HDTenEightyP/NetNews huggingface dataset:
From: leichter@zodiac.rutgers.edu
Newsgroups: alt.security
Subject: Re: passwd security check
Date: 23 Jul 92 13:27:15 GMT
Organization: Rutgers University Computing Services

The odds are very much against it, but "same password with the same salt"
will happen sometimes.  At Yale a number of years back, it happened - in the
worst possible way:  Someone noticed that their salt and hashed password
matched that of root!

One thing it's important to remember is that there are many passwords that
hash to the same value.  Even if you and I have the same salt and the same
hash value, it doesn't mean we chose the same password - though it DOES mean
that either of our passwords will work on either account.

In hashing passwords, VMS uses both a random salt (16 bits worth) AND the
UIC (user/group number, 32 bits) as part of the hash.  The components
protect different things:  The random salt is unpredictable for any given
user, so makes dictionary attacks harder.  The UIC is predictable - the UIC
for the SYSTEM account is always [1,4], for example - but it means that no
two different users ever have "comparable" hashed passwords, even if they end
up with the same salt.  (Since protection is based on the UIC, different
accounts with the same UIC already have complete access to each other.)

							-- Jerry
Xref: sparky alt.security:4006 rec.arts.movies:23121
From: smith@sctc.com (Rick Smith)
Newsgroups: alt.security,rec.arts.movies
Subject: Re: Cuckoo's Egg (Was: Re: Sneakers (Upcoming movie about "hackers"))
Keywords: Cliff, Cuckoo's Egg, movie
Date: 24 Jul 92 19:18:12 GMT
Distribution: usa
Organization: SCTC

billg@bony1.bony.com (Bill Gripp) writes:

>While Christopher Lloyd is best known for his "psycho" roles ...
>... I have seen him do a serious role or two and he is very good.

Does this have to be a _serious_ role?
Xref: sparky alt.security:4035 comp.security.misc:860
From: marantz@dartagnan.rutgers.edu (Roy Marantz)
Newsgroups: alt.security,comp.security.misc
Subject: security cards
Date: 29 Jul 92 14:57:24 GMT
Followup-To: alt.security
Organization: Rutgers Univ., New Brunswick, N.J.
To: marantz

First off, sorry about cross posting this, but I couldn't figure out
which list would be more appriopriate.

I'm trying to find out what kind of products are around that are some
kind of security card.  By security card I have in mind a small device
roughly the size of a credit card that would be used to augment
traditional password security schemes used on computers.

My objectives are to have a card system that:
 - has some way to generate a one time password.  I'd prefer not to
   use a challenge-response type system cause I think my users
   wouldn't like having to key in 3 passwords (password to computer,
   challenge to card, then resonse to computer)
 - can not use one card to impersonate another.  It would be nice if
   you could not impersonate a card even given the central database
   the verifying server uses.
 - can be integrated to work with kerberos V5 servers. (I'll do the
   work if need be).  This means any software will probably be needed
   on a variety of machines, so source would be best.
 - support replicated verifying servers.
 - is cheap enough for all my users to afford.  My direct users number
   in the hundreds while the university has thousands of potential
   users.  The cards I've found so far are in the $50 to $75 range (in
   quantity) with software costing from $0 to $25k.
 - is small and lite enought for people to carry on their person,
   hopefully in their wallet

So anyone have any comments/suggestions?  Please email me directly
since I don't read these lists.

Roy
-- 
Internet:   marantz@cs.rutgers.edu
uucp:       {backbone}!rutgers!cs.rutgers.edu!marantz
US Mail:    Rutgers University - LCSR * PO Box 879 * Piscataway, NJ 08855
Phone:      908/932-3995
From: dtj@caffeine.cray.com (Dean Johnson)
Newsgroups: alt.security
Subject: Re: Cuckoo's Egg (Was: Re: Sneakers (Upcoming movie about "hackers"))
Keywords: Cuckoo's Egg, security, PBS
Date: 21 Jul 92 22:28:41 GMT
Distribution: usa
Organization: Cray Research, Inc.
Originator: dtj@caffeine


In article <35876@sdcc12.ucsd.edu>, mark@kraken.ucsd.edu (Mark Anderson) writes:

> 
> Besides, word around town, is that Christopher Lloyd
> has a lock on playing you.
> 

How 'bout Gilbert Gottfried? Sorry Cliff...

