HDTenEightyP/NetNews huggingface dataset:
From: dwing@cudnvr.denver.colorado.edu (Dan Wing)
Newsgroups: comp.security.misc
Subject: Re: Forging E-mail from root to get users to change passwords
Date: 9 Nov 92 21:34:45 GMT
Article-I.D.: cudnvr.1992Nov9.214145.1

In article <1992Nov5.174213.2370@mksol.dseg.ti.com>, mccall@mksol.dseg.ti.com 
(fred j mccall 575-3539) writes:

> In <92309.193737CXF111@psuvm.psu.edu> Charles Fee <CXF111@psuvm.psu.edu> writes:
> 
>>Why would a hacker (who apparently has root access) need to tell users to
>>change their password?  On my system (Linux) all root has to do is wipe out
>>the users' old password and then the account is free.  You could then log in
>>as that user without a password and run the passwd program to change it to
>>whatever the cracker feels like doing.  
[...]
> You don't even have to go through all this, if you already have root
> access.  Just use passwd from root with the username argument and you
> can change it directly from root.

A hacker would usually ask a user to change their password because the 
hacker *doesn't* have root access (at least, not yet).  The hacker faked an
Email address to make it look like it came from root - it didn't come from 
root.

Also, if a hacker changes someone's password, the person will know it (the
legitimate user can no longer login) and the legit user will call the 
the sysadmin and whine "I forgot my password" and the sysadmin will change it 
-- locking out the hacker.  If a hacker wants to run 'stealth' on your system,
it is a lot easier to use an already-existing username rather than create a
new username or use your root login.

My own comments and ideas, not those of my employer.

-dan
 Internet: DWING@UH01.Colorado.EDU, or DWING@cudnvr.denver.colorado.edu
Newsgroups: comp.security.misc
From: ckd@eff.org (Christopher Davis)
Subject: Re: Experiences with John Haugh's Shadow Suite
Organization: Electronic Frontier Foundation Tech Central
Date: Fri, 13 Nov 1992 23:54:09 GMT

Randy> == Randy Carpenter <syscrc@pickle.gsu.edu> 

 Randy> We are considering installing John Haugh's shadow password suite
 Randy> on our Silicon Graphics systems because of all the grief we get
 Randy> from our users about the proactive password program we
 Randy> installed.

Shadowed passwords are not a replacement for a good (some would say
fascist) proactive password program.

NFS misconfigurations, buggy setuid programs, and the like can offer
access to the shadow file.  (I won't even go into the behavior most NIS
installations have of giving the shadow file to the world.)
--
Christopher K. Davis      | ``Usenet seems to run much like the Kif (or,
<ckd@eff.org>   EFF #14   |   for the TV generation, Klingon) high command.
System Administrator, EFF |   Whoever takes action and can be heard wins.''
+1 617 864 0665  [CKD1]   |   --Peter da Silva <peter@ferranti.com>
Newsgroups: comp.security.misc
From: djohanne@comp1.mcs.loral.com (David Johannes)
Subject: Info on MORRIS' INTERNET WORM
Organization: Loral Command & Control Systems
Date: Wed, 11 Nov 1992 03:35:10 GMT

> Damian Kanarek writes:
>
>  I'm trying to get more info on the whole affair.  Is there an ftp site
> where I could get a copy of Cornell's report on this incident, and
> maybe some more details on how the worm worked? Really, now - this is
> a serious request; I have to fill 20 pages with this stuff :)
> Thanks in advance,

You might try the following:

cerebrum.impaqt.drexel.edu (129.25.10.3)
	/pub/files/misc/papers for morris.appeal.Z
quartz.rutgers.edu (128.6.60.6)
	/pub/cud-papers for morris.appeal.Z
kragar.eff.org (192.88.144.4)
	/pub/cud/papers for morris.appeal


You might also try relay.cs.toronto.edu (128.100.3.6)
	/doc/worm	has three files on the Internet Worm, on the same
			system look under the following directory:
	/lists
	/lists.1987
	/lists.1991  	These three directories might contain something.


nic.sura.net  (128.167.254.179) has various files on security try the
following directories:
	/pub/security/worm
	/pub/security/CERT
	/pub/security/CIAC


You can get a lot more from archie, if you need help on how to use
archie just drop me a line.


