HDTenEightyP/NetNews huggingface dataset:
From: johnm@cajal.uoregon.edu (John Martin)
Subject: Re: Pleasure.com mystery solved.
Keywords: n
Organization: Institute of Neuroscience, University of Oregon
Date: Thu, 30 Jul 92 05:34:13 GMT

In article <1992Jul29.215824.16932@anomaly.sbs.risc.net>, kd1hz@anomaly.sbs.risc.net (Michael P. Deignan (KD1HZ)) writes:

>atkinson@itd.nrl.navy.mil (Randall Atkinson) writes:
>
>>  The DDn Network Information Center is the ONLY official organisation
>>that can grant or delegate responsibility for domain names.
>
>Do you have the law which deligates them this authority?
>
>No? I thought so.
>
>The NIC is a clearinghouse, which is generally accepted amoung sites to be
>"the center" for registering a domain. There is no force-of-law behind this,
>however.
> 


This is downright frightening.  Are you saying that something has to be
criminal before you should avoid doing it??  There is no force of law, as you
put it, but it is a very strongly rooted convention, not to mention just
plain old good manners.

It is this very type of thinking that requires we have so many stupid laws
on the books in the first place!  I find it very discouraging that this could
even be brought up in this discussion.


-- 
John Martin                                        johnm@cajal.uoregon.edu
Institute of Neuroscience,   University of Oregon,    Eugene, OR,    97402
Xref: sparky comp.security.misc:878 alt.security:4062 comp.unix.ultrix:6000
From: tjc@ecs.soton.ac.uk (Tim Chown)
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
Subject: Re: Problem with npasswd??
Date: 31 Jul 92 13:06:36 GMT
X-Phone: +44 703 593257

In <1992Jul28.035951.22683@reed.edu> nelson@reed.edu (Nelson Minar) writes:

>Furthermore, there's no reason in principle that the crack 4.1 word
>generation engine (which is excellent) can't be grafted into npasswd.
>I keep hoping someone else will do the work for me.

Why not just alter npasswd to force at least one upper case letter, one
digit plus one non-alphanumeric?   Such passwords can still be remembered
reasonably easily and are very resistant to cracking programs.  

Tim
From: coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size)
Subject: Re: COPS-like packages for VMS
Summary: Maybe the DECinspect suite?
Keywords: DECinsoect, COPS, VMS
Organisation: Employed by (*NOT* speaker for) DEC, Boxborough, MA, U.S.A.
Organization: Digital Equipment Corp.
Date: Thu, 23 Jul 1992 20:46:10 GMT


In article <1992Jul23.183709.11718@linus.mitre.org>, edelheit@smiley.mitre.org (Jeff Edelheit) writes...
>
>Does anyone have any recommendations for COPS-like software packages
>for VMS?

    Have you looked into the DECinspect product suite from Digital?
    (DECinspect Compliance Manager, DECinspect Security Reporting Facility,
    and DECinspect Intrusion Detection..)  There are versions for ULTRIX and
    SunOS as well, and they're all *supposed* to play together.

>Jeff Edelheit		email:  edelheit@mitre.org

    #ken    :-)}	Jeratol the Chaotic

Coar@Nephi.Enet.DEC.Com	 | All opinions herein contained, stated or implied,
Coar@DECUS.Org		 | are solely those of the author.  And he's fullovem.
Coar@Eisner.DECUS.Org	 | `... it was mine art, ... that made gape the pine 
Massachusetts, USA       | and let thee out.'  - Prospero (_The Tempest_)
Xref: sparky comp.security.misc:841 alt.security:4026 comp.unix.ultrix:5926
From: bush@ecs.ox.ac.uk (Mark Bush)
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
Subject: Re: Problem with npasswd??
Date: 28 Jul 92 08:47:20 GMT
Organization: Oxford University Computing Laboratory

In article <PCL.92Jul27140810@black.oxford.ac.uk> pcl@oxford.ac.uk (Paul Leyland) writes:
#At our site, I *may* have found a problem, though I have no idea
#whether I broke the Ultrix specific code, or if it is a bug in the
#generic code.  This under Ultrix v4.2a
#
#Third-party password changes sometimes change *root's* password.  That
#is, suppose I (pcl) am approached by jruser to change their password.
#I type something like:
#	% \/bin/su - root
#	Password:
#	# npasswd jruser
#	...
#
#If I make a typo at this point, and have to have another go at
#changing jruser's password (still in the same invocation of npasswd,
#BTW) and succeed in getting a password through, I *sometimes* find
#that root's password has been changed and the user's has not.  My
#password is left unchanged. (Phew!)