	-Dean
Newsgroups: alt.security
From: thomg@dsr.uucp (Thom Garrett)
Subject: PBS Video addr
Organization: DSR
Distribution: alt
Date: Thu, 23 Jul 1992 13:21:22 GMT
Summary: PBS Video addr
Keywords: video

>have mentioned the PBS/Nova tv show, "The KGB, the CIA, the Computer,
>and Me"

>Well, I played a part in it, but I don't know where to get a copy

Wham, if anyone is interested, PBS Video may help:

		PBS Video
		1320 Braddock Place
		Alexandria Va 22314

		(703) 739.8490

Crackle, also PBS headquarters phone # is: (703) 739.5000 if needed.
 
----------------------------------\|/----------------------------------
|    "I wonder why I wonder why    |         Thom Garrett             |
|       I wonder why I wonder"     -         Digital System Resources |
|                                  |         thomg@dsr.UUCP           |
----------------------------------/|\----------------------------------
Newsgroups: alt.security,comp.security.misc
From: ignatz@wam.umd.edu (Mark J. Sienkiewicz)
Subject: Re: spell is a Trojan horse?
Organization: University of Maryland, College Park
Date: Wed, 22 Jul 1992 21:44:11 GMT

In article <1992Jul22.153612.6856@jarvis.csri.toronto.edu> flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>ignatz@wam.umd.edu (Mark J. Sienkiewicz) writes:
>>could be a security hole, if you have people spell-checking documents
>>that contain sensitive information.)
>
>Good Lord, spell is a Trojan horse!  I thought I was just spell-checking my
>documents, but really I'm filing them away for a sysadmin to peruse?  What
>systems is this true on?  And is it world readable too?

It's not quite that blatant. What it does (or used to do) is write a list of 
unrecognized words to /usr/dict/spellhist, along with the output of 'who am i'.

I just recently looked in /usr/bin/spell on a Next and an Ultrix, and found
that the file they use for this is /dev/null.  You could make it start
logging by changing 'H=/dev/null' to 'H=/usr/dict/spellhist' (or whatever
file you wanted) at the top of /usr/bin/spell.

Apparently "newer" systems are being shipped logging disabled, but it is 
probably because people don't know to clean out spellhist instead of any
concern for security.  (Why, yes, I _am_ cynical! why do you ask? :)

Yes, it is world readable too.  But if you don't want it recorded, you can
say
	spell -h /dev/null filename
to use your own history file.

Mark S.
Newsgroups: alt.security
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: passwd security check
Date: 23 Jul 92 15:34:10 GMT

technews@iitmax.iit.edu (Kevin Kadow) writes:
>Can somebody point me to a program that will do a security "audit" on the passwd
>file, e.g. reporting (either in a file or as e-mail to the concerned parties)
>when 2 or more accounts have the same password, and other "holes" that would
>not be found by crack?

apart from the big security problem others have pointed out, you can't do this
without cracking the two individual passwords anyway, unless they were
encrypted with the same salt (if the randomization is good, just one chance
in 4096).

>R.E. crack- is there a good reason not to simply build a file consisting of the
>crypted and uncrypted entries for an entire dictionary?

yeah, because it would be 4097 times as big as an entire dictionary rather than
just 2 times, due to the salt.  but you can do this using an exabyte drive.

>what is the meaning of accounts in passwd that have simply * as their password?

they're blocked from login, but programs like "ls" can still recognize them, so
you can see that the file is/was owned by fred even though his account has been
disabled, rather than it saying "user 356" which you forget who it is.
Xref: sparky alt.security:4040 comp.security.misc:866
Newsgroups: alt.security,comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Problem with npasswd??
Date: 30 Jul 92 02:57:38 GMT

hubcap@hubcap.clemson.edu (System Janitor) writes:
>Even dropping the time consuming crypt part, it seems like it would
>take an unacceptable amount of time to change your password if it were 
>checked against, say, an 800,000 word dictionary with 300 transmogrification 
>rulesets.

