HDTenEightyP/NetNews huggingface dataset:
From: unruh@physics.ubc.ca (William Unruh)
Newsgroups: alt.security
Subject: Re: Detecting an Ethernet Tap
Date: 9 Nov 1992 23:26:56 GMT
Organization: The University of British Columbia
Distribution: world
NNTP-Posting-Host: physics.ubc.ca

rick@postmaster@hq.af.mil writes:


>Does anyone know of any software available that will detect a
>tap of an ethernet cable? Assmuming that this is possible.


I don't believe it's possible in general. Certainly no software ( since
the hardware port has to be sufficiently robust to handle an arbitrary
number of legit "taps" already) and even with hardware, I ccan always
make the impedence of the tap sufficiently high so as to be invisible
in the normal variations of the ethernet. Unless of course you use
quantum ethernet ( Pat. Pend. -)

Newsgroups: alt.security
From: nhaldar@magnus.acs.ohio-state.edu (Neil A Haldar)
Subject: Re: Detecting an Ethernet Tap
Organization: The Ohio State University
Date: Tue, 10 Nov 1992 03:11:26 GMT

In article <GUENTHER.92Nov9175156@amcl5.stolaf.edu> guenther@stolaf.edu (Philip
 A Guenther) writes:
>In article <12914@hq.hq.af.mil> rick@postmaster@hq.af.mil writes:
>
>   Does anyone know of any software available that will detect a
>   tap of an ethernet cable? Assmuming that this is possible.
>
>   I am looking at the ability to detect a tap in an ethernet cable and
>   have the software notify a network admin. We have etherhostprobe, which
>   works fine after the fact, but I am looking for something that monitors
>   the line and detects a tap or new device in real time.
>
>   I am a novice at the physical aspects of ethernet. i.e., I am not
>   sure if it is even possible to detect such a thing. I assume that it is
>   possible to detect a voltage drop across the line or something similar.
>   Or perhaps detect new ethernet packets as soon as they hit the wire.
>
>   Does anyone know of any products or methods for doing this sort of thing?
>

Additionally... couldn't you just have all machines plugged into the net send 
out some sort of ID packet at a specific interval?  I mean... those machines 
with net access would be required to send out some sort of packet to all other 
devices...

If one machine attempted to access various other machines on the net without 
providing a proper id sequence, root could be notified...

Although there are several problems to overcome...

Not to mention the increased network overhead...

-Neil
-- 
*>  Neil Haldar                                                              <*
*>  nhaldar@magnus.acs.ohio-state.edu                                        <*
*>  neilh@well.sf.ca.us                                                      <*
*>  364 West Lane Ave #225, Cols., OH 43201   614.299.8529                   <*
Newsgroups: alt.security
From: kdm1@Ra.MsState.Edu (Kenneth D. Mitchell)
Subject: Get your idea for security in print!
Keywords: security,encryption
Organization: Mississippi State University
Date: Fri, 13 Nov 1992 10:13:01 GMT

 
 
If you have any wonderful ideas that have not been discussed
before about data security, communications security, and computer
security let me know.
 
I am helping to research a book on computer security and data encryption.
Anyone that provides a new insightful idea or technique can
get their name and email address listed in the credits.
Just because you mail does not mean you get your name in the credits,
you have to give me something good.
 
I already know about multiple encryptions of DES, so dont tell me about
that.
 
I dont want to know about this wonderful thing called 'public-key'
I know about that too.
 
What I DO want is something new and innovative, like how your neighbor
converted his tv and shortwave to monitor the computer screens at the bank.
Or how you pass secret keys using carrier pidgeons.
Or how you implement the Canary Trap in your mail.
Or how you keep the FBI from learning from your computer after they have
confiscated it.
Or how you converted your bedroom to a TEMPEST/VanEck proof area.
Or how you tapped your schools fiberoptic network.
 
Tell me what you think about Nortons Diskreet, Wipeinfo
Tell me about such and such program that claims to be DES but is
   really Caesar.
Tell me if there is a vendor that sells one-time pad systems.
Tell me how to beat ethernet encryption software
Tell me if you have some way of sending data besides modem, microwave,
internet, compuserve, radio network, ethernet, fiberoptic, telepathy
   or tell me something new in these fields.
 
It must be something that I can suggest to others,
something that is tested and explain why you think it is secure or insecure,
something I can tell others to watch out for or not to use,
 
 
Tell me something I probabally dont know.
 
I will not respond by telling you 'that is a stupid idea, everyone knows
that', this is supposed to be a learning service.
 
I cannot gurauntee that I will respond to everyones mail but I will try.
All help is appreciated.
From: exudnw@exu.ericsson.se (Dave Williams)
Newsgroups: alt.security
Subject: Re: Tom Clancy, and whitenoise digital encr
Date: 9 Nov 92 21:04:42 GMT
Reply-To: exudnw@exu.ericsson.se
Organization: Ericsson Network Systems
X-Disclaimer: This article was posted by a user at Ericsson.
              Any opinions expressed are strictly those of the
              user and not necessarily those of Ericsson.

In article 3401@lokkur.dexter.mi.us, scs@lokkur.dexter.mi.us (Steve Simmons) writes:
>kdm1@Ra.MsState.Edu (Kenneth D. Mitchell) writes:
>
>>In the book _Sum of All Fears_ by Tom Clancy he mentions the CIA
>>using a cd containing random noise to encrypt data, I know this
>>is a good method to use, and I know Tom Clancy keeps his
>>details accurate but I was wondering if the CIA really uses this method.
>
>Something like this was used in military stuff sometime in the 70s.
>The general idea was to generate a series of pseudo-random bits.  The
>series would not "repeat" or become less random for several days, and
>was restarted with a new key every day.
>
>The series would be broadcast continuously.  Whenever a message was to
>be sent, the bits of the message would be xored onto the random bits.
>Recievers were in sync and generated the same sequence.  They xored the
>sequence recieved with the generated sequence.  The message would
>immediately appear.
>
>Advance apologies for inaccuracies; I heard this stuff over a lot of beer
>in a Navy bar back in the 70s.

Actually, it's a pretty good description of the wideband technology used
in tactical air-air in the 70's and early 80's.  All an intercept receiver 
would hear would be "white" noise.  The main problem with this system was 
the bandwidth required to transmit the signal.

---
= exudnw@exu.ericsson.se                                                =
= David Williams              "You can't win, you can't break even,     =
= Ericsson Network Systems     and you can't quit"                      =
= Richardson, TX 75081                                  my opinions...  =
Newsgroups: alt.security
From: smb@ulysses.att.com (Steven Bellovin)
Subject: Re: A Solicitation for Opinions
Date: Thu, 5 Nov 1992 19:40:19 GMT
Organization: AT&T Bell Laboratories

In article <6183@tuegate.tue.nl>, johan@blade.stack.urc.tue.nl (Johan Wevers) writes:
> smb@ulysses.att.com (Steven Bellovin) writes:
> 
> >> Agree, and I would go beyond that. Computer 'underground' representatives
> >> should actively give their input to security plans and activities and they
> >> should be listened to.
> 
> >Assuming, of course, that you can trust their answers...  That's the
> >thing -- I regard computer break-ins, especially those that are done
> >for ``fun'' or ``knowledge'' as a manifestation of ethical issues.  Given
> >that, by default I do not trust the offenders.  I'm willing to be
> >persuaded otherwise, but the burden of proof is on them, not me.
> 
> This is bullshit: you can check the answers by an expert. Most security
> holes are just overlooked by experts, but they're certainly capable to
> see wether something is a hole or not when they're pointed at.

Actually, most security holes were caused by people who aren't experts
writing security-sensitive code -- because they didn't realize it was
that sensitive.

But what I meant when I said that you couldn't trust the answers was not
that the answers would be false, but that they might be deliberately
incomplete.
From: oleg@csufres.CSUFresno.EDU (Oleg Kibirev)
Newsgroups: alt.security
Subject: Re: Lan watchers and sniffers
Date: 13 Nov 92 04:04:59 GMT
Distribution: alt
Organization: California State University, Fresno

In article <1dtgfcINN28a@neuro.usc.edu> merlin@neuro.usc.edu (merlin) writes:
>In article <BxHts7.3s2@minerva1.bull.it> alexb@minerva1.bull.it (Alessandro Bottonelli) writes:
						    
>>ANYONE OUT THERE HAD ANY EXPERIENCE WITH PROTECTING LANS OF LARGE
>>ORGANIZATIONS FROM LAN SNIFFERS ??? 
>
>Make LAN sniffing -- particularly password snooping -- a terminal
>offense -- issue written notices such snooping will result in the
>immediate dismissal of the responsible parties.
>

How would you  like  if the state was   to issue a  law tomorrow  that
exceeeding speed limit  results  in capital  punishment?  That's about
what you suggest. I would disable an account for a couple  of weeks --
unless a person has really damaged important files, etc.

It's a frustration to see how  sites are adopting policies just design
to say  that users have no  rights and  {college, university, company}
has all priviliges  to erase there files,  read their love letters and
kick them  out of {}  if they don't like their  face.  Rather than  to
reflect real life.

>
>Divide your ethernet up into several segments using smart routers
>-- isolate sensitive people/machines onto a relatively secure leg
>of your ethernet -- put known snoopers on their own isolated leg.
>                        ^^^^^^^^^^^^^^

Aren't they supposed to be shot  by now :). Seriously, this  is likely
to take a lot of time and money  - potentially much  more that to deal
with security break-in.

>Forbid indescriminant ethernet snooping -- only permit monitoring
>for debugging purposes when filtering for some specific source and 
>destination address -- forbid packet sniffing by pc's -- require
>all packet sniffing to be done via authorized accounts on audited
>host systems such as sun systems with full logging turned on.
>

I don't remember what original article said, but I recall that software
used for debugging was PC based. 

Anyway, fascist measures above will hardly prevent a person interested
enough to   do snooping anyway and  will  certainly make bull.it users
hate Alessandro Bottonelli. It looks  for me is the  only way to avoid
password  snooping but still  permit  network debugging  is end-to-end
encryption. If network  is  using TCP/IP, original  poster may want to
look at latest version of BSD  telnet[d] ( @gatekeeper.dec.com  ) that
has built-in encryption.

Oleg
From: dcrawfor@manitou.cse.dnd.ca (David Crawford)
Subject: Re: Cracking Word Perfect's passwords
Organization: Canadian System Security Centre
Date: Thu, 5 Nov 92 22:46:53 GMT

In article <1992Nov5.185648.12304@das.harvard.edu> adam@endor.uucp (Adam Shostack) writes:
>In article <dbarber.720940916@crash.cts.com> dbarber@crash.cts.com (David C. Barber) writes:

>>I've heard that at least one company has a special program to
>>crack Word Perfect's password locked/scrambled files.  My question
>>is: Is this ability limited to just one company, or are there
>>several WP cracker programs running around?

>
>There is at least one available from the net, that was posted a few
>months back.

I can vouch for the usefulness of the program that was posted.  I am
currently using it as part of my security awareness program to 
demonstrate the weaknesses associated with the use of such protection 
schemes.  The nice thing about this is that the author provides the
C code to automate the cryptographic analysis (known plain text attack) of the
WordPerfect protection scheme that was published in Cryptologia in 1990. 

There is at least one commercial package available.  My staff found a 
crippled demo version of a package that "broke" WP5.0 password protected
files with (I believe) 8 character passwords.  We did not pursue 
the procurement of the package and I now do not remember either the
firm or the package name. 

