HDTenEightyP/NetNews huggingface dataset:
From: hendrick@ctron.com (Jim Hendrick)
Newsgroups: alt.security
Subject: Xterminals and security, Question
Date: 10 Oct 92 14:22:02 GMT
Distribution: alt
Organization: Cabletron Systems Inc.

Hi,
	I am looking for information on the security problems with
using Xterminals to access "realtively secure" machines. By this I
mean machines that act as access points to a database containing
critical resources. These access machines have been physically
"secured" in a minimal sense, locked cabinets, no terminals
considered secure in the /etc/ttytab file including the console. As
part of the duties of several administrators, they are required to log
into these "trusted" machines and occasionally su to root or other
more priviliged accounts. My question relates to the ability (or
inability) to safely use Xterminals to access these "trusted"
machines. Specifically, does anyone know of a way to secure the
transmissions from these Xterminals such that a network "snooper"
could not obtain the cleartext passwords as they fly by? I am moving
towards using Kerberos as the authentication service for these
machines so that one could (from a workstation running K.) use the
encrypted mode of transmission for sensitive login sessions and to
generally keep cleartext passwords off the wire but now I have been
asked to set up Xterminals for the administrative staff to use and
think that this might pose a problem. {whew, how's that for a sentence :-}

Please reply via email any questions, answers, comments or pointers to
further information sources. I will summarize if there appears to be
the desire.

Thanks!!

Jim

--
###########################################################################
### Jim Hendrick (hendrick@ctron.com)   ###                             ###
### Cabletron Systems Inc.              ###   " My opinions, etc are    ###
### P. O. Box 5005                      ### exclusively the property    ###
### Rochester, NH 03867-5005            ### of nobody in particular."   ###
### (603) 332-9400 x1457                ###                             ###
### fax:(603)332-1019                   ###                             ###
###########################################################################
From: cower@ssd.intel.com (Rich Cower)
Newsgroups: alt.security,comp.security
Subject: Some disk degaussing questions
Date: 12 Oct 92 15:39:09 GMT
Distribution: usa
Organization: Supercomputer Systems Division (SSD), Intel


I've got some questions about degaussing disks, maybe someone can help.

1. Are there degausing devices available that will degauss disks that
   are over 120mb? Who makes them? How much do they cost?

2. Will degaussing these larger disks in any way make them not useable?
   We've heard that the field required to degauss these large disks will
   somehow damage the servo, and make the disk unuseable.

3. Do other sites worry about sending disks out for repair that might
   contain sensitive data?

thanks...rich cower
Newsgroups: alt.security
From: jtruitt@dw3f.ess.harris.com (Jim Truitt)
Subject: LOOKING FOR:      ISO 7498-2      (REPOST)
Date: Thu, 8 Oct 1992 18:59:01 GMT
Reply-To: jtruitt@dw3f.ess.harris.com (Jim Truitt)
Organization: Harris GISD

HI

	I'm still trying to locate an ftpable copy of ;

ISO 7498-2, "Information Processing Systems - Open Systems
Interconnection - 
		Basic Reference Model Part 2: Security Architecture"

Thanks in advance
Jim T.
--
----------------------------------------------------------------------
----------
| NAME	:JAMES O. TRUITT (JIM)		| HARRIS CORPORATION	| INFORMATION |
| PHONE	:1-407-984-5791			| P. O. BOX 98000	|   SYSTEMS   |
| FAX	:1-407-984-6323			| MELBOURNE, FL 32902	|  DIVISION   |
| EMAIL	:HARRIS.JTRUITT@IC1D.HARRIS.COM	|			|             |	
----------------------------------------------------------------------
----------
From: uri@watson.ibm.com (Uri Blumenthal)
Newsgroups: alt.security
Subject: Re: IBM password
Date: 14 Oct 92 19:20:52 GMT
Reply-To: uri@watson.ibm.com
Distribution: usa
Organization: Huh?
Disclaimer: This posting represents the poster's views, not necessarily those of IBM

