HDTenEightyP/NetNews huggingface dataset:
From: styri@hal.nta.no (Haakon Styri)
Subject: Re: Passwd traps?
Reply-To: styri@nta.no
Organization: Norwegian Telecom Research
Date: Tue, 15 Dec 92 10:22:46 GMT

In article <1935@enst.enst.fr>, tardieu@cyclone.enst.fr writes:
|> In article <77925@hydra.gatech.EDU>, gs26@prism.gatech.EDU (Glenn R. Stone) writes:
|> -> In <1992Dec9.123607.22649@nntp.nta.no> styri@hal.nta.no (Haakon Styri) writes:
|> -> 
|> -> >[...] dan@cubmol.bio.columbia.edu (Daniel Zabetakis) writes:
|> -> >|>     Is there a way to detect password trapping programs.
|> -> >If the login program was able to authenticate itself to you before you
|> -> >revealed your password the problem would be solved.
|> -> 
|> -> Something I saw at the University of California: login was hacked to 
|> -> attempt to open $HOME/.secret (presumably mode 600) and display it
|> -> as the Password: prompt; each individual had his own, custom .secret
|> -> file that he could change from time to time.  If the right challenge
|> -> isn't displayed, then you know that that isn't the real login program.
|> -> 
|> -> 4.3 BSD UNIX (ucscb.UCSC.EDU)
|> -> 
|> -> login: thrush
|> -> What's the haps?
|> 
|> I don't understand the utility of this soft: you just have to make a little
|> Perl or C program which tries to login under each username, and you'll
|> obtain all sentences.
|> It's easyer if you want a particular password.

A real good solution to this problem is to use a one-time password system.
Spoofing would be outdated. However, you'll have to introduce a new system
and probably invest some money.

A poor mans hack to the "individual challenge" scheme outlined would be to
have more than one password prompt. Not perfect, but harder to beat. The
paranoid user should of course change password every time a login fails...

---
Haakon Styri
Newsgroups: comp.security.misc
From: rslade@cue.bc.ca (Rob Slade)
Subject: Re: Security of telephone Answering machines
Keywords: password, security, answering machine
Organization: Computer Using Educators of B.C., Canada
Date: Fri, 11 Dec 92 21:43:05 GMT

Vince Manis brought this up on RISKS a few years back.  At the time he had a 
machine which had a three digit, user-selectable code.  One of the responses
gave a numeric string which contained all possible combinations of three
digits: the poster estimated, based upon the length of time you had to enter
the code, that at most two calls would be necessary to "hack/crack" the
machine.

My own machine has a four digit, factory set code.  It is rendered slightly
more secure by the fact that the company makes several models, not all of
which have remote access, but which all sound identical.

One machine I bought for a company I was contracting for had a single digit
security code.  My daughter's machine is even worse: it has a three digit
code, but any of the three digits, repeated three times, is valid for access!
 
==============
Vancouver      ROBERTS@decus.ca         | "If you do buy a
Institute for  Robert_Slade@sfu.ca      |  computer, don't
Research into  rslade@cue.bc.ca         |  turn it on."
User           p1@CyberStore.ca         | Richards' 2nd Law
Security       Canada V7K 2G6           | of Data Security

Newsgroups: comp.security.misc,comp.org.eff.talk
From: mccalld@vax.sonoma.edu
Newsgroups: comp.security.misc
Subject: Re: Backups
Date: 17 Dec 92 21:27:02 GMT
Organization: Sonoma State University

> 
>   Your thoughts are requested... I will let you know if you're
> right!!
I'm exploring the concept of using our aging campus mainframe to 
do network backups of the campus UNIX & PC boxes......
our thoughts are that we would solicit from the individual users
on each machine which directories were more valuable than others
and then we would custom taylor the program to do the work during
the wee hours of twilight via ftp.  Letting the users make the
choices seems the best way to aviod issues of privacy, where they
are given the opportunity to disclose the data they want kept 
up to date and the secret stuff would have to be their own responsibility!
dmc
Xref: sparky comp.security.misc:2329 comp.org.eff.talk:7770
From: misar@rbg.informatik.th-darmstadt.de (walter misar)
Subject: Re: Killer Cracker
Date: Thu, 17 Dec 1992 09:18:28 GMT
Organization: TH Darmstadt

In article <1992Dec16.072857.19363@jhunix.hcf.jhu.edu>, unclesam@jhunix.hcf.jhu.edu (Sam C Chi) writes:
> 	I understand that there's a program called 'Killer Cracker' that can
> crack the encrypted password file on Unix.  Is there an another version/new
> version of Killer Cracker that cracks BSD encryption?  How is the BSD
> encrption different from the original encrption that came out when Unix was
> first developed?  Sorry if I sound clueless, please enlighten me.

The crypt() function, which is used for password encryption, is functionally
the same on all unices I know. I don't know the program 'Killer Cracker',
but I think it's just another variant of crack. This means, the program cracks
the passwords just by trying (tries username etc, a long word list, and
modifications (backwards, double) thereof) and not, that it can reverse the
encryption. So, if you choose good passwords, this programs can't crack it.
 
-- 
Walter Misar                        It is impossible to enjoy idling thoroughly
misar@rbg.informatik.th-darmstadt.de       unless one has plenty of work to do.
Xref: sparky comp.security.misc:2316 comp.org.eff.talk:7746
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
From: lindstrom@acs.harding.edu
Date: 17 Dec 92 08:01:19 -0500
Reply-To: lindstrom@acs.harding.edu
 <1992Dec14.133030.804@ualr.edu>,<1992Dec16.083322.6448@nntp.hut.fi>
Organization: Harding University

In article <1992Dec16.083322.6448@nntp.hut.fi>, jkp@cs.HUT.FI (Jyrki Kuoppala) writes:
>In article <1992Dec14.133030.804@ualr.edu>, lindstrom@acs writes:
>>
>>As for the phone, it is also for business. Sure, I use it for personal
>>things (call my wife to find out what time to get home by) but if someone
>>is making personal long distance calls, that's taking money from our
>>already small budget and I want to know.
>
>A question: do you think it would be an invasion of privacy if someone
>from the company / agency listened to your calls to your wife to make
>sure they're really to your wife and not long-distance running up
>costs or leaking confidential information?
>
If they feel the need, I have no problem with it.  You see, I have nothing
to hide.  The most "they" could find out is that I am head-over-heels
in love with my wife. Long distance calls can be flagged without listening
in, and since I do all my industrial espionage at home (where they have
no right to listen in without that warrant), they won't catch me giving
away any secrets.

>Threats, fear, uncertainty and doubt are often good and much-used
>measures for this ;-).  Or, in other words, peer pressure.  Published
>rules with input from users as well often are enough - most people are
>reasonable, and when they know what the issues are there will be few
>problems.

Agreed. Nothing beats a healthy working enviroment.

Greg
Newsgroups: comp.security.misc
Subject: Backups
From: lindstrom@acs.harding.edu
Date: 15 Dec 92 13:10:52 -0500
Reply-To: lindstrom@acs.harding.edu
Organization: Harding University

Hello-
  We were sitting around discussing the keystroke monitoring
thread when the following came up: I make a full backup of
our system every week.  If I were to make a copy of *EVERYTHING*
in your office--even though I would not look at it--you would
go through the roof about privacy...but you expect and even
demand that a backup of your files be kept. What is the difference?
[Note: 'you' is generic, or are you paranoid?]

  I know our University keeps such backups, and Texas A&M posts
a banner at login directing students how to request "file
restoration."

  Your thoughts are requested... I will let you know if you're
right!!

Greg--
Xref: sparky comp.security.misc:2202 comp.org.eff.talk:7616
From: ron@zooid.guild.org (Secret Mud)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Fun things to do to RTM (was: Internet worm)
Date: 13 Dec 92 17:18:04 GMT

From: cmcurtin@bluemoon.use.com (Matthew Curtin)
>
> . . .
>To cite just one example, let me remind you of Steve Wozniak. He created 
>the Apple II computer, which gave birth to the "computer revolution", 
>bringing computers to everyone. The Apple II was the first "open system," 
>a term which we hear a lot about nowadays. I doubt that anyone would argue 
>that Woz was crucial in helping make the computer industry what it is 
>today. Yet, in getting experience which no doubt helped him create the 
>Apple II, he had a friend help him to sneak into the Sylvania company to 
> . . .

Actually the Apple II wasn't the first open system.  All of the Altair/S-100
type machines that came out in the two years before the Apple II were open
systems.
Newsgroups: comp.security.misc,comp.org.eff.talk
From: mnemonic@eff.org (Mike Godwin)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Originator: mnemonic@eff.org
Organization: Electronic Frontier Foundation
Date: Mon, 14 Dec 1992 04:44:41 GMT

In article <1992Dec11.161745.197@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:

>And would you have a similar problem with recasting the opinions of
>people who happen to disagree with you as their wanting to "feel good
>about the outcome of the case"?

Only if I thought it were misrepresentation to do so.

>Texas
>has a law that makes doing what Morris did a crime.  Try him and give
>him the penalty prescribed (a jail term plus a fine) FOR EACH SYSTEM
>IN TEXAS HE AFFECTED (I don't know how many, if any, that was).
>Sentences to be served consecutively.

This would be a very unusual way for Texas to prosecute the Morris 
case. It would also be an unusual sentence for Texas. Looks as if you 
want to bend Texas law to make your point.

Besides, Texas prosecutors are barred by double-jeopardy principles from
trying Morris.

>Do you like that better?  It's
>in accord with all those legal principles you're worried about, so you
>should.

What you have written is in accord neither with my principles nor with
Texas criminal law.

>Now then, back to where I think that problem really lies.  I've had
>this problem in discussions involving the law with friends of mine who
>are lawyers before.  The presumption seems to be that the law is
>'right' and that what we 'should' do stems from taht.

In the Morris case, in my opinion, the law (as interpreted by the
government) was wrong. So your discussion here seems inapposite.

>It's a great pity that Mr Godwin appears to feel that the appropriate
>response to someone disagreeing with him is to try and pillory them
>instead of trying to figure out where they're coming from.

Why do you keep referring to yourself in the third person?


--Mike




-- 
Mike Godwin,    |"Everything one invents is true."
mnemonic@eff.org| 
(617) 864-0665  |                           --Flaubert
EFF, Cambridge  |                           
Newsgroups: comp.security.misc
From: evans@c4west.eds.com (Bill Evans)
Subject: SUMMARY: Help with Crack
Keywords: crack password
Organization: EDS C4 West
Date: Thu, 17 Dec 1992 18:01:50 GMT

Thanks for all the quick responses - nice list!

Turns out I needed to clean up after an abnormal
exit.  
Run "Scripts/spotless" once, and answer "NO" to the 
second question

Original posting:
>We are running Alec Muffetts crack program to improve security
>on our local net.  The initial run of the program went smoothly
>and ran through 1/3 of the password file before exiting.  Now,
>I cannot get it to run and get the following error in the "out"
>file:
>
>ran with:  ./Crack <name of password file) (the file exists and is
>                                            world readable)
>
>pwc: Dec 16 08:53:06 Loading Data, host=hostname
>pwc: Dec 16 08:53:06 No input supplied: everything removed by feedback ?
>pwc: Dec 16 08:53:06 Nothing to Crack. Exiting...

Help from and thanks to (in no particular order):
<steve@ecf.toronto.edu>Steve Kotsopoulo
<elee9sf@Menudo.UH.EDU>Karl Barrus
<Alec.Muffett@sunehq.UK.Sun.CO>Alec Muffett
and more that I deleted their mail address...
Newsgroups: comp.security.misc,comp.org.eff.talk
From: mnemonic@eff.org (Mike Godwin)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Originator: mnemonic@eff.org
Organization: Electronic Frontier Foundation
Date: Tue, 15 Dec 1992 19:31:11 GMT

In article <1992Dec14.183858.22132@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:

>The point is that if someone is convicted of deliberate vehicular
>homicide, the obvious situation is 'driving a vehicle', whether they
>are a professional driver or not.

Are you saying, then, that Morris should be barred from driving a car,
since he doubtless used a car now and then to get to computer terminals
at Cornell?

>Whether Morris was part of
>"the computer industry" isn't relevant.

You were among those who defended the notion of keeping Morris from being
hired in the computer industry. And it was you who talked about Morris's
"position."

>  I have no problem with him
>working in the computer industry -- as long as what he does has
>nothing to do with doing anything on computers.

What about telephone lines and leased lines? I understand that the
Internet Worm propagated in this way too. Perhaps we should bar Morris
from using the phone as well?

You refer to "anything on computers" as if it were analytically obvious
that "anything on computers" is connected with the Worm. But all sorts of
uses of computers are pretty unconnected with writing and propagating a
worm or virus. Should we bar Morris from writing the next Wordperfect
or Excel or Procomm? Seems like a stupid thing to do, especially since
there's no inherent connection between software development per se and
the release and propagation of the Worm; lots of people do one without
doing the other.

Now, my mom, who's something of a computer illiterate, thinks all things
having to do with computers are more or less connected, even though she is
not so simplistic about cars or phones. The question is whether we adopt a
simplistic view of computers or not. I think it would be a disservice to
both the computer-using community and the legal community to do so.

>I would also hardly
>make this a lifetime ban, but I think a certain amount of "think about
>it" time might be both useful and constructive in this kind of case.

What is the source of your belief that Morris has had inadequate "think
about it" time? He has shown no signs of recidivism thus far.


--Mike



-- 
Mike Godwin,    |"Everything one invents is true."
mnemonic@eff.org| 
(617) 864-0665  |                           --Flaubert
EFF, Cambridge  |                           
Newsgroups: comp.security.misc,comp.org.eff.talk
From: brad@clarinet.com (Brad Templeton)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Organization: ClariNet Communications Corp.
Date: Fri, 11 Dec 1992 22:03:25 GMT

Well, Mike, there do seem to be people here discussing only the particulars
of the Morris case, and others who wish to discuss the whole question of
computer crime sentencing and deterrence.

I think the issues are closely related.  Robert Morris, as the first
famous conviction under these statutes, sets a precedent in more than
just the legal sense.  As such I think I am addressing your question.

You suggest that there was no increase in computer intrusions and related
offences after Morris was sentenced.  It's a hard thing to measure, but
given that it's true, should this be surprising?  It is in fact, what
we would expect.

When you have a new crime, and people are cavelier and do not fear punishment,
and do not consider punishment greatly in their actions.  If deterrent works,
then when they see punishment that frightens them, they should reduce their
activity.

That there would be an increase after light sentencing would imply that
people are sitting scared, waiting to do computer crimes, and that once they
saw a light sentence they would proceed apace.   I doubt it.

I can't say we even know for sure if deterrence works here.  There are some
offences which punishment does not really deter.

As for what Morris deserved?  Well, there seem to be many opinions on that.
There is not strong evidence of malice, so one can't be too critical of the
judge for delivering a light sentence.  On the whole, people tend to get
a bit worked up over this one.  They yell because they had to spend in most
cases a few hours or at most a day futzing around with their systems -- as if
this doesn't happen all the time for natural reasons.