It certainly buttresses the argument for "approved encryption" where
there is a strict confidentiality requirement.

Dave Crawford		The opinions expressed herein are those of the author
dcrawfor@cse.dnd.ca	and are not to be construed as an official Government
			of Canada or Department of National Defence position.
Newsgroups: alt.security
From: scs@lokkur.dexter.mi.us (Steve Simmons)
Subject: Re: Tom Clancy, and whitenoise digital encryption
Organization: Inland Sea
Date: Thu, 12 Nov 92 04:41:49 GMT

erc@unislc.uucp (Ed Carp) writes:

 [[ various stuff excised, which cause me to write ]]

>: >The series would be broadcast continuously.  Whenever a message was to
>: >be sent, the bits of the message would be xored onto the random bits.
>: >Recievers were in sync and generated the same sequence.  They xored the
>: >sequence recieved with the generated sequence.  The message would
>: >immediately appear.

>This method was widely used, even back in the 60's, by the military, even over
>lines considered "tamper-proof" (using such methods as pressurizing the comm
>cables with nitrogen, then setting an alarm if the pressure dropped).  But how
>would this technique affect your long-distance bills?  If the line is connected
>all the time (leased), it doesn't matter if what's going down it is white noise,
>no noise, or data.

The person who described the system said it was being done with radio
broadcast.  Given channel availability, probably not many sites were
doing it.  This person was on a flagship getting traffic for the whole
fleet and was recieve-only.
-- 
 "When Dexter's on the Internet, can Hell be far behind?"
		-- Steve Simmons, scs@lokkur.dexter.mi.us
From: silverm@bcstec.ca.boeing.com (Jeff Silverman)
Newsgroups: alt.security
Subject: Re: Tom Clancy, and whitenoise digital encryption
Date: 9 Nov 92 05:50:15 GMT
Organization: Boeing Computer Services, Seattle

scs@lokkur.dexter.mi.us (Steve Simmons) writes:

>kdm1@Ra.MsState.Edu (Kenneth D. Mitchell) writes:

>>In the book _Sum of All Fears_ by Tom Clancy he mentions the CIA
>>using a cd containing random noise to encrypt data, I know this
>>is a good method to use, and I know Tom Clancy keeps his
>>details accurate but I was wondering if the CIA really uses this method.

>The series would be broadcast continuously.  Whenever a message was to
>be sent, the bits of the message would be xored onto the random bits.
>Recievers were in sync and generated the same sequence.  They xored the
>sequence recieved with the generated sequence.  The message would
>immediately appear.
This is good cryptographic practice.  One way the bad guys (them) know that
the good guys (us) are up to something, is that the quantity of traffic changes.
Usually upwards, theoretically downwards is possible.  This technique is called
"Traffic Analysis".  If you send random information continuously, then the
bad guys can't do it, because the rate of transmission remains constant.
The technique will impact your long distance bills and may cause ire
of other users on the same Ethernet.

regards,

Jeff Silverman, Boeing Commercial Airplane


Newsgroups: alt.security
From: dbarber@crash.cts.com (David C. Barber)
Subject: Re: FAQ
Organization: CTS Network Services (crash, ctsnet), El Cajon, CA
Date: 5 Nov 92 06:52:29 GMT

In <Bx7qsD.By5@dcs.ed.ac.uk> adk@dcs.ed.ac.uk (Andrew Kennedy) writes:

>Could someone please email the FAQ to me.  I tried to save it, but it somehow
>got lost in the process.

>I'm adk@dcs.ed.ac.uk

>Thanks,
>	Andrew


>--
>     /  \  |  |   Andrew Kennedy -  First Year Student -  BSc (hons) AI & CS  
>    /    \ |  |   Edinburgh University -  And these are my opinions (c) 1992
>   /  /\  \|  |   ----------------------------------------------------------
>  |   __   |  |   "Continuity was an AI, and                adk@dcs.ed.ac.uk  

Done!

(Everyone else take note before the e-mail system gets swamped.)


