The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / a_m / ati35.txt < prev next >

Wrap

Text File | 2003-06-11 | 25.7 KB | 474 lines

Date: Tue, 18 Apr 89 01:47 CDT To: TK0JUT1 From: Gordon Meyer <TK0GRM1> Subject: ATI 35 (yes..I got thru to GZ at last) ***** ********* ******* * * * * * * * * ********* * * * * * * * * * * * * * ******* Issue #35 March 29, 1989 Happy Birthday to The Operator (201) !! ************** ** YIPPIE! **- - - - - - - - - - . ************** / / / / / Activist Times, Inc. ATI is a journalistic, causistic, / /cyberpolitical / /organization, / 4 more info? /trying to / send SASE /help y'all / stamps??? change the world / to: radically, in less / ATI than two minutes / P.O. Box 2501 ...of course! / Bloomfield, NJ - - - - - - - 07003 Note the new address! Of course.. The only difference is that your lovely correspondence will go to yours truly, Ground Zero. Ok, here's some of the correspondence we've gotten lately. Keep the feedback coming. We love to hear from our readers, even if it's criticism. .:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:. From: Anonymous Location: Unknown Finally got all of ATI34... Just a few comments. NJ Bell isn't "favoring" AT&T over the other carriers. It's merely engaging in the common business of selling information on its customers. Name one business that doesn't do this, I'll show you one missing out on a nice source of easy profit. The New Age club: is it any worse than any of the politically correct movements (the New Age movement, that is)? A couple of days ago I went down to the low-rent/low-iq/high-crimerate section of town and started collecting some of the political posters. The following was taken from a flyer advertising a feminist rally to oppose pro-lifers: The Link Between Forced Reproduction and Forced Sterilization! Speaker: Elizabeth Thacker from the Revolutionary Communist Youth Brigade I won't bother with the rest; it was a paranoid ramble about how white males were opposing abortion to force women into being sterilized as the only means of birth control. I could give more examples, like a press statement from the NAACP regarding a recent civil rights decion by the federal government The New Age movement is no worse than any other mass movement; in fact, by your standards they should be the best. Don't they show concern for the environment, the arms race, and poverty, and believe in Universal Love and all the other things your average 60's-leftover leftist advocates but has enough sense not to follow. Regarding the Tau Kappa Et advocates but has enough sense not to follow. Regarding the Tau Kappa Epsilon poster: was it any more frightening than the self-righteous censorship practiced by yourself and the other campus feminists? Question yourself as well as others -:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:- GZ's reply: I do question myself,quite often, in fact. You brought up a good point about NJ Bell, which I can agree with. However, your refernce to the "low rent/low-iq" part of town shows an obvious bias against the poor. And I am all too familiar with the Revolutionary Communist Youth Brigade, which often takes extreme stances on issues, but I must say that there truly have been many instances in which the poor have undergone forced steriliz- ation. And you cannot deny the fact that regular means of birth control are not readily accessible by poor women. If these methods were available to poor women in the first place, there would be little need for abortions or ster- ilization. And as far as censorship of the TKE posters, I believe that I have the right to remove materials that are both extremely offensive and, more importantly, dangerous to women. -:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:-:- From: The Worm Location: 203 I enjoy reading ATI very much. Are you the originator of this magazine? :.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.:.: GZ's reply: No, Prime Anarchist (203) was the originator of ATI last summer. When he went into the Army last November, I took over the writing and distribution, along with Fah-Q and The Operator (201) and our staff, consisting of Cygnus (203) and The Happy Hacker (412), and other occasion- al contributors. Thanks for your continued support! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ok, now for something that I think you'll enjoy. We don't have the Doc Telecom/Raider article ready yet, so we will grace you with an article on UNIX which we hope you'll find very informative. Don't flinch, just read it. Maybe you'll learn something.. ?"Striving for Unix Security" ? ? Typed in by Nightcrawler for Activist Times, Inc. ? ? Originally presented in Computerworld -- March 20, 1989 ? Last November's well-publicized worm attack struck more than Internet's Unix-based electronic mail system. The operating system and AT & T, its major developer, are also suffering from the impact. Other potential victims may be corporations and governments that have accepted Unix for its functionality and portability. Unix has a reputation for being insecure. But is it inherently insecure? The question has enormous economic, political and techonological sensitivity but it and others must be answered. The facts are that Unix's security depends on the version of the operating system being used, what the systems administrator has established as controls and what pressures for security improvements develop from the government corporations and even AT & T. What are the security problems associated with using the Unix operating system? How can IS best safeguard information running on Unix-based systems? What specific approaches to improving the security of Unix systems will be effective? "Unix popularity" Secure or not, there is no doubt that Unix is popular. The results of a recent survey of Unix users indicate that the reasons for Unix's growing popularity among users range from its portability and cost-effectiveness to its proven success in other organizations. Certain companies have little choice in whether to select Unix, because the software programs best suited for their needs are often Unix-based. According to the survey, the biggest barrier to increasing Unix usage is the lack of trained technical expertise, the lack of compatibility and the lack of application software. Framingham, Mass.-based market research firm International Data Corp. has cited the lack of proven commercial and application software performance and the standards confusion as also working against Unix. Interestingly, security was not mentioned once in the survey results, even though the questions were asked in December, during the height of the publi- city surrounding the Internet virus attack. Yