🚀 go-pugleaf

In article <2757@mtgzz.UUCP>, gcm@mtgzz.UUCP writes:
> 
>   Wonder why we have so many security problems at our comp centers -
> read on.
> 
> ************************************
> From Asbury Park Press (week of 6/15)
> ************************************
> 
> 	        APPLE FOUNDER OFFERS SCHOLARSHIP FOR HACKERS
> 	          - Associated Press
> 
> 	Boulder, CO - Computer whiz Stephen Wozniak has donated $100,000 for
>     a University of Colorado scholarship aimed at developing excellence in
>     computer hackers at his alma mater.
> 	"The value of cracking security codes and understanding them is that 
>     generates incredible knowledge," said Wozniak, one of the original hackers
>     and co-founder of Apple Computer Inc. 
> 	Wozniak said he actually encourages the "mildly" social deviants" to
>     break access and security codes as a way to learn.
> 	As a freshman at CU in 1969, Wozniak tapped into the university's
>     computer system to print out reams of mathematical information. Angry 
>     university officials placed him on probation, and, he said, on the road to
>     Apple Computer.
> 
> 	...nuff said.


First, I think that used to be done here with blue-boxers. 
However toll fraud is now a multi-million dollar industry that is no
longer cute, no longer funny and no longer tolerable to our
business.

Second, I think the social deviance is more than mild when people
hack away at other people's work or learning environment.  It is one
thing to figure out how to become root.  It is quite another to use
that knowledge to make it impossible for other people (NOT faceless
representatives of Ma Bell, but PEOPLE) to do their work.  Somebody
who thinks it's cute to cream the root file system of somebody
else's computer is extremely anti-social.  Real people have their
livelihoods, and professional reputations tied up with the data that
is lost, and suffer from real depression and frustration when it
happens.

Screw Wozniak and send the bastards to jail.
-- 
andy sherman / at&t bell laboratories (medical diagnostic systems)
room 2h-097 / 480 red hill road / middletown, nj 07748
(201) 615-5708 / andys@shlepper.ATT.COM
...The views and opinions are my own.  Who else would want them?

--------
[]
>In article <345@genesis.UUCP> andys@genesis.UUCP (a.b.sherman) writes:
>In article <2757@mtgzz.UUCP>, gcm@mtgzz.UUCP writes:
>> 
>> 
>> 	        APPLE FOUNDER OFFERS SCHOLARSHIP FOR HACKERS
>> 	          - Associated Press
>> 
>> 	Boulder, CO - Computer whiz Stephen Wozniak has donated $100,000 for
>>     a University of Colorado scholarship aimed at developing excellence in
>>     computer hackers at his alma mater.........
>> 	"The value of cracking security codes and understanding them is that 
>>   generates incredible knowledge," said Wozniak, one of the original hackers
>>     and co-founder of Apple Computer Inc. 
>
>....... I think the social deviance is more than mild when people
>hack away at other people's work or learning environment.  It is one
>thing to figure out how to become root.  It is quite another to use
>that knowledge to make it impossible for other people (NOT faceless
>representatives of Ma Bell, but PEOPLE) to do their work.  Somebody
>who thinks it's cute to cream the root file system of somebody
>else's computer is extremely anti-social.  Real people have their
>livelihoods, and professional reputations tied up with the data that
>is lost, and suffer from real depression and frustration when it
>happens.
>
>Screw Wozniak and send the bastards to jail.

I don't believe Woz is advocating creaming a file system. He is
advocating breaking the file system security, and learning a lot
about the guts of the system in the process (like he did). He
believes this kind of hands-on experience is the best way to learn,
and that people are responsible and wouldn't abuse this system of
learning (I didn't say he wasn't naive and idealistic)
--
{decwrl,hplabs,ihnp4}!nsc!apple!baum		(408)973-3385