Dave

+---------------------------------+-----------------------------------------+
|  David N. S. Johannes           |  I've seen things you people wouldn't   |
|                                 |  believe...  Attack ships on fire of    |
|  Loral Command and Control      |  shoulder of Orion...  I've watched     |
|  Systems, Colorado Springs, CO  |  c-beams glitter in the dark near the   |
|                                 |  Tanhauser Gate...  All those moments   |
|  Internet:                      |  will be lost in time like tears in     |
|                                 |  rain...  Time to die.                  |
|  djohanne@mcsds3.mcs.loral.com  |                                         |
|  johannes@slab.pr.erau.edu      |                    Blade Runner (1982)  |
+---------------------------------------------------------------------------+
Newsgroups: comp.security.misc
From: jbotz@mtholyoke.edu (Jurgen Botz)
Subject: Re: Cryptology, RSA, public domain program called Pretty Good Privacy (PGP)
Keywords: secure passwd exchange
Organization: Mount Holyoke College
Distribution: na
Date: Fri, 13 Nov 1992 13:03:16 GMT

In article <1992Nov13.015549.18467@u.washington.edu> jcl@yonext.apl.washington.edu writes:
>I read an article in Dr. Dobb's Journal ( May 1992 ) titled
>"Untangling Public-key Cryptography" by Bruce Schneier.  In it he
>mentions a public domain program call Pretty Good Privacy (PGP) that
>implements the RSA public-key encoding/decoding algorithm.  He says
>that this program, last updated by folks in New Zealand in April, is
>available on computer bulletin boards worldwide.  If someone can tell
>me a specific bulletin board to look for this program I would be most
>appreciative.  Also, I've been unable to find a news group that deals
>with cryptography in general and would also appreciate leads in that
>vein.  Thanks!

To find PGP, use archie.  It was originally written for MS-DOS, I think,
but there's a pgp-2.0 unix port on the Net.  There's also a newsgroup
that deals with it: alt.security.pgp.  The newsgroup for cryptography is
sci.crypt.  Btw., there's some question about the legality of using PGP
in the USA, since it violates the RSA patents (RSA does permit use of
PEM software for personal email, but I'm not sure if that clause covers
other people's code based on their algorithms.)
--
Jurgen Botz                  |   Internet: JBotz@mtholyoke.edu
Academic Systems Consultant  |     Bitnet: JBotz@mhc.bitnet
Mount Holyoke College        |      Voice: (US) 413-538-2375 (daytime)
South Hadley, MA, USA        | Snail Mail: J. Botz, 01075-0629
Newsgroups: comp.security.misc
From: ckd@eff.org (Christopher Davis)
Subject: Re: Window watching programs
Organization: Electronic Frontier Foundation Tech Central
	<CKD.92Nov4141022@loiosh.eff.org> <1992Nov9.163127.1687@mcc.com>
Distribution: na
Date: Mon, 9 Nov 1992 20:58:11 GMT

Doug> == Doug Rosenthal <rosenthl@faith.mcc.com> 

 Doug> Will use of the xterm "secure keyboard" option take care of the
 Doug> situation Scott describes, at least for a given window?

Almost.  It will prevent grabbing the actual key events, but apparently
there's still a loophole available by asking for keydown and keyup
events and putting those together...

