Newsgroups: bit.listserv.banyan-l
Date:         Mon, 23 Nov 1992 17:22:27 CET
From:         Bent=Tranberg%Data%AID@BAN.AID.NO
Subject:      Security risks.

I always thought you had to give your old password if you wanted to change
it. Not so! Anyone with access to your logged in PC may change your password
without knowing your old password, and then log in on another PC later.
Simply run MUSER rather than PASSWORD to change password. How long has it
been like this without anyone noticing, or is it just me?

Please, don't tell me I can protect MUSER. What I would like is that Banyan
changes this as soon as possible. A user that is not an administrator should
not be allowed to change password without giving the old, no matter what.
The mechanism that checks your old password must be in the server, if it is
to be safe. Otherwise anyone can do whatever MUSER is doing wrong.

While i'm at it. We have some Unix workstations. Did you know just how easy
it is to find someones passwords? There is a file with users passwords in
encrypted form, and all you have to do is to try all kinds of combinations of
passwords until the formula comes up with the same encrypted form as is in
the file. This file is not read protected. There are many combinations, but
most people use a word. As long as you have the file, it is not difficult to
make a program that will go through all english words and more in a
relatively short time. This information has been given to us, and I am no Unix-
guru myself, but if you think it must be a rumour or something; we were told a
few quite convincing passwords. Also, it seems people are using this method on
internet to get access illegaly.

My advice is that you do not use anything that can be guessed at, like a word
in any language, and use a password that is sufficiently long for a fast
computer to be unable to iterate it's way through to the correct combination
in a reasonable time.

If anyone think I should hang for telling the world about this, think again.
Security on these systems is a joke. And I am furious that I have to find
out about these things the way I do. In my opinion anyone has a right to
know what security risks there are in using a system. The oldfashioned "don't
tell anyone about the risks and it'll be safe" and "make it difficult for the
user, and you make it difficult for the hacker" kind of thinking should stop.
It actually makes it less safe!

Banyan has shown the way, by making a system filled with security barriers,
still transparent to the logged in user as long as access to a resource is
granted, and so easy to use that it is actually used by administrators when
it should be used. And it's safe, which is more than I can say about any
other system I have ever had to deal with, ( ...... among them ) which are
simply ridikoloss ( when do I get a spell checker in Mail.EXE? ).

I do not believe that VINES is fooled that easily, but I would appreciate it
if someone would care to enlighten us about the security in Banyan VINES.
Just how much can we trust it, and what risks are there? Is there written
documentation somewhere about this, except for the manuals? Why aren't the
information encrypted in the ethernet cables? How can we prevent fake login
programs from stealing passwords? ( I have been doing quite a lot about that
since last I mentioned the problem ) How is security on the new Unix-platform?

Yours furious   ;)  , have had quite enough for one day.

Bent.Tranberg@ban.aid.no
Agder College of Engineering, Grimstad, Norway
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU