🚀 go-pugleaf

In article <82930@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>How common is this attack?
>
>  1:  User on foo.bar.com gets mail from root@foo.bar.com or admin@foo.bar.com
>      asking to change his password to "gromitvomit" because root needs to
>      [access the account|modify something|find a hacker|(etc.)]

>Knowledgable users would be *VERY* suspicious because (to by knowledge)
>root **N-E-V-E-R** needs to know a user's password to effect changes
>to an account or the system, but this attack could work on novice UNIX
>users.

Probably fairly common, at Universities and other places with large
populations of low knowledge users.  It might be easier to social
engineer the password out of someone, rather than get them to change
it.

>What is the best way to prevent/slow down this form of attack?

Use a wrapper around passwd, warning people never to change their
password to something someone else told them to use.  Their password
should always be something that they choose, and they should not share
it with anyone.

You might also want to ask them to report it, explaining that forging
mail is really easy, but that might encourage hundereds of students to
go start forging mail.  Bleah.

You might also want to start logging sendmail connections, to see if
anyone is actually doing this.

Adam


Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all.  How true that is.