HDTenEightyP/NetNews huggingface dataset:
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: pc-mpc
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date: 11 Jan 93 17:30:30 GMT

rick@ee.uwm.edu (Rick Miller) writes:

> > Well, an brand new version of PS-MPC is already out as of a few
> >days ago. It is suposed to be a far superior Virus authoring package than
> >the original.
> >                   phase@cybernet.cse.fau.edu

> Did I understand right?  You're talking about a tool for *developing* viruses?

Yes, he is speaking about a program to generate viruses. On the top of
that, it generates viruses in source (as .ASM files), so they can be
further modified by whoever wishes. There are already half a dozen
such packages (we are calling them "virus authoring packages") and
PS-MPC was the less buggy one... There were already two versions of
it, he is probably speaking about yet another version.

> Where has this come out? and how can its progeny be combatted?  Are the viruse
> thus produced generic enough to catch easily? or are they gonna be trouble???

Well, the viruses -origianlly- generated by a virus authoring package
can be detected generically. For instance, both F-Prot and Dr.
Solomon's Anti-Virus ToolKit detect all viruses generated by the first
two versions of PS-MPC as "PS-MPC encoded" viruses.

Nevertheless, each such virus authoring package means trouble. First,
because it is much more difficult to analyse a virus creation tool
than a particular virus. This means more time spent by the anti-virus
researchers. Second, because the viruses are generated in source,
which means that they can be very easily modified in such a way that
the scanners will not detect them... :-(

Regards,
Vesselin

P.S. Please not that the appropriate group to discuss this is
comp.virus.
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: phase@cybernet.cse.fau.edu (Phase)
Newsgroups: alt.security
Subject: pc-mpc
Date: 10 Jan 93 15:08:33 GMT
Organization: Cybernet BBS, Boca Raton, Florida


 Well, an brand new version of PS-MPC is already out as of a few
days ago. It is suposed to be a far superior Virus authoring package than
the original.
                   phase@cybernet.cse.fau.edu
Newsgroups: alt.security
From: zeleznik@cs.utah.edu (Mike Zeleznik)
Subject: Re: trusted network interpretation
Date: 6 Jan 93 14:13:38 MST
Organization: University of Utah CS Dept

In article <1993Jan5.133700.3950@nplpsg.uucp> rpl@dsg.npl.co.uk (Richard Lampard) writes:
>
>I am looking for information on the Trusted Network Interpretation of the US
>DoD TCSEC (the Orange Book). I actually have a copy of the TNI, but time is
>short, and it's a rather formidable document. 
>
>Are there any papers in the literature which give an overview of the TNI? I
>am especially interested in claims that the TNI is flawed i.e. that it does
>not adequately address the problems of evaluating distributed systems. Can
>anyone shed any light on this?

Two similar articles by Alfred Arenault give a good overview:

Developments in Guidance for Trusted Networks, 10th National Computer
Security Conference, 1987, p1

Developments in Guidance for Trusted Computer Networks: the Trusted Network
Interpretation, AIAA/ASIS/IEEE Third Areospace Computer Security
Conference, 1987, p52

The NCSCs can be gotten by calling 301-975-3360, Irene Gilbert; they
are free of charge.

Mike
From: rpl@dsg.npl.co.uk (Richard Lampard)
Newsgroups: alt.security
Subject: trusted network interpretation
Date: 5 Jan 93 13:37:00 GMT
Organization: National Physical Laboratory, UK


I am looking for information on the Trusted Network Interpretation of the US
DoD TCSEC (the Orange Book). I actually have a copy of the TNI, but time is
short, and it's a rather formidable document. 

Are there any papers in the literature which give an overview of the TNI? I
am especially interested in claims that the TNI is flawed i.e. that it does
not adequately address the problems of evaluating distributed systems. Can
anyone shed any light on this?

Thanks in advance.

Richard Lampard
Data Security Group
National Physical Laboratory
Queens Road
Teddington
Middlesex TW11 0LW
ENGLAND

Tel: +4481 943 7060
Fax: +4481 977 7091
Newsgroups: alt.security,comp.security.misc
From: jna@silver.lcs.mit.edu (some nights he's weightless)
Subject: Rainbow Series Telephone number anyone?
Organization: We Take What We Want, Inc.
Date: Tue, 5 Jan 1993 06:52:47 GMT

I'm looking for the phone number for INFOSEC so I can order the rainbow
series of books, but the number listed in the FAQ isn't working anymore..
anyone have it?

