🚀 go-pugleaf

ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:

>How common is this attack?

>  1:  User on foo.bar.com gets mail from root@foo.bar.com or admin@foo.bar.com
>      asking to change his password to "gromitvomit" because root needs to
>      [access the account|modify something|find a hacker|(etc.)]

>  2:  User changes password to "gromitvomit"

>  3:  Hacker who forged the E-mail logs in, changes the password and now
>      has the account.

>Knowledgable users would be *VERY* suspicious because (to by knowledge)
>root **N-E-V-E-R** needs to know a user's password to effect changes
>to an account or the system, but this attack could work on novice UNIX
>users.

>What is the best way to prevent/slow down this form of attack?

>-- 
>******* ifbb657@ccwf.cc.utexas.edu (Douglas R. Floyd) ******
>Disclaimer: I speak for myself.
>Win NT:     Another reason to pour salt water on the toroid
>            coil of your 21" monitor.

This happened at my Alma Mater while I was an undergrad there (1990).  Someone
was sending email supposedly from root to users asking them to change
there passwords.  I guess one of the users figured out what was going on,
because the system administrators posted notes saying not to change
your password, to save the email message (though this really won't help
if the forger is any good), etc.

The only real way I know to combat problems like this is to educate users
about security, passwords, and the like.  Most novice users pick something
simple for their password anyway (like their cat's name), and would
most likely obey an "official" looking message saying to change their
password.  Yes, it is true that root never needs to know a user's password ---
root can always su to the user without knowing the password.

Dave
-- 
* *  ***  *     *    |   Dave "Van Damme" Ratner
* *  *    *    * *  / \  ratner@cs.ucla.edu
* *  *    *    ***  \ /  
***  ***  ***  * *   |   "Wham Bam, thank you Van Damme!"	

In article <82930@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu 
(Douglas Floyd) writes:
> [A hacker forges email telling a novice to set their passwd. to
> 'gromitvomit', then logs in.] 
> What is the best way to prevent/slow down this form of attack?
> 

Educate your users.  The weakest biggest security hole is always the
users.


-- 
Daniel F. Boyd -- boyd@cs.buffalo.edu
----------------------------------------------------------------------
"It's not a System called 'X-Windows', it's a window system named 'X',
after the owl on 'Mister Rogers' Neighborhood'".

In article <82930@ut-emx.uucp> ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:
>How common is this attack?
>
>  1:  User on foo.bar.com gets mail from root@foo.bar.com or admin@foo.bar.com
>      asking to change his password to "gromitvomit" because root needs to
>      [access the account|modify something|find a hacker|(etc.)]

>Knowledgable users would be *VERY* suspicious because (to by knowledge)
>root **N-E-V-E-R** needs to know a user's password to effect changes
>to an account or the system, but this attack could work on novice UNIX
>users.

Probably fairly common, at Universities and other places with large
populations of low knowledge users.  It might be easier to social
engineer the password out of someone, rather than get them to change
it.

>What is the best way to prevent/slow down this form of attack?

Use a wrapper around passwd, warning people never to change their
password to something someone else told them to use.  Their password
should always be something that they choose, and they should not share
it with anyone.

You might also want to ask them to report it, explaining that forging
mail is really easy, but that might encourage hundereds of students to
go start forging mail.  Bleah.

You might also want to start logging sendmail connections, to see if
anyone is actually doing this.

Adam


Adam Shostack 					adam@das.harvard.edu

What a terrible thing to have lost one's .sig.  Or not to have a .sig
at all.  How true that is.      

We have to put up a MOTD every semester telling users
that no one needs to know their password.  Such is life
in a U.  --grish

Why would a hacker (who apparently has root access) need to tell users to
change their password?  On my system (Linux) all root has to do is wipe out
the users' old password and then the account is free.  You could then log in
as that user without a password and run the passwd program to change it to
whatever the cracker feels like doing.  Similarly, couldn't this also be
done to the root password as well?  This is all assuming that there is a
normal /etc/passwd file.  I don't know what the story is with Yellow Pages..
If a user has access to the passwd file, he can change the users group Id to
0, too no?

I'm curious as to (if the above is correct) what can be done to cut down the
chances of such an attack..

