HDTenEightyP/NetNews huggingface dataset:
From: leonard@qiclab.scn.rain.com (Leonard Erickson)
Newsgroups: comp.security.misc
Subject: Re: CERT and the Dept. of Justice on keystr
Date: 17 Dec 92 00:43:07 GMT
Article-I.D.: qiclab.1992Dec17.004307.15153
Reply-To: Leonard.Erickson@f51.n105.z1.fidonet.org
Organization: SCN Research/Qic Laboratories of Tigard, Oregon.

jpe@ee.egr.duke.edu (John P. Eisenmenger) writes:

>This borderline legality is comparable to what we as administrators face when
>trying to maintain the security of our systems.  This is the reason we have to
>put such a banner on our systems.  Does such a banner give blanket protection
>to the administrators?  It does not - notice the phrase "In the course of
>monitoring individuals improperly using this system, or [...] system
>maintenance".  This restricts the authority of the administrator, and I would
>imagine that if a legal case were to ensue the administrator had better have
>a d*mn good log of the evidence that lead to the monitoring.

>BTW: I have yet to figure out why I would monitor an individual while doing
>system maintenance.  Anyone have any examples?

I think that part is more aimed at reading *files*.

As administrator of the LAN at a company I used to work for, I sometimes
had to free up space. Which meant looking for "backup" files, redundant
copies of drivers (some folks kept putting copies of drivers in their
personal directories, even though the LAN was set up so that the programs
would "see" the ones in a public directory as being in any directory).
So I'd put out the usual notice that I'd be going thru and nuking the
files. Then a day or so later (except in *real* space crunches) I'd
run a script to kill the "obvious" stuff. Then I had to page thru all
the directories to find the stuff the script wasn't smart enough to
handle safely.

So I saw a *lot* of files that were "suspicious". I left them alone, mostly.
It wasn't my business if someone had his resume (named "resume" :-) in his 
directory. I did send notes to folks about some things. Like games and
GIF files. But that was mostly a "Please move it, we need the space"
message.

And I've had to "snoop" because someone had files locked open that
interfered with a backup or with a system shutdown. 

-- 
Leonard Erickson		      leonard@qiclab.scn.rain.com
CIS: [70465,203]			 70465.203@compuserve.com
FIDO:   1:105/51	 Leonard.Erickson@f51.n105.z1.fidonet.org
(The CIS & Fido addresses are preferred)
Newsgroups: comp.security.misc
From: bdixon@wap.oau.org (Bill Dixon)
Subject: Re: New "official" motd
Date: Fri, 11 Dec 1992 18:20:30 GMT
Organization: White Aluminum Products, Leesburg, FL
Keywords: motd

In article <jpe.723910551@ee.egr.duke.edu> jpe@ee.egr.duke.edu (John P. Eisenmenger) writes:
>While we're on this subject of the MOTD notice.  Will that actually do
>the job? What if your have .hushlogin files so they don't see the motd
>messages when they login?  What if the account an unauthorized user has
>compromised has a .hushlogin?  Wouldn't this present the intruder with
>a legal loophole, or would s/he have given up their right to notification?
>If the former, should we start removing .hushlogin files from our users'
>home directories or what?
>
>-John

Why not change the login herald so that the notice is displayed at each
login?  On AIX, the herald is in /etc/security/login.cfg, and can be
changed to anything you want (I don't know whether it's legal to
change/remove the copyright notice, though).

Wouldn't this suffice to present the notice to all users, legitimate or
otherwise?
-- 
Bill Dixon
bdixon@wap.oau.org
From: zen@death.corp.sun.com (d)
Newsgroups: comp.security.misc
Subject: Re: COPS 1.04 suggestion
Date: 11 Dec 92 22:12:22
Organization: savage hackers
NNTP-Posting-Host: death.corp.sun.com
In-reply-to: medley@sun44.synercom.hounix.org's message of Fri, 11 Dec 1992 15:40:14 GMT


In article <1992Dec11.154014.2173@sun44.synercom.hounix.org> medley@sun44.synercom.hounix.org (Bert Medley) writes:
> I think COPS needs another test added to the password check phase:  accounts
> whouse password is the account name -
> login: dsuser
> Password: dsuser
> My last run did not report this simple problem.

  It does check that.  I suppose you might be running shadow passwords,
in which case if you're not running passwd.chk as root, or if it's an
odd architecture that isn't supported, or if it's a password in the NIS
maps and it wasn't sucked in or one of any number of possibilities, it
might get missed (RTFM, if desired, for more on this).  Feel free to
send me your system type/setup, and I'll look it over to why it might
have been missed.

 -- d
From: rhealey@dellr4.digibd.com (Rob Healey)
Newsgroups: comp.security.misc
Subject: Re: CERT and the Dept. of Justice on keystr
Date: 15 Dec 92 00:08:55 GMT
Organization: DigiBoard Incorporated, Eden Prairie, MN

In article <1992Dec13.090705.22164@news.Hawaii.Edu>, newsham@wiliki.eng.hawaii.edu (Timothy Newsham) writes:
|> ack!  if you think these are not rights I dont really know what
|> to say..
|> (1) drive a car - if it doenst infringe on the rights of others
|> then it is entirely your own business...
|> 
	Driving a vehicle is NOT a right in the US, check the law if you don't
	believe me. It is a privledge granted by one of the 50 states to
	a citizen of that state.

|> (2) come and go as we please  -  as long as we dont intrude on
|> other peoples "property".  
|> 
	This is a right.

|> (3) drink alchohol, take drugs etc - again as long as it doesnt
|> intrude on other peoples rights.   
|> 
	Not if you are under legal drinking age or if it is a
	"controlled" substance.

	Better check up on your understanding of the US "legal"
	system.

	My comments apply only to US law of course.

	I found the comment in one of the related posts about
	"takes a Fin to stand up for American rights" interesting.
	
	We in the US have been brainwashed from birth to think we have a free
	society when in fact it is one of the most restrictive on the
	planet when you get down to the nitty gritty. The result of
	a Government gone amuck and apathy by the citizenry helping the
	government go more amuck. The worst offense is usually committed by the
	US Government "in the name of National Security" which usually
	translates to a free reign to violate human rights and break
	whatever laws necessary to maintain power and perks.
	
	"National Security" is also used when a rotty piece of paper called
	"The Constitution" happens to get in the way of their plans... B^(.

	As far as the tread that started all this, motd stuff, I think
	the warning has to restrict the use of monitoring to situations
	where it is known the proper owner of the account is NOT the
	one generating the keystrokes.

		-Rob
From: ho@cs.arizona.edu (Hilarie Orman)
Newsgroups: comp.security.misc
Subject: Re: CERT and the Dept. of Justice on keystroke monitoring
Date: 14 Dec 92 23:26:16 GMT

In article <1992Dec14.133030.804@ualr.edu>, lindstrom@acs.harding.edu
writes: 
|> As for the phone, it is also for business. ...  if
|> someone is making personal long distance calls, that's taking money
|> from our already small budget and I want to know.

The analogy with computer use rights would be if concern for
enforcement extended to monitoring employee phone calls and turning
over any suspicious information to the police.  Certainly this has
been done in some places, and I imagine sometimes this has raised
civil rights issues that go beyond the ownership of the telephone.

|> Now I'm not for a police state, ...

It's worth considering if there will be much non-monitored space for
us in the future.  If we commit most of our lives to computer
equipment and communication systems owned by others, and they are
constantly keeping tabs on us to make sure we use their equipment only
for legal, moral, and ethical purposes, then we may end up living in
some sort of police state, even though no one really wanted to.  Maybe
not; but I think that's the specter that haunts some of the objections
to monitoring.
Newsgroups: comp.security.misc
From: palmer@Trade_Zone.msfc.nasa.gov (Paul (Cliffy) Palmer)
Subject: Re: Security vs usefulness (was Re: reasons
Reply-To: palmer@Trade_Zone.msfc.nasa.gov
Organization: New Technology, Inc.
Date: Mon, 14 Dec 1992 21:12:55 GMT

In article <WCS.92Dec13203554@rainier.ATT.COM> wcs@anchor.ho.att.com (Bill Stewart +1-908-949-0705) writes:
>>
>>The main job of security is to say "NO".  
>>The main job of Unix is to say "Yes".
>
>O.K., you agree in this point: The main job of Unix is to get the
>user's work done.
>The main job of security is to stop the user from getting his work
>done.

I disagree, security is not a win/lose scenario...granted when the
security officer takes the easy way out when fixing a problem, the end
user usually loses functionality or useability.  But when the careful
security officer carefully considers the situation, there is almost
always a win/win solution.

It is especially important to inform the users of changes mandated by
security requirements and to provide them with methods to perform their
duties that are not impacted by the change.  Often the changes that are
necessary do not impact the user at all (like activating auditing, or
applying the NIS patch to implement "securenets").

System security is one of the toughest jobs I have ever performed, which
consequently makes it one of the easiest to perform badly.