When a case is tried that has more malice and intent, but not enough to
warrant hard time, I suggest a probationary condition which forbids not
using computers, but employment or contracting to work with them.  This is
far milder than jail time, but I think could be a frightening deterrent to
certain classes of offenders.
-- 
Brad Templeton, ClariNet Communications Corp. -- Sunnyvale, CA 408/296-0366
From: wyle@synopsys.com (Mitch Wyle)
Subject: SYNOPSYS APPOINTS AART J. DE GEUS PRESIDENT AND ELECTS HARVEY C. JONES CHAIRMAN
Organization: Synopsys Inc.
Date: Fri, 18 Dec 1992 23:07:40 GMT

Another Synopsys press release posted in biz.comp.software
From: helz@ecn.purdue.edu (Randall A Helzerman)
Newsgroups: comp.lsi.cad
Subject: Magic for DOS
Date: 20 Dec 92 20:44:02 GMT
Organization: Purdue University Engineering Computer Network

I've heard of a version of Magic for DOS.  Can anybody point me to
an ftp site or tell me how I can get it?  Thanks!
Newsgroups: comp.lsi.cad,comp.os.ms-windows.programmer.win32
From: sjr@dartac.demon.co.uk (Simon Roberts)
Subject: Re: NT-Spice update available
Reply-To: sjr@dartac.demon.co.uk
Distribution: world
Followup-To: comp.lsi.cad
X-Mailer: cppnews $Revision: 1.20 $
Organization: Dartacross Limited, Cambridge, UK
Date: Wed, 16 Dec 1992 00:17:02 +0000

In article <1992Dec15.201304.28850@koko.csustan.edu> Robert Zeff writes:

> I have uploaded my latest version on Spice for Windows NT to:
> fpt.cica.indiana.edu.  It's in the /pup/pc/win3/uploads directory.
> (It'l be moved to the NT directory sometime later.
> I've added multiple plot windows, command history via a Combo Box and
> a few other tools for faster database regen and plotting.  I've reduced
> the frequency of shareware nagging.

Good news indeed. May I respectfully suggest that you take out
the "shareware nagging" entirely. If you have a good product (which I am
sure you do) and give good support, that in itself would be enough
incentive for people to support you by registering it.

> A few answers to FAQ's:
> 1.  I will not distribute Berkeley source code outside the U.S.

Why?

--
Simon Roberts
Dartacross Limited - Open Systems Consulting
sjr@dartac.demon.co.uk (preferred) 
srob@cix.compulink.co.uk
Newsgroups: comp.lsi.cad
From: freier@gmd.de (Bernd Freier)
Subject: Re: Magic transistor netlists
Reply-To: freier@gmd.de
Organization: Sun Microsystems, Inc.
Date: Mon, 14 Dec 1992 09:49:32 GMT

In article 1gben3INNal2@usenet.pa.dec.com, mayo@pa.dec.com (Bob Mayo) writes:
> In article <1992Dec11.120248.425@gmd.de> huebner@eissn5.gmd.de writes:
> >Hi netters,
> >Does anybody know what the next line produced by magic means???
> >Ok, I know it's a line of a transistor netlist. But where are
> >the source gate drain and bulk nodes?
> >
> >p bsp.ch.2_0/I10 bsp.row_2_0/aoi21s_0/6_4_86# bsp.row_2_0/fts_0/Vdd 2 29 51 60
> 
> See the file ~cad/src/magic/doc/man/sim.5 for a specification of the .sim
> file format.
> 
> --Bob




Newsgroups: comp.lsi.cad
From: ghuntres@nyx.cs.du.edu (Gary  huntress)
Subject: Need help installing Magic
Summary: Compiler Complaints
Keywords: Magic Install Iris
Organization: University of Denver, Dept. of Math & Comp. Sci.
Date: Fri, 18 Dec 92 19:37:04 GMT


Hi,

I'm having trouble installing magic version 6 on a Personal Iris 
running X11.  Besides getting a huge number of inconsequential
warnings, DBmain.c (et. al.) is choking on

   static struc sigvect vect= {0,0,0};

I'm sure that its a configuration problem, I don't want to touch 
the code!!  Can someone help me with the config file options??
(i.e. the three choices you get when you "make config").

Thanks,

Gary Huntress
huntress@npt.nusc.navy.mil
ghuntres@Nyx.cs.du.edu
From: reid@ss6.cps.msu.edu (Dr Richard J. Reid)
Newsgroups: comp.lsi.cad
Subject: Re: Boolean Simplification Program?
Date: 14 Dec 92 12:40:43 GMT
Organization: Department of Computer Science, Michigan State University

In article <1992Dec8.212333.39513@ns1.cc.lehigh.edu> sh09@ns1.cc.lehigh.edu (STEVEN HIGGINS) writes:
>
>    A while back, somebody was looking for a program to assist in the
>    simplification of Boolean expressions.  I was wondering if they had
>    any luck, and would be grateful if you could forward me info on any FTP
>    sites that would have such a program.
>
>    Thanks,
>
>
>    
>-- 
>
>~Steve
>sh09@lehigh.edu

An alpha release of our combinational network design tool,
cnd, is available on ftp.

This release of cnd minimizes single-output, two-valued-logic
functions of n variables, n <= 32.

TO START

  Use "anonymous" ftp login to acs.msu.edu (35.8.56.90).
  
  Ftp the executable(binary) and the sample data.

  The program cnd is in the pub/arch subdirectory.

  Only the binaries are being distributed--remember to set
  ftp mode to "binary".

 THEN (uncompress, if necessary):

 >$ cnd -c <cnd.data | more

The documentation relates to usage only, and is available
only in compressed PostScript-format (-.ps.Z).


A PC version of our combinational network
design tool, cnd, is also available.

This release of cnd minimizes single-output, two-valued-logic
functions of n variables, n <= 16.

The executables for the PC and Sun-SPARC are available now. 

Let me know of any problems or successes you have.

Thanks,

Dick

reid@cps.msu.edu
Newsgroups: comp.lsi.cad
From: psantana@rodan.acs.syr.edu (Paramesh Santanam)
Subject: Cif description
Organization: Syracuse University, Syracuse, NY
Date: Fri, 18 Dec 92 12:36:13 EST


Greetings!

	I am trying to use cif to describe a lsi circuit, but am having
trouble in specifying and displaying diagonal lines. 

Format being used:
	B xxx xxx xxx,xxx xxx,xxx ;
	  len wid  center  direction

I am using cif2ps to display the cif file, cif2ps does not give
an error with this format but does not show the diagonal lines I 
am trying to draw. 
Could some kind soul, tell me where I can get a copy of cif specs for
circuit description ? I need to turn in a project this weekend (12.18)
and would great appreciate early responses. Please reply to

psantana@rodan.acs.syr.edu

Thanks in advance.

Paramesh
From: robert@csustan.csustan.edu (Robert Zeff)
Newsgroups: comp.lsi.cad
Subject: Re: NT-Spice update available
Date: 17 Dec 92 17:24:57 GMT
Organization: CSU Stanislaus

In article <724490222snx@dartac.demon.co.uk> sjr@dartac.demon.co.uk writes:
>In article <1992Dec15.201304.28850@koko.csustan.edu> Robert Zeff writes:
>
>> I have uploaded my latest version on Spice for Windows NT to:
>> fpt.cica.indiana.edu.  It's in the /pup/pc/win3/uploads directory.
>> (It'l be moved to the NT directory sometime later.
>> I've added multiple plot windows, command history via a Combo Box and
>> a few other tools for faster database regen and plotting.  I've reduced
>> the frequency of shareware nagging.
>
>Good news indeed. May I respectfully suggest that you take out
>the "shareware nagging" entirely. If you have a good product (which I am
>sure you do) and give good support, that in itself would be enough
>incentive for people to support you by registering it.

The "nag" isn't very serious, just a background bitmap which slows the
plot times a little.  I'll consider your suggestion.


>> A few answers to FAQ's:
>> 1.  I will not distribute Berkeley source code outside the U.S.
>

>Why?

I am not allowed to do so by the Berkeley licensing agreement.



-robert
-- 
robert@csustan.csustan.edu
Cserve 70323,1251
fax (209) 577-8548
voice (209) 577-4268 X101
Newsgroups: comp.lsi.cad