HDTenEightyP/NetNews huggingface dataset:
From: jlacour@casbah.acns.nwu.edu (John Lacour)
Subject: Re: A Solicitation for Opinions
Organization: Northwestern University, Evanston Illinois.
Distribution: world,local
Date: Fri, 6 Nov 1992 18:39:22 GMT

In article <1992Nov4.153248.12490@ulysses.att.com> smb@ulysses.att.com (Steven Bellovin) writes:
>In article <Bx6oLy.L7z@minerva1.bull.it>, alexb@minerva1.bull.it (Alessandro Bottonelli) writes:
>> Agree, and I would go beyond that. Computer 'underground' representatives
>> should actively give their input to security plans and activities and they
>> should be listened to.
>
>Assuming, of course, that you can trust their answers...  That's the
>thing -- I regard computer break-ins, especially those that are done
>for ``fun'' or ``knowledge'' as a manifestation of ethical issues.  Given
>that, by default I do not trust the offenders.  I'm willing to be
>persuaded otherwise, but the burden of proof is on them, not me.

What is the issue with trusting h/cr-ackers answers on security issues?  If
someone tells me ln yourunreadablefile $HOME/.plan ; finger me  will show
me an unreadable file, I try it.  If it works, they know what they're talking
about.  Otherwise you dismiss them as full of it, or go back for
clarification.

John

Newsgroups: alt.security
From: merkstam@nyx.cs.du.edu (Magnus Erkstam)
Subject: Re: Password at Boot for PCs
Keywords: pc password boot security
Organization: University of Denver, Dept. of Math & Comp. Sci.
Distribution: alt
Date: Sat, 7 Nov 92 17:22:29 GMT

alexb@minerva1.bull.it (Alessandro Bottonelli) writes:

>Does anyone know of commercial or P.D. software that would prevent 
>booting a PC unless a password id keyed in? The purpose is to restrict
>PC booting for those PC that have no EPROM passwrd nor a key switch.

>I know, I know, that would not prevent an intruder to boot the PC 
>from a floppy, but hey ... that's better than nothing at all!

There is a program called Safe Guard, I think it's commercial, but,
I do not know where to get it.
It will ask for account and password when booted from the harddrive, 
and, if booted from floppy disk it will deny that the hard drive exists.

	/Magnus
merkstam@nyx.cs.du.edu

Newsgroups: alt.security
From: mas@dit.upm.es (Antonio Martinez Mas)
Subject: Information on Companies with Secure Data Network System (SDNS) based products
Organization: UUES, Asociacion de Usuarios de UNIX, Spain
X-Newsreader: Tin 1.1 PL4
Date: Sat, 7 Nov 1992 11:41:11 GMT

We are interested to contact companies that develop product based on
the US SDNS program standards. We would like to acquire software
products that implement the security protocols SP3 and SP4.

If you have any information on those companies, please send us the
company name, address, and contact person name. Our contact point is
the e-mail address laseca@crisa.es

Thank you,

A.Laseca

Newsgroups: alt.security
From: cotrozzi@ghost.dsi.unimi.it (Massimo Cotrozzi)
Subject: Re: A Solicitation for Opinions
Organization: Computer Science Dep. - Milan University
Date: Fri, 6 Nov 1992 08:54:07 GMT
Distribution: world,local

alexb@minerva1.bull.it (Alessandro Bottonelli) writes:

>johan@blade.stack.urc.tue.nl (Johan Wevers) writes:

>>kaplan@misvax.mis.arizona.edu (RayK) writes:

>>>A Solicitation for Opinions:
>>>Is it advisable to allow members of the computer 
>>>underground or convicted computer criminals to participate 
>>>in public, security-related discussions?

>>Of course!! Because:

>> 1. Anyone has the right to tell his or her opinion, and
>> 2. If the security community wants to understand the underground,
>>    talking with them is the only way. If they don't, they will
>>    be working on a subject of which they don't understand much.
>>    And that's not so smart.
>>-- 

>Agree, and I would go beyond that. Computer 'underground' representatives
>should actively give their input to security plans and activities and they
>should be listened to. The only issue is how to motivate them to do such
>a thing. In many cases that shoudln't be difficult, most computer 'criminals'
>love to tell you HOW they did it, if they can be guaranteed immunity ...