Use xauth, folks.
--
Christopher K. Davis      | ``Usenet seems to run much like the Kif (or,
<ckd@eff.org>   EFF #14   |   for the TV generation, Klingon) high command.
System Administrator, EFF |   Whoever takes action and can be heard wins.''
+1 617 864 0665  [CKD1]   |   --Peter da Silva <peter@ferranti.com>
From: probreak@kitty.ksu.ksu.edu (James Michael Chacon)
Newsgroups: comp.security.misc
Subject: Re: BAFFELED ??#@# !! CONFUSED !!#@@!!!!!
Date: 11 Nov 1992 11:03:02 -0600
Organization: Kansas State University
NNTP-Posting-Host: kitty.ksu.ksu.edu

873nikorawal@gw.wmich.edu writes:

>  What I do not understand is that how a user can send mail to a different user
>on the same system, and make it appear as though it has been sent by the
>operator or any other user on the system. Unless Of-course he has access to the
>operator/other persons account !!!!!

>							Curiocity !!!!!!

Its a rather simple exercise to forge email from anyone at anywhere.
I of course am not going to say how its done, other than to say it's
pretty trivial to accomplish this. Basically I could send you mail from
root on your machine without ever having logged in or been near that 
machine.

James

Newsgroups: comp.security.misc,alt.security,comp.unix.admin
From: uri@watson.ibm.com (Uri Blumenthal,35-016,8621267,)
Subject: Re: Tripwire release
Originator: uri@aixproj.watson.ibm.com
Date: Fri, 13 Nov 1992 17:50:37 GMT
Disclaimer: This posting represents the poster's views, not necessarily those of IBM
Organization: IBM T.J. Watson Research Center

From article <1992Nov13.004708.26881@cs.sandia.gov>, by mccurley@cs.sandia.gov (Kevin McCurley):
> uri@watson.ibm.com (Uri Blumenthal) writes:
>>    Tripwire supports hooks for up to ten signature routines.  We
>>ship it with MD5, Snefru, CRC32, CRC16, MD4, and MD2.............
> 
> I stated earlier that NONE of these, including MD5, Snefru, and MD4,
> are..................

Hey, is it too much to ask to quote correctly? You quoted not
from my question, but from the response to it (by Gene?).  Is
Netiquette dead, or what? (:-)
-- 
Regards,
Uri.		uri@watson.ibm.com
------------
<Disclaimer>
Newsgroups: comp.security.misc
From: jcl@yonext.apl.washington.edu (James C. Luby)
Subject: Cryptology, RSA, public domain program called Pretty Good Privacy (PGP)
Keywords: secure passwd exchange
Reply-To: jcl@yonext.apl.washington.edu
Organization: University of Washington
Distribution: na
Date: Fri, 13 Nov 1992 01:55:49 GMT

I read an article in Dr. Dobb's Journal ( May 1992 ) titled "Untangling  
Public-key Cryptography" by Bruce Schneier.  In it he mentions a public domain  
program call Pretty Good Privacy (PGP) that implements the RSA public-key  
encoding/decoding algorithm.  He says that this program, last updated by folks  
in New Zealand in April, is available on computer bulletin boards worldwide.   
If someone can tell me a specific bulletin board to look for this program I  
would be most appreciative.  Also, I've been unable to find a news group that  
deals with cryptography in general and would also appreciate leads in that  
vein.  Thanks!

					Jim Luby
Newsgroups: comp.security.misc
From: scott@sfi.santafe.edu (Scott D. Yelich)
Subject: Re: BAFFELED ??#@# !! CONFUSED !!#@@!!!!!
Date: Wed, 11 Nov 92 16:44:44 GMT
Organization: Santa Fe Institute

> It's trivial, but we're not going to tell you how to do it.

Sure we will.

RTFRFC


Newsgroups: comp.security.misc
From: gordon@ug.cs.dal.ca (Scott King)
Subject: Re: Window watching programs
Organization: Math, Stats & CS, Dalhousie University, Halifax, NS, Canada
Distribution: na
Date: Thu, 5 Nov 1992 15:12:00 GMT

