Subject: Re: Isn't it a security hole...

From: Karl Ferguson <[email-masked]>
Date: Thu, 15 Aug 1996 01:23:34 +0800

At 05:01 PM 8/14/96 +0200, you wrote:
>
>...the attribute readable for others in case of the file /etc/passwd?
>
>Recently my debian system was cracked by several pirates. They have 
>account name and the password widely broadcasted on an IRC channel. The 
>only way, as I guess, they grabed root's privilages was free access to 
>/etc/passwd.
>Is there a free and debianized shadow-password package?

Make sure you take good steps to ensure your security - for example, when a
user changes passwords on my network it wont let them change it to a
dictionary word,  must have uppercase letters, and at least 1 numeral in it.
(that's the way I installed Debian 1.1 anyway - by default it does this I
think as long as you install a dictionary).

There certainly is a debian shadow password package...  Check the
project/experimental directory - be forewarned though, it's exactly that --
experimental :-)  I however have run it fine and it does seem to work
(though I'm not using it now because I reformatted).

...Karl

--
Karl Ferguson, 
Tower Networking Pty Ltd (ACN: 072 322 760)        [email-masked]
t/a STAR Online Services                           [email-masked]
Tel: +61-9-455-3446  Fax: +61-9-455-2776           http://www.star.net.au/

---

From: [email-masked] (Bruce Perens)
Date: Wed, 14 Aug 96 11:21 PDT

Yes, it is in project/experimental on the FTP server. We'll put it in 1.2 .

	Bruce
--
       Clinton isn't perfect, but I like him a lot more than Dole.
            Please register to vote, and vote for Democrats.
Bruce Perens AB6YM          [email-masked]            http://www.hams.com/

---

From: Casper BodenCummins <[email-masked]>
Date: Thu, 15 Aug 1996 10:32:26 +0100

Guy Maor wrote:

>> Truly cracking a passwd file would take more than "a bit of time".  Or
>> Maybe you're an extremely patient person.

It may take a while in general, but poor maintenance and naive password
choice often leads to surprising results - besides, the increase in
low-cost high-power CPUs are narrowing the gap. The following excerpt
from 'How to improve the security of your site by breaking into it' by
Dan Farmer and Wietse Venema illustrates this point:

---begin
quote-----------------------------------------------------------
After receiving mail from a site that had been broken into from one of
our systems, an investigation was started.  In time, we found that the
intruder was working from a list of ".com" (commercial) sites, looking
for hosts with easy-to steal password files.  In this case,
"easy-to-steal" referred to sites with a guessable NIS domainname and an
accessible NIS server.  Not knowing how far the intruder had gotten, it
looked like a good idea to warn the sites that were in fact vulnerable
to password file theft.  Of the 656 hosts in the intruder's hit list, 24
had easy-to-steal password files -- about one in twenty-five hosts!  One
third of these files contained at least one password-less account with
an interactive shell.  With a grand total of 1594 password-file entries,
a ten-minute run of a publically-available password cracker (Crack)
revealed more than 50 passwords, using nothing but a low-end Sun
workstation.  Another 40 passwords were found within the next 20
minutes; and a root password was found in just over an hour. The result
after a few days of cracking: five root passwords found, 19 out of 24
password files (eighty percent) with at least one known password, and
259 of 1594 (one in six) passwords guessed.
---end
quote-------------------------------------------------------------

>Casper Boden-Cummins.

---

From: Casper BodenCummins <[email-masked]>
Date: Thu, 15 Aug 1996 15:52:22 +0100

Quite true, but by all accounts crackers dislike the name. You won't
succeed without a majority adopting the new term, and I'm afraid that
involves the cooperation of the culprits themselves. Otherwise, I'm sure
this long-running debate would have concluded long ago.

I think we should just accept that we're stuck with the double meaning.
As with other ambiguous words, the context usually points to the true
meaning.

Casper Boden-Cummins.

>----------
>From: 	Christopher R. Hertel[SMTP:[email-masked]]
>Sent: 	15 August 1996 15:10
>To: 	[email-masked]
>Cc: 	The recipient's address is unknown.
>Subject: 	Re: Isn't it a security hole...
>
>On Aug 14,  2:35pm, Bruce Perens wrote:
>: Ahem. Let's not use the word "hacker" to mean "computer criminal" on
>: this list. "cracker" is more appropriate.
>>-- End of excerpt from Bruce Perens
>
>Seconded.  The term "hacker" originally referred to one who would
>"hack" at [working] code to make it better, faster, cleaner, more fun,
>etc.  The term has been badly misused in recent years, and for some has
>taken on a new meaning.  Given the true meaning of the term, most of
>the people on this list could be called "hacker".
>
>Chris -)-----
>
>-- 
>Christopher R. Hertel -)-----                   University of Minnesota
>[email-masked]              Networking and Telecommunications Services
>
>

---

From: Casper BodenCummins <[email-masked]>
Date: Fri, 16 Aug 1996 10:15:10 +0100

>> Thus, I propose a new word be adopted to describe the clever
>> and benign inventor of quick technical fixes.  Rasher, from
>> "Shockwave Rider" usage, is a possible candidate, except
>> Brunner's rashers seemed to operate too much outside the
>> boundaries of ethics, delving into industrial espionage and
>> even sabotage, as I recall.  Ideas, anyone?
>
Good word, but it tends to make me think of bacon. Just like crackers
suggest cheese. It also suggests poor-quality fixes - rash ones.

I've read a very good argument for 'spider' as a candidate. There are
many parallels to be drawn between the behaviour of spiders and, er,
those other people. However, I go back to my earlier point that you'll
very likely fail to introduce a new word without the cooperation of the
(great many) people you're labelling. You also need a really good word
for it to stick, and I'm afraid hacker is a damned good word.