In article <92309.193737CXF111@psuvm.psu.edu>, Charles Fee <CXF111@psuvm.psu.edu> writes:
> Why would a hacker (who apparently has root access) need to tell users to
> change their password?
> On my system (Linux) all root has to do is wipe out
> the users' old password and then the account is free.  You could then log in
> as that user without a password and run the passwd program to change it to
> whatever the cracker feels like doing.  Similarly, couldn't this also be
> done to the root password as well?  This is all assuming that there is a
> normal /etc/passwd file.  I don't know what the story is with Yellow Pages..
> If a user has access to the passwd file, he can change the users group Id to
> 0, too no?
> 
> I'm curious as to (if the above is correct) what can be done to cut down the
> chances of such an attack..

You don't need root access to forge a mail message from "root".

-- 
Cosmik Debris --- "I owe money, therefore I am!"

Charles Fee <CXF111@psuvm.psu.edu> writes:

>Why would a hacker (who apparently has root access) need to tell users to
>change their password?  On my system (Linux) all root has to do is wipe out
>the users' old password and then the account is free.  You could then log in
>as that user without a password and run the passwd program to change it to
>whatever the cracker feels like doing.  Similarly, couldn't this also be
>done to the root password as well?  This is all assuming that there is a
>normal /etc/passwd file.  I don't know what the story is with Yellow Pages..
>If a user has access to the passwd file, he can change the users group Id to
>0, too no?

>I'm curious as to (if the above is correct) what can be done to cut down the
>chances of such an attack..

I think you missed the point he was trying to make. Anyone with enough
expertise can forge mail that looks to the normal user as is it came from
root. I don't even have to have access to your machine, just your mail
port to do this. Then, to joe-user it appears as is root sent the mail.

James

ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:

>Knowledgable users would be *VERY* suspicious because (to by knowledge)
>root **N-E-V-E-R** needs to know a user's password to effect changes
>to an account or the system, but this attack could work on novice UNIX
>users.

>What is the best way to prevent/slow down this form of attack?

Make it clear to all users when they are given the account the sort of
things that they will be asked to do and the sort of things they should be
aware of.  eg a list that states.

  Do not change your password to anything that someone tells you to.
  Report this to your superuser.

  Do not mail the file /etc/passwd to people requesting it.  Report them to
  your superuser.

  If you see something you don't think looks right.  TELL SOMEONE.

  Don't run xwindows :-)

This is by far the best way to combat this sort of problem.  You can also
install a program such as tcpd which will let you prevent telnet and
certain other service access from non-trusted sites.  You still accept mail
from anywhere because it won't get to you otherwise, but you don't have to
accept telnet connections from anyone you don't think needs access to your
machine.  If they can't get on, they can't do any (much) damage.

Craig
--
Craig Richmond.  Computer Officer -  Dept of Economics (morning) 380 3860
  University of Western Australia    Dept of Education (afternoon)
craig@ecel.uwa.edu.au Dvorak Keyboards RULE!  "Messes are only acceptable
if users make them.  Applications aren't allowed this freedom" I.M.VI 2-4

In <92309.193737CXF111@psuvm.psu.edu> Charles Fee <CXF111@psuvm.psu.edu> writes:

>Why would a hacker (who apparently has root access) need to tell users to
>change their password?  On my system (Linux) all root has to do is wipe out
>the users' old password and then the account is free.  You could then log in
>as that user without a password and run the passwd program to change it to
>whatever the cracker feels like doing.  Similarly, couldn't this also be
>done to the root password as well?  This is all assuming that there is a
>normal /etc/passwd file.  I don't know what the story is with Yellow Pages..
>If a user has access to the passwd file, he can change the users group Id to
>0, too no?

You don't even have to go through all this, if you already have root
access.  Just use passwd from root with the username argument and you
can change it directly from root.

>I'm curious as to (if the above is correct) what can be done to cut down the
>chances of such an attack..

Mail forgery is a problem inherent in the non-encrypted non-verified
SMTP mail world.  Tell your users not to do certain things when you
give them the account.

-- 
"Insisting on perfect safety is for people who don't have the balls to live
 in the real world."   -- Mary Shafer, NASA Ames Dryden
------------------------------------------------------------------------------
Fred.McCall@dseg.ti.com - I don't speak for others and they don't speak for me.

ifbb657@ccwf.cc.utexas.edu (Douglas Floyd) writes:

>How common is this attack?