  -john


Newsgroups: alt.security
From: cs_e445@ceres (Vlod Kalicun)
Newsgroups: alt.security
Subject: Re: VIRUS TOOLKIT
Date: 5 Jan 1993 16:49:52 GMT
Organization: Kingston University
NNTP-Posting-Host: ceres.kingston.ac.uk
X-Newsreader: Tin 1.1 PL4

bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev) writes:
: curt@access.digex.com (curt williams) writes:
: 
: > Has anyone else heard about, or run across, a menu-driven program
: > that allows a person to build a custom virus for MS-DOS machines.
: > It was supposed to be for sale in one of the hacker magazines.
: 
: There are several. We are calling them "virus authoring packages".
: Currently I am aware of VCS, VCL, MtE, PS-MPC, IVP, TPE, Genvirus.
: Most of them exist in more than one version. From your description I
: guess that you mean either VCL or Genvirus - the others are not
: menu-driven. VCL has a nice flashy look but is horribly buggy - most
: of the viruses it generates do not assemble, if they assemble they
: hang the machine, and if they don't hang the machine, they do not
: replicate... :-). About Genvirus I don't know, since I don't have it.
: It is supposed to be French (with French user interface) and is sold
: by its author in France. The others should be freeware.
: 
: Please, don't ask me to send you any of them, because the policy of
: our VTC forbids me to send out malicious code.
: 
: Regards,
: Vesselin
: -- 
: Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
: Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
: < PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
: e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany

I don't suppose the above mentioned progs. are avail from a ftp site??

Wolodymyr Kalicun.
Kingston Univ. London. England.
cs_e445@kingston.ac.uk
Newsgroups: alt.security
From: al@escom.com (Al Donaldson)
Subject: Re: pc-mpc
Reply-To: al@escom.COM (Al Donaldson)
Organization: ESCOM Corp., Oakton VA (USA)
Date: Mon, 11 Jan 1993 19:02:50 GMT

In article <1iq463INNm17@uwm.edu> rick@ee.uwm.edu (Rick Miller) writes:
>Did I understand right?  You're talking about a tool for *developing* viruses?

That could be quite profitable to someone who had software to make
"cures" for the family of viruses it generated.  Give the virus 
generator away for free, and charge for the software to find and 
remove the virus.  Sorta like a cancer hospital going into the 
tobacco business..

OK, so I'm paranoid.  But that doesn't mean they're not out to get me.. :-)

Al
Xref: sparky alt.security:5297 comp.security.misc:2484
From: Burchianti@Fwva.Saic.Com
Newsgroups: alt.security,comp.security.misc
Subject: VMS Computer Security
Date: Tue, 12 Jan 1993 01:28:52 GMT
Organization: Science Applications Int'l, Corp. - Computer systems operation

My company is interested in putting a medical information system on the
Internet but is concerned about privacy restrictions of the data.  Most of the
computer information on the Internet seems to deal with Unix systems but not
VMS.  Does anyone have any information that may be useful?
From: ibacon@uniwa.uwa.edu.au (Ian Bacon)
Newsgroups: alt.security
Subject: Re: Rainbow Series Telephone number anyone?
Date: 6 Jan 1993 16:20:11 +0800
Organization: The University of Western Australia
NNTP-Posting-Host: uniwa.uwa.edu.au
X-Newsreader: Tin 1.1 PL5

Ok, ok,  call me stupid, what is the rainbow series of books about?
From: faigin@aero.org (Daniel P. Faigin)
Newsgroups: alt.security
Subject: Re: Rainbow Series Telephone number anyone?
Date: 6 Jan 93 12:25:14
Organization: The Aerospace Corporation, El Segundo, CA
NNTP-Posting-Host: soldan.aero.org
In-reply-to: ibacon@uniwa.uwa.edu.au's message of 6 Jan 1993 16:20:11 +0800

On 6 Jan 1993 16:20:11 +0800, ibacon@uniwa.uwa.edu.au (Ian Bacon) said:

> Ok, ok,  call me stupid, what is the rainbow series of books about?

The Rainbow Series, so called because of the colors of their covers, is a
collection of computer security criteria and criteria interpretations
developed by the National Computer Security Center in the U.S.

Daniel
--
[W]:The Aerospace Corp. M1/055 * POB 92957 * LA, CA 90009-2957 * 310/336-8228
[Email]:faigin@aerospace.aero.org              [Vmail]:310/336-5454 Box#13149
		    "And as they say, the rest is compost"
Xref: sparky alt.security:5277 comp.org.usenix:1192 comp.unix.admin:6949 comp.security.misc:2464
From: ecd@cert.org (Edward DeHart)
Newsgroups: alt.security,comp.org.usenix,comp.unix.admin,comp.security.misc
Subject: Fourth USENIX UNIX Security Symposium
Keywords: USENIX UNIX Security Symposium workshop
Date: 7 Jan 93 15:55:22 GMT
Organization: Computer Emergency Response Team, Pittsburgh, PA


=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

                       Announcement and Call for Papers

                   The Fourth USENIX UNIX Security Symposium
                               October 4-7, 1993
                             Santa Clara Marriott

                              Incooperation with
                         The CERT Coordination Center

       The  goal  of  this  symposium  is  to  bring  together  security
       practitioners,  system administrators and system programmers, and
       anyone with an interest in computer security  as  it  relates  to
       networks  and  the  UNIX  operating  system.   The symposium will
       consist of tutorials, invited speakers, technical  presentations,
       and panel sessions.

       This will be a three and 1/2 day,  single-track  symposium.   The
       first  day  will  be  devoted  to  tutorial  presentations.   The
       following two and 1/2 days will include  technical  presentations
       and  panel  sessions.   There will also be two evenings available
       for birds-of-a-feather sessions and work-in-progress sessions.

       Papers are being solicited in areas including but not limited to:

          o User/system authentication
          o File system security
          o Network security
          o Security and system management
          o Security-enhanced versions of the UNIX operating system
          o Security tools
          o Network intrusions (including  case  studies  and  intrusion
            detection efforts)
          o Security on high-bandwidth networks

       Important Dates
            Extended abstracts due             June    4, 1993
            Program Committee decisions made   June   30, 1993
            Camera-ready papers due            August 15, 1993

       Send hardcopy submissions to the program chair:
            Bill Cheswick
            AT&T Bell Laboratories
            Room 2c416
            600 Mountain Ave.
            Murray Hill, NJ  07974

       Send ASCII or Postscript submissions to:
            ches@research.att.com

       Program Committee
            Steve Bellovin      AT&T Bell Laboratories
            Matt Bishop         Dartmouth College
            Ed DeHart           CERT
            Jim Ellis           CERT
            Marcus Ranum        Trusted Information Systems

Newsgroups: alt.security
From: pholman@Ingres.COM (Paul Holman)
Subject: Kerberos Information
Keywords: Network Kerberos
Date: 8 Jan 93 14:52:32 GMT

I'm interested in any information about Kerberos, knowing only
that it is an authentication server and PC Net based in origin.

A search through a stack of PC mags yielded nothing, so any 
pointers to contacts/information would be appreciated.

______________________________________________________________________________
Ingres International     |     pholman@ingres.com     |   15-19 Britten Street
EEC (Emerging Products)  |____________________________|        London, SW3 3TY
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 9 January 1993
Date: Sat, 9 Jan 1993 22:00:24 EST
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<1993Jan4.223743.452@news.cs.indiana.edu> "vulnerabilities of RIPEM"
<C0E2L0.Euw@usenet.ucs.indiana.edu> "vulnerabilities of RIPEM"
<bontchev.726256535@fbihh> "info about a program that produces viruses"
<1992Dec23.044509.23809@jpradley.jpr.com> "hill - encryption program"
<1992Dec30.214813.13497@softwords.bc.ca> "virus report"
Newsgroups: alt.security
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: VIRUS TOOLKIT
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date:  4 Jan 93 12:48:54 GMT

curt@access.digex.com (curt williams) writes:

> Has anyone else heard about, or run across, a menu-driven program
> that allows a person to build a custom virus for MS-DOS machines.
> It was supposed to be for sale in one of the hacker magazines.

There are several. We are calling them "virus authoring packages".
Currently I am aware of VCS, VCL, MtE, PS-MPC, IVP, TPE, Genvirus.
Most of them exist in more than one version. From your description I
guess that you mean either VCL or Genvirus - the others are not
menu-driven. VCL has a nice flashy look but is horribly buggy - most
of the viruses it generates do not assemble, if they assemble they
hang the machine, and if they don't hang the machine, they do not
replicate... :-). About Genvirus I don't know, since I don't have it.
It is supposed to be French (with French user interface) and is sold
by its author in France. The others should be freeware.

Please, don't ask me to send you any of them, because the policy of
our VTC forbids me to send out malicious code.

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
From: faigin@aero.org (Daniel P. Faigin)
Newsgroups: alt.security
Subject: Re: Rainbow Series Telephone number anyone?
Date: 5 Jan 93 07:44:04
Organization: The Aerospace Corporation, El Segundo, CA
NNTP-Posting-Host: soldan.aero.org
In-reply-to: jna@silver.lcs.mit.edu's message of Tue, 5 Jan 1993 06:52:47 GMT

On Tue, 5 Jan 1993 06:52:47 GMT, jna@silver.lcs.mit.edu (some nights he's
weightless) said: 

> I'm looking for the phone number for INFOSEC so I can order the rainbow
> series of books, but the number listed in the FAQ isn't working anymore..
> anyone have it?

To order one complimentary copy of the rainbow series, call or write the
INFOSEC Awareness Office at:

	INFOSEC Awareness Division
	Attn: X711/IAOC
	Ft. George G. Meade MD 20755-6000

	(410) 766-8729
	Barbara Keller

Daniel
Chair, ACM/SIGSAC



--
[W]:The Aerospace Corp. M1/055 * POB 92957 * LA, CA 90009-2957 * 310/336-8228
[Email]:faigin@aerospace.aero.org              [Vmail]:310/336-5454 Box#13149
		    "And as they say, the rest is compost"
Newsgroups: alt.security
From: bontchev@fbihh.informatik.uni-hamburg.de (Vesselin Bontchev)
Subject: Re: VIRUS TOOLKIT
Reply-To: bontchev@fbihh.informatik.uni-hamburg.de
Organization: Virus Test Center, University of Hamburg
Date:  5 Jan 93 17:55:35 GMT

cs_e445@ceres (Vlod Kalicun) writes:

> I don't suppose the above mentioned progs. are avail from a ftp site??

Fortunately - not, at least not any ftp site I am aware of.
Unfortunately, many pirate and/or virus exchange BBSes are
distributing some of them... :-( Of all the packages listed the only
one that poses any considerable danger is PS-MPC. The others are
either too silly to produce any serious virus, or too difficult to use
(MtE, TPE). PS-MPC can produce 96 signifficantly different viruses
(each of them using a different, slightly polymorphic decryptor) and
those viruses actually work... What is worse - they are generated in
source code, so they can be very easily modified further by anybody
how knows how to program in assembly language... On the top of that,
there are 2 different versions of PS-MPC, which means that up to 192
different decryptors can be generated... Fortunately, some of the
existing scanners (F-Prot, Dr. Solomon's Toolkit) can handle any virus
generated by this virus authoring package, unless the virus writers
modifies the generated decryptor further (and even then in some
cases).

Regards,
Vesselin
-- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany
Newsgroups: alt.security
From: MAEPSTEIN@VASSAR.EDU
Subject: DISKLOCK SOFTWARE EMERGENCY- HELP PLEASE
Organization: Yale University
Date: Tue, 12 Jan 93 18:17:20 EST

This may be inappropriate for this newsgroup, but perhaps someone could kindly
steer me in the right direction. I have an inherited (department) Mac SE, on wh
ich the former owner placed an unfortunately unregistered copy of DISKLOCK.
 
I fed in my password, and all was going well until last week when I found
I could not get in to my own hard drive. I am informed that I need a program ca
lled EMERGENCY UNLOCK which comes with DISKLOCK. Unfortunately I have no backup
 of the program, so I wonder if someone has that program and could send me
 a copy. Please EMAIL me directly with any suggestions you might have, or call.
 Time is of the essence here.  Thank you.
Marc M. Epstein
AP, Religion Department
VASSAR COLLEGE
(914) 437-5522 or MAEPSTEIN@VASSAR.EDU
From: colint@spider.co.uk (Colin Tinto)
Newsgroups: alt.security
Subject: Re: car security idea
Keywords: technology
Date: 5 Jan 93 11:53:40 GMT
Followup-To: alt.security
Organization: Spider Systems Limited, Edinburgh, UK

Just read that the LoJack system has been under trial in the UK by one
of the Police Forces, and will soon be available all over the country...