---
Paul (Cliffy) Palmer

Newsgroups: comp.security.misc
From: pace@usace.mil (Joe Pace)
Subject: Re: Security of telephone Answering machines
Keywords: password, security, answering machine
Organization: US Army Corps of Engineers, Sacramento District
Date: Sun, 13 Dec 92 09:57:48 GMT

In article <1ftp5iINNt33@iskut.ucs.ubc.ca> unruh@physics.ubc.ca (William Unruh) writes:
> I have just been looking at telephone answering machines, and am appalled
> at the lack of security of the things All of them have this wonderful
> "remote" capability, which you can access with a " security code" This

If you don't like the features, don't buy the ones that have them.  Consumer
demand is the most efficient way to adjust the market.

Joe
-- 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Joe Pace                                              UNIX/Networking Analyst
US Army Corps of Engineers                                     pace@usace.mil
Sacramento District                                     JPPACE@UCDAVIS.BITNET
Newsgroups: comp.security.misc,alt.privacy,comp.org.eff.talk
From: jkp@cs.HUT.FI (Jyrki Kuoppala)
Subject: Re: New "official" motd
Keywords: motd
Reply-To: jkp@cs.HUT.FI (Jyrki Kuoppala)
Organization: Helsinki University of Technology, Finland
Date: Wed, 16 Dec 1992 08:32:39 GMT

In article <1992Dec10.143956.15403@ulysses.att.com>, smb@research (Steven Bellovin) writes:
>Certainly, such a policy can be ridiculously harsh, and even if it
>isn't, a reasonable one can be ignored or abused by an SA.  But the
>concepts I -- and CERT, and DoJ -- are advocating are hardly novel.  In
>fact, they're fundamental to our system of jurisprudence, that laws
>clearly give notice of the prohibited conduct (a law may be struck down
>by the courts for vagueness) and that probable cause is required for
>things like search and arrest warrants.

I didn't see anything in the notice that said that probable cause is
required for searches.  To the contrary, the message seemed to say
that by using the systems all users consent to all monitoring - ie. no
suspicion or probable cause required.

There was some sugar-coating which talked about monitoring
unauthorized users, but that was separate from the consent.

>> "The
>> management reserves the right to monitor all use of this system and to
>> share the monitoring results with law enforcement officials."

That seems to me like a good, brief summary of the meaning of the
login message strongly recommended by CERT.

//Jyrki
Newsgroups: comp.security.misc,comp.org.eff.talk
From: aclark@netcom.com (Al Clark)
Subject: Re: Stupid Licenses (YUCK!)
Organization: Self
Date: Sat, 19 Dec 1992 19:59:41 GMT

In article <1992Dec19.023609.26000@news2.cis.umn.edu> charlie@umnstat.stat.umn.edu (Charles Geyer) writes:
      [ -- related material deleted -- ]
>
>It is fair to say that no computer company puts quality first, ahead of
>featurality.  Until they do, quality will remain abysmal.
>
      I think some put it high enough on their priority list 
      to make their products fairly high quality.  I would put
      "Turbo-Tax", "Quicken", and Borland's "Turbo-C" in this
      category.
>The issue is not whether they exercised "due care" or whether they found
>the last bug.  The issue is whether bug fixes for all serious bugs are
>provided as a matter of course, and by "serious" here I mean anything that
>affects the functionality of the software, and whether product is simply
>not shipped with known serious bugs.
>
>Every time I say something like this on the net.  Industry people tell me
>that economic realities (according to conventional wisdom) dictate that
>deadlines come before quality.  He who ships first gets the customers.
>
      Here you have the central issue.  As a consultant, I have
      convinced some clients that much of the non-commercial software
      (both public domain and FSF) is of higher quality than the
      commercial equivalents.  I have installed 'less', 'RCS', screen,
      gnu-tar, and others on this basis.

      I recall one contributor to such software saying, to paraphrase,
      "This product represents me, and I'm not gonna release it until
      its right."  In the commercial world, such an attitude would, in
      my opionion, be likely to lead to disaster.  So commercial
      vendors DO have to balance their priorities.  However, the
      failure to fix significant bugs promptly is unforgivable.  

      Which means no more business from me and others I can convince
      likewise.

