HDTenEightyP/NetNews huggingface dataset:
From: psr@castle.ed.ac.uk (Paul S Randal)
Newsgroups: comp.security.misc,alt.security
Subject: Communications of the ACM
Date: 16 Nov 92 20:27:36 GMT
Organization: Edinburgh University Computing Service

Hi,
Does anyone know where the archive sites are for the following groups:

1) The ACM (whatever it is), specifically 'Communications of the ACM'
2) CRYPTO, specifically 'CRYPTO Proceedings'
3) USENIX UNIX Security Workshop
4) National Computer Security Conference

I've tried my local archie server but to no avail.
Also does anyone know if its possible to get articles from the New York
Post (??) and Boston Herald (??) on-line ??

Cheers,

Paul.

+==========================================================================+
| Send cheques, compliments, daughters, etc. to:                           |
+==========================================================================+
|       __     ____         __     __  BT Systems and Software Engineering |
|      /\ \   /  \ \       /\_\__ /\ \  Edinburgh Uni. Comp. Sci. Dept.    |
|     /  \_\ | /\ \ \     / / /\_\\ \ \                                    |
|    / /\ | |\ \/  \ \   / / / / / \ \ \  Contact: psr@dcs.ed.ac.uk        | 
|   /  \/ |_| \  /\ \_\ / / / / /   \ \ \       or psr@castle.ed.ac.uk     |
|  / /\__/_/   \ \ \/_// / / / /    / / /       or prandal@gssec.bt.co.uk  |
| / / /         \ \_\  \ \/ / /    / / /             (summer only)         |
| \/_/           \/_/   \__/_/     \/_/                                    |
+==========================================================================+
From: stanley@skyking.OCE.ORST.EDU (John Stanley)
Newsgroups: comp.security.misc
Subject: Re: Two hackers caught tapping into Boeing, federal computers
Date: 22 Nov 92 02:35:10 GMT
Article-I.D.: talon.1emrkuINNs5s
Organization: Oregon State University, College of Oceanography
NNTP-Posting-Host: skyking.oce.orst.edu

In article <10013@blue.cis.pitt.edu.UUCP> nick+@pitt.edu (Nick C De Mello) writes:
>>>They didn't explicitly say that they cracked the root password. 
>>
>>If decrypting the passwords gave him the root password, then yes, Dave,
>>they cracked the root password.
>
>  Oh, come on... what do you think is more likely: these two kids
>broke the DES encryption scheme, or the newspaper confused decrypting
>with running the encryption on a /usr/dict/words file and greping
>it with the /passwd file.

Since both of these cases can be called "cracking" the root password,
what is your problem?

I think that it is most likely that they used something like Crack,
which is really not the same as either one of your proposed methods.

>  I'll grant you they cracked the root, and thus system, but unless
>I see some more details I'm going to be really skeptical of claims
>they came up with the inverse DES function.

My comment was in response to Dave's claim that the article didn't say
that the kids "cracked" the root password. Nothing else. You admit
that they cracked the password, and nobody here has claimed they
inverted the DES algorithm. What's your problem?
Newsgroups: comp.security.misc
From: janw@fwi.uva.nl (Jan Wortelboer)
Subject: Re: Setuid script - is this unsecure?
Organization: FWI, University of Amsterdam
Date: Fri, 20 Nov 1992 13:50:59 GMT

hmj@cs.tut.fi (J{rvinen Hannu-Matti) writes:

>In article <AMOSS.92Nov6102549@shuldig.cs.huji.ac.il> amoss@shuldig.cs.huji.ac.il (Amos Shapira) writes:
>>A general suggestion for a programme which will do what you want would be:
>>
>>main (ac, av)
>>	int ac;
>>	char **av;
>>{
>>	exec ("/usr/etc/mount", av);
>>}
>>
>>and have the object of this C programme suid root.

>Equivalent would be that you let anybody execute mount (i.e., set
>mount suid), which is not reasonable. Also you have to deny suid
>programs on the floppy, and ensure that there does not exist special
>devices on the floppy.