In article <CKD.92Nov4141022@loiosh.eff.org> ckd@eff.org (Christopher Davis) writes:
>Scott> == gordon@ug.cs.dal.ca (Scott King) writes:
>Cliff> == Cliff Hathaway <cliff@cs.arizona.edu> 
>
> Scott> I have recently come across a program on the net that will allow
> Scott> a user to continuously monitor a window (including the root
> Scott> window) on another machine.  The disturbing part of it is that
> Scott> you seem to be able to do this to any machine without even
> Scott> having an account on it or having to set up permission to do so
> Scott> with xhost.  Is there a way to protect a machine from people
> Scott> using such programs? If so, how?
>
>Note that just using xhost/xauth won't do it all, if you're on a Sun.
>You also need to set up /etc/fbtab (see fbtab(5)) so that raw access to
>the frame buffer is blocked out.
>
This seems that it would fix the problem on a Sun.  What about an HP.  In my
original post, I neglected to mention that the machine that I was able to 
"watch" without even an account on the machine was an HP.  I am not to
familiar with HP's so I'm not sure what is going on.  Does anyone have any
insights that they could add to make this problem a little clearer?

On the Sun I found that you had to set xhost to be able to watch the screen.
The problem was that someone logged in to the machine from another one
could set the DISPLAY environment variable to the machine they logged into,
setup xhost and watch the display remotely using the window watching program.
Does the suggestion that Mr. Davis presented above prevent users not logged
in to the console from setting up xhost and their DISPLAY variable and then
directing output to the console (or reading it)?

- Scott
From: koh@lynx.cat.syr.edu (Jean Koh)
Newsgroups: comp.lsi
Subject: WANTED: Email Address of someone in AT&T Microelectronics
Date: 6 Nov 92 22:35:05 GMT
Distribution: usa
Organization: Syracuse University

Hi!
Is there anybody working at AT&T Microelectronics and subscribing this
newsgroup? Or Anybody knows email address of someone working at AT&T?
If any, please let me know email addresses.

I would like to get more techinical information about the AT&T multistandard
chip set for JPEG/MPEG/Px64. I already received their catalog but
it's too simple.

Thank you in advance!
-JK
Newsgroups: comp.lsi.cad
From: c2k@ham.slc.mentorg.com (Carl Ketcham)
Subject: Re: netlist comparisons
Date: 11 Nov 92 10:44:27
Organization: /slc/home/c2k/.organization

In article <1992Nov10.023646.2310@u.washington.edu> ivanw@stein.u.washington.edu (Ivan Wemple) writes:
Path: news.mentorg.com!uunet!ogicse!news.u.washington.edu!stein.u.washington.edu!ivanw
   From: ivanw@stein.u.washington.edu (Ivan Wemple)
   Newsgroups: comp.lsi.cad
   Date: 10 Nov 92 02:36:46 GMT
   Article-I.D.: u.1992Nov10.023646.2310
   Sender: news@u.washington.edu (USENET News System)
   Organization: University of Washington, Seattle
   Lines: 23



   Hello all:

   I am in the process of debugging a piece of software
   which translates a flattened circuit simulator input
   netlist into a 'hierarchical' netlist (ie, one which
   contains subcircuit definitions and instances).

   Question:

   Is there a tool around which will compare two circuit
   simulation input files and determine if they are the
   same *topologically*?

   My current technique involves running lengthy hspice
   simulations and comparing the outputs... a long and
   tedious process.

   Thanks in advance!

   Ivan Wemple
   ivan@dtrl.ee.washington.edu


Hi, 
Most Physical verification packages contain "LVS" (layout vs. schematic)
software.  This software provides netlist extraction from a layout, and,
important for your application, netlist comparison.  I worked on the 
CheckMate product at Mentor Graphics, and the NetCheck executable should
do what you need.

Disclaimer: Yup, I still work for Mentor Graphics and am probably biased....

Cheers,
Carl

--
-------------------------------------------------------------------
My opinions are mine, (all mine), and do not necessarily reflect 
those of my employer.

Carl Ketcham     carl_ketcham@mentorg.com
Mentor Graphics, Suite 300, 5295 South 300 West, Murray, Utah 84107
-------------------------------------------------------------------
From: strataki@cerberus.csi.forth.gr (Manolis Stratakis)
Newsgroups: comp.lsi.cad
Subject: XILINX development system on the PC.
Date: 6 Nov 1992 10:08:32 GMT
Organization: FORTH - ICS, P.O.Box 1385, Heraklio, Crete, Greece 71110 
       tel: +30(81)221171, 229302 fax: +30(81)229342,3 tlx: 262389 CCI
Distribution: world
NNTP-Posting-Host: cerberus.csi.forth.gr

    Hello,

	has anybody had any experience with the XILINX development system
	(FPGA hardware design system) for IBM PC compatibles? We are
	thinking of buying one, and would like to know more about it,
	like efficiency of the system, compatibility, support, etc.

	Please reply by e-mail.

	Thanks a lot,

	Manolis Stratakis.
From: aranake@cse.uta.edu (Sandeep Suresh Aranake)
Newsgroups: comp.lsi.cad
Subject: Register allocation in pipelined designs
Date: 5 Nov 92 05:44:15 GMT
Distribution: usa
Organization: Computer Science Engineering at the University of Texas at Arlington

I will greatly appreciate if you could outline/show pointer to
information on my following query.

Are there synthesis systems which allocate if-then-else
behaviours using pipelined FUs (functional units) . As I
understand, there is a possibility of both branches
being active at the same-time if pipelined FUs are used. 
How is the optimality of the resources allocated in branches 
ensured ? I am particularly interested in register allocation. 

Thank you in anticipation.
regards,

Sandeep
From: tsai@hal.com (Finnegan T. Tsai)
Newsgroups: comp.lsi.cad
Subject: Wanted: Informations on parallel VHDL/Verilog Simulators
Keywords: parallel processing, VHDL, Verilog, Logic Simulator
Date: 12 Nov 92 20:01:54 GMT
Organization: HaL Computer Systems
NNTP-Posting-Host: molly.hal.com


Hi, Experts


I am trying to gather any informations related to event-driven 
parallel VHDL or Verilog simulators. Would you please help me?
Any clues to papers or academic researches are highly appreciated.



Desperately Finney
Newsgroups: comp.lsi.cad
From: walkerb@antares.cs.rpi.edu (Bob Walker)
Subject: volunteer to run DAC Univ. Booth in 1994?
Organization: Rensselaer Polytechnic Institute, Troy NY
Distribution: na
Date: Thu, 12 Nov 1992 16:55:38 GMT


As the Coordinator of the DAC / ACM SIGDA University Booth for the
1993 Design Automation Conference, I would like to solicit volunteers
(preferably from academia) to serve as the Coordinator of the
University Booth for the 1994 Design Automation Conference.

Basically, the University Booth Coordinator invites universities to
bring machines to the Booth, invites university students and faculty
with papers at the DAC to particpate in the Booth as demonstrators
(giving them the opportunity to demonstrate their research), schedules
those students and faculty onto the machines, and handles alll the
administrivia necessary to make the Booth a success.

As incentive, the ACM SIGDA (Special Interest Group fogn Automation)
may be able to provide the 1994 University Booth Coordinator-designate
with a modest equipment grant to buy a workstation, possibly asking
for some matching funds from the Coordinator-designate's host
institution.  In return, in addition to serving as Booth Coordinator
for the 1994 DAC, the Coordinator-designate may be asked to bring that
workstation to the Design Automation Conference in 1994, 1995, and
1996 (shipping will be paid for by SIGDA).

If you are interested in serving as Coordinator of the University
Booth at the 1994 DAC, please send email to "walkerb@cs.rpi.edu",
stating your qualifications, and whether or not you think that your
university will be willing to provide any matching equipment funds for
you (not necessarily a 1-to-1 match).  If you have any additional
questions, I'll do my best to answer them...