Not a bad system by the looks of things.


-- 
/-----------------------------------------------------------------------------\
!   Colin Tinto			!  Time Travel Parcel Deliveries Inc          !
!   colint@spider.co.uk		!  The only courier with previous day service.!
\-----------------------------------------------------------------------------/
Xref: sparky alt.security.pgp:457 alt.security.ripem:29
From: matt@ra.oc.com (Matthew Lyle)
Subject: Re: PGP
Organization: OpenConnect Systems, Dallas, TX
Date: Wed, 6 Jan 1993 15:08:36 GMT

Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu> writes:
>Thus said eoliver@ralph.cs.haverford.edu (Erik Oliver):
>>I found that its interface made PGPs look terrific, IMHO.
>Can you be more specific?  What tasks did you find easier to perform
>using PGP?  How exactly did you attempt to perform them with each?
>RIPEM takes a bit of customization to make work smoothly, and works
>much better with some mailers than others (which is the fault of the
>mailer.)

Sounds like an excuse to me.  If you are creating a program that needs to
work with existing mailers you should architect it to do that.

I've not been impressed with RIPEM's user interface, and I've run it on
several platforms. 


-- 

Matthew Lyle                                           matt@oc.com
                                                       matt@utdallas.bitnet
OpenConnect System, Dallas, Texas                      (214) 888-0474
Newsgroups: alt.security.pgp,alt.security.ripem
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: PGP
Followup-To: alt.security.ripem
X-Quoted: 28%
Organization: Computer Science Dept, Indiana University
Date: Wed, 6 Jan 1993 15:04:40 -0500

Thus said matt@ra.oc.com (Matthew Lyle):
>Sounds like an excuse to me.  If you are creating a program that needs to
>work with existing mailers you should architect it to do that.

Indeed, it was written with the intention of being reasonably portable
to any mailer.  For example, just before being passed to the MTS, a
message should be piped through "ripem -e -h rp" for encryption to work;
this is pretty simple to see and use.  Can anyone tell me the PGP
equivalent to the above command?

>I've not been impressed with RIPEM's user interface, and I've run it on
>several platforms. 

Can you be a little more specific?
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted

Nature makes jumps.
		- Hilbert
Newsgroups: alt.security.pgp,alt.security.ripem
From: Marc VanHeyningen <mvanheyn@whale.cs.indiana.edu>
Subject: Re: PGP
X-Quoted: 28%
Organization: Computer Science Dept, Indiana University
Date: Wed, 6 Jan 1993 09:34:08 -0500

Thus said eoliver@ralph.cs.haverford.edu (Erik Oliver):
>RIPEM  just ain't as good as PGP, I got a special username password to
>download ripem from a site in missouri, (I think it is the creator's
>site), and compiled it without much trouble.

Michigan, not Missouri (not that it really matters.)

>I found that its interface made PGPs look terrific, IMHO.

Can you be more specific?  What tasks did you find easier to perform
using PGP?  How exactly did you attempt to perform them with each?
RIPEM takes a bit of customization to make work smoothly, and works
much better with some mailers than others (which is the fault of the
mailer.)

>Also, I realized that using it would be a pain in the ass, because
>nobody outside the USA and CA would be able to (1) validate my messages
>and (2) nobody would be able to decrypt them either.

This is true, at least until compliant software ends up in use outside
North America.  Conversely, with PGP, many potential correspondents in
the U.S. and Canada will not be able to decrypt or verify your messages
because they believe PGP to be illegal and will not use it.  You makes
your choices.

>Additionally, there are going to be _many_ competing RIPEM
>implementations that are not all necessarily going to be compatible.
>For example, I am waiting to beta test a version of RIPEM from tis.com.
>Perhaps that will be better.

I assume that what you actually mean is "there will be many PEM
implementations that are not all necessarily going to be compatible."
There is a version of PEM from TIS that is being made available.  It
will not be RIPEM.  It should (eventually) be compatible with RIPEM in
some way, though the standards are still evolving.  But at least there
are standards, and RIPEM has a chance in hell of communicating with
anything other than another copy of RIPEM, which is more than PGP can
say.
-- 
Marc VanHeyningen    mvanheyn@whale.cs.indiana.edu    MIME & RIPEM accepted

Immediate access, limited costs, high-tech medicine.
For health care, choose only two of the above.
Newsgroups: alt.security.pgp,alt.security.ripem