In article <345@genesis.UUCP> andys@genesis.UUCP (a.b.sherman) writes:
>In article <2757@mtgzz.UUCP>, gcm@mtgzz.UUCP writes:
>> 
>>   Wonder why we have so many security problems at our comp centers -
>> read on.
>> 
>> ************************************
>> From Asbury Park Press (week of 6/15)
>> ************************************
>> 
>> 	        APPLE FOUNDER OFFERS SCHOLARSHIP FOR HACKERS
>> 	          - Associated Press
>> 
>First, I think that used to be done here with blue-boxers. 
>However toll fraud is now a multi-million dollar industry that is no
>longer cute, no longer funny and no longer tolerable to our
>business.
>
>Second, I think the social deviance is more than mild when people
>hack away at other people's work or learning environment.  It is one
>thing to figure out how to become root.  It is quite another to use
>that knowledge to make it impossible for other people (NOT faceless
>representatives of Ma Bell, but PEOPLE) to do their work.  Somebody
>who thinks it's cute to cream the root file system of somebody
>else's computer is extremely anti-social.  Real people have their
>livelihoods, and professional reputations tied up with the data that
>is lost, and suffer from real depression and frustration when it
>happens.
>
>Screw Wozniak and send the bastards to jail.
>-- 
>andy sherman

Its too bad that you failed to fully reason this out before firing off
your followup.

What Woz is trying to do will IMPROVE systems security not destroy it.
As more holes are found and plugged all computer users will benifit,
INCLUDING Ma Bell!  If anything all security conscious companies should
follow Woz's lead.  The fact that it is so easy to rip off the Phone
Company should SHOUT that you have major problems.  Don't stick your
head in the sand and expect the problems to go away!  Donate computer
systems with your latest software to schools and have them HACK away
in a controlled environment.  Find your BACK DOORS and put locks on
them!  If this is handled correctly it can be a BIG win for the whole
computer using society.

As far as Woz being ANTI-SOCIAL, I think if you just calm down and
reasses his true intent you will come to the conclusion that he is
a real leader!

Hans

In article <532@houxa.UUCP>, mel1@houxa.UUCP (M.HAAS) writes:
...
> The DES algorithm is now quite old, but still not used in computer
> hardware.  Why? 
...
>    Mel Haas  ,  odyssey!mel

According to many, the DES algorithm is not used because the feds designed it 
so that THEY could break it.  The NSA doesn't want any codes being used that
they can't break.  

This is why people who really want to seriously encrypt their messages/data
use RSA public key encryption.  This supposedly beats DES any day. 31 Bit key 
for DES vs. huge (50 deciman digit) prime for RSA.  RSA wins.

BTW, I don't think NSA / DOD / CIA super secret goop is done using DES.


Nonetheless, there is no excuse for not using some standard kind of encryption
for each system, especially sensitive network links.


						Spidey!

-- 
DON'T PANIC!!!                                              \_\ /_/  Yes, it is
                                                             _[*]_   supposed to
A message from Spidey, and the Spidey Team.  ------>>>>     / / \ \  look like a
Reachable via UUCP: ...[seismo,mimsy]!jhu!osiris!jdia                spider!

In article <532@houxa.UUCP> mel1@houxa.UUCP (M.HAAS) writes:
<to exist.  Why?  Who makes these decisions?  Why?

The people who design computer systems make some of them, the people
who run them make others.

<Why?  Call back and random password techniques are readily
<available, but aren't used.  Why? 

Sorry, but call back and random password technology *are* used. Just
not widely. Why? Because they tend to cost more, and are make getting
to a system harder for the legitimate users as well as crackers (*not*
hackers - hackers you put on your payroll and let them make your
system a nicer place to be).

<Why?  Our computer systems can be designed to be reliable and fault
<tolerant, but still require "superuser" gurus to administer them. 

Reliable and fault tolerant? Hmmm. The few I know of that actually are
cost lots of extra $$$s.

As for needing gurus, simple systems (a Macintosh, say) don't require
gurus to administer them. But a box that supports 20+ users is
noticably more complicated than a Macintosh, so you expect it to be
more complicated to run.

<I think the damage is being done by the people who bury their heads
<in the sand and foist these security horrors onto the public, not
<the college kid hackers.

Oh, horse pucky. You can buy secure systems if you want to. But they
cost (and cost, and cost). The public (since individuals very seldom
buy multi-user boxes, "the public" is actually closer to "corporate
america") chooses to spend fewer dollars for less security.

<Make it so that nothing gets onto any storage hardware in clear text.

How much extra will this cost? And what do you do about moving things
to other sites with different hardware and character sets?

<Don't allow anyone to get access to the system without their handy-dandy
<vest pocket gadget. 

How much more does this cost than a simple lock? How about the extra
inconvenience of having to carry a passcard and a key?

<Don't put anything over any line or cable in clear text.

How much does it cost? What do you do for dialin lines?