[attack deleted]

Quite common among novice crackers/troublemakers. It is however almost
never succesfull, very obvious and also quite annoying.

>What is the best way to prevent/slow down this form of attack?

Educate your users to pick good passwords, tell them not to tell
them to anyone, especially not to people claiming to be the
admin and needing their passwords 'for system maintenance'.

Rob
-- 
/-----------------------------------------------\	Never		   ,==.
| Rob J. Nauta, UNIX computer security expert.	| 	 Apologize,	  /@  |
| rob@wzv.win.tue.nl, Phone: +31-40-837549	| 	  Never		 /_  <
| Feel free to email me for free advice		|	   Explain.	=" `g'

In article <ratner.720811773@ficus.cs.ucla.edu> ratner@ficus.cs.ucla.edu (Dave "Van Damme" Ratner) writes:
> Yes, it is true that root never needs to know a user's password ---
> root can always su to the user without knowing the password.

Not if root is trying to debug a problem in login or rlogin where the user's
password is entered. I had one case where a user's password included a pound
sign... which worked fine on the Suns but he couldn't login on Xenix for some
reason.

Generally I get the *user* to type in his password in cases like this, and
make a point of not watching. If I  ask the user his password it's always in
person and I tell them to change it immediately.

This sort of social engineering attack is hard to foil in the general case.
See alt.shenanigans for more ideas... :->
-- 
% Peter da Silva % 77487-5012 % +1 713 274 5180 %
true(<<VV$@\\$'&O 9$O%'$LT$&$"V6"$&$<4$?'&$ #I&&?$=$<<@)24 24 scale 3 21 moveto
{dup 36 eq{pop not}{dup 7 and 4 sub exch 56 and 8 div 4 sub 2 index{rlineto}{
rmoveto}ifelse}ifelse}forall stroke pop showpage % Har du kramat din varg idag?

In article <id.Z9RU.L6K@ferranti.com>, peter@ferranti.com (peter da silva) writes:
>In article <ratner.720811773@ficus.cs.ucla.edu> ratner@ficus.cs.ucla.edu (Dave "Van Damme" Ratner) writes:
>> Yes, it is true that root never needs to know a user's password ---
>> root can always su to the user without knowing the password.
>
>Not if root is trying to debug a problem in login or rlogin where the user's
>password is entered. I had one case where a user's password included a pound
>sign... which worked fine on the Suns but he couldn't login on Xenix for some
>reason.

The reason is that on some systems, the default erase/kill characters
are #/@ which is behavior left over from the days when Unix had real
teletypes as terminals.  Not a bug in login at all -- the tty driver
just had different defaults.

-bsy

-- 
Bennet S. Yee		Phone: +1 412 268-7571		Email: bsy+@cs.cmu.edu
School of Computer Science, Carnegie Mellon, Pittsburgh, PA 15213-3890

In article <1992Nov5.174213.2370@mksol.dseg.ti.com>, mccall@mksol.dseg.ti.com 
(fred j mccall 575-3539) writes:

> In <92309.193737CXF111@psuvm.psu.edu> Charles Fee <CXF111@psuvm.psu.edu> writes:
> 
>>Why would a hacker (who apparently has root access) need to tell users to
>>change their password?  On my system (Linux) all root has to do is wipe out
>>the users' old password and then the account is free.  You could then log in
>>as that user without a password and run the passwd program to change it to
>>whatever the cracker feels like doing.  
[...]
> You don't even have to go through all this, if you already have root
> access.  Just use passwd from root with the username argument and you
> can change it directly from root.

A hacker would usually ask a user to change their password because the 
hacker *doesn't* have root access (at least, not yet).  The hacker faked an
Email address to make it look like it came from root - it didn't come from 
root.

Also, if a hacker changes someone's password, the person will know it (the
legitimate user can no longer login) and the legit user will call the 
the sysadmin and whine "I forgot my password" and the sysadmin will change it 
-- locking out the hacker.  If a hacker wants to run 'stealth' on your system,
it is a lot easier to use an already-existing username rather than create a
new username or use your root login.

My own comments and ideas, not those of my employer.

-dan
 Internet: DWING@UH01.Colorado.EDU, or DWING@cudnvr.denver.colorado.edu