In article <1992Oct14.013409.77393@watson.ibm.com>
> Oh no! You can't really see that it's `      '! It could as well
> be `000000000', `111111111', or whatever! So you have to run
> your 50,000 words (probable key) against several probable
> plaintexts... And in case both:

Let me correct myself. Actually, if you spot a pattern in 
an encrypted file, it means just that - there's a pattern.
Why do you assume it's made of similar characters? It can
be as well repeating of "12345678", "3.141592", or you 
tell me what!
From: barmar@think.com (Barry Margolin)
Newsgroups: alt.security
Subject: Re: Dataless system
Date: 8 Oct 1992 15:27:57 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
Distribution: usa
NNTP-Posting-Host: telecaster.think.com

In article <1992Oct8.132019.14318@crd.ge.com> davidsen@crd.ge.com (bill davidsen) writes:
>I don't normally regard any system which needs to be backed up as
>dataless, just for the record. Typically I have a dataless client with
>tmp and swap local for performance, and ALL filesystems remote.

We don't back up / and /usr on our dataless systems.  If a disk goes bad we
can just clone a new one from another, identically-configured system.  In
the case of those few files that change from time to time we use rdist to
keep them in sync.
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
From: davidsen@ariel.crd.GE.COM (william E Davidsen)
Newsgroups: alt.security
Subject: Re: Dataless system
Date: 12 Oct 92 13:24:57 GMT
Reply-To: davidsen@crd.ge.com (bill davidsen)
Distribution: usa
Organization: GE Corporate R&D Center, Schenectady NY

In article <1b1k1tINNhe6@early-bird.think.com>, barmar@think.com (Barry Margolin) writes:
| In article <1992Oct8.132019.14318@crd.ge.com> davidsen@crd.ge.com (bill davidsen) writes:
| >I don't normally regard any system which needs to be backed up as
| >dataless, just for the record. Typically I have a dataless client with
| >tmp and swap local for performance, and ALL filesystems remote.
| 
| We don't back up / and /usr on our dataless systems.  If a disk goes bad we
| can just clone a new one from another, identically-configured system.  In
| the case of those few files that change from time to time we use rdist to
| keep them in sync.

  I guess I didn't make that totally clear, I meant that you can't put
in a raw drive, partition it, and go. Having a complete copy is a
backup, in that sense.
-- 
bill davidsen, GE Corp. R&D Center; Box 8; Schenectady NY 12345
    Keyboard controller has been disabled, press F1 to continue.
From: tihor@acf3.NYU.EDU (Stephen Tihor)
Newsgroups: alt.security
Subject: Re: Dataless system
Date: 7 Oct 92 20:58:00 GMT
Organization: New York University

The ideal model of dataless system is of course one running the system 
off of a CD-ROM csache parts of it on the magnetic disks which it reinits 
each boot and where it puts its paging/swaping/tmp space.
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 10 October 1992
Date: Sat, 10 Oct 1992 22:00:28 EDT
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<dank.718304327@blacks> "npasswd patched to handle Sun's shadow password file"
From: peter@ferranti.com (peter da silva)
Newsgroups: alt.security
Subject: Re: Dataless system
Date: 6 Oct 92 16:30:21 GMT
Distribution: usa
Organization: Xenix Support, FICC

In article <81116@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>   I heard this mentioned a couple of times.  What is a dataless system?

A dataless system is simply one where there is no working data stored on it,
just the operating system and enough stuff to get it running on a network
with reasonable performance. It's one step up from a diskless system, in
that you can simply reload it and not worry about backups or security, but
you don't have to do things like swapping or paging over ether.

The security considerations of this (both pro and con) should be obvious.

> It that similar to the state of my hard drive after being erased :-) ?