I don't believe most of them will tell you how they did it, since they may
have spent weeks in trying and, if they tell you, you will fix the hole,
closing up the playground.

Here in Italy is no use talking about immunity in this field as there's
no law regarding intrusion ( as far as I know ).


As was said long time ago, most of the Bad Guys are not so bad,and finally
( at least here in Italy ) they are given a job as a System Security Admin
( don't want to offend any of the Admins ) so they don't tell you anything.


-- 
 -- Massimo Cotrozzi  Computer Science Dept. Milan Italy
            cotrozzi@ghost.dsi.unimi.it  +39-2-27201253
 #include     <std/disclaimer.h>
From: alexb@minerva1.bull.it (Alessandro Bottonelli)
Newsgroups: alt.security
Subject: Lan watchers and sniffers
Date: 10 Nov 92 09:16:52 GMT
Distribution: alt
Organization: Bull Italia SpA

ANYONE OUT THERE HAD ANY EXPERIENCE WITH PROTECTING LANS OF LARGE
ORGANIZATIONS FROM LAN SNIFFERS ??? ANY DOCUMENTS REACHABLE BY
FTP OR TELNET ON THE NET ???

Basically, we know some people on a large LAN have PCs that with
proper software (lanwatch et similia) may filter out traffic from/to
specific addresses (say a Unix box and a Pc-based workstation connected
via telnet). They may 'see' what you type as a password at login.

Say that the use on Lanwatchers is also legitimate because in an R&D
organization like the one I am talking about you need to do a lot
of debugging. So prohibiting the use of such software is not an option
(difficult to enforce anyway). 

Any idea ????





-- 
== Alex Bottonelli / Bull Italia BSP  | FAX  : +39-(0)2-6779/8463          ==
== I.S./W.S./Network Security Officer | PHONE: +39-(0)2-6779/8324          ==
== E-MAIL: A.Bottonelli@it12.bull.it  | (BullCom users dial 260+extension) ==
== BULLTX: /BULLX/IT12X/BOTTONELLI A. |                                    ==
Newsgroups: alt.security
From: "robert winkler" <robert.winkler@canrem.com>
Subject: "wargames" dialler
Reply-To: "robert winkler" <robert.winkler@canrem.com>
Organization: Canada Remote Systems
Distribution: alt
Date: 8 Nov 92 04:47:59 EST

     Sorry for the intrusion, but I have a problem & someone
outthere might be able to help.

     I've just gotten a copy of a "Wargames"-type dialler called
Comfind4 (Compfind). It's originated from _The Wall_ BBS (Metro
Dallas\Ft Worth - phone# 1-817-261-2737) & uses either COM1 or
COM2. Now, I use my modem from COM4, & as the COM port for various
reasons can't be changed, I'm not able to use the program.

     I'd REALLY appreciate if anyone could give me an answer to the
following questions:

1)  Is there an updated version of this software that can be used
    through COM4 ?

2)  If no, is there a way to change the program so that it'd use
    COM4 ?

3)  Is the use of this program illegal in Canada or in the world ?

     I've tried to get in touch with the above mentioned BBS, but
with no luck. If you know the answers, or can get them from The
Wall (1-817) 261-2737, please leave a short message. Thanks for
your time

Robert
--
Canada Remote Systems  - Toronto, Ontario
World's Largest PCBOARD System - 416-629-7000/629-7044
Newsgroups: alt.security
From: vince@ghost.dsi.unimi.it (David Vincenzetti)
Subject: Re: Get your idea for security in print!
Keywords: security,encryption
Organization: Computer Science Dep. - Milan University
Date: Fri, 13 Nov 1992 16:14:13 GMT

In <kdm1.721649581@Ra.MsState.Edu> kdm1@Ra.MsState.Edu (Kenneth D. Mitchell) writes:

> 
> 
>Tell me what you think about Nortons Diskreet, Wipeinfo
>Tell me about such and such program that claims to be DES but is
>   really Caesar.
>Tell me if there is a vendor that sells one-time pad systems.
>Tell me how to beat ethernet encryption software
>Tell me if you have some way of sending data besides modem, microwave,
>internet, compuserve, radio network, ethernet, fiberoptic, telepathy
>   or tell me something new in these fields.
> 

Instead of TELLing you I ASK you:

	"Are you going to include the names of the people who
	 ``TELL you'' something in the book you will make
	 collecting an putting together all the answers you get?"
-- 
David Vincenzetti := {System, Security} Administrator
  Department of CS,             Email : vince@ghost.dsi.unimi.it
  via Comelico 41,              Voice : ++39 2 55006 392
 I-20133 Milan, ITALY             Fax : ++39 2 55006 373
Newsgroups: alt.security
From: flaps@dgp.toronto.edu (Alan J Rosenthal)
Subject: Re: internet worm.
Summary: lower-tech solution
Date: 8 Nov 92 04:58:00 GMT

morten@oase.kemi.aau.dk (Morten Kjeldgaard) writes:
>So, along those lines, why not have a beneign, authorized and official WORM
>on the internet, that tries every known way of penetrating the security
>system. If the worm penetrates into a computer, the system manager is
>notified and told how and where the security failed. 
>
>This should be done in *agreement* with the parties involved, and the worm
>should NOT be programmed to duplicate and spread wildly, of course, but
>could be directed towards specific computers, via a list of hosts that have
>joined the system.

This facility already exists.  To access it, ftp a copy of "cops" and run it on
your system.  Various security holes will be reported.

Of course, it would be COOLER if it actually tried to exploit these holes from
a remote system, but no more useful.  In fact, it would be less useful, because
cops also tells you about holes that people could exploit once they were
already in, even if it doesn't find any hole which it knows will assist people
in breaking in per se.
From: ywtsay@aquarius.ce.ntu.edu.tw (Yi-Hwai Tsai)
Subject: HP-UX DUI should setuid or not
Organization: Department of Civil Engineering, National Taiwan University
Date: Sat, 14 Nov 1992 07:45:21 GMT

Hi.. 
	There may have '/usr/diag/bin/DUI' in many HP-UX 8.0 machines. It is setuid by root. I don't think it should be run by everyone in host. because it can be used to empty any file in system. Am I right ?


--------------------------------------------------------------------------------
                                          |
	Yihwai Tsai                       |      Mail: P.O. Box 23-97, Taipei
	CAE Lab.                          |            Taiwan, R.O.C.
	Department of Civil Engineering   |      EMail: ywtsay@ce.ntu.edu.tw
	National Taiwan University        |
                                          |
--------------------------------------------------------------------------------
From: imp@solbourne.com (Warner Losh)
Newsgroups: alt.security
Subject: Re: A Solicitation for Opinions
Date: 5 Nov 1992 11:19:21 -0700
Organization: ParcPlace Boulder
NNTP-Posting-Host: kolvir.solbourne.com

In article <6183@tuegate.tue.nl> johan@blade.stack.urc.tue.nl (Johan
Wevers) writes: 
>Most security holes are just overlooked by experts, but they're
>certainly capable to see wether[sic] something is a hole or not when
>they're pointed at. 

I am not a security expert.  Many times when talking with someone I
ask them why they didn't do something this way rather than that.  They
usually say something about "security hole."  Most of the time, I see
what they mean right away.  Sometimes I have to ask for more info to
discover the hole.  Most holes are very obvious to someone who is
looking for them, but not so obvious to most programmers.

Warner
-- 
Warner Losh		imp@parcplace.COM	ParcPlace Boulder
I've almost finished my brute force solution to subtlety.
Newsgroups: alt.security
From: dolson@waterloo.hp.com (Dave Dolson)
Subject: Re: Window watching programs
Date: Mon, 9 Nov 1992 20:31:58 GMT
Distribution: na
Organization: HP Panacom Div Waterloo ON Canada
X-Newsreader: TIN [version 1.1.4 PL6]

Scott King (gordon@ug.cs.dal.ca) wrote:
: I have recently come across a program on the net that will allow a user to
: continuously monitor a window (including the root window) on another
: machine.  
Not only that, but you have complete read/write access to every window or
resource in the X system.  You can close all their windows, lock up the
terminal, paint them black, etc.

:           The disturbing part of it is that you seem to be able to do
: this to any machine without even having an account on it or having to set
: up permission to do so with xhost.  Is there a way to protect a machine
: from people using such programs? If so, how?
Unfortunately, security measures never seem to be on by default.  Turning it on
is machine-specific.  On workstations this may be an X command line option.  
On X terminals it may be a config screen option. 

Any X implementation which claims to be X11/R4 or later should have implemented
client authorization (MIT-MAGIC-COOKIE-1).  This applies to X terminals as
well.  
I don't know about other vendors, but on Hewlett Packard machines, a 16-byte 
"magic cookie" is stored in a file in your home directory called .Xauthority.  
It is readable only by you.  All X applications must read the file and present
the cookie to the X server before being allowed to connect.  The cookie is 
generated at the start of each session by 'xdm'.

A caveat of using client authorization is that all X applications must have
been compiled using X11R4 or later libraries.

Of course this is only secure if no one is snooping on your LAN.

David Dolson
Hewlett-Packard (Canada) Ltd.
Panacom Automation Division
(519) 886-5320
dolson@waterloo.hp.com
Newsgroups: alt.security
From: alexb@minerva1.bull.it (Alessandro Bottonelli)
Newsgroups: alt.security
Subject: Password at Boot for PCs
Keywords: pc password boot security
Date: 6 Nov 92 15:57:16 GMT
Distribution: alt
Organization: Bull Italia SpA

Does anyone know of commercial or P.D. software that would prevent 
booting a PC unless a password id keyed in? The purpose is to restrict
PC booting for those PC that have no EPROM passwrd nor a key switch.

I know, I know, that would not prevent an intruder to boot the PC 
from a floppy, but hey ... that's better than nothing at all!

Let me know either by e-mail or posting 


-- 
=============================================================================
== Alex Bottonelli / Bull Italia BSP  | BULLNET USERS USE: 260/EXTENSION   ==
== I.S./Network Security Officer      | FAX  : +39-(0)2-6779/8463          ==
== E-MAIL: A.Bottonelli@it12.bull.it  | PHONE: +39-(0)2-6779/8324          ==
From: rick@postmaster@hq.af.mil
Newsgroups: alt.security
Subject: Detecting an Ethernet Tap
Date: 9 Nov 92 14:36:59 GMT
Reply-To: rick@hq.af.mil
Organization: 7TH Communications Group


Does anyone know of any software available that will detect a
tap of an ethernet cable? Assmuming that this is possible.

I am looking at the ability to detect a tap in an ethernet cable and
have the software notify a network admin. We have etherhostprobe, which
works fine after the fact, but I am looking for something that monitors
the line and detects a tap or new device in real time.


I am a novice at the physical aspects of ethernet. i.e., I am not
sure if it is even possible to detect such a thing. I assume that it is
possible to detect a voltage drop across the line or something similar.
Or perhaps detect new ethernet packets as soon as they hit the wire.

Does anyone know of any products or methods for doing this sort of thing?
 
Any and all responses welcome. 

-- 
Rick Weldon     I-NET Inc. 
E-mail: rick@hq.af.mil
Phone:  703-695-5060
Newsgroups: alt.security
From: scs@lokkur.dexter.mi.us (Steve Simmons)
Subject: Re: Tom Clancy, and whitenoise digital encryption
Organization: Inland Sea
Date: Fri, 6 Nov 92 17:50:51 GMT

kdm1@Ra.MsState.Edu (Kenneth D. Mitchell) writes:

>In the book _Sum of All Fears_ by Tom Clancy he mentions the CIA
>using a cd containing random noise to encrypt data, I know this
>is a good method to use, and I know Tom Clancy keeps his
>details accurate but I was wondering if the CIA really uses this method.

Something like this was used in military stuff sometime in the 70s.
The general idea was to generate a series of pseudo-random bits.  The
series would not "repeat" or become less random for several days, and
was restarted with a new key every day.

The series would be broadcast continuously.  Whenever a message was to
be sent, the bits of the message would be xored onto the random bits.
Recievers were in sync and generated the same sequence.  They xored the
sequence recieved with the generated sequence.  The message would
immediately appear.

Advance apologies for inaccuracies; I heard this stuff over a lot of beer
in a Navy bar back in the 70s.
-- 
 "When Dexter's on the Internet, can Hell be far behind?"
		-- Steve Simmons, scs@lokkur.dexter.mi.us
From: ck041@cleveland.Freenet.Edu (Kevin Currie)
Newsgroups: alt.security
Subject: Crack and Cops
Date: 12 Nov 1992 05:36:12 GMT
Organization: Case Western Reserve University, Cleveland, Ohio (USA)
NNTP-Posting-Host: hela.ins.cwru.edu


	I'm writing a paper on computer security and I'd like the source
code for Crack and Cops.  Actually, I'm not too sure what these progs
do, but I was under the impression that these are progs that sysadmins use
to check how secure thier system is, is this correct?
	Since I don't have ftp access, I have had a very hard time finding thesesources.  Could somebody please uuencode a compressed file of these sources
for me and email me?  
	NOTE:  Please don't send me executible files, I need the source, exe's
don't tell you very much, and I only know 68000 asm so dissassembling an intel
prog won
't be of much help.

-- 
"Chalk up another soul that's lost, |       Kevin Currie  
 Calculate the social cost,         |   Ottawa,Ontario,Canada     
 You know what's not inside of me,  | ck041@cleveland.Freenet.Edu
 Raging mad insanity!!"  - S.T.     |      ag816@yfn.ysu.edu
From: ck041@cleveland.Freenet.Edu (Kevin Currie)
Newsgroups: alt.security
Subject: Redirecting SU's output
Date: 12 Nov 1992 19:46:56 GMT
Organization: Case Western Reserve University, Cleveland, Ohio (USA)
NNTP-Posting-Host: hela.ins.cwru.edu



	Is is possible to redirect SU's screen output to a text file?
I tried SU > textfile    but that just gives me an empty file.
	Any ideas?

-- 
"Chalk up another soul that's lost, |       Kevin Currie  
 Calculate the social cost,         |   Ottawa,Ontario,Canada     
 You know what's not inside of me,  | ck041@cleveland.Freenet.Edu
 Raging mad insanity!!"  - S.T.     |      ag816@yfn.ysu.edu
From: shawnb@ecst.csuchico.edu (S.E. Brown)
Newsgroups: alt.security
Subject: Re: Password at Boot for PCs
Date: 9 Nov 1992 21:57:04 GMT
Organization: California State University, Chico
Distribution: alt
NNTP-Posting-Host: cscihp.ecst.csuchico.edu
Keywords: pc password boot security

Someone a while back wrote:

>>Does anyone know of commercial or P.D. software that would prevent 
>>booting a PC unless a password id keyed in? The purpose is to restrict
>>PC booting for those PC that have no EPROM passwrd nor a key switch.
>
>>I know, I know, that would not prevent an intruder to boot the PC 
>>from a floppy, but hey ... that's better than nothing at all!
>
>There is a program called Safe Guard, I think it's commercial, but,
>I do not know where to get it.
>It will ask for account and password when booted from the harddrive, 
>and, if booted from floppy disk it will deny that the hard drive exists.

There is a program available at the simtel archive called ccp10a.zip 
(I think this is correct, in any case it is in the /msdos/security
directory) that is put out by McAffee Associates.  It provides boot
protection for the hard disks, and will not allow access to the hard disks 
when the system is booted form a floppy.  All in all it appears to be
a pretty good system, the only drawback being that I can't run any
disk-caching software, because it somehow messes with the functioning
of the program.

Shawn

---
S.E.P. Brown
shawnb@cscihp.ecst.csuchico.edu
PGP public keys available upon request

Newsgroups: alt.security
From: erc@unislc.uucp (Ed Carp)
Subject: Re: Tom Clancy, and whitenoise digital encryption
X-Newsreader: TIN [version 1.1 PL6]
Organization: Unisys Corporation SLC
Date: Wed, 11 Nov 1992 17:15:09 GMT

Jeff Silverman (silverm@bcstec.ca.boeing.com) wrote:

: scs@lokkur.dexter.mi.us (Steve Simmons) writes:
: 
: >kdm1@Ra.MsState.Edu (Kenneth D. Mitchell) writes:
: 
: >>In the book _Sum of All Fears_ by Tom Clancy he mentions the CIA
: >>using a cd containing random noise to encrypt data, I know this
: >>is a good method to use, and I know Tom Clancy keeps his
: >>details accurate but I was wondering if the CIA really uses this method.
: 
: >The series would be broadcast continuously.  Whenever a message was to
: >be sent, the bits of the message would be xored onto the random bits.
: >Recievers were in sync and generated the same sequence.  They xored the
: >sequence recieved with the generated sequence.  The message would
: >immediately appear.

: This is good cryptographic practice.  One way the bad guys (them) know that
: the good guys (us) are up to something, is that the quantity of traffic changes.
: Usually upwards, theoretically downwards is possible.  This technique is called
: "Traffic Analysis".  If you send random information continuously, then the
: bad guys can't do it, because the rate of transmission remains constant.
: The technique will impact your long distance bills and may cause ire
: of other users on the same Ethernet.

This method was widely used, even back in the 60's, by the military, even over
lines considered "tamper-proof" (using such methods as pressurizing the comm
cables with nitrogen, then setting an alarm if the pressure dropped).  But how
would this technique affect your long-distance bills?  If the line is connected
all the time (leased), it doesn't matter if what's going down it is white noise,
no noise, or data.
--
Ed Carp			erc@apple.com, erc@saturn.upl.com	801/538-0177

"There is nothing to seek and nothing to find.  You're already enlightened, and
all the words in the world won't give you what you already have.  The wise
seeker, therefore, is concerned with one thing only: to become aware of what
he already is, of the True Self within."  -- Zen maxim
-- 
Ed Carp			erc@apple.com, erc@saturn.upl.com	801/538-0177

"There is nothing to seek and nothing to find.  You're already enlightened, and
all the words in the world won't give you what you already have.  The wise
From: limes@ouroborous.eng.sun.com (Greg Limes)
Newsgroups: alt.security
Subject: Re: Tripwire release
Date: 9 Nov 92 16:04:02 GMT
	<LIMES.92Nov5142000@ouroborous.eng.sun.com>
	<3698@amethyst.math.arizona.edu>
Organization: Sun Microsystems Computer Corporation
NNTP-Posting-Host: ouroborous
In-reply-to: uurtamo@math.arizona.edu's message of 6 Nov 92 16:03:23 GMT

I wrote:
| I think this is insufficient.
...
| If I can make that backward calculation either
| directly or by trial-and-error in a reasonable time, then your
| signature protection system is no protection.

In article <3698@amethyst.math.arizona.edu> uurtamo@math.arizona.edu (Steve Uurtamo) writes:
| Have you ever tried to back-engineer any of these methods while spending
| "reasonable" time?  Even a slightly sophisticated method can keep you 
| from doing this.  

Which is exactly the point originally made ... the signature method *must*
be sophisticated enough. Admittedly, the backcalculations I have done were
against early (1984) programs that "protected" file contents with fairly
simple CRCs, and more recently with a potentialy stronger algorithm which
unfortunately stored (get this) a one-byte signature.
From: kyle@wendy-fate.uu.net (Kyle Jones)
Newsgroups: alt.security.index
Newsgroups-Indexed: alt.security
Subject: alt.security index for the week ending 7 November 1992
Date: Sat, 7 Nov 1992 22:01:17 EST
Summary: This is an index of alt.security postings that describe or fix a
         security hole in a computer system.  Each line contains the
         message-ID of an article and a terse summary of the article's
         contents.  See the article itself for details.

<alt.security_720884532@aber.ac.uk> "alt.security FAQ"