Um, you don't have to check everything in the "crack" way though.. like if one
of the rules is to prepend a digit, then you just remove a leading digit before
doing the lookup in the dictionary.  If you're starting from the plaintext
password, you can perform a lot of things directly rather than trying all
possibilities.  For example, suppose you wanted to ensure that the password is
not entirely lower-case letters.  Using crack, this involves 26**8 encryptions,
well a little more to include passwords shorter than 8 characters.  However, to
generate all of these passwords and compare the string against the plaintext
would be ridiculous.  You simply step through the plaintext password checking
whether each character is a lower-case letter.  Very quick as opposed to very
slow.
Newsgroups: alt.security
From: richg@hatch.socal.com (Rich Greenberg)
Subject: Re: Privileges and standards
Organization: Hatch Usenet and E-mail.  Playa del Rey, CA
Date: Wed, 22 Jul 1992 05:34:43 GMT

In article <1096@se.alcbel.be> mvbr@se.alcbel.be writes:

>Are there other operating systems than VMS that support the concept of
>privileges or is VMS the only one (and if yes, why) ? 

No, VMS is not the only one.  In VM, (IBM 370s), there are 32 privledge 
classes, A->Z & 0->5 which are implemented as bits in a 32 bit word.

IBM only uses A -> G, the others are for user implemented functions or
re-definitions of IBM specs.  G is General user.  Various privledged
commands are set to need A->E,  for example all commands that operate 
on the spool sub-system need class D.  Class F is used for hardware
diagnostics.  In addition to allowing you to manipulate the system
error recording logs,  it inhibits all system i/o error recovery.
-- 
                
Rich Greenberg - N6LRT - 310-649-0238 - richg@hatch.socal.com
Xref: sparky alt.security:4012 rec.arts.movies:23229
From: bryan@wupost.wustl.edu (bryan o'connor)
Newsgroups: alt.security,rec.arts.movies
Subject: Re: Cuckoo's Egg (Was: Re: Sneakers (Upcoming movie about "hackers"))
Keywords: Cuckoo's Egg, security, PBS
Date: 25 Jul 92 20:40:16 GMT
Distribution: usa
Organization: Washington University in Saint Louis, MO USA
NNTP-Posting-Host: wupost.wustl.edu

>>I think Cliff should play Cliff.
>nah - it's been done.  

I think that he should play one of the suits/spooks/etc. Imagine, if you will,
Cliff in a suit, tie, and dark glasses; and a stuffy suit type with jeans,
wrinkled shirt, long hair wig, and yoyo.:

CIA/FBI Guy (played by Cliff): Zooks, you says some vermin broke into
your computers... and stole the precious strawberry shake formula!
Cliff (played by CIA/FBI type): Yes, sir, as it says on line 5, sub-paragraph
24, section III of the aforementioned journal.

sprinkle the above with smilies,
--bryan
Newsgroups: alt.security,comp.security.misc,comp.sys.dec
From: coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size)
Subject: Re: News Group Readership Monitoring
Summary: How to let Digital know about security issues
Keywords: CERT, ERT, SSRT, Digital
Organisation: Employed by (*NOT* speaker for) DEC, Boxborough, MA, U.S.A.
Organization: Digital Equipment Corp.
Date: Tue, 21 Jul 1992 22:19:06 GMT


In article <1992Jul13.104153.28305@nntpd.lkg.dec.com>, coar@Nephi.Enet.DEC.Com
(Rodent of Unusual Size) writes...  - Hey, that's me..!
> 
>    If I get the exact details, would it be of interest to anyone for me to
>    post them here?  (Reply by email to coar@nephi.enet.dec.com, please.  If I
>    get more than a few `yes' responses, I'll do it.)

    As I've pointed out ealier, the `details' involved were those of
    contacting Digital's Software Security Response Team, *not* those of
    security holes.. ;->

    Anyway, here it is - right from ftp@cert.org:/pub/FIRST/first-contacts

>Constituency:           Digital Equipment Corporation and Customers
>Response Team:          SSRT (Software Security Response Team)
>E-mail:                 rich.boren@cxo.mts.dec.com
>Telephone:              +1-800-525-7100
>Emergency Phone:        +1-719-592-4689
>FAX:			 +1-719-592-4121

    Unfortunately, the indication is that there is *not* 7x24 coverage; I will
    try to verify this.

    #ken    :-)}	Jeratol the Chaotic

Coar@Nephi.Enet.DEC.Com	 | All opinions herein contained, stated or implied,
Coar@DECUS.Org		 | are solely those of the author.  And he's fullovem.
Coar@Eisner.DECUS.Org	 | `... it was mine art, ... that made gape the pine 
Massachusetts, USA       | and let thee out.'  - Prospero (_The Tempest_)
From: rjq@phys.ksu.edu (Rob Quinn)
Newsgroups: alt.security
Subject: Re: passwd security check
Date: 23 Jul 1992 14:44:26 GMT
Organization: Kansas State University
NNTP-Posting-Host: bohr.phys.ksu.edu

In <1992Jul23.092715.1@zodiac.rutgers.edu> leichter@zodiac.rutgers.edu writes:
]One thing it's important to remember is that there are many passwords that
]hash to the same value.  Even if you and I have the same salt and the same
]hash value, it doesn't mean we chose the same password - though it DOES mean
]that either of our passwords will work on either account.

 Can you provide an example? Or is there some mathematical proof? This question
has come up a lot before, and there have been answers on both sides, but no
proof either way that I have seen.
 
--
|                                                                Rob Quinn |
|                                                         rjq@phys.ksu.edu |
|                                                    QuinnBob@KSUVM.BITNET |
Newsgroups: alt.security,rec.arts.movies
From: billg@bony1.bony.com (Bill Gripp)
Subject: Re: Cuckoo's Egg (Was: Re: Sneakers (Upcoming movie about "hackers"))
Keywords: Cliff, Cuckoo's Egg, movie
Organization: LA&W RR
Distribution: usa
Date: Wed, 22 Jul 92 14:58:30 GMT

In article <1992Jul21.135455.19215@nntpd.lkg.dec.com> coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:
>
>In article <35876@sdcc12.ucsd.edu>, mark@kraken.ucsd.edu (Mark Anderson) writes...
>>In article <14fdptINNga9@agate.berkeley.edu> stoll@ocf.berkeley.edu (Cliff Stoll) writes:
>>>
>>>Zooks!  I'm trying to get back to astronomy.  My 15 minutes of fame are over.
>>>Cheers,
>>>Cliff
>>
>    [...]
>> 
>>Besides, word around town, is that Christopher Lloyd
>>has a lock on playing you.
>
>    Freud in the Void!  What a perfect casting!  There can be no alternatives!

While Christopher Lloyd is best known for his "psycho" roles (Rev Jim on
Taxi, Doc Brown in Back to the Future, the Judge in Who Framed Roger
Rabbit, etc. ) I have seen him do a serious role or two and he is very
good.

Newsgroups: alt.security
From: duck@nuustak.csir.co.za (Paul Ducklin)
Subject: Re: PIN Codes
Organization: CSIR
Date: Thu, 30 Jul 92 15:54:35 GMT

Thus spake rja14@cl.cam.ac.uk (Ross Anderson):
>As a result of all the posting here, I've got a fair bit of email and one
>item in particular should be of interest. Last month, at a market stall in
>High Wycombe, England, a stallholder was offering some pretty good bargains.
>To pay with your credit or debit card, you just swiped it in his reader,
>types a PIN into the portable PC to which the reader was attached, and got
>a beautiful printed receipt. . .