>And that's why computers don't work.
>
>(end rant)
>
      Understandable.
      You do have to be really careful.  I evaluate products very
      carefully, using money back guarantees if possible.  Once
      I have confidence in a product, such as Turbo-Tax, I note
      whenever the company involved has any major changes, such
      as in leadership or ownership, and then reevaluate before
      I trust updates.
>-- 
>Charles Geyer
>School of Statistics
>University of Minnesota
>charlie@umnstat.stat.umn.edu

      Note.  I have no interest in any of the software mentioned 
      other than that of satisfied user.
-- 
Al - aclark@netcom.com - My opinions are my own.
Newsgroups: comp.security.misc,comp.org.eff.talk
From: s_titz@ira.uka.de (Olaf Titz)
Newsgroups: comp.security.misc
Subject: Re: Security vs usefulness (was Re: reasons
Date: 15 Dec 92 17:25:19 GMT
Organization: Fachschaft math/inf, Uni Karlsruhe, FRG
NNTP-Posting-Host: irau31.ira.uka.de

In article <1992Dec15.162703.3216@lambda.msfc.nasa.gov> palmer@Trade_Zone.msfc.nasa.gov writes:
>In article 1gkpsmINNn05@iraul1.ira.uka.de, s_titz@ira.uka.de (Olaf Titz) writes:
>>In article <1992Dec14.211255.15839@lambda.msfc.nasa.gov> palmer@Trade_Zone.msfc.nasa.gov writes:
>> ^^^^^^^^
>>You see that the following applies largely to government/military only?
>
>Please do not do me the disservice of discounting my statements simply
>because I happen to have sent my message from a NASA provided host.  My

I didn't want to dimiss your statements, but rather to point out that
there surely are different considerations at nasa.gov than at
universities. My experience with the matter is only from academical
installations, and my criticism applies largely to them only. 

>statements apply just as well to the purely commercial organizations I
>have worked for that have a vested interest in maintaining the
>integrity of their computers.

O.K., commercial sites might have a similar position.

Olaf
-- 
| Olaf Titz - comp.sc.student  |   o     | uknf@dkauni2.bitnet | old address |
| univ. of karlsruhe - germany |  _>\ _  | s_titz@ira.uka.de   | is still    |
| +49-721-60439                | (_)<(_) | praetorius@irc      | valid       |
  "My heart is human - my blood is boiling - my brain IBM" - Mr. Roboto
Xref: sparky comp.security.misc:2198 comp.org.eff.talk:7611
From: honey@citi.umich.edu (Peter Honeyman)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Fun things to do to RTM (was: Internet worm)
Date: 13 Dec 1992 13:51:43 GMT
Organization: Center for Information Technology Integration, Univ of Michigan
Distribution: world
Reply-To: honey@citi.umich.edu
NNTP-Posting-Host: hone.citi.umich.edu

Bill Dixon writes:
|> Isn't one of the justifications for punishment for _any_ crime that of
|> providing a deterrent for other would-be criminals?
|> ...
|> However, if a hacker knew that s/he might lose his/her ability
|> to work on a computer, at least professionally, and not communicate via
|> modem, s/he _should_ be a little more inclined to consider the cost before
|> testing to see if s/he can propagate a worm or virus, whether it is benign
|> or not.

more of a deterrent than jail time?  i doubt it.  and, as mike points out,
this would require a thorough recasting of the law, for a narrow goal.  it
doesn't seem worth it.

	peter
Xref: sparky comp.security.misc:2199 comp.org.eff.talk:7612
From: honey@citi.umich.edu (Peter Honeyman)
Newsgroups: comp.security.misc,comp.org.eff.talk
Subject: Re: Fun things to do to RTM (was: Internet worm)
Date: 13 Dec 1992 14:05:27 GMT
Organization: Center for Information Technology Integration, Univ of Michigan
Distribution: world
Reply-To: honey@citi.umich.edu
NNTP-Posting-Host: hone.citi.umich.edu

fred j mccall writes:
|> In <1992Dec8.160732.13055@eff.org> mnemonic@eff.org (Mike Godwin) writes:
|> 
|> >In article <1992Dec7.160649.3039@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:
|> 
|> >>No, I think he's telling you that his lack of judgement in releasing
|> >>it in the first place indicates that he is not to be trusted in a
|> >>position from which he could decide to do some other 'harmless' thing.
|> 
|> >What position, specifically, is that? Graduate student?
|> 
|> I know you're not this stupid, Mike, so I have to assume that this is
|> a deliberate 'cute but obfuscatory' tactic.  Color me unimpressed.
|> And unconvinced.

fred, i wanted to ask you the same question.  i saw mike had asked it and
reckoned that you would answer him.  can you elaborate?

	peter
Newsgroups: comp.security.misc,comp.org.eff.talk
From: mrmach@mtu.edu (MARK ROMAN MACH)
Subject: Re: Licence to Net? No! (was Re: Fun things to do to RTM)
Organization: CCLI at Michigan Technological University
Date: Sun, 13 Dec 1992 10:13:41 GMT

In article <1992Dec11.163322.24608@news2.cis.umn.edu> charlie@umnstat.stat.umn.edu (Charles Geyer) writes:
>In article <1992Dec11.011139.3166@tc.cornell.edu> mdw@db.TC.Cornell.EDU
>(Matt Welsh) writes:
>
>>Besides, these things are usually handled internally. If Foo Computers,
>>Inc. produced an operating system used on their Foo/9000 computers, and
>>a hospital happened to use these machines, [. . .]
>
>[. . .]  Those disclaimers
>don't mean anything?  We can all sue computer companies for buggy software?
>How about if you go first?  I don't have the dough.

    Hospitals do.  :-)
-- 
Mark R. Mach, mrmach@mtu.edu,
The title varies with the nature of the correspondence...
Newsgroups: comp.security.misc
From: steve@ecf.toronto.edu (Steve Kotsopoulos)
Subject: Re: Am I being hacked?
Organization: University of Toronto, Engineering Computing Facility
Date: Thu, 17 Dec 1992 14:32:12 GMT

In article <1gk5p8INN8i9@uniwa.uwa.edu.au> craig@ec.uwa.oz.au (Craig Richmond - division) writes:
>subbarao@fc.hp.com (Kartik Subbarao) writes:
>
>>In article <1frfh9INNil3@network.ucsd.edu> mbk@lyapunov.ucsd.edu (Matt Kennel) writes:
>
>>Well, the /etc/passwd probably wouldn't be of any use, since it most likely
>>has '*'s in the place of the password. At least I hope so, in your case.
>
>I wanted to create a bogus password file with passwords like
>
>have
>you
>cracked
>every
>password
>yet
>
>so that you got a nice message when you unscrambled it after running crack
>on the password file :)
>
>Alternatively you set up a dummy account with a crackable password in the
>ftp passwd file and when the account is logged into, you record the IP,
>finger the machine and set of alarms on your local machine.  That way, you
>catch the potential hackers.

You should read Bill Cheswick's excellent "An Evening with Berferd ..."
paper, in the conference proceedings from the January 1992 Usenix.

He had a bogus password file, and many other amusing booby-traps
(fake smtp DEBUG hole and chroot login environment).
-- 
Steve Kotsopoulos                   mail:   steve@ecf.toronto.edu
Systems Analyst                     bitnet: steve@ecf.UTORONTO.BITNET
Engineering Computing Facility      uucp:   uunet!utai!ecf!steve
University of Toronto               phone:  (416) 978-5898
Newsgroups: comp.security.misc,comp.org.eff.talk
From: mccall@mksol.dseg.ti.com (fred j mccall 575-3539)
Subject: Re: Fun things to do to RTM (was: Internet worm)
Organization: Texas Instruments Inc
Date: Mon, 14 Dec 1992 18:38:58 GMT

In <1992Dec13.055137.15759@eff.org> mnemonic@eff.org (Mike Godwin) writes:

>In article <1992Dec11.160608.29674@mksol.dseg.ti.com> mccall@mksol.dseg.ti.com (fred j mccall 575-3539) writes:

>>>What position, specifically, is that? Graduate student?
>>
>>I know you're not this stupid, Mike, so I have to assume that this is
>>a deliberate 'cute but obfuscatory' tactic.  Color me unimpressed.
>>And unconvinced.

>It looks very much as if you are avoiding the question. If the issue
>is whether Morris should be barred from the computer industry, it should
>be noted that he was not a part of it at the time of the Internet Worm.

The point is that if someone is convicted of deliberate vehicular
homicide, the obvious situation is 'driving a vehicle', whether they
are a professional driver or not.

This is obvious to anyone with a modicum of sense, and pointing that
out is hardly 'avoiding the question'.  Whether Morris was part of
"the computer industry" isn't relevant.  I have no problem with him
working in the computer industry -- as long as what he does has
nothing to do with doing anything on computers.  I would also hardly
make this a lifetime ban, but I think a certain amount of "think about
it" time might be both useful and constructive in this kind of case.

>I strongly suggest, by the way, that folks interested in the Iernet
>Worm case read Hafner and Markoff's book CYBERPUNK, and Peter Denning's
>COMPUTERS UNDER ATTACK. It is difficult for those with actual knowledge
>about the case to obsess on punishing Morris.

Ah, once more anyone who disagrees gets the unfavorable
characterization.  It's "obsess" this time.

-- 
"Insisting on perfect safety is for people who don't have the balls to live
 in the real world."   -- Mary Shafer, NASA Ames Dryden
------------------------------------------------------------------------------
Fred.McCall@dseg.ti.com - I don't speak for others and they don't speak for me.
Newsgroups: comp.security.misc,alt.security