🚀 go-pugleaf

In article <BssuF5.G4@ibmpcug.co.uk>, gtoal@ibmpcug.co.uk (Graham Toal) writes:
> Has anyone heard a rumour circulating that some crackers have found a
> trapdoor password that lets people on to Next machines with root
> privs?  I told the person I heard it from that it sounded like total

I heard this one too: I was told that there was a "backdoor". This struck me
as reasonable, since the NeXT was developed for fun and the NetInfo programs
that handle passwords are not obviously accessible and do not come with
source code. I mentioned the rumor to our NeXT owner here at the lab, and
asked for more details.

Upon checking, my rumor source forwarded a copy of a note from a private bbs
that complained of security *holes* on NeXT, but made no mention of actual
backdoors. I then explained to my rumor source the distinction between the
two, and have heard nothing further.
-- 
			Nico Garcia
			CIRL/MEEI
			eddie.mit.edu!eplunix!raoul

In article <BssuF5.G4@ibmpcug.co.uk>, gtoal@ibmpcug.co.uk (Graham Toal) writes:
> ... found a trapdoor password that ...
              ^^^^^^^^
Do you mean backdoor password?

In article <1259@eplunix.UUCP> raoul@eplunix.UUCP (Nico Garcia) writes:
>In article <BssuF5.G4@ibmpcug.co.uk>, gtoal@ibmpcug.co.uk (Graham Toal) writes:
>> Has anyone heard a rumour circulating that some crackers have found a
>> trapdoor password that lets people on to Next machines with root
>> privs?  I told the person I heard it from that it sounded like total
>
>I heard this one too: I was told that there was a "backdoor". This struck me
>as reasonable, since the NeXT was developed for fun and the NetInfo programs
                               ^^^^^^^^^^^^^^^^^^^^^
That's a good one, I'm sure the Wall Street Firms using it to develop
trading programs would certainly call it "fun"...

[...blah blah]
>Upon checking, my rumor source forwarded a copy of a note from a private bbs
>that complained of security *holes* on NeXT, but made no mention of actual
>backdoors. I then explained to my rumor source the distinction between the
>two, and have heard nothing further.

As with any computer, the NeXT has it's share of security holes, you're kidding
yourself if you think you most computers are secure out of the box.

As for whether the NeXT has a "backdoor" password, I *REALLY* *REALLY*
*REALLY* doubt it. I would wager this rumor is one of those permuted
rumors, starting out as someone hearing about the loginwindow special
account names (which are undocumented)

The loginwindow program used to login on the console has two special account
names "exit" and "console", exit will stop and restart the windowserver
(handy for some uses) and console will quit the windowserver and bring
up the system console upon which you login in via a getty process
running on /dev/console.  This "backdoor" password rumor is very
likely to have mutated from this feature of the loginwindow program.

la la la,
-- 
:: Christopher Lloyd :: a74k110@titan.ucc.umass.edu :: Yrrid, Inc. ::

a74k110@titan.ucc.umass.edu (Chris Lloyd) writes:

>In article <1259@eplunix.UUCP> raoul@eplunix.UUCP (Nico Garcia) writes:
>>In article <BssuF5.G4@ibmpcug.co.uk>, gtoal@ibmpcug.co.uk (Graham Toal) writes:
>>> Has anyone heard a rumour circulating that some crackers have found a
>>> trapdoor password that lets people on to Next machines with root
>>> privs?  I told the person I heard it from that it sounded like total
>>

>As with any computer, the NeXT has it's share of security holes, you're kidding
>yourself if you think you most computers are secure out of the box.

And there have been CERT advisories that have cleaned up the most
blatant holes, such as the rexd hole (the 'hole' is that NeXT
shipped OS 2.x machines with rexd enabled...their rexd isn't any less
secure than anyone else's), and the rdist hole (that hit 99% of
every BSD 4.2 or 4.3 derived system).  
NeXTs come with a manual (paper and on-line) that describes security
and how to make your machine more secure.  

-- 
David Lemson                                                 (217) 244-1205
University of Illinois NeXT Campus Consultant  / CCSO NeXT Lab System Admin
Internet : lemson@uiuc.edu                 UUCP :...!uiucuxc!uiucux1!lemson 
NeXTMail accepted                                   BITNET : LEMSON@UIUCVMD

In article <1259@eplunix.UUCP> raoul@eplunix.UUCP (Nico Garcia) writes:
>In article <BssuF5.G4@ibmpcug.co.uk>, gtoal@ibmpcug.co.uk (Graham Toal) writes:
>> Has anyone heard a rumour circulating that some crackers have found a
>> trapdoor password that lets people on to Next machines with root
>> privs?  I told the person I heard it from that it sounded like total
>
>I heard this one too: I was told that there was a "backdoor". This struck me
>as reasonable, since the NeXT was developed for fun and the NetInfo programs
>that handle passwords are not obviously accessible and do not come with
>source code. I mentioned the rumor to our NeXT owner here at the lab, and
>asked for more details.

I would probably disagree with the statement that NeXT's were developed for
"fun," which implies that you do not consider the NeXT to be a "real" machine.

>Upon checking, my rumor source forwarded a copy of a note from a private bbs
>that complained of security *holes* on NeXT, but made no mention of actual
>backdoors. I then explained to my rumor source the distinction between the
>two, and have heard nothing further.

I would be interested in hearing about these bugs.  I know of the rdist
problem; although that wasn't a NeXT-only problem.  I also fixed the obvious
permission problems with some of the directories as shipped.  What are the
other bugs/security holes?

Bob
-- 
Bob Snyder, Computing Services, GE Aerospace, Advanced Technology Labs
rsnyder@atl.ge.com, (609) 866-6672, FAX: (609) 866-6397, DialComm 8*777-6672