No, but just shortly after that... when you've reinstalled the OS but haven't
restored your files from backup.
-- 
Peter da Silva                                          `-_-'
Ferranti Intl. Ctls. Corp.                               'U` 
Sugar Land, TX  77487-5012           "Heeft u vandaag al uw wolf geknuffeld?"
+1 713 274 5180            "Dat is mijn gezel, en niet bedoeld als een fooi."
From: gk@skyline.UUCP (Gary Kremen)
Newsgroups: alt.security
Subject: Re: Some disk degaussing questions - A better way
Date: Mon, 12 Oct 92 23:11:04 GMT
Organization: Skyline Ridge Partners
Reply-To: gk@skyline.UUCP (Gary Kremen)
Distribution: usa
X-Mailer: uAccess - Mac Release: 1.5


In article <1bcar1INN1t9@network.ucsd.edu>, brian@ucsd.edu (Brian Kantor) writes:
> 
> Quite a few hard drives have a 'servo track' recorded on one of the
> platters that helps the positioner find what track it's on.  Usually
> such drives have an odd number of user-accessable surfaces - look for
> a drive with 5 heads specified, for example.
> 
> Degaussing the drive often erases or damages the recorded servo track.
> The drive is unusable until a new servo track can be recorded.  Not all
> repair facilities have the ability to do that.
Yes this is very true.  Too many Osteds.
> 
> Thus by degausing a drive you may render it unrepairable, or raise the
> cost of the repair.
Approximately 25% of the time.
> 
> If the drive is mostly operational, you may be able to write zeros and
> other patterns all over it several times to obscure the data.
Yes, but you must go below the operating system to do it as to take
into consideration bad blocks and other disk conditions.
> 
> If the data on the drive must be kept private, then you may wish to
> consider simply destroying the drive and buying a new one.  The cost is
> the price you pay for your data security.
> 	- Brian

There is a much better way.  A company that I do work with has
a product that is in the Defense Investigative Service (DIS)
approval process for software degausing.  Instead of crushing
the disk or disolving the disk platters in acid (environmental
unsafe), you can use this software product (UniShred Pro for UNIX
workstations).  The product goes directly to the disk
controller and "scrubs" the disk in a DOD / DIS approved
manner.  

Sorry about the tooting the company, but disk
destruction is not only a waste, but an environmental disaster.
The name of the product is UniShred Pro.  For more information
call UNIX CENTRAL at 1-800-553-UNIX, Qualix Group at
1-800-245-UNIX or Los Altos Technologies (info@lat.com)
at 1-800-999-UNIX or send me e-mail.

Gary Kremen  {uunet,mips, fernwood}!dikta.chicago.com!skyline!gk, fss@btr.com

 
Newsgroups: alt.security
From: ab03@einstein.et.tudelft.nl (CA-BO)
Newsgroups: alt.security
Subject: Killer Cracker
Date: 16 Oct 92 14:17:14 GMT
Organization: Delft University of Technology, Dept. of Electrical Engineering

I got killer cracker a few weeks ago and compiled it sucessfully, using
Borland C++ compiler but when i perform the test included in the program,
the answer i get is that the encryption is wrong. Anyone has any idea how
to solve this problem?
From: jerry@pawnee.telecom.ksu.edu (Jerry Anderson)
Newsgroups: alt.security
Subject: Re: Letter Frequency
Date: 15 Oct 1992 12:54:11 -0500
Organization: Kansas State University
NNTP-Posting-Host: pawnee.telecom.ksu.edu

holland@matt.ksu.ksu.edu (Rich Holland) writes:

> I'm in dire need of a letter frequency chart for the English language.  I
> remember as a kid reading books on basic cryptanalysis and seeing these
> charts of the most frequently used letter (like "E" is most often used,
> then "S" or "R" or something, etc).  I don't remember the order, but now
> I need it.  Anyone got a copy of a table of something like this online?

> If not, got a source where I can go look it up quick?

