🚀 go-pugleaf

ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:

>How common is this attack?

>  1:  User on foo.bar.com gets mail from root@foo.bar.com or admin@foo.bar.com
>      asking to change his password to "gromitvomit" because root needs to
>      [access the account|modify something|find a hacker|(etc.)]

>  2:  User changes password to "gromitvomit"

>  3:  Hacker who forged the E-mail logs in, changes the password and now
>      has the account.

>Knowledgable users would be *VERY* suspicious because (to by knowledge)
>root **N-E-V-E-R** needs to know a user's password to effect changes
>to an account or the system, but this attack could work on novice UNIX
>users.

>What is the best way to prevent/slow down this form of attack?

>-- 
>******* ifbb657@ccwf.cc.utexas.edu (Douglas R. Floyd) ******
>Disclaimer: I speak for myself.
>Win NT:     Another reason to pour salt water on the toroid
>            coil of your 21" monitor.

This happened at my Alma Mater while I was an undergrad there (1990).  Someone
was sending email supposedly from root to users asking them to change
there passwords.  I guess one of the users figured out what was going on,
because the system administrators posted notes saying not to change
your password, to save the email message (though this really won't help
if the forger is any good), etc.

The only real way I know to combat problems like this is to educate users
about security, passwords, and the like.  Most novice users pick something
simple for their password anyway (like their cat's name), and would
most likely obey an "official" looking message saying to change their
password.  Yes, it is true that root never needs to know a user's password ---
root can always su to the user without knowing the password.

Dave
-- 
* *  ***  *     *    |   Dave "Van Damme" Ratner
* *  *    *    * *  / \  ratner@cs.ucla.edu
* *  *    *    ***  \ /  
***  ***  ***  * *   |   "Wham Bam, thank you Van Damme!"