com
Organization: Lawrence & Assc.
Date: Wed, 30 Sep 92 02:50:42 GMT

In <fstuart.920929091018@lab16.eng.auburn.edu> fstuart@eng.auburn.edu (Frank Stuart) writes:

>In article <BvAv1r.M8C@csugrad.cs.vt.edu> rlee@csugrad.cs.vt.edu (Richard Lee) writes:
>>Does anyone know of a program that puts a password program in the config.sys and
>>the boot sector of an IBM PC?  I know of many that it's in the autoexec.bat
>>but that is almost laughable.
>>Thanks

For what is worth,  I see several posts mentioning  how to use Norton
Utilies to break thru various protection schemes.   I  find  that Norton's
DISKREET  program is the most  effective protection I have found so far 
for data in a PC.  It will not prevent anyone from booting the machine,
but data in DISKREET's virtual disk can be DES encrypted, and it even
allows the creation of virtual disks on diskettes, each with itsown
password (key).  Access to the data is very straight foreward once the
key is entered.

-- 
If any given program runs correctly, it is obsolete.
=========================================================================
Andrew Lawrence, Informaticien Conseil           |  alawrenc@sobeco.com
3605 St-Urbain, #1605                            |  uunet!sobeco!alawrenc
From: vince@ghost.dsi.unimi.it (David Vincenzetti)
Newsgroups: comp.security.misc
Subject: Re: IBM password
Date: 29 Sep 92 17:02:04 GMT
Article-I.D.: ghost.1992Sep29.170204.22957
Organization: Computer Science Dep. - Milan University

In <1992Sep29.095334.20666@ghost.dsi.unimi.it> cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi) writes:

>There's no way to protect a PC from use by unauthorized users ..
>( I am not talking just for DOS, for UNIX too . Think about it !!!)
>>bill pociengel
>>--
>>llbi locgeenpi " i'm a little confused right now"
>
>	Massimo
>-- 
>--------------------------------------------------------------------------
>!  /|/|  /| \ /  ! Massimo Cotrozzi  Computer Science Dept. Milan Italy  !
>! /   | /-|  \   ! cotrozzi@ghost.dsi.unimi.it      			 !
>!/    |/  | / \  ! massimo@cdc835.cdc.polimi.it	                         !

I strongly agree with Massimo.
Effectively protecting Unix machines is a very hard task and trying to
protect a D class guy like MSDOS is simply ridicolous. Think about it.

Ciao,	David
-- 
David Vincenzetti  -*-  System Administrator and C Programmer
Dip. di Scienze dell'Informazione,      Internet: vince@ghost.dsi.unimi.it
V. Comelico 41, I-20133, Milano, Italy  Phone   : +39 2 55006 392
**PGP public key available by finger**  Fax     : +39 2 55006 373
Newsgroups: comp.security.misc
From: jason@coombs.anu.edu.au (jason..)
Subject: Re: IBM password
Organization: Computer Services Centre, Australian National University
Date: 29 Sep 92 14:11:39 GMT

cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi) writes:

>bill@chaos.cs.umn.edu ( Hari Seldon     psychohistorian ) writes:

>>In <BvAv1r.M8C@csugrad.cs.vt.edu> rlee@csugrad.cs.vt.edu (Richard Lee) writes:

>>>Does anyone know of a program that puts a password program in the config.sys and
>>>the boot sector of an IBM PC?  I know of many that it's in the autoexec.bat
>>>but that is almost laughable.

>>drdos 6 can provide what you want

>If you don't mind for people booting your PC with MSDOS 5.0,
>editing the disk and changing the line in config.sys that says
>DEVICE=C:\DRDOS\LOGIN.EXE to something like
>REM CE=C:\DRDOS\LOGIN.EXE
>and then boot your computer again.
>You could put a BIOS password but then if someone takes the battery out you're done
>again.
>There's no way to protect a PC from use by unauthorized users ..
>( I am not talking just for DOS, for UNIX too . Think about it !!!)
>>bill pociengel
>>--
>>llbi locgeenpi " i'm a little confused right now"

I believe you can encrypt the contents of your harddrive when you use superstor
which is supplied with DR-DOS 6. This is as well as encrypting certain 
directories (logical drives?) to prevent access to them. Hence, you boot
of a bootable dos disk .. grab your copy of norton's and proceed to examine
junk (hopefully) .. There are probably ways around it, but it seems as secure
as you could hope to get for whatever the cost of dr-dos is ..