Nope, but it's an easy program:

    #include <stdio.h>

    main()
    {
        int c,
            letter[128];

        for(c = 32; c < 127; c++)
            letter[c] = 0;

        while((c = getchar()) != EOF)
            if(c > 31 && c < 127)   /* not a control character (0-31)
                                              and not delete (127) */
                letter[c]++;

        for(c = 32; c < 127; c++)
            printf("%c: %10d\n", c, letter[c]);

        putchar('\n');
    }

The output of this program is suitable for sorting, al la:

    freq < /usr/dict/words | sort -r +1

Of course, it is not really a letter frequency program but a
character frequency program.  "A" and "a" are counted
separately.  This is easily fixable, just change the while
loop:

        while((c = getchar()) != EOF)
        {
            if(c >= 'A' && c <= 'Z')
                c += ('a' - 'A');
            if(c > 31 && c < 127)   /* not a control character (0-31)
                                              and not delete (127) */
                letter[c]++;
        }

Pick any reasonably large statistical universe (such as
/usr/dict/words) and run freq on it.  Voila' ... a letter
frequency chart.

[Sure it's highly ASCII-specific code, but whaddaya want
from a quick hack?  :-)]

-- 
jerry@telecom.ksu.edu                     Jerry Anderson
                                          Kansas State University
vox: (913) 532-6936                           Telecommunications
fax: (913) 532-7114                       Manhattan  KS  66506
Organization: Penn State University
Date: Thu, 8 Oct 1992 07:52:28 EDT
From: Peter M. Weiss <PMW1@psuvm.psu.edu>
Newsgroups: alt.security
Subject: Re: Dataless system

The diskless, cpuless executive workstation.  This marvel of
high tech engineering opens up a new era of desktop computing:
the diskless, cpuless executive workstation (DCEW) is a marvel
of R&D engineering.  Borne from thinktank work done for the
space shuttle program, this product is available now at all
PC dealers and mail order companies and is manufactured by most
computer firms.  Various brand names have been applied, but
perhaps the best know as the DEC VT100.

                                        Dealer Inquires Invited

w/ Tongue Firmly Planted in Cheek -- Pete
From: ujacampbe@memstvx1.memst.edu
Newsgroups: alt.security
Subject: FTP Sites for PGP 2.0???????
Date: 14 Oct 92 17:13:24 -0600
Organization: Memphis State University

Does anyone know of an FTP site for PGP 2.0?  PGP 1.0 is all I have 
been able to find on Internet and on BBS's in my area.  Any info would
be GREATLY appreciated!

James Campbell
Memphis State University
Newsgroups: alt.security.pgp,sci.crypt
From: ahaley@eo17 (Andrew Haley)
Subject: Re: Prime generation, a possible weakness in PGP?
Organization: EO, Inc.
X-Newsreader: TIN [version 1.1 PL6]
Distribution: alt
Date: Fri, 9 Oct 1992 16:01:50 GMT

Ari Huttunen (Ari.Huttunen@hut.fi) wrote:
: I am concerned about the primeness of the prime numbers
: that PGP generates. This is how they are done:
: 	- first throw away numbers that are divisible
: 	  by small primes
: 	- then use Fermat's theorem 4 times
: 	  (Fermat's theorem:  if  b**(n-1) != 1 (mod n), then
: 	  'n' cannot be a prime. This requires that 'b' and 'n'
: 	  are relatively prime.)
: 
: My concern is the number of rounds of the Fermat test. It's only 4.
: I would not trust this level of primeness. Also, the resulting
: number might be a Carmichael number. (So it would pass any number
: of such tests.) 

Large pseudoprimes (of any base) are very rare indeed.  RSADSI did
some experiments a couple of years ago to search for such numbers, and
found none (this is written up in one of the CRYPTO proceedings).

It is conjectured that the density of base 2 pseudoprimes of this size
is less than 10^-10 (this is from memory, so that figure might be
wrong.)  In any case, it is likely that a composite p or q would cause
messages to not decrypt correctly, a fact that you'd soon notice.

It might be worth using the Miller-Rabin test, in which no analogues
of Carmichael numbers exist, as a backup.  This would be easy to add
to the search procedure, but I don't think that it's really necessary.

Andrew.