>I've written a set of programs (fdmkfs, fdmount, and fdumount) to give
>users access to the floppy. They are available by anonymous ftp on
>site cs.tut.fi (130.230.4.2), file pub/src/tut/floppy.shar. Use on
>your own risk.

Everybode executing mount isn't indeed a good idea:
How about mount /dev/fd /etc


Jan.
-- 
Jan Wortelboer,  University of Amsterdam
                 Computer Science Department  Email: janw@fwi.uva.nl
Unix             Kruislaan 403 Kamer F003     Phone: +31 20 525 7501
systems manager  1098 SJ AMSTERDAM            Fax  : +31 20 525 7490
Newsgroups: comp.security.misc
From: gtoal@ibmpcug.co.uk (Graham Toal)
Subject: Re: Grabbing your pw file from anonymous FTP
Organization: The IBM PC User Group, UK.
Date: Mon, 16 Nov 1992 00:17:31 GMT

In article <83347@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>  What keeps any person who can anonymous ftp from going down your
>etc directory and grabbing the passwd file?  Does ftp log this?  I
>know that some Unix systems use a chroot system to lock anonymous
>ftp users into a restricted section of the directory.  Do all
>ftp systems do this?

No, they don't all do it but you'd be hard pressed nowadays to find one
that didn't.  Anyway, most unixes are set up on the principle that
people *can* snarf your password file.  If you're a security-by-obscurity
fanatic, you might as well go the whole hog and get a shadow password
suite.

On the flavour of unix that I run, I haven't worked out how to get
it to log transfers except by turning ftpd debugging on (-d).  A bit
verbose, but it gives me what I want.

(I have moral objections to logging anonymous ftp transfers on public
sites, but this is *my* machine, and I have no public archives and
no users who would be ftp'ing in)

G
-- 
Newsgroups: comp.security.misc
From: dejesus@archimedes.nwc.navy.mil (Francisco X DeJesus)
Subject: Re: What has happened to the comp.security.announce newsgroup
Organization: Science Applications International Corp.
Date: Fri, 20 Nov 1992 03:47:31 GMT

In article <4199@datasci.uucp> tgll@datasci.co.uk writes:
>What has happened to the comp.security.announce newsgroup.  I used to read the
>CERT advisories in it regularly, but I have reveived nothing on it since the
>summer, and I have a feeling that the newsgroup has even been deleted.

It's still there... in fact, I remember a post as recently as a few days ago.
There just hasn't been as many posts as there used to be, I suppose.


-- 
Francisco X DeJesus  ----- S A I C -----  dejesus@archimedes.chinalake.navy.mil
disclaimer: "Opinions expressed here are mine. Typos and errors are all yours."
Newsgroups: comp.security.misc
From: rickert@mp.cs.niu.edu (Neil Rickert)
Subject: Re: Ftp'ing out of a chroot()ed environment
Organization: Northern Illinois University
Date: Mon, 16 Nov 1992 22:37:21 GMT

In article <1e8od6INN1b4@ef2007.efhd.ford.com> smd@sl0091.srl.ford.com (Steve Dahmen) writes:
>
>Does anybody understand chroot and ftp/telnet enough to tell me why
>I can't get ftp nor telnet to run in my chrooted account??  I'd like
>to set up a user zone to allow simple ftp/telnet through without opening
>my whole system.

This may require /etc/services unless there is a services NIS map.  I'm
not sure about /etc/protocols.
From: unruh@physics.ubc.ca (William Unruh)
Newsgroups: comp.security.misc
Subject: Re: Two hackers caught tapping into Boeing, federal computers
Date: 24 Nov 1992 02:16:57 GMT
Organization: The University of British Columbia
Distribution: world
NNTP-Posting-Host: physics.ubc.ca

zeus@vxcrna.cern.ch writes:

>Any company that uses a braindead operating system that makes passwords readable
>in encrypted form in the first place is braindead.