<Don't let anybody, ever, get into the system with "privileged" access.

So how do you do maintenance things that require privileges, like
reading all the files to back them up to tape? Privileged programs? So
who gets the privs needed to create those? The vendor supplies them
all (snicker)?

<Then, do as Woz suggests, and pay the
<brightest and best to find holes in the defenses.  And pay rewards
<for being a hacker and learning the next generation of techniques to
<cause problems.  ----  Then DO SOMETHING about the problems, don't let
<another 12 years or so go by with heads buryed.

All of which costs money. This cost gets passed back to your
customers. Pretty soon, most of your customers have gone to a less
secure and less costly system.

You forgot some important things, though. Make sure that *no* lines
carrying data go outside the machine/terminal rooms. Make sure both
rooms are EMF tight, including filtering on the power line. Of course,
that all costs mone too.

Face it: what people are willing to spend on security is less than the
percieved costs of having a system broken into. For most people,
that's significantly less than what real security costs, so they
settle for a placebo.

	"The only secure computer is one that's turned off."
	<mike
--
How many times do you have to fall			Mike Meyer
While people stand there gawking?			mwm@berkeley.edu
How many times do you have to fall			ucbvax!mwm
Before you end up walking?				mwm@ucbjade.BITNET

In article <532@houxa.UUCP> mel1@houxa.UUCP (M.HAAS) writes:
>I think the damage is being done by the people who bury their heads
>in the sand and foist these security horrors onto the public, not
>the college kid hackers.
>
And, in the same vein:

- Don't blame the burglar, blame the guy with inadequate alarms.
- Don't blame the murderer, blame the guy who goes out without
  suitable body armor.
- Don't blame the rapist, blame the woman who's "asking for it"...

>Make it so that nothing gets onto any storage hardware in clear text.
>Don't allow anyone to get access to the system without their handy-dandy
>vest pocket gadget.  Don't put anything over any line or cable in
>clear text.  Don't let anybody, ever, get into the system with
>"privileged" access.

Don't walk down the street at night.
Don't answer your door.
Don't answer your phone.
Lock up your daughters...

>----  Then, do as Woz suggests, and pay the
>brightest and best to find holes in the defenses.  And pay rewards
>for being a hacker and learning the next generation of techniques to
>cause problems.  ----  Then DO SOMETHING about the problems, don't let
>another 12 years or so go by with heads buryed.

Why do people seem to think that the advent of computers has liberated
them from moral education?  Electronic crime is still crime.  Would you
papplaud your local police picking up street gang members, and, instead of
punishing them, paying them to teach how to perform assaults?  I agree
that it is important to beef up security... but this "aren't hackers 
cute?" mentality is the MAJOR threat.  Someone who destroys a financial
record should be jailed for robbery.  It's THAT simple.  I don't care
if your tool is a jimmy or a keyboard.  Scum is scum, no matter how
high-tech the pond it's floating atop.
-- 
 ///==\\   (No disclaimer - nobody's listening anyway.)
///        Roger B.A. Klorese, CELERITY (Northeast Area)
\\\        40 Speen St., Framingham, MA 01701  +1 617 872-1552
 \\\==//   celtics!roger@seismo.CSS.GOV - seismo!celtics!roger

In article <345@genesis.UUCP>, andys@genesis.UUCP (a.b.sherman) writes:
> 
> Screw Wozniak and send the bastards to jail.

That's too lenient.  Instead, we'll make them all SYSTEM ADMINISTRATORS!


	"Hey, Rocky!  Watch me pull a UNIX program out of my
	   source directory!"
	"AGAIN?"
	"Nothin' up my sleeve ... PRESTO!"

		IDENTIFICATION DIVISION.
		PROGRAM-ID.  PROCESS-DATA.
		AUTHOR-NAME.  B. J. MOOSE, FROSTBYTE DATA SYS.
		SOURCE-COMPUTER.  IBM-7044.
		OBJECT-COMPUTER.  IBM-7044.
		. . .

	"No doubt about it--I gotta get a new source directory!"
-- 
Col. G. L. Sicherman
...!ihnp4!odyssey!gls

In article <2757@mtgzz.UUCP> gcm@mtgzz.UUCP (g.c.mccoury) writes:
< 
<   Wonder why we have so many security problems at our comp centers -
< read on.

You have so many security problems because you have idiots running
your comp centers.
-- 
Tim Smith, Knowledgian		{sdcrdcf,seismo}!ism780c!tim

In article <1594@celtics.UUCP> roger@celtics.UUCP (Roger B.A. Klorese) writes:
>  Would you
>papplaud your local police picking up street gang members, and, instead of
>punishing them, paying them to teach how to perform assaults?  

Often the "punishment" for some crimes is community service.  These
gang menbers might be good candidates for teaching self-defense at the
Y.

								I agree
>that it is important to beef up security... but this "aren't hackers 
>cute?" mentality is the MAJOR threat.  Someone who destroys a financial
>record should be jailed for robbery.  It's THAT simple.  I don't care
>if your tool is a jimmy or a keyboard.  Scum is scum, no matter how
>high-tech the pond it's floating atop.

I don't think anyone who destroys financial records will be awarded
one of Woz's scholarship.  The candidates will more likely be the ones
who bring an administrator over to their terminal and say, "All I have
to do is type '...' and your financial records would be ruined;
however, if you had done X I wouldn't be able to do it."

What this discussion needs is another good analogy.  Many techniques
can be used for good and evil.  Locksmithing is an important
profession; isn't Woz's scholarship similar to a locksmith school
giving scholarships to people who have demonstrated talent in picking
locks?  I'm sure most locksmiths and many stage magicians started out
by picking locks.

Yes, there are problems if people with these talents have moral
problems.  I think it was once said that we were lucky that Houdini
never turned to crime, because no handcuffs or prison could hold him.
But if you were looking for someone to put on a show, there was none
finer.

Another analogy: the technology that is used to build nuclear reactors
is the same as that for atomic bombs.  Should the study of nuclear
physics be disallowed because it might be used to destroy the world?

In article <1594@celtics.UUCP>, roger@celtics.UUCP (Roger B.A. Klorese) writes:
>.. but this "aren't hackers 
> cute?" mentality is the MAJOR threat.  Someone who destroys a financial
> record should be jailed for robbery.

But by definition these people aren't hackers, they are just scum.
The true definition of a hacker is one who explores and *FIXES* problems.

... This signature was put in in a way to bypass the 
... bogus artificial line limit on the .signature file.
... Also, by its length it adds fodder to help avoid having
... my followups being bounced due to the restriction on
... followup articles.

Kenneth Ng: Post office: NJIT - CCCC, Newark New Jersey  07102
uucp !ihnp4!allegra!bellcore!argus!ken *** NOT ken@bellcore.uucp ***
bitnet(prefered) ken@orion.bitnet

That was worth about 2 cents (or less).

In article <915@argus.UUCP>, ken@argus.UUCP (Kenneth Ng) writes:
> But by definition these people aren't hackers, they are just scum.

Which definition of "scum" are you talking about?

In article <6674@ism780c.UUCP>, tim@ism780c.UUCP writes:
> In article <2757@mtgzz.UUCP> gcm@mtgzz.UUCP (g.c.mccoury) writes:
> < 
> <   Wonder why we have so many security problems at our comp centers -
> < read on.
> 
> You have so many security problems because you have idiots running
> your comp centers.
> -- 
> Tim Smith, Knowledgian		{sdcrdcf,seismo}!ism780c!tim

	I was speaking about comp centers in general - I should have 
made that clear in the initial article(Hacker Scholarship) I posted. 
By the way, on what information do you base your accusations about
the lack of competence of our comp centers employees?? 

/***************************************************************************
*									   *
*      e N			Grover McCoury				   *
*    B     o			ATT Laboratories(?) [was ISL]		   *
*   y       r m a l  ??		...!ihnp4!mtgzz!gcm			   *
*   h									   *
*     W				I refuse to have a battle of wits	   *
*				  with an unarmed person...		   *
*									   *
****************************************************************************/

Well, from personal experience, I learned a lot by screwing around. Sometimes
on my system, sometimes on other people system (the security holes were truck
sized). Damage anything? Never. Steal unused cycles? A few.

Belive me, if the people are not ?ssholes, then it does work.
-- 
: Michael Gersten		seismo!scgvaxd!stb!michael
: Monsters from outta space -- 3-11-2

In article <532@houxa.UUCP>, mel1@houxa.UUCP (M.HAAS) writes:
> I agree with much of what Andy says, but feel that his anger should
> mostly be directed to the people who consciously allow the hackers
> to do so much damage.  Woz's work was done several generations of
> system software and hardware ago.  The holes were well know then
> and still allowed to exist.  They exist now and are still allowed
> to exist.  Why?  Who makes these decisions?  Why?