-jason
>	Massimo
>-- 
>--------------------------------------------------------------------------
>!  /|/|  /| \ /  ! Massimo Cotrozzi  Computer Science Dept. Milan Italy  !
>! /   | /-|  \   ! cotrozzi@ghost.dsi.unimi.it      			 !
>!/    |/  | / \  ! massimo@cdc835.cdc.polimi.it	                         !
--

Jason Andrade	jason@coombs.anu.edu.au			irc: Morkeleb
		jason@sorokin.anu.edu.au
		jason@montebello.ecom.unimelb.edu.au
Newsgroups: comp.security.misc
From: vince@ghost.dsi.unimi.it (David Vincenzetti)
Subject: Re: hill: how secure?
Organization: Computer Science Dep. - Milan University
Date: Tue, 29 Sep 1992 16:34:29 GMT

In <19qmcfINN3jp@nestroy.wu-wien.ac.at> bruhn@uxe.wu-wien.ac.at (Peter Bruhn) writes:

>I am new to this group, so I hope my question is appropriate: How secure
>is the (Unix)program "hill"? What are the chances that someone can decrypt
>my hill-texts?
>
>Any comments are appreciated
>
>Thanks
>
>Peter (bruhn@uxe.wu-wien.ac.at)

The hill program is very weak. I suggest you use DES instead.

Ciao,	David
-- 
David Vincenzetti  -*-  System Administrator and C Programmer
Dip. di Scienze dell'Informazione,      Internet: vince@ghost.dsi.unimi.it
V. Comelico 41, I-20133, Milano, Italy  Phone   : +39 2 55006 392
**PGP public key available by finger**  Fax     : +39 2 55006 373
Newsgroups: comp.security.misc
From: S_TITZ@iravcl.ira.uka.de (Olaf Titz)
Subject: Re: IBM password
Organization: Fachschaft Informatik, Uni Karlsruhe
Date: Tue, 6 Oct 1992 15:53:47 GMT
X-News-Reader: VMS NEWS 1.23

In <1992Oct5.182237.17441@unislc.uucp> erc@unislc.uucp writes:

>...
>  : Just ANY sort of password protection scheme can be bypassed if you are
>  : able to boot the machine from a diskette. No matter if you use UNIX
>  : SVR4 or CP/M with a login add-on :-)
>  
>  Not if the password protection scheme encrypts your hard drive. :)

But if this is desirable is a frequently discussed topic...
If you encrypt your hard disk you risk a total loss of data if the key
gets lost. The key may be a password that gets forgotten or a special
'emergency' boot disk that is lost or accidentally erased, or
whatever.
I prefer a readable hard disk, and that at least *I* can in case of
accident boot from a disk and 'hack' it up (has already happened), and
having my machine physically locked from intruders.



MfG,
        Olaf
-- 
    o     Olaf Titz - comp.sc.student - univ of karlsruhe - germany
 _ /<_    s_titz@iravcl.ira.uka.de - uknf@dkauni2.bitnet - praetorius@irc
(_)>(_)   +49-721-60439 - did i forget something?
One frequently hears horror expressed that a 2M byte machine may have 400K
 devoted to its operating system... - Fred Brooks (1975)
Newsgroups: comp.security.misc
From: fstuart@eng.auburn.edu (Frank Stuart)
Subject: Re: Need reference for court case
Organization: Auburn University Engineering
Date: Tue, 6 Oct 1992 01:53:09 GMT