>In the real world computers have to be built for pinheads. People
>who try to sell a product that requires intelligence to operate it
>are not going to sell much.

The design of the Unix password was deliberately open so people wouldn't
think they were safe ( eg using cat as a password) when they were not.
Yes it is time that a new password algorithm were produced tha cannot be
cracked as "easily" as the unix one, but hiding the passwords isn't the
answer. ( so someone getws ahold of one of your backup tapes and there
are the passwords in all their (encrypted) glory- then what do you do.
And if you want the computer designed for pinheads, they are presumably
precisely the ones who would let someone get a copy of their backup
tape.
Newsgroups: comp.security.misc
From: smb@ulysses.att.com (Steven Bellovin)
Subject: Re: gnumake SGID: potential security hole?
Date: Tue, 17 Nov 1992 16:51:57 GMT
Organization: AT&T Bell Laboratories

In article <MELLAN.92Nov17131950@syst06.acri.fr>, mellan@syst06.acri.fr (Alain Mellan) writes:
> 
> I just discovered today that gnumake is installed with SGID bit, and
> belongs to user root, group kmem.
> 
> Am I right to be suspicious ?  The kmem SGID will allow gnumake to
> read into /dev/kmem the info needed for load balancing, but is that
> all?

Someone who can read /dev/kmem can also read interesting things like
typed passwords in tty input buffers, and disk blocks from read-protected
files.  I have no idea whether or not it's possible to trick gnumake
into doing those things -- for example, if it doesn't properly reset
its setgidness and close the file descriptor before execing a user program.
There's a definite risk here, if things weren't done properly.
Newsgroups: comp.security.misc
From: francis@monod.Biol.McGill.CA (Francis Ouellette)
Subject: anonymous FTP checklist
Keywords: anon FTP
Organization: McGill University
Date: Thu, 19 Nov 1992 06:49:05 GMT

Dear csm readers,

I have just installed anon ftp on my machine, and I was wonderring if
there is a checklist somewhere of things that have to be checked for
me to assure myself that everything is OK from a security point of
view.

Any pointers would be most appreciated,

regards to all,

francis


--
| B.F. Francis Ouellette  
| manager, yeast chromosome I project
| dept of biology, McGill university, Montreal, Qc, Canada
| francis@monod.biol.mcgill.ca
Newsgroups: comp.security.misc
From: zeus@vxcrna.cern.ch
Subject: Re: Two hackers caught tapping into Boeing, federal computers
Organization: CERN European Lab for Particle Physics
Date: Sun, 22 Nov 1992 23:31:57 GMT

In article <1992Nov12.084549.5128@unix.brighton.ac.uk>, ddv@unix.brighton.ac.uk (Domenico De Vitto) writes:
> Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
> 
> Dom

Any company that uses a braindead operating system that makes passwords readable
in encrypted form in the first place is braindead.

50,000 crypts per second in FORTRAN on a Cray sounds nice. I have played
with much faster machines than that though, imagine what the CRAY will
do once it has the bucket of Alpha chips bolted on... say a 1024 point
array running 200 Mips... Exhaustive search starts to look quite 
feasible.

If a computer is delivered in an unsecure state IT IS THE MAUFACTURERS
FAULT!

We should NOT go arround patching up garbage, especialy when the garbage
costs a significant amount of money. I for one don't see why I should
spend time patching a $2000 operating system.

It's one thing for a manufacturer to screw up and throw out a security
flaw. But the open password file has been present in UNIX for ten years.

AND I DO KNOW THAT A "PROTECTED" PASSWORD FILE IS NOT SAFE EITHER !

But I DO Know that it is a damn sight safer, especialy when there is
a pinhead sysop.

In the real world computers have to be built for pinheads. People
who try to sell a product that requires intelligence to operate it
are not going to sell much.

I for one would rather spend my time learning about something a
bit more interesting than the failings of 1970's spaghetti code
operating systems.


