🚀 go-pugleaf

brett@bambi.wg.waii.com (Marc Brett) writes:

>In article <1992Oct13.172459.28720@zip.eecs.umich.edu>, ayman@eecs.umich.edu (Ayman I. Kayssi) writes:
>|> I posted a question on comp.unix.questions about how to get a shell by email,
>|> that is a shell that would execute what's in the body of an email message.
>|> All the details have been worked out except for one thing: security.
>|> Currently, security is obtained using the following:
>|> 1- the subject of the message is a certain (fixed) special string
>|> 2- a header line is added which contains an encrypted string
>|> You can see that the problem is that the message itself contains the security
>|> keys, and therefore anyone can intercept the email and fake a message...
>|> So, are there any suggestions on how to make this more secure?
>|> Email or post...
>|> Thanks,

>How about running a unique checksum algorithm on the message (including
>the source and destination addresses) and appending the result on the end
>of the message.  Only the sender and receiver know the algorithm, and so
>a third party could not construct a false message without knowing (or
>stealing) the checksum algorithm.  

>For extra points, change the algorithm periodically.

Can I assume that only a select number of users will/should be able to
send messages/shells to you to execute? The algorithm used could be
based on the sender ID. The ID should NOT be used as a key, because that
could help in breaking the code, but just as a simple index to a known
set of algorithms. Even with a given ID, it would still be a good idea
to change the algorithm from time to time.
-- 
     ____  __   __       Tom@UTS.CC.Wayne.Edu
      /   /_/  /_        Thomas_Richard_Stevenson@MTS.CC.Wayne.Edu
     /.  /\ . __/.       Tom@CMS.CC.Wayne.Edu
                         UserTom@WayneMTS.Bitnet