Without change,                         *David Barber*
   nothing can ever get better.            @}-->----

UUCP: ucsd!crash!dbarber
INET: dbarber@crash.cts.com
Newsgroups: alt.security
From: dbarber@crash.cts.com (David C. Barber)
Subject: Cracking Word Perfect's passwords
Organization: CTS Network Services (crash, ctsnet), El Cajon, CA
Date: 5 Nov 92 05:21:56 GMT

I've heard that at least one company has a special program to
crack Word Perfect's password locked/scrambled files.  My question
is: Is this ability limited to just one company, or are there
several WP cracker programs running around?



Without change,                         *David Barber*
   nothing can ever get better.            @}-->----

UUCP: ucsd!crash!dbarber
INET: dbarber@crash.cts.com
Newsgroups: alt.security
From: shipley@merde.tcs (Pete Shipley)
Subject: Re: The Worm's Common Password List
Organization: Processed People for a Processed America
Date: Thu, 5 Nov 1992 06:31:22 GMT


The "Internet's Worm"'s common password list was actually the password
list from Bob Baldwins "fdes" package plus (+ three words).

[fyi: fdes was one of the first "fast des" programs released to the public,
this was done to demonstrate the weaknesses in the unix password scheme
now that "fast" systems are become common place].


		-Pete
--
---------------
Pete Shipley:
email: shipley@berkeley.edu             Flames:  cimarron@postgres.berkeley.edu
Spelling corections: /dev/null          Quote: "Anger is an energy"
From: lllowen@netcom.com (lllowen)
Newsgroups: alt.security
Subject: Morris Inet worm in OMNI
Date: 6 Nov 92 17:58:07 GMT
Organization: Netcom Online Communications Services (408-241-9760 login: guest)

With the earlier discussions of Robert Morris' Inet worm, there was a
short article on Cyberpunks and Morris on the December issue of OMNI.
I just noticed this and thought it was appropriately interesting. 
-- 

Lon Lowen Jr.                        |  Wayne State University
Netcom Online Communications         |  Detroit, Michigan
lllowen@netcom.com                   |  (lllowen@mts.cc.wayne.edu)
-------------------------------------------------------------------------
Newsgroups: alt.security.pgp,sci.crypt
From: magnus@thep.lu.se (Magnus Olsson)
Subject: PGP secret key on multiuser system (again) (was: Risks of keeping...) 
Keywords: pgp 2.0
Organization: Theoretical Physics, Lund University, Sweden
Date: Mon, 9 Nov 1992 10:57:06 GMT

OK, let me rephrase my question, since people seems to discuss
everything but what I really wanted to know (not that the discussion
hasn't been interesting - thanks for all the opinions):


Suppose I only *store* my secret keyring on a multiuser system, but
don't actually use it. The evil cracker Bob reads it.

Now, obvoiusly, if I didn't have any pass phrase, Bob could start
forging messages in my name. 

But suppose I do have a pass phrase, and that it's so complicated that
Bob fails to guess it, even using automatic guessing programs. Can Bob
do anything dangerous in this case?

In short: How secure is the pass phrase mechanism of PGP 2.0?


Magnus Olsson                   | \e+      /_
Dept. of Theoretical Physics    |  \  Z   / q
University of Lund, Sweden      |   >----<           
Internet: magnus@thep.lu.se     |  /      \===== g
Bitnet: THEPMO@SELDC52          | /e-      \q
Organization: Freshman, CIT general, Carnegie Mellon, Pittsburgh, PA
Newsgroups: alt.security
Date: Tue, 10 Nov 1992 01:56:49 -0500 
From: "Manu S. Kumar" <mk5a+@andrew.cmu.edu>
Subject: Re: Password at Boot for PCs
Distribution: alt