Xref: sparky alt.security.pgp:73 sci.crypt:3669
From: nmm1@cus.cam.ac.uk (Nick Maclaren)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: Prime generation, a possible weakness in PGP?
Date: 7 Oct 92 16:08:48 GMT
Distribution: alt
Organization: U of Cambridge, England

In article <ARI.HUTTUNEN.92Sep27174550@laphroaig.cs.hut.fi>, Ari.Huttunen@hut.fi (Ari Huttunen) writes:
|> I am concerned about the primeness of the prime numbers
|> that PGP generates. This is how they are done:
|> 	- first throw away numbers that are divisible
|> 	  by small primes
|> 	- then use Fermat's theorem 4 times
|> 	  (Fermat's theorem:  if  b**(n-1) != 1 (mod n), then
|> 	  'n' cannot be a prime. This requires that 'b' and 'n'
|> 	  are relatively prime.)
|> 
|> My concern is the number of rounds of the Fermat test. It's only 4.
|> I would not trust this level of primeness. Also, the resulting
|> number might be a Carmichael number. (So it would pass any number
|> of such tests.) 

It would be a lot better (and very little more expensive) to use the strong
pseudoprime test.  This removes powers of 2 from (n-1) and then checks that
the sequences of residues goes ..., -1, 1, ..., 1 as the result is squared.
There are no strong Carmichael numbers.  See any good book on number theory
for the details.


Nick Maclaren
University of Cambridge Computer Laboratory,
New Museums Site, Pembroke Street,
Cambridge CB2 3QG, England.
Email:  nmm1@cus.cam.ac.uk
Tel.:   +44 223 334761
Fax:    +44 223 334679
Newsgroups: alt.security.pgp,sci.crypt
From: lrk@k5qwb.lonestar.org (Mr. Lyn R. Kennedy)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: Prime generation, a possible weakness in PGP?
Date: 8 Oct 92 14:45:46 GMT
Organization: Radio Amateur k5qwb

Ari.Huttunen@hut.fi (Ari Huttunen) writes:

> I am concerned about the primeness of the prime numbers
> that PGP generates. This is how they are done:

..............

It's my understanding that if the numbers AREN'T prime, the decription 
won't work. True?

If you can send/receive messages, you must have primes numbers.


-------------------------------------------------------------------------
                 
73,            internet     | lrk@k5qwb.lonestar.org
Lyn Kennedy    packet radio | K5QWB @ N5LDD.#NTX.TX.US.NA
               pony express | P.O. Box 5133, Ovilla, TX, USA 75154

-------------- "We have met the enemy and he is us."  Pogo --------------
Newsgroups: alt.security.pgp,sci.crypt
From: warlord@MIT.EDU (Derek Atkins)
Subject: Re: Prime generation, a possible weakness in PGP?
Organization: Massachusetts Institute of Technology
Distribution: alt
Date: Thu, 8 Oct 1992 04:49:50 GMT


	- then use Fermat's theorem 4 times
	  (Fermat's theorem:  if  b**(n-1) != 1 (mod n), then
	  'n' cannot be a prime. This requires that 'b' and 'n'
	  are relatively prime.)

In all the numbers less than 10^12 (or something like that), 
the Fermat test using b=2 will fail (i.e., give a false positive
reading) for only 15000 numbers.  Thats 15000 out of 10^12!  Thats
like 1 in 10^8, which are worse odds than you winning the lottery!

Now, if you iterate this four times, you increase your odds,
probabalistically, of having a good number.  Yes, you do have to
worry about the Carmichael numbers (since there are an infinity of
them), however there are far fewer Carmichael numbers than there
are primes.