The "holes" still exist because the solutions to them usually cause more
problems than the holes themselves do. These solutions all serve to further
distance the user from the computer, and make the computer less of a
useful tool. If Wozniak was really thinking about the situation rather
than mouthing sixties platitudes, then he would realise that if people
took him seriously the situation would worsen.

The United States is a society based on free (that is, unregulated) transfer
of goods and services. Anything that serves to interrupt that hurts the
country. And... you can find and fix loopholes without becoming a cracker.
While I was at Berkeley I discovered a couple of holes in the EECS machine.
Both were minor and temporary, but rather than screwing things up and
encouraging paranoid measures, I plugged them and left mail to someone
responsible.

> The DES algorithm is now quite old, but still not used in computer
> hardware.  Why?

The DES algorithm is used in computer hardware where security is important.
The UNIX password encryption technique is a deliberately mutated version
of the DES algorithm... mutated so that DES chips can't be used in an
exhaustive search of likely name spaces.

> Call back and random password techniques are readily available, but aren't
> used.  Why?

Because they're a pain. People do not like to remember random passwords, and
are more likely to write them down somewhere... which would actually reduce
security. Callback is used where necessary, but most of the time users of
a machine need to be able to call from multiple and unpredictable places.
For example... reporters phoning in a story from a hotel room.

> Data communication protocols are well into the standards making procedure,
> but don't include encryption capabilities.  Why?

Because it's neither a necessary nor sufficient technique. It's not necessary
because you can always encrpt your data at a higher level, and it's not
sufficient because all systems still have to have the keys. If security is
broken at one site and the key is discovered you will now be completely
open... while still thinking you're secure. On the other hand individual
files and parts of files canm be encrypted using a key that's not even
stored permanently online *anywhere*.

> Our computer systems can be designed to be reliable and fault tolerant, but
> still require "superuser" gurus to administer them.  Why?

Because the set of things that can go wrong is larger than the set of things
that can be predicted to go wrong, and because a human is still cheaper than
a 500 megabyte AI system.

> I think the damage is being done by the people who bury their heads
> in the sand and foist these security horrors onto the public, not
> the college kid hackers.

While you didn't mean that the way I would, I'd have to agree with you. The
damage is being done by the people who want to foist excessive security
measures onto the public.

> Make it so that nothing gets onto any storage hardware in clear text.
> Don't allow anyone to get access to the system without their handy-dandy
> vest pocket gadget.  Don't put anything over any line or cable in
> clear text.  Don't let anybody, ever, get into the system with
> "privileged" access.

There are systems that do this. They tend to be slow, cumbersome to use, and
at Government sites.

> ----  Then, do as Woz suggests, and pay the brightest and best to find holes
> in the defenses.

This is also done. Have you ever heard of the Navy's "Tiger Teams"?

> And pay rewards for being a hacker and learning the next generation of
> techniques to cause problems.

Pay rewards for reporting problems, not for taking advantage of them... and
don't pay so much that you divert too many resources into security. A
computer is primarily a tool, not a place to play "wheel wars".

> ----  Then DO SOMETHING about the problems, don't let another 12 years or
> so go by with heads buryed.

That's "buried". Before you do something about the problem, make sure it's
costing you more than the solution. Shoplifting could be solved by doing strip-
searches of all customers before they leave the store, but it would probably
not turn out to be a wise investment.

>    Mel Haas  ,  odyssey!mel
-- 
-- Peter da Silva `-_-' ...!seismo!soma!uhnix1!sugar!peter (I said, NO PHOTOS!)
-- 
-- Peter da Silva `-_-' ...!seismo!soma!uhnix1!sugar!peter (I said, NO PHOTOS!)

In article <1594@celtics.UUCP>, roger@celtics.UUCP (Roger B.A. Klorese) writes:
> ...
> Why do people seem to think that the advent of computers has liberated
> them from moral education?  Electronic crime is still crime.  Would you
> papplaud your local police picking up street gang members, and, instead of
> punishing them, paying them to teach how to perform assaults?  I agree
> that it is important to beef up security... but this "aren't hackers 
> cute?" mentality is the MAJOR threat.  Someone who destroys a financial
> record should be jailed for robbery.  It's THAT simple.  I don't care
> if your tool is a jimmy or a keyboard.  Scum is scum, no matter how
> high-tech the pond it's floating atop.