Excerpts from netnews.alt.security: 9-Nov-92 Re: Password at Boot for
PCs by S.E. Brown@ecst.csuchico 
>Someone a while back wrote:
> 
>>>Does anyone know of commercial or P.D. software that would prevent 
>>>booting a PC unless a password id keyed in? The purpose is to restrict
>>>PC booting for those PC that have no EPROM passwrd nor a key switch.
>>
>>>I know, I know, that would not prevent an intruder to boot the PC 
>>>from a floppy, but hey ... that's better than nothing at all!
>>
>>There is a program called Safe Guard, I think it's commercial, but,
>>I do not know where to get it.
>>It will ask for account and password when booted from the harddrive, 
>>and, if booted from floppy disk it will deny that the hard drive exists.
> 
>There is a program available at the simtel archive called ccp10a.zip 
>(I think this is correct, in any case it is in the /msdos/security
>directory) that is put out by McAffee Associates.  It provides boot
>protection for the hard disks, and will not allow access to the hard disks 
>when the system is booted form a floppy.  All in all it appears to be
>a pretty good system, the only drawback being that I can't run any
>disk-caching software, because it somehow messes with the functioning
>of the program.
> 
>Shawn
> 
>---
>S.E.P. Brown
>shawnb@cscihp.ecst.csuchico.edu
>PGP public keys available upon request



    McAffee Associates leads me to believe that this package would
attempt to provide security by embedding code either in the partition
table or the boot sector. If that is the case it can prove to be
sensitive and even vulnerable. If some one could provide more
information I would appreciate it.


                                                    Manu Kumar
                                                    (sneaker)
_____________________________________________________________________________
Class of 1992,Modern School,Barakhamba Road,New Delhi...MHS is the best!!
Freshman, Carnegie Mellon University, Electrical and Computer Engineering.
Campus Address: A-306 Hamerschalg House, Margaret Morrison St., Mail Box 
#4532, Pittsburgh,PA 15213,Tel(fax):(412)-268-4322,Email:mk5a@andrew.cmu.edu
Home Address: 13-A, Amrita Shergill Marg, New Delhi 110 003, India, 
Tel : (91-11)-611-624, (91-11)-462-6629, Fax : (91-181)-778-27
_____________________________________________________________________________
Sorry, no snazzy e-mail quotes!!
Newsgroups: alt.security
From: wcs@anchor.ho.att.com (Bill Stewart +1-908-949-0705)
Subject: Re: A Solicitation for Opinions
Organization: Sorceror's Apprentice Cleaning Services, Ltd.
Date: Fri, 6 Nov 1992 05:24:46 GMT
	<1992Nov4.153248.12490@ulysses.att.com> <6183@tuegate.tue.nl>

In article <6183@tuegate.tue.nl> johan@blade.stack.urc.tue.nl (Johan Wevers) writes:
   smb@ulysses.att.com (Steven Bellovin) writes:
   >Assuming, of course, that you can trust their answers...  That's the
   >thing -- I regard computer break-ins, especially those that are done
   >for ``fun'' or ``knowledge'' as a manifestation of ethical issues.  Given
   >that, by default I do not trust the offenders.  I'm willing to be
   >persuaded otherwise, but the burden of proof is on them, not me.

   This is bullshit: you can check the answers by an expert.  Most security
   holes are just overlooked by experts, but they're certainly capable to
   see whether something is a hole or not when they're pointed at.

Steve *is* an expert :-)   Besides, if you're a Bad Guy, 
one valuable technique is to get a privileged person to try something, 
and leave something around to watch them while they do it.
If they're only a pseudo-expert, that may give you root,
but even if they're a real expert, you may still benefit from seeing what
they try, or what they don't try, or what they explore before they try
the suggestion you gave them....
--
#				Pray for peace;      Bill
# Bill Stewart 908-949-0705 wcs@anchor.att.com AT&T Bell Labs 4M312 Holmdel NJ
# Nov 12 - Anniversary of Indonesian massacre in East Timor, 1991
# Indonesia first invaded in 1975, and about 1/3 of the people have been killed.
Newsgroups: alt.security