                - bob

-- 
Bob Walker              CS Dept, Rensselaer Polytechnic Institute
walkerb@cs.rpi.edu      Troy, NY 12180          (518) 276-8275
Newsgroups: comp.lsi.cad
From: rick@cs.sunysb.edu (Richard Spanbauer)
Subject: Re: XILINX development system on the PC.
Organization: State University of New York, Stony Brook
Date: Sun, 8 Nov 1992 22:36:21 GMT

In article <1992Nov8.134340.18298@ntuix.ntu.ac.sg> eoahmad@ntuix.ntu.ac.sg (Othman Ahmad) writes:
>Manolis Stratakis (strataki@cerberus.csi.forth.gr) wrote:
>:     Hello,
>: 	has anybody had any experience with the XILINX development system
>: 	(FPGA hardware design system) for IBM PC compatibles? We are
>: 	thinking of buying one, and would like to know more about it,
>: 	like efficiency of the system, compatibility, support, etc.
>I have one, for not at the hardware side. I do not recommend the futurenet 
>version because I've problems with connectivity and expansibility .
>	I recommend that you choose others. Now the recommended one is the
>Viewlogic which is a very good package apparently. I prefer Orcad because I'm
>used to it but the Vst simulator interface was not ready at that time.
>	Support here in Singapore is not so good. They are more interested in
>Selling their tools than their chips. If we try to integrate into our 
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

	This is not at all surprising - I remember seeing an article 
	(in EE Times?) which stated that a fairly large portion of
	Xilinx's profits come from tool sales.  One would expect that 
	profits would come from sales of chips!  BTW, Xilinx is notoriously 
	close minded when it comes to publishing *anything* about the 
	internal architecture of their chips.  For your amusement, ask 
	them sometime for a spec about what each bit means in the fusemap ;-)

	We have the Viewlogic tools (schematics capture, simulator, vhdl,
	synthesizer, etc) for use with the Xilinx design system.  Viewlogic
	stuff is pretty nice, though their doc could use a much more
	careful job of proofreading - many typos, errors, etc.

>Othman bin Ahmad, School of EEE,

					Rick Spanbauer, SUNY/Stony Brook
From: M.Nigri@cs.ucl.ac.uk (Meyer E. Nigri)
Newsgroups: comp.lsi.cad
Subject: Subset of VHDL for synthesis.
Date: 9 Nov 92 12:27:20 GMT


Dear all,

I would like to know the present state regarding a formal definition
for a subset of VHDL aiming at synthesis.

I believe there is a group (VHDL Synthesis Working Group in Europe???) that
is trying to specify this subset.

Does anybody know how I can get info on this subject?

Thanks a lot,

Meyer.

PS: I will summarise to the group the responses I get on this
+--------------------------+-----------------------------------------------+
|Meyer Elias Nigri         |   JANET:mnigri@uk.ac.ucl.cs                   |
|Dept. of Computer Science |  BITNET:mnigri%uk.ac.ucl.cs@UKACRL            |
|University College London |Internet:mnigri%cs.ucl.ac.uk@nsfnet-relay.ac.uk|
|Gower Street              | ARPANet:mnigri@cs.ucl.ac.uk                   |
|London WC1E 6BT           |    UUCP:...!mcvax!ukc!ucl-cs!mnigri           |
+--------------------------+-------------------------+---------------------+
|Tel: +44 71 387-7050      | Fax: +44 71 387-1397    |    Telex: 28722     |
|                 ext. 3708|                         |                     |
+--------------------------+-------------------------+---------------------+
Newsgroups: comp.lsi.cad
From: vrkaramc@mtu.edu (Karamchedu)
Subject: Current-mode Subthreshold Analog VLSI
Organization: Michigan Technological University
Date: Sat, 7 Nov 1992 23:10:05 GMT


Are there any forthcoming conferences/conventions allowing for presentations
or discussions of Current-mode Subthreshold Circuits (perhaps with some 
applications or demonstrations of neural circuits) ? 


Any feelers and hints on probable dates, locations would be greatly 
appreciated.

PLEASE E-MAIL ME DIRECT.

Thank you

Karamchedu Raj

Dept of EE

 
-- 

Instruments and moods are two facets of Being.


Newsgroups: comp.lsi.cad