-derek
--
         Derek Atkins -- MIT '93 -- Electrical Engineering
--warlord@MIT.EDU | ..!mit-eddie!mit-athena!warlord | s20069@mitvma.bitnet
      Chairman, MIT Student Information Processing Board (SIPB)
           MIT Media Laboratory, Speech Research Group
Xref: sparky alt.security.pgp:75 sci.crypt:3679
From: rgep@emu.pmms.cam.ac.uk (Richard Pinch)
Newsgroups: alt.security.pgp,sci.crypt
Subject: Re: Prime generation, a possible weakness in PGP?
Date: 8 Oct 92 09:15:40 GMT
Distribution: alt
Organization: DPMMS University of Cambridge

In article <WARLORD.92Oct8004937@m66-080-20.mit.edu>,
warlord@MIT.EDU (Derek Atkins) writes:
>
> [...]
>
>In all the numbers less than 10^12 (or something like that), 
>the Fermat test using b=2 will fail (i.e., give a false positive
>reading) for only 15000 numbers.  Thats 15000 out of 10^12!  Thats
>like 1 in 10^8, which are worse odds than you winning the lottery!
>

In fact there are 101629 Fermat base 2 pseudoprimes up to 10^12,
and 37607912018 primes.  The chance of getting a composite is thus
101629 / (37607912018 + 101629), which is about 2.7 in 10^6.  
There are only 22407 strong (Miller/Rabin) pseudoprimes
base 2, which improves your chances to about 0.6 in 10^6.

Richard Pinch,  Dept of Pure Mathematics, University of Cambridge
Newsgroups: alt.security.pgp,sci.crypt
From: Ari.Huttunen@hut.fi (Ari Huttunen)
Subject: Prime generation, a possible weakness in PGP?
Organization: Helsinki University of Technology, Finland
Distribution: alt
Date: Sun, 27 Sep 1992 15:45:52 GMT

I am concerned about the primeness of the prime numbers
that PGP generates. This is how they are done:
	- first throw away numbers that are divisible
	  by small primes
	- then use Fermat's theorem 4 times
	  (Fermat's theorem:  if  b**(n-1) != 1 (mod n), then
	  'n' cannot be a prime. This requires that 'b' and 'n'
	  are relatively prime.)

My concern is the number of rounds of the Fermat test. It's only 4.
I would not trust this level of primeness. Also, the resulting
number might be a Carmichael number. (So it would pass any number
of such tests.) 
--
...............................................................................
Ari Huttunen   			       Any similarity to other alien life forms
				          is purely coincidental.
					      <Alien 3 misquote>
Newsgroups: alt.security,alt.security.pgp,sci.crypt
From: agillum@magnus.acs.ohio-state.edu (Aaron C Gillum)
Subject: Re: Please Help
Organization: The Ohio State University
Date: Thu, 8 Oct 1992 23:48:27 GMT

Unfortunately this same idiotic post found its way on to 5 out of 6 of my 
newsgroups. How's that for waste o' time?

Aaron Gillum
Newsgroups: alt.security
From: al@escom.com (Al Donaldson)
Subject: Re: The Inslaw affair still raises a stink around Washington
Keywords: Casolaro,Inslaw,Kilpatrick,Hamilton,Bua,Thornburgh,Brooks,House Judiciary Committee,special prosecutor,corruption,murder,USA,computer,PROMIS,software,activism,poverty,homelessness,AIDS,greed,corruption,etc.etc.etc.
Reply-To: al@escom.COM (Al Donaldson)
Organization: ESCOM Corp., Oakton VA (USA)
Date: Sat, 17 Oct 1992 03:25:05 GMT

In article <Bw85Hv.Mry@ais.org> seraphim@ais.org (Henry Hardy) writes:
>The Inslaw Affair still raises a stink around Washington
blah de blah de blah de blah...
>Copyright (C) Detroit Free Press, August 24, 1992, p. 7A.

Let me get this straight -- the Inslaw software contained programs
to break the Government's ``codes'', and that is why you posted this
to alt.security, right?

Al
From: s907175@otto (Hung Cheng Chiang)
Newsgroups: alt.security
Subject: TEST
Date: 9 Oct 92 07:37:17 GMT
Organization: RMIT Computer Centre
NNTP-Posting-Host: otto.bf.rmit.oz.au

TEST!

Newsgroups: alt.security