That really *is* far out. In South Africa now, miniature EFTPOS units are
becoming very widespread. Many small stores are going for them because they
automate the process of credit card authorisation (no more voice calls to an
080-TOL-FREE number), keep the customer waiting 20 seconds instead of 15
minutes and (apparently) get money from client to shop faster. There seem
to be more types of EFTPOS unit than there are brands of credit card, and
they all look like a sort of screenless KIM-1, done out in a very tastelessly
coloured, 100% pure plastic. How is the consumer supposed to know whether
they're looking at a Trojanised unit or not? Ross's example is extreme, and 
should be ringing alarm bells in the least paranoid mind. But when you see a
genuwyne-looking EFTPOS unit with F*rst Nat*onal B*nk and the (infamous)
thorn-tree logo all over it, even the most paranoid types are likely to relax
a little! Incidentally, I seem to remember that the FNB units are blue. When
do we see a new wave of Blue Boxes?

Paul Ducklin
CSIR, Pretoria

 

--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--<>--
Paul Ducklin                                           duck@nuustak.csir.co.za

    CSIR Computer Virus Research Lab * Box 395 * Pretoria * 0001 S Africa
From: jsm@phoenix.Princeton.EDU (John Scott McCauley Jr.)
Newsgroups: alt.security
Subject: physically locking a RS232 line
Date: 31 Jul 92 14:37:39 GMT
Organization: Princeton University
Originator: news@ernie.Princeton.EDU

Anyone know a gadget that prevents unautorized use of an unused RS232 port?

Something like a small lock and hasp to make it difficult to use the
port without the key. 

Even a small cover using TORX screws might help.


	Thanks,

		Scott
From: rjq@phys.ksu.edu (Rob Quinn)
Newsgroups: alt.security
Subject: Re: passwd security check
Date: 22 Jul 1992 19:46:53 GMT
Organization: Kansas State University
NNTP-Posting-Host: bohr.phys.ksu.edu

In <1992Jul22.190827.30077@iitmax.iit.edu> technews@iitmax.iit.edu (Kevin Kadow) writes:
>file, e.g. reporting (either in a file or as e-mail to the concerned parties)
>when 2 or more accounts have the same password, and other "holes" that would
>not be found by crack?

 Interesting idea, wonder why I hadn't thought of that before? Here's a start:

grep :Y: F.merged | cut -d: -f4 | sort | uniq -d


>R.E. crack- is there a good reason not to simply build a file consisting of the
>crypted and uncrypted entries for an entire dictionary? this would be twice
>as large as just a word dictionary, but much faster than re-crypting...

 There are 4096 ways to encrypt each word, and dicts.rules and gecos.rules
generate thousands of new words.

>what is the meaning of accounts in passwd that have simply * as their password?

 No password encrypts to '*' so the account can not be used by a normal user.

--
|                                                                Rob Quinn |
|                                                         rjq@phys.ksu.edu |
|                                                    QuinnBob@KSUVM.BITNET |
From: technews@iitmax.iit.edu (Kevin Kadow)
Newsgroups: alt.security
Subject: passwd security check
Date: 22 Jul 92 19:08:27 GMT
Organization: Technology News, IIT, Chicago, IL

Several q`s from a novice:

Can somebody point me to a program that will do a security "audit" on the passwd
file, e.g. reporting (either in a file or as e-mail to the concerned parties)
when 2 or more accounts have the same password, and other "holes" that would
not be found by crack?

R.E. crack- is there a good reason not to simply build a file consisting of the
crypted and uncrypted entries for an entire dictionary? this would be twice
as large as just a word dictionary, but much faster than re-crypting...

what is the meaning of accounts in passwd that have simply * as their password?

-- 
             There's a fine line between clever and stupid.

technews@iitmax.iit.edu                           kadokev@harpo.iit.edu
                         My Employer Disagrees.
From: coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size)
Newsgroups: alt.security
Subject: Re: passwd security check
Summary: VMS uses salt and *username*, not UIC
Keywords: VMS, password, encryption
Date: 23 Jul 92 17:08:56 GMT
Organization: Digital Equipment Corp.
Organisation: Employed by (*NOT* speaker for) DEC, Boxborough, MA, U.S.A.