I have not experienced this on Suns (yet!).  This is running the pw_yp.c
code to update NIS passwords if there is no local password.  The main hacks
I have made are to update a separate NIS password age database if a NIS
password has been successfully changed.

Mark
From: richard@asis.unimelb.EDU.AU (Richard Begg)
Newsgroups: comp.security.misc
Subject: Re: System "pleasure.com"
Date: 31 Jul 92 03:19:08 GMT

gt5870c@prism.gatech.EDU (Noah White) writes:

|In article <14qpc7INNore@agate.berkeley.edu> alanc@ocf.berkeley.edu (Alan Coopersmith) writes:
|>In article <64189@hydra.gatech.EDU> gt5870c@prism.gatech.EDU (Noah White) writes:
|>)In article <1992Jul23.144712.547@ulowell.ulowell.edu> oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:
|>
|>Wait a minute...if I log in to pleasure.com and ask the sysadmin to put a
|>file in my account here, how is he going to get into my account here without
|>divulging my password?  Or am I misunderstanding what's happening?
|>
|  If the sysadmin is running Unix, a simple chown, chgrp make it yours, 
|remember the super user can go anywhere and do anything without others 
|passwords.

On *HIS* host maybe, but how is supposed to do it on anybody elses machine
without a password?

--
Richard Begg (richard@asis.unimelb.edu.au)
Admin Systems and Info Services - University of Melbourne.
Newsgroups: comp.security.misc
From: ggm@brolga.cc.uq.oz.au (George Michaelson)
Subject: Re: unhappy about overloading finger
Organization: Prentice Centre, University of Queensland
Date: Tue, 21 Jul 1992 23:55:04 GMT

dank@blacks.jpl.nasa.gov (Dan Kegel) writes:

>But what about 'Horton'?  It fingers all the participating machines in
>one's own domain hourly to update an e-mail address database,
>which users then access via whois.
>Since all the finger requests it generates are between two sites inside 
>your own domain, they should be easy to distinguish as benign.
>Do you consider this a 'bad' use of finger?

Ummmmmm.. I think I'd like to think about that one. On the whole, I'd
have preferred 'horton' to distribute a variant of the fingerd daemon
as a stepping stone to applying for an allocated SERVICE number from
NIC/<whoeveritis> so that this migrates to another port.

That way I know that this traffic is constrained to just that context.

no... I dont trust every host within my local domain. some of these hosts
are TCP/IP terminal servers where connect <host> <port> is legal, so people
can be emulating a range of services by telnet-typing.

>It would be impractical to make horton use something other than finger,
>since it's whole reason for being is that it makes use of a universally 
>available protocol for gathering information & thus requires no
>active cooperation from the participating (but anarchic) sites.

This is a dual-edged sword. Deploying something as sensitive as an information
gatherer, without requiring active consent, and to close off access requiring
local modification.... not social behaviour methinks.

I think I'm being too paranoid. This problem probably isn't that big, its
just giving me an itchy feeling.

On the whole, I think (mis)use of finger is doing more good than bad. I'd have
preferred to see the various threads of functionality unravelled a bit more. 

	-George
--
                         George Michaelson
G.Michaelson@cc.uq.oz.au The Prentice Centre      | There's no  market for
                         University of Queensland | hippos in Philadelphia
Phone: +61 7 365 4079    QLD Australia 4072       |          -Bertold Brecht
Newsgroups: comp.security.misc
From: by411@cleveland.Freenet.Edu (Patrick Hoyt)
Subject: Illegal Activities
Organization: Case Western Reserve University, Cleveland, Ohio, (USA)
Date: Thu, 23 Jul 92 03:43:49 GMT


How can I report a person I know to be preforming illegal and 
destructive acts on the internet. I need to be able to to report
this activity without him knowing that I have because of the nature
of the people he works for.

Sorry, after reading that back I see it doesn't make sense. The 
first sentence was a question.
Newsgroups: comp.security.misc
From: lemson@ux1.cso.uiuc.edu (David Lemson)
Subject: Re: System "pleasure.com"
Organization: University of Illinois at Urbana
Date: Mon, 27 Jul 1992 05:51:00 GMT

oneill@cs.ulowell.edu (Brian 'Doc' O'Neill) writes:

>Has anyone else heard of this system? I'm getting tons of FTP connections
>from it.

>The domain "pleasure.com" does not actually exist. The IP address used is
>192.160.196.5, which is mapped to "pleasure.com". The IP address actually
>belong to InteleCom Data Systems (NET-NET-IDS-COM).

>This site appears to a BBS for erotica gifs and such, which may violate some
>of the regulations of some networks. Apparently a user can have that system
>ftp files to their own account, which is why I see the FTP connections. 
>however I am concerned about the methods used to do this, as it may require
>the divluging of the users password.

Yes, it's a commercial BBS that is only connectable through the
'business' nets.  That is, if I go through my employer's PSI
connection, I can telnet to it.  If I go through UIUC's NFSNET
connection, I cannot.  So, there is some router somewhere that isn't
allowing NSFNET traffic to their network.  I'm surprised that it
allows traffic the other way!

I wonder if they're just setting up and collecting passwords...
-- 
David Lemson                                                 (217) 244-1205
University of Illinois NeXT Campus Consultant  / CCSO NeXT Lab System Admin
Internet : lemson@uiuc.edu                 UUCP :...!uiucuxc!uiucux1!lemson 
NeXTMail accepted                                   BITNET : LEMSON@UIUCVMD
Newsgroups: comp.security.misc,alt.security,comp.unix.ultrix
From: hubcap@hubcap.clemson.edu (System Janitor)
Subject: Re: Problem with npasswd??
Organization: Clemson University
Date: Tue, 28 Jul 1992 16:06:06 GMT

dsiebert@icaen.uiowa.edu (Doug Siebert) writes:

>With that kind of logic why bother with security at all?  

Now now. Calm down. I don't think my logic makes me that much of a kook.
I want an unCrackable password file. I haven't yet come up with how to 
get one. npasswd, which has been defended nicely here since I first posted,
doesn't seem like the way to get an unCrackable password file. Nobody
wants draconian security measures that get in the user's ways, so what
we need is a simple elegant way to get an unCrackable password file.
There may not be a simple elegant way to get an unCrackable password file. 
That doesn't stop us from looking for one. 

>If you really do check a 800,000 word dictionary with 300
>transmorgrifications each a cracker would have to work a REALLY long time to
>get even one password

It takes a long time to run to completion, but it doesn't take long at all 
to get lots of passwords. After the first rush of easy-to-guess passwords
spews out (these are the ones I would expect npasswd to cut down on) then
harder ones continue to dribble out for days. I wouldn't expect npasswd
to make that much of an impact on these.  npasswd is a good thing in its 
own light, but I always thought it sprang up as a (flawed) way to fight crack. 

I'll try to scrounge up the time (to convince a graduate student :-) to 
graft crack to npasswd (seems like someone would have already done that) 
and then hook it to our 800,000 word dictionary and 300 rulesets and see 
how long it takes. Already this discussion has suggested some optimizations 
on how to zip through the rulesets.

-Mike

Humorous aside: A local user set his password to a ``random'' string
of lower case letters. While Crack was going through the rock-star 
dictionary, and was checking for the drummer of Metalica backwards, it
got him!
Newsgroups: comp.security.misc
From: dave@jato.jpl.nasa.gov (Dave Hayes)
Subject: Re: unhappy about overloading finger
Reply-To: dave@jato.jpl.nasa.gov
Organization: Jet Propulsion Lab - Pasadena, CA
Date: Tue, 21 Jul 1992 21:06:58 GMT

ggm@brolga.cc.uq.oz.au (George Michaelson) writes:
>To cover ourselves, we are increasingly using callback checks to
>have trace on who fingers us.
>Thus, we have a nasty scenario:
>	(1) automated s/w is flooding the net with fingers
>	(2) paranoia-calls are responding with fingers
>	(3) loops are likely.
>	(4) meantime, crackers are "hidden" by legitimate finger usage.

What we do to avoid any "backfinger loops" is to not backfinger a host if
we have already backfingered a host (a lock file works well for this). 
That way...the recursion stops here (so to speak). 

But increasingly, many sites disable "finger" service...therefore the 
"backfingers" and the "email fingers" and whatever else start to
become less and less useful.

I personally LIKE finger services...they are useful in a lot of ways.
-- 
Dave Hayes - Network & Communications Engineering - JPL / NASA - Pasadena CA
dave@elxr.jpl.nasa.gov       dave@jato.jpl.nasa.gov         ...usc!elroy!dxh

A great deal of thought is only a substitute for the thoughts which the 
individual would really find useful at the time.
Newsgroups: comp.security.misc
From: dag@ossi.com (Darren Alex Griffiths)
Subject: Re: unhappy about overloading finger
Organization: Open Systems Solutions Inc.
Distribution: comp
Date: Fri, 24 Jul 1992 22:20:15 GMT

coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:

>    So what's supposed to happen?  I'm running a system with standard ULTRIX
>    (other than modified FTP), and all this does is a full finger of the
>    passwd file of the remote system.  Is that the screwup?  What should it do
>    instead?

It's definately a major screwup.  This allows the pond scum who try and 
break into systems to get a list off all users and then attempt to crack the
password for each of these users.  Even worse, they can see who hasn't logged
in for a while and try those accounts knowing that they may not be detected,
or see what accounts have never been logged into and try them assuming that
they were recently added and have a null or obvious password.

Instead it should complain about the bogus user not existing.


   Cheers,
     --dag
_______________________________________________________________________________
Darren Alex Griffiths               | dag@nasty.ossi.com
Open Systems Solutions, Inc         | (510) 652-6200 x139
Fujitsu                             | Fax: (510) 652-5532
6121 Hollis Street                  | Berkeley is famous for two exports
Emeryville, CA 94608-2092           | LSD and unix, this isn't a coincidence.
_______________________________________________________________________________
From: spaf@cs.purdue.EDU (Gene Spafford)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 21 Jul 92 05:13:57 GMT
Organization: Department of Computer Science, Purdue University

Finger can be replaced with something else, say, a simple Perl script.
You might have something that prints out an appropriate message and
then exits.  This means you can keep from printing user .plan files,
thus cutting down on their attempts to use it as a "billboard".

You can also hook this up to a "white pages" server, etc.
-- 
Gene Spafford
Software Engineering Research Center & Dept. of Computer Sciences
Purdue University, W. Lafayette IN 47907-1398
Internet:  spaf@cs.purdue.edu	phone:  (317) 494-7825
Newsgroups: comp.security.misc
From: Tom Fitzgerald	<fitz@wang.com>
Subject: Re: unhappy about overloading finger
Organization: Mail to News Gateway at Wang Labs
Date: Wed, 22 Jul 92 21:40:48 EDT

ggm@brolga.cc.uq.oz.au (George Michaelson) writes:

> 	(1) automated s/w is flooding the net with fingers
> 	(2) paranoia-calls are responding with fingers
> 	(3) loops are likely.

Anybody that does back-fingers has to worry about loops, for sure.  The
best thing to do might be to keep a log of recent backfingers and not
refinger anybody that's been hit in the last minute.

> 	(4) meantime, crackers are "hidden" by legitimate finger usage.

Make finger useless to crackers, and this won't be a problem.

The advantages of finger to crackers is it lets them find login names,
identify accounts that haven't been used for a while, and get the human
name for the account so they can try looking up spousal names and such in
the phone book, as potential passwords.  The best way to counteract these
is 1) have finger look up substrings of the mailing address, not the login
name, and don't report the login name, 2) don't report the time of last
login, and 3) make sure nobody is using a spouse name as a password.

The finger daemon here reports a user's human name, mailing address,
whether they're currently logged on (so you can try a talk (but you already
have to know the user's login name)), and the .plan file.  A finger without
a user name prints a polite message to contact me.  I like this scheme.

> I would prefer
> to see an explicit 'distributed information' protocol to replace finger
> being used for:
>
> 	email address lookup
> 	directory service call
> 	generalised information checks

whois does this, but too few people have whois clients.  Most name-brand
DOS TCP/IP packages, and all Unixes that I know of, have finger.  Many
Unixes, and most (nearly all?) DOS packages are missing whois.  And nobody
has a client for any alternative protocol....

I'm wondering what to do about the person who ran "finger \*@das.wang.com"
from an outside site today.  Anybody know if there are finger daemons that
screw up on user "*"?

-- 
Tom Fitzgerald   Wang Labs       fitz@wang.com   "I went to the universe today;
1-508-967-5278   Lowell MA, USA                   It was closed...."
Newsgroups: comp.security.misc
From: avalon@coombs.anu.edu.au (Darren Reed)
Subject: Re: unhappy about overloading finger
Organization: Computer Services Centre, Australian National University
Date: 25 Jul 92 12:34:51 GMT

john@iastate.edu (John Hascall) writes:

>dag@ossi.com (Darren Alex Griffiths) writes:
>}coar@Nephi.Enet.DEC.Com (Rodent of Unusual Size) writes:
>}>    So what's supposed to happen?  I'm running a system with standard ULTRIX
>}>    (other than modified FTP), and all this does is a full finger of the
>}>    passwd file of the remote system.  Is that the screwup? ...
>}It's definately a major screwup.  This allows the pond scum who try and 
>}break into systems to get a list off all users and then attempt to crack the
>   ...
>}Instead it should complain about the bogus user not existing.

>I like our fix better, try: finger @@iastate.edu
>(a bunch of gotta-try-it students doing this on a system with 7000 passwd
>entries convinced us to fix this in a hurry before system meltdown).

If you have problems with people using "@@", get a fingerd source (or
write your own :) and include '@' with the white space separators such
as \t, \n, ' ', etc.

Also stops people doing "finger @host1@host1@host1@host1@host1..." and
some other similar things.

For systems with large /etc/passwd files there should be a version of
getpwuid() & getpwnam() which look for information in hashed versions
on the passwd file (should be regenerated after any vipw or changes
to the /etc/group file).  I'm sure I've seen this implemented somewhere.

darren
Newsgroups: comp.security.misc
From: ignatz@wam.umd.edu (Mark J. Sienkiewicz)
Subject: Re: root-owned world-writable files
Organization: University of Maryland, College Park
Date: Tue, 21 Jul 1992 22:02:32 GMT

In article <62524@cup.portal.com> VESOFT@cup.portal.com (Michael D Hensley) writes:
>COPS doesn't seem to report ALL root-owned world-writable files.
>
>Agree/disagree/discussion: Any root-owned world-writable file should be
>considered a potential security loophole.

There is a good argument for both sides:

Disagree - It is only a security hole if it is a program that somebody
(root or otherwise) will run or if it contains data that you trust for
system security.  If I make /tmp/junk in single user mode and then
leave it there world writeable, it is only a hole if it is also readable
and contains data you don't want to get out.

Agree - _Any_ world writeable file is a de-facto security hole because
any random user can change it.  For example, /users/fred/.login is
a security hole if it is world writeable.  /users/fred/phone_numbers
is also a form of security hole, since by writing to it, I could
probably cause Fred to make telephone calls to the wrong people.

btw.. beware of things that are supposed to be world writeable: e.g.
on many machines, /usr/dict/spellhist is world writeable.  (It collects
lists of words that people spell wrong.  It has no special security
because you don't really _care_ if it gets trashed.  All it is good for
is identifying words that _might_ belong in the dictionary.  This in itself
could be a security hole, if you have people spell-checking documents
that contain sensitive information.)
Newsgroups: comp.security.misc
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: Illegal Activities
Date: 23 Jul 92 15:48:37 GMT

by411@cleveland.Freenet.Edu (Patrick Hoyt) writes:
>How can I report a person I know to be preforming illegal and 
>destructive acts on the internet?  I need to be able to to report
>this activity without him knowing that I have because of the nature
>of the people he works for.

Um, why don't you mail to the sysadmins of the systems he's attacking?
Just request anonymity and you'll likely get it, although nothing is
guaranteed.
Newsgroups: comp.security.misc
From: edelheit@smiley.mitre.org (Jeff Edelheit)
Subject: Crack (not the drug)
Organization: The MITRE Corporation, McLean, VA
Date: Mon, 27 Jul 1992 18:09:13 GMT

I am supporting the security engineering of a distributed system and
am interested in getting a version of "crack".  It was suggested to me
that it could be ftp'ed from "Volume 28" off of ftp.uu.net.  When I
looked at ftp.uu.net, there was no such volume.  Does anyone else know
of a ftp source for crack?

Regards,

Jeff Edelheit		email:  edelheit@mitre.org
The MITRE Corporation	voice:  (703) 883-7586
7525 Colshire Drive	FAX:	(703) 883-1397
McLean, VA   22102
From: fitz@wang.com (Tom Fitzgerald)
Newsgroups: comp.security.misc
Subject: Re: unhappy about overloading finger
Date: 23 Jul 92 00:17:27 GMT
Organization: Wang Labs, Lowell MA, USA

spaf@cs.purdue.EDU (Gene Spafford) writes:

> Finger can be replaced with something else, say, a simple Perl script.
> You might have something that prints out an appropriate message and
> then exits.  This means you can keep from printing user .plan files,
> thus cutting down on their attempts to use it as a "billboard".

What's wrong with using finger as a billboard?  It's great for
going-on-vacation notices, new-phone-number notices, etc.

-- 
Tom Fitzgerald   Wang Labs       fitz@wang.com   "I went to the universe today;
1-508-967-5278   Lowell MA, USA                   It was closed...."