In article <Bvo9vF.JuL@cs.psu.edu> jim@math.psu.edu (Jim Duncan) writes:
>In article <1992Oct5.024348.23203@msuinfo.cl.msu.edu> rjs@crs.cl.msu.edu
>(Robert J. Stanton) writes:
>> I heard or read of a case a while back where the hacker
>> who was being proseuted was exonerated because the system
>> that he broke into printed a "welcome" greeting.
>> 
>> Can anybody point me to some info about this, preferably 
>> something in print?
>
>I asked about this at the USENIX Unix Computer Security Symposium in
>Baltimore a few weeks ago and Gene Spafford told me that this appears to be
>an urban legend.  I don't have the details, but I believe he cited a search
>of LEXIS by some researchers looking for just the case you mention and
>nothing was found.
>
>That's not to say that someone didn't start to bring the case and then
>dropped it before it got to trial.
>
>Sorry I don't have some details for you.

I've heard some version of this story.  As I recall, it was a voice-mail
system.  Sorry, but I don't have details either.


Frank Stuart           |   Slower traffic keep right.  |  Don't Panic
fstuart@eng.auburn.edu |   MMMMMmmmmm lutefisk.        |  Never moon a werewolf
Newsgroups: comp.security.misc
Subject: Re: IBM password
From: frey@alfheim.actrix.gen.nz (Bruce Clement)
Date: Wed, 30 Sep 92 10:57:35 GMT
Distribution: world
Organization: Private System

rlee@csugrad.cs.vt.edu writes in article <BvAv1r.M8C@csugrad.cs.vt.edu>:
> 
> Does anyone know of a program that puts a password program in the config.sys and
> the boot sector of an IBM PC?  I know of many that it's in the autoexec.bat
> but that is almost laughable.

There's a shareware program around called PC-VAULT. We use it at work on
all our portables (Sorry, but I'm at home now & don't have access to any info
on author or registration fees).

It works by requiring a password before booting DOS. The DOS partition
is not readable by DOS booted from a floppy, but I don't know if that is
acheived by fiddling the partition table or by encrypting the disk.

In either case, I would only look on encryption as a defense against relatively 
simple attacks. Presumably the program can be read with a debugger, and the 
key should be derivable from the fact that the plain text of the DOS boot 
sector is known.

Against that, there is a good chance that anyone stealing your PC would simply
repartition/reformat & your sensitive data would go unread.

--
Bruce Clement    (frey@alfheim.actrix.gen.nz  SNEWS/2,  UUPC 1.11q)
Newsgroups: comp.security.misc
From: jlynch@portal.hq.videocart.com (John Lynch)
Subject: Intel 8294 DES IC
Organization: VideOcart Inc.
X-Newsreader: Tin 1.1 PL3
Date: Wed, 30 Sep 1992 17:46:52 GMT

I'm looking for advice and information regarding the Intel 8294 DES
unit.  In particular, does anyone have experience implementing its
standby mode (low power)?  Thanks.


==========================================================================
John Lynch @ VideOcart, Inc.
300 S. Wacker Dr.                                     PHONE: (312)987-5049
Chicago, IL 60606                                       FAX: (312)922-5096

-- 
==========================================================================
John Lynch @ VideOcart, Inc.
300 S. Wacker Dr.                                     PHONE: (312)987-5049
Chicago, IL 60606                                       FAX: (312)922-5096
Newsgroups: comp.security.misc
From: bob@sunspot.noao.edu (Bob Riegelmann)
Subject: Re: IBM password
Organization: National Solar Observatory/SP, Sunspot NM, USA
Date: Tue, 29 Sep 92 16:54:10 GMT

[...] much advice about ways to encrypt hard disks deleted.

If you have a user who requires a high degree of security, contact any one
of a number of makers of *removeable* disk drives.  Physical security is really
the only way to go.  Buy them a good wall or floor safe, and have them be sure
that they put the drive away after every use.  Be sure there is *no* other 
drive in the system, as "secure" information has a habit of leaking onto the
other drives unless carefully monitored.  


bob

-- 
<=============================================================================>
Bob Riegelmann   Be slow to meddle in the affairs  bob@sunspot.sunspot.noao.edu
P.O. Box 58              of programmers, 
Sunspot, NM 88349-0058       for they get soggy and hard to light.
Newsgroups: comp.security.misc
From: wayner@cs.cornell.edu (Peter Wayner)
Subject: Conference in Baltimore MD
Organization: Cornell Univ. CS Dept, Ithaca NY 14853
Date: Tue, 6 Oct 1992 14:28:18 GMT

There is going to be a SEcurity Conference In Baltimore MD later
this month. I would be obliged if someone could send me a copy of the
electronic flyer announcing the fest. Thanks...

-Peter Wayner
(wayner@cs.cornell.edu)

-- 
Peter Wayner   Department of Computer Science Cornell Univ. Ithaca, NY 14850
EMail:wayner@cs.cornell.edu    Office: 607-255-9202 or 255-1008
Home: 116 Oak Ave, Ithaca, NY 14850  Phone: 607-277-6678
From: rlee@csugrad.cs.vt.edu (Richard Lee)
Newsgroups: comp.security.misc
Subject: IBM password
Date: 28 Sep 92 17:53:50 GMT
Organization: Virginia Tech Computer Science Dept, Blacksburg, VA

Does anyone know of a program that puts a password program in the config.sys and
the boot sector of an IBM PC?  I know of many that it's in the autoexec.bat
but that is almost laughable.
Thanks

-- 
 |   Rich Lee     |   Richard Lee               |                         |
 | My Power is    |   1711 Whipple Dr.          | rlee@csugrad.cs.vt.edu  |
 | Beyond Your    |   Apt 11                    | or                      |
 | Understanding  |   Blacksburg,Va 24060       | rlee@earth.tjhsst.edu   |
Newsgroups: comp.security.misc
From: ckchiu@cucs11.cs.cuhk.hk (Chiu Chong-kan)
Subject: Looking for UNIX SECURITY papers/reference
Keywords: UNIX
Organization: Faculty of Engineering, The Chinese U. of Hong Kong
Date: Mon, 5 Oct 1992 15:22:01 GMT

I am looking for some UNIX SECURITY related papers that are available through
internet.  Please E-MAIL me some or MAIL me to let me know where I can ftp them.

Thanks a lot !!!

C.K.Chiu
Newsgroups: comp.security.misc
From: clark@angelo.amd.com (Brad D. Clark)
Subject: Computer Crime a Threat? Darn Straight!
Summary: See the article...
Keywords: net.views security policy
Organization: Advanced Micro Devices, Inc.
Date: Mon, 5 Oct 1992 21:48:37 GMT

I am performing the duties of Data Security Administrator at Advanced
Micro Devices, specifically dealing with IBM mainframes. More specifically,
I administrate the security system on our corporate mainframes (MVS running
RACF).

AMD takes data security _very seriously_. AMD considers any information
residing on corporate computing platforms as valued assets, and should be
protected against unauthorized access and/or distribution. Therefore, 
I keep a working relationship with Corporate Security, and our company's
Unix security Guru. With effective communication and coordination between
security and platform entities, the overall system is, IMHO, more secure.

An awareness should be built up between any and all departments dealing with
data security and integrity, so that all informational assets are better
secured.

Just my humble opinions, mind you, but I would wager, not too far off
from Corporate Thinking...

Brad Clark
Data Security Person
Advanced Micro Devices
Sunnyvale, CA
(408) 749-5192

clark@brahms.amd.com
   - or -
clark@bartok.amd.com

Newsgroups: comp.security.misc,alt.security
From: jtruitt@dw3f.ess.harris.com (Jim Truitt)
Subject: LOOKING FOR:Security for ISDN (documents/references/contacts/...)
Date: Mon, 28 Sep 1992 13:30:43 GMT
Reply-To: jtruitt@dw3f.ess.harris.com (Jim Truitt)
Organization: Harris GISD
Keywords: ISDN, security

Hi,

	I just started on a project evaluating security for ISDN. I have been
looking on the
Internet for  documents/references. Any pointers to sites where such
materials can be found
would be helpful and appreciated.