I seem to recall that there was an episode of Max Headroom where someone
describes computer/credit fraud as being "worse than murder".

There also was a story written by Isaac Asimov (I think) about someone
in a ultra-computerized society who commited computer fraud.  His punishment
was to be prevented to from using a computer for a year.  He was conditioned
psychologically to vomit every time he ouched a computer device of any type.

I my opinion, a little of all aspects of protection is necessary.  A
combination of stiffer penalties for computer fraud/vandalism/theft, strong
education on the fact that these actions are immoral (or at least illegal --
no flames about "morality" please), and better security procedures.

With regards to maintaining better security procedures, these could include
(but in no means be limited to) the following ideas:

1) Distribution of random letter combination privaledged passwords at random
   intervals through secure communication channels.
2) Forcing users to change their passwords regularly.
3) Callback systems to verify the system is being accessed from a known
   terminal.
4) Implementation of a key card system, in which the user must insert his/her
   card into a slot in the terminal so that it can be read and verified.
   Login name and password would still be required, but this would help
   prevent users from looking over someones shoulder to find out their
   password and get onto the system. (I believe that IBM already implemented
   a system like this as an option on their 3270 series terminals).
5) Use of encryption systems (RSA public key preferably) for communication and
   storage of private data/messages.
6) Keep accurate accounting files tracking all commands/system calls executed.
7) Make sure that all acounts autologout after a relatively short period
   of idle time (perhaps send a warning message after 30 seconds idle time,
   then autologout if still no key hit within 30 seconds).  This would prevent
   the "root forgot to log out and left an open terminal as superuser" problem.


At one system that I know of, new student and faculty user id's are posted in
the computer center.  The initial password is always the person's social 
security number.  There are always those users who never change their 
passwords, leaving a gaping hole in security.  There are others who never 
use their account, leaving it open to anyone who takes the time to figure
out the users social security number (not very difficult at a university
where SS# doubles as school id number).


					Spidey!




-- 
DON'T PANIC!!!                                          /\ Josh /\   At last! a
                                                       //\\ .. //\\  spider that
A message from Spidey, and the Spidey Team.  ----->>>  //\((  ))/\\  looks like
Available via UUCP: ...[seismo,mimsy]!jhu!osiris!jdia  /  < `' >  \  a spider!

In article <1610@stb.UUCP>, michael@stb.UUCP (Michael) writes:
> Well, from personal experience, I learned a lot by screwing around. Sometimes
> on my system, sometimes on other people system (the security holes were truck
> sized). Damage anything? Never. Steal unused cycles? A few.
> 
> Belive me, if the people are not ?ssholes, then it does work.

For example, when Michael was running his BBS on his TRS-80 Model I, we would
spend hours thinking of ways of getting into BASIC, modifying the program, etc.
They ranged from the very basic (password hacking, etc) to the very complex
(replacing SYS files, replacing the RS232 driver, sending a stream of ^S's).
But every time we managed to do something, we told him.  Well, there was that
one time..... :-)

Now it's running on a Model 16.  Streams of ^S's don't do it anymore, but wait
till he gets a load of the new /xenix I installed!  :-) :-) :-)

Enter your name (or handle)? BASIC/CMD
...
Delete this? Y

Ah, those were the days!
-- 
Roger Murray

UUCP: ...!{ihnp4,randvax,sdcrdcf,ucbvax}!ucla-cs!cepu!ucla-an!remsit!rem
ARPA: cepu!ucla-an!remsit!rem@LOCUS.UCLA.EDU

In article <1226@osiris.UUCP>, jdia@osiris.UUCP (Josh Diamond) writes:
> 
> I my opinion, a little of all aspects of protection is necessary.  A
> combination of stiffer penalties for computer fraud/vandalism/theft, strong
> education on the fact that these actions are immoral (or at least illegal --
> no flames about "morality" please), and better security procedures.

     You have to be able to catch them first. Not a simple problem.

> 
> With regards to maintaining better security procedures, these could include
> (but in no means be limited to) the following ideas:
> 
> 1) Distribution of random letter combination privaledged passwords at random
>    intervals through secure communication channels.
> 2) Forcing users to change their passwords regularly.
> 3) Callback systems to verify the system is being accessed from a known
>    terminal.
> 4) Implementation of a key card system, in which the user must insert his/her
>    card into a slot in the terminal so that it can be read and verified.
>    Login name and password would still be required, but this would help
>    prevent users from looking over someones shoulder to find out their
>    password and get onto the system. (I believe that IBM already implemented
>    a system like this as an option on their 3270 series terminals).
> 5) Use of encryption systems (RSA public key preferably) for communication and
>    storage of private data/messages.
> 6) Keep accurate accounting files tracking all commands/system calls executed.
> 7) Make sure that all acounts autologout after a relatively short period
>    of idle time (perhaps send a warning message after 30 seconds idle time,
>    then autologout if still no key hit within 30 seconds).  This would prevent
>    the "root forgot to log out and left an open terminal as superuser" problem.
> 
> 					Spidey!
> 
> 
> 
> 
> -- 
> DON'T PANIC!!!                                          /\ Josh /\   At last! a
>                                                        //\\ .. //\\  spider that
> A message from Spidey, and the Spidey Team.  ----->>>  //\((  ))/\\  looks like
> Available via UUCP: ...[seismo,mimsy]!jhu!osiris!jdia  /  < `' >  \  a spider!


1)  Not really save.  If someone knows what the procedure is then 
    they will be able to use the passwords.

2)  If you force users to  change their passwords regularly then - 1. you'll
    have your users forgetting their passwords regularly, 2. have a less
    friendly system, 3 probably have the user cycle between two different
    passwords.

3)  Is only as safe as the phone lines.  If you have broken Ma'bell, you could
    probably fool this mechanism.

4)  This is only as safe as an extra password.  At some level this will
    get turned into a bit stream.

5) Isn't one of the problems with data encryption for communications, the
   fact that the both systems have to agree on the key?  And hence the key
   must be transmitted.

6) is easy to break, what if someone writes this loop -

	while (1) logged_system_call();

    when the log file is filled (ie. no more disk space) does your system
    come to a grinding halt or do you truncate the log file. Either
    solution is unexpectable.

7) easy to fool, plus makes the system very unfriendly.  You'll find users
   writing little programs like

	while (1) { printf("Hello\n"); sleep(29); }

   Theses are a start though and will help keep the novice from doing damage,
but if someone wants to get onto your system, I'm sure they'll find away
around those security  measures.

-- 
					Eddie Wyatt

e-mail: edw@ius2.cs.cmu.edu

terrorist, cryptography, DES, drugs, cipher, secret, decode, NSA, CIA, NRO.

In article <1226@osiris.UUCP> jdia@osiris.UUCP (Josh Diamond) writes:
>...
>There also was a story written by Isaac Asimov (I think) about someone
>in a ultra-computerized society who commited computer fraud.  His punishment
>was to be prevented to from using a computer for a year.  He was conditioned
>psychologically to vomit every time he ouched a computer device of any type.
>
Several members of my family feel that way. Could they have been
convicted of computer crime?
-- 
	bill davidsen		(wedu@ge-crd.arpa)
  {chinet | philabs | sesimo}!steinmetz!crdos1!davidsen
"Stupidity, like virtue, is its own reward" -me

In article <2780@mtgzz.UUCP> gcm@mtgzz.UUCP (g.c.mccoury) writes:
>>In article <2757@mtgzz.UUCP> gcm@mtgzz.UUCP (g.c.mccoury) writes:
>>   Wonder why we have so many security problems at our comp centers -
>
> I was speaking about comp centers in general - I should have 
> made that clear in the initial article (Hacker Scholarship) I posted.

I work for the Computer Center at the University of Colorado @ Boulder.
I am also an indirect beneficiary of the Wozniak Scholarship.  I receive
one of these `hacker's to delegate some of my workload to and, in return,
the `hacker' has an excellent opportunity to learn.  In retrospect, I was
lucky enough to get the same breaks when I was younger...

The term `hacker', as used here, is a person who is seriously interested
in learning more about computers as opposed to "just knowing enough to
get by".  Perhaps this is what some people are afraid of, I dont know.
Anyways, to be selected, they must have a `decent' GPA and have some
"special quality" (loosely defined by an *equally* special selection
committee).  In answer to your question, our group is looking forward
to their arrival.  I myself, will probably learn a couple things too,
uh, but dont tell anyone that...  :-)
---
Jeff Forys @ UC/Boulder Engineering Research Comp Cntr (303-492-4991)
forys@Boulder.Colorado.EDU  -or-  ..!{hao|nbires}!boulder!forys

In article <2780@mtgzz.UUCP> gcm@mtgzz.UUCP (g.c.mccoury) writes:
< In article <6674@ism780c.UUCP>, tim@ism780c.UUCP writes:
< > In article <2757@mtgzz.UUCP> gcm@mtgzz.UUCP (g.c.mccoury) writes:
< > <   Wonder why we have so many security problems at our comp centers -
< > < read on.
< > You have so many security problems because you have idiots running
< > your comp centers.
< 	I was speaking about comp centers in general - I should have 
< made that clear in the initial article(Hacker Scholarship) I posted. 
< By the way, on what information do you base your accusations about
< the lack of competence of our comp centers employees?? 

It was clear that you were talking about comp centers in general.
My answer was about comp centers in general.  Since you used "we"
to refer to comp centers in general, it seemed appropriate to
use "you" to respond.  I wasn't talking about your specific comp
center.
-- 
Tim Smith, Knowledgian		{sdcrdcf,seismo}!ism780c!tim

	Since Toshiba is one of the largest importers of 256 and 1 Meg DRAM's
maybe we should start trading DRAM futures on the Commodities market. As I see
it, 64k's would be a "Stable product", 256's a "Volitile Market" and 1 Meg's 
as "A Highly Speculative Risk". 

	Just think if you had invested in Toshiba futures 6 months ago!!
	Just think if you had invested in TI Mil Spec Parts!!!!


	Take the pricing control out of the hands of the government, and put
it in the hands of the people that know how to do it!!!!


	Bob Bownes 	Sun Microsystems East Coast Division   
	sun!suneast!ringworld!bbownes	

This is my opinion and mine only. It is not shared by my current or
any former employers. It may however, be shared by my TR-6 or my houseplants.

In article <1226@osiris.UUCP>, jdia@osiris.UUCP (Josh Diamond) writes:
> I my opinion, a little of all aspects of protection is necessary.  A
> combination of stiffer penalties for computer fraud/vandalism/theft...

Yeah, stiffer penalties.  Let's really get 'em.  Let's make it a year
in jail, no time off for good behaviour, if you steal some information from
someone's computer.  Right?

How many of you reading this have a copy of the Unix source under your
bed at home?  A bootleg copy of "ultra rogue"?  Perhaps a compiler you
never really paid for, or your favorite hacks from your previous job?
Some pretty graphics pictures that you aren't sure where they came from?

Oh, I see.  The new penalties will only apply to TEENAGE crackers.
Or those who use the telephone.  But not to professionals like us,
who steal with magtapes and are key employees at major corporations.

The jails are gonna get crowded, but at least we'll have good company...

	"Usenix in '94 -- Sing Sing"

PS: If you didn't get it, the point is that the whole computer culture
is rife with what the main culture would call "theft", but it is the
norm here, and the only major damage seems to be in our brains: schizoid
ideas about intellectual property ownership that aren't fully worked
out.  AT&T is probably BETTER OFF that you have that bootleg Unix
source, since you won't call them to get your problems fixed, you'll
just fix them yourself.  One more Unix wizard in the making.

I advise that we stay clear of laws and lawmakers and work it out ourselves.
The whole thing is a plot by lawyers to cash in on the computer boom.
-- 
{dasys1,ncoast,well,sun,ihnp4}!hoptoad!gnu	     gnu@postgres.berkeley.edu
Alt.all: the alternative radio of the Usenet.

>PS: If you didn't get it, the point is that the whole computer culture
>is rife with what the main culture would call "theft", but it is the
>norm here, and the only major damage seems to be in our brains: schizoid
>ideas about intellectual property ownership that aren't fully worked
>out.  AT&T is probably BETTER OFF that you have that bootleg Unix
>source, since you won't call them to get your problems fixed, you'll
>just fix them yourself.  One more Unix wizard in the making.
>
>I advise that we stay clear of laws and lawmakers and work it out ourselves.
>The whole thing is a plot by lawyers to cash in on the computer boom.
>-- 
>{dasys1,ncoast,well,sun,ihnp4}!hoptoad!gnu	     gnu@postgres.berkeley.edu
>Alt.all: the alternative radio of the Usenet.

     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
     This person has great wisdom!