From: darren@rice.edu (Darren Bolding)
Subject: Re: POSTING FROM  FBI.GOV
Organization: Rice University, Houston, Texas
	<1992Apr11.034318.11347@cco.caltech.edu>
Date: Sat, 11 Apr 1992 08:56:33 GMT

Well, actually I have been investigating NNTP and SMTP protocols for
a little while now (quite intensively the last 4-5 weeks) and have found
a substantial number of security "holes", yet I have also found that
all of these "holes" soon disappear when one considers some of the inate 
security of telnet and tcp/ip.  While I agree it is easy to fake mail and
News (news is easiest, you can just change the headers) by telneting to
the appropriate ports on machines (which are conveiniently listed in the
RFC's on such subjects (as well as in /usr/services)); there is an 
underlying security measure that most people fail to remember, and one which
has thankfully made it possible (as I understand it) to catch people posting
fake news to rice.* newsgroups.  This is the handy dandy telnet handshaking
protocol (ie. Will you tell you who you are?  Yes, I will, I'm darren@128.42
.18.18) although it may not send username.  The point is, most sites won't
stay connected if you answer "no, I won't tell you who I am"; they then can
log the connection- and then when they trace the mail/news back they can
match the time/machine/port it came from with whatever ip address/username
was on that particular telnet line.  This is much easier to do in an 
inter-site case (such as rice.*) than an intra-site case since it requires
cooperation on both sides.  Also, most NNTP servers will ONLY connect to
IP addresses on there own sub-domain (domain) and a few others with which
the site trades mail.  The only one I could find that would stay connected
to me (and I only tried two or three) was slate.mines.collorado.edu- and it
would only list its newsgroups (no posting or even reading from my IP).  So
News, although being easier to forge is actually also easier to trace since
it most likely was posted on your own local site, thus ensuring cooperation
in tracking it down.  Mail is much harder, since it is a direct telnet 
connection to a port.  It's also easy to fake, SMTP is almost menu driven;
RMAIL etc. are written in ELISP (if I'm not mistaken) which is terribly easy
to rig, and a particularly loony user might copy the sendmail defaults to 
their own account, modify it to make them a "trusted user", point sendmail
at their defaults and change their name at will WITHIN the system (just as
easy to track, it's just that sendmail is actually doing the processing and
you therefore can't just focus on telnets)- besides if I were a sysadmin, I'd
be watching for sendmail executions outside of my daemon.  Now, If someone
were to recode telnet (the source IS available) so that you could "dial an
IP) that would make life much more dificult.  It also raises a question in my
mind- Couldn't you just grab the IP number from the IP layer of the communicat
ion?  Isn't IP above the TCP layer, so it's even more universal?  Anyway,
I realize this probably has some mistakes in it, and I also realize it probably
belongs in alt.security, but I saw the message and I decided to put what I 
knew out in the group; if I'm incorrect in anyway, please correct me- and do
it by mail (no use cluttering this group anymore).

Darren K. Bolding
darren@rice.edu 

P.S. I don't condone faking mail or News, in fact the reason I'm researching
this was to possibly write my own newsreader; and to try to find a way to send
mail/news securely.
Newsgroups: alt.locksmithing