In article <1992Jul23.092715.1@zodiac.rutgers.edu>, leichter@zodiac.rutgers.edu writes...
> 
>In hashing passwords, VMS uses both a random salt (16 bits worth) AND the
>UIC (user/group number, 32 bits) as part of the hash.

    Actually, it's the *username* that goes into the soup, not the UIC.  Hence
    even users with the same salt and UIC won't hash the same.  At least, this
    is the case with the VMS-supplied algorithms; if you've instituted your
    own, this need not apply.

>							-- Jerry

    #ken    :-)}	Jeratol the Chaotic

Coar@Nephi.Enet.DEC.Com	 | All opinions herein contained, stated or implied,
Coar@DECUS.Org		 | are solely those of the author.  And he's fullovem.
Coar@Eisner.DECUS.Org	 | `... it was mine art, ... that made gape the pine 
Massachusetts, USA       | and let thee out.'  - Prospero (_The Tempest_)
From: barmar@think.com (Barry Margolin)
Newsgroups: alt.security
Subject: Re: CERT ADVISORY - Multiple SunOS Vulnerabilities
Date: 22 Jul 1992 21:51:23 GMT
Organization: Thinking Machines Corporation, Cambridge MA, USA
NNTP-Posting-Host: telecaster.think.com

In article <1992Jul22.154650.9967@jarvis.csri.toronto.edu> flaps@dgp.toronto.edu (Alan J Rosenthal) writes:
>In comp.security.announce, cert-advisory-request@CERT.ORG (CERT Advisory) writes:
>    >CA-92:15                        CERT Advisory
>    >                                July 21, 1992
>    >                    Multiple SunOS Vulnerabilities Patched
>    >--------------------------------------------------------------------------
>
>    >NFS jumbo patch upgrade, SunOS 4.1, 4.1.1, 4.1.2, all architectures
>
>What's new with THIS jumbo patch?  Is it the same jumbo patch?

Like it says, it's an upgrade, i.e. a new version, of the old jumbo patch.

>    >ICMP redirects patch upgrade, SunOS 4.1, 4.1.1, 4.1.2, all architectures
>    ...
>    >     allows an intruder to close existing network connections to and from
>				^^^^^
>    ...
>    >II.  Impact
>    >     A remote user may deny network services on a Sun system.
>			    ^^^^
>
>So which is it, can they close existing ones or only deny new ones?

The Impact section doesn't specifically say "new".  Presumably it affects
all communication with the subnet/host to which the fake redirect refers.
My guess is that this patch makes the code that processes an ICMP redirect
check whether it came from the gateway that is currently being used for
the specified destination, so that random hosts can't send you arbitrary
redirects (although there's still the possibility of the sender having
enough control to insert the router's address in the ICMP packet's source
address -- if your router to the Internet has filtering capabilities, it's
a good idea to have it filter out packets whose source address is on your
local network, to prevent an important class of such spoofing).
-- 
Barry Margolin
System Manager, Thinking Machines Corp.

barmar@think.com          {uunet,harvard}!think!barmar
Newsgroups: alt.security,sci.crypt
From: imp@solbourne.com (Warner Losh)
Subject: Re: passwd security check
Organization: Solbourne, User Interface Group
Date: Thu, 30 Jul 1992 15:55:47 GMT

>: In article <1345@eouk9.eoe.co.uk> ahaley@eoe.co.uk (Andrew Haley) writes:
>: >There are weak keys (e.g. 01 01 01 01 01 01 01 01) which do no real
[...]
>How do you get from eight bytes of 01 hex to ",U,U,U,U"?  I don't
>understand...

I thought that the 01010101 was a series of bit values, rather than
hex values.  Since they are hex values, they are indeed quite hard to
type as characters at a Password: prompt.  Sorry for any confusion
that my previous post may have caused.

Warner
-- 
Warner Losh		imp@Solbourne.COM
Interview Horror Story #882: "It's pretty informal around here.
Thursdays are clothing optional.."
Newsgroups: alt.security