Phill Hallam-Baker
With 10 years UNIX experience I have the right to say it sucks.

Newsgroups: comp.security.misc
From: stehman%citron.cs.clemson.edu@hubcap.clemson.edu (Jeff Stehman)
Subject: responsibility of admins (was: Two hackers caught...)
Reply-To: stehman%citron.cs.clemson.edu@hubcap.clemson.edu
Organization: Clemson University
Date: Mon, 16 Nov 1992 14:43:39 GMT


Familiarity is a dangerous thing.  Seems like many of you have forgotten what
it is like not to be familiar with computer security issues.

Working on it a few hours a week, Joe Average has been keeping a box up and
running for a while.  Joe's boss says it sure would be nice to do a little
work from home, so Joe buys a couple of modems.  He reads all the manuals for
the box and for the modems, and even calls the customer service number for
the box to double check everything he's done.  A couple days later they have
dail-in access to their box.  What has Joe done wrong?  He read all the
vendor's documentation and even called the vendor to double check, and some
of you think it's Joe's fault when his computer is broken into?

You tell him to read books, but why should he bother?  Joe's site isn't
interested in their computer being finely tuned.  They just want it to stay
up and running, which it already is.  Besides, Joe only works a sysadmin a
few hours a week.  He's got more important things to do than read third-party
books.  As far as passwords go, sure everyone there uses easy ones.  Why not?
It's a small site and everybody knows everybody else.  As far as the modems
go, no one else even knows that they have them, much less the phone numbers.

Try seeing it from Joe's perspective before you flame him.

--
Jeff Stehman			Systems Staff, G-18A Jordan
stehman@cs.clemson.edu		Dept. of Computer Science
(803)656-2639			Clemson University
Newsgroups: comp.security.misc
From: kent@sparky.imd.sterling.com (Kent Landfield)
Subject: Re: Setuid script - is this unsecure?
Organization: Sterling Software
Date: Mon, 23 Nov 1992 18:02:58 GMT
X-Md4-Signature: fd5b809d08724eb77f329e258a798066

In article <92Nov23.165237.13903@acs.ucalgary.ca> steven@enel.ucalgary.ca (Steven Leikeim) writes:
>Another set of programs which I have used is mntdisk. This was posted in
>comp.sources.unix volume 22, and is available from many ftp sites. It includes
>support for diskettes UNIX and PC formats (at least on Suns), CD's and
>Erasable Optical Disks. It attempts to make sure that you do not mount
>diskettes with device files and mounts with the nosuid option to prevent
>misuse of diskettes.

mntdisk was posted to comp.sources.misc, *not* comp.sources.unix.  Here is
the info on it from the index.

/usenet/comp.sources.misc/volume-issue/index:
v22i031 mntdisk/part01 mntdisk - Allow general users to mount disks, Part01/03
v22i032 mntdisk/part02 mntdisk - Allow general users to mount disks, Part02/03
v22i033 mntdisk/part03 mntdisk - Allow general users to mount disks, Part03/03

			-Kent+
--
Kent Landfield                   INTERNET: kent@IMD.Sterling.COM
Sterling Software, IMD           UUCP:     uunet!sparky!kent
Phone:    (402) 291-8300         FAX:      (402) 291-4362
Please send comp.sources.misc-related mail to kent@uunet.uu.net.
From: stanley@skyking.OCE.ORST.EDU (John Stanley)
Newsgroups: comp.security.misc
Subject: Re: Two hackers caught tapping into Boeing, federal computers
Date: 20 Nov 92 21:04:39 GMT
Article-I.D.: talon.1ejjt7INNhql
Organization: Oregon State University, College of Oceanography
NNTP-Posting-Host: skyking.oce.orst.edu

In article <1992Nov13.195515.19232@jato.jpl.nasa.gov> dave@jato.jpl.nasa.gov writes:
>ddv@unix.brighton.ac.uk (Domenico De Vitto) writes:
>>Any org. that has a _root_ password in _a_ dictionary gets all it deserves.
>
>They didn't explicitly say that they cracked the root password. 