Thanks
Jim Truitt
--
-------------------------------------------------------------------------------
| NAME	:JAMES O. TRUITT (JIM)		| HARRIS CORPORATION	| INFORMATION |
| PHONE	:1-407-984-5791			| P. O. BOX 98000	|   SYSTEMS   |
| FAX	:1-407-984-6323			| MELBOURNE, FL 32902	|  DIVISION   |
| EMAIL	:HARRIS.JTRUITT@IC1D.HARRIS.COM	|			|             |	
-------------------------------------------------------------------------------
Newsgroups: comp.security.misc
From: jim@ferkel.ucsb.edu (Jim Lick)
Subject: Re: Doorknobs
Organization: University of California, Santa Barbara
Distribution: usa
Date: Tue, 6 Oct 1992 09:24:58 GMT

In <81115@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>  How does one tell if someone is doing "doorknobs" on the network?
>Doorknobs is when someone tries the guest account, and other accounts
>with default passwords on varied systems to get access.

This system is set up with scripts which print out a message when this is
tried.  The message is:

-----

 The pig systems (piggy, ferkel, oinker, cavevax) DO NOT
 have guest accounts.  Please DO NOT try to log in here
 without authorization.  Repeated attempts to log in WILL
 result in a complaint being sent to your sysadmin.


 If you were trying to use ftp, you need to use the ftp
 program and not telnet to access files.  For basic help
 on using ftp, try the command 'finger ftp@ferkel.ucsb.edu'.


 If, on the other hand, you were looking for a free guest
 account, you should know that trying to log in on random
 systems is akin to walking down a street and checking for 
 unlocked front doors.  It is anti-social, and can get you 
 into trouble.  To look for public systems, consult the 
 USENET newsgroups alt.internet.services and alt.bbs.internet.

-----

The message is the .plan file, so it is displayed on finger attempts as
well.  The advantages of this are that logins show up in wtmp (which I
have mailed to me every morning), so you know when it happens.  The user is
warned not to do that here, and this is further reinforced by the promise to
notify their admin if it happens again.  It also redirects clueless folk who
don't know the difference between telnet and ftp.  And it tries to persuade
the user that such behaviour is wrong (or at least impolite!) and gives them
sources to find what they are looking for through legitimate means.

                            Jim Lick		       
Work: University of California	| Play: 1236 Camino Meleno
      Santa Barbara		|       Santa Barbara, CA 93111-1007
      Dept. of Mechanical Engr. |	(805) 964-2088 voice/msg
      2311 Engr II Building     |	(805) MUD-SPY1 data
      (805) 893-4113            |       jim@tcp.com
      jim@ferkel.ucsb.edu	| This space intentionally left blank

Newsgroups: comp.security.misc,alt.security
From: rja14@cl.cam.ac.uk (Ross Anderson)
Subject: Re: IBM password
Reply-To: rja14@cl.cam.ac.uk (Ross Anderson)
Organization: U of Cambridge, England
Date: Tue, 6 Oct 1992 15:39:08 GMT

In <bontchev.718376938@fbihh>, bontchev@fbihh.informatik.uni-hamburg.de 
(Vesselin Bontchev) writes:

> erc@unislc.uucp (Ed Carp) writes:
>
> > Then again, DES isn't that strong if your keys aren't chosen carefully 
> > (for a discussion of this, see sci.crypt).
>
> DES is strong enough. In fact, you have to choose very carefully, if
> you want to get weak keys... :-) There are only 4 weak keys in the
> whole 2^56 keyspace...

I looked at what a PC dealer said was the top-selling office automation 
suite. It was called Da Vinci or something like that. Look, it's even 
got DES encryption!

Wow! I wondered how they'd got that past the State Department!

Until I had a closer look, that is. It takes one password of up to eight
characters and produces a ciphertext file with visible eight-byte block
patterns - must be ECB (or something similar but homemade). There are a lot 
of null strings in its cleartext file formats and so there is one dominant 
ciphertext block.

Looks like a PC will be enough to do keysearch on this one: just encrypt
a null string with all the passwords in a dictionary, and sort the list.

Ross
Newsgroups: comp.security.misc