>>filed with the charges stated. ``He then transferred the password file
>>to a Boeing Company computer, where he decrypted the passwords.''
>>      That process gave Anderson the ``root'' password, which allowed

If decrypting the passwords gave him the root password, then yes, Dave,
they cracked the root password.
Newsgroups: comp.security.misc
From: howesb@monashee.sfu.ca (Charles Howes)
Subject: Re: Ftp'ing out of a chroot()ed environment
Organization: Simon Fraser University, Burnaby, B.C., Canada
Date: Tue, 17 Nov 1992 03:09:43 GMT

>smd@sl0091.srl.ford.com (Steve Dahmen) writes:
] Does anybody understand chroot and ftp/telnet enough to tell me why
] I can't get ftp nor telnet to run in my chrooted account??  I'd like
] to set up a user zone to allow simple ftp/telnet through without opening
] my whole system.
] 
] I did a dump -n on the binaries and ensured the requested libraries are
] available in the chrooted environment.  Do I need anything special in
] /etc (I have resolv.conf) or /dev???
] 
] Help.

I recommend doing a 'trace' on telnet in the normal environment, and
massaging the output of that to get a list of the directories and files you
need to migrate.  Here's a new-awk script that converts the trace output
file into the appropriate commands:
=========================fix.awk=============================================
$1 ~ /^(open|stat|creat|unlink)$/ {
sub("^[^\"]*\"","");
sub("\".*$","");
for (x=2;x<=length($0);x++)
  if (substr($0,x,1)=="/") print "mkdir ~ftp"substr($0,1,x)
if ($0 ~ /\/./) print "cp "$0" ~ftp"$0
}
=============================================================================
So type:
  trace -o output /usr/ucb/ftp somehost.edu
  nawk -f fix.awk output > file1
  sort -u < file1 > result
  vi result
  source result
Newsgroups: comp.security.misc
From: craig@jido.b30.ingr.com (Craig Presson)
Subject: Re: early Trojan Horse
Reply-To: craig@jido.b30.ingr.com
Organization: Intergraph Corporation, Huntsville, Alabama
Date: Thu, 19 Nov 1992 16:13:06 GMT

In article <1992Nov18.202710.9652@mcs.kent.edu> keithf@Nimitz.mcs.kent.edu (Keith Fuller) writes:

   I heard that early UNIX systems came with a Trojan Horse.
   As I remember, the C compiler would compile one of the utilities
   in a way that would give a knowledgable person entry into any UNIX
   system.

   Does anyone know anything about this?

This is described in "Reflections on Trusting Trust", the ACM Turing
Award lecture by Ken Thompson, which appeared in Communications  of
the ACM, Vol. 27 # 8, August 1984. This should be required reading for
every CS student.

   Like some other people who are asking such questions,
   I am indeed writing a term paper on UNIX security.

Look at:
Farrow, _Unix System Security_, Addison-Wesley 1991
Garfinkel and Spafford, _Practical Unix Security_, O'Reilly &
Associates, 1991.

Sufficient references in both to get you as deep into the literature
as you have time for. If you want to make your paper stand out, you
might want to actually implement some of the suggestions instead of
just digesting and restating.

-- Craig Presson
From: wls@cray.csd.uwm.edu (Bill Stapleton)
Newsgroups: comp.security.misc
Subject: Re: anonymous FTP checklist
Date: 19 Nov 1992 22:00:24 GMT
Organization: Computing Services, U of Wisc-Milwaukee
Distribution: world
Reply-To: Bill Stapleton <wls@csd4.csd.uwm.edu>
NNTP-Posting-Host: 129.89.6.69
Keywords: anon FTP

In article <drector.722195714@math.uci.edu>, drector@math.uci.edu (David Rector) writes:

> If you find it necessary to have an "incoming" directory, that is a
> directory with write privileges, be sure to check it regularly for
> unwanted material, or you might find yourself playing host to an
> unwanted---or even illegal---bulletin board.  A favorite trick of
> bb creators is to hide their files from the ls command by prefixing the
> file names with periods or other unprintable characters.  Use the
> -a option to ls, or use du, to search for unwanted files.

If you only need an "incoming" directory for outside users to drop files
off for users of the machine, try this trick:

d-wxr-xr-x  2 ftp      nobody        512 Oct 11 12:08 incoming/

Anonymous users can write files, but can't list or read them, while users
on the machine can do directory listings and read the files.  You still
need to clean out junk, but no "bulletin board" problems.  Note that
this doesn't work if you have some brain-dead "ftpd" that doesn't make
anonymous ftp files world readable (Convex).

Heck, might as well mention everything as long as I'm here.  On the flip side
of "incoming" would be "pub":

dr-xrwxrwt  2 ftp      nobody        512 Nov 10 17:23 pub/

Where anonymous users can list and read but not write, while local users
can do anything (except delete each others' files).

As for the rest, most should be mode 555:  the parent directory, as well as
bin, and any other needed stuff (etc, dev, ...), owned by root.  Depending
on how much info you want to give out, you can either omit etc/passwd and
etc/group altogether, or include modified versions (passwd: no passwords,
groups, home directories, shell of /bin/false just in case;  group: no
passwords or user lists).  The "ftpd" man page usually gives some info about
which other files are needed, for shared libraries, etc.

Anybody else have any helpful hints?

--
Bill Stapleton
     wls@csd4.csd.uwm.edu
     uwmcsd4!wls
Newsgroups: comp.security.misc
From: john@iastate.edu (John Hascall)
Subject: Re: Ftp'ing out of a chroot()ed environment
Organization: Iowa State University, Ames, IA
Date: Mon, 16 Nov 1992 22:17:42 GMT

smd@sl0091.srl.ford.com (Steve Dahmen) writes:
}Does anybody understand chroot and ftp/telnet enough to tell me why
}I can't get ftp nor telnet to run in my chrooted account??  I'd like
}to set up a user zone to allow simple ftp/telnet through without opening
}my whole system.
}
}I did a dump -n on the binaries and ensured the requested libraries are
}available in the chrooted environment.  Do I need anything special in
}/etc (I have resolv.conf) or /dev???
}
}Help.

Without you saying what kind of system you have this is pretty hard, but
Try this:
         strings `which telnet` | grep '/[a-z]'

John
-- 
John Hascall                   ``An ill-chosen word is the fool's messenger.''
Systems Software Engineer
Project Vincent
Iowa State University Computation Center  +  Ames, IA  50011  +  515/294-9551
From: eb@felix.Sublink.Org (Enrico Badella)
Newsgroups: comp.security.misc
Subject: Spoofing a LAN cable, is it possible?
Date: 20 Nov 92 18:35:07 GMT
Organization: Soft*Star s.r.l, Torino, Italy

Recently I was at a friend's office and he started showing his
new network installation. Since the company has of offices on the
same block I questioned if they had a leased line, an RF LAN or
whatever. The answer was 'We have a cable that runs down into the
cellar and enters all the cellars of the houses that separate the two
locations'. I also got a tour in the cellar and I really saw a UTP
cable entering a plastic tube that ran all through the cellar into
the house next door.

At this point I asked my friend if he wasn't afraid of someone spoofing
on his cable. At this question he turned white and said nobody had
though of such an event; now he is really worried.

Do you think a potential hacker/spoofer could wind some electric wire
around the plastic tube and inductivly pickup was is moving on the LAN
wire without physically disturbing the operation?


-- 
Enrico Badella				Internet: eb@felix.sublink.org
Soft*Star s.r.l.			          eb@icnucevx.cnuce.cnr.it
Via Camburzano 9			Phone:    +39-11-746092
10143 Torino, ITALY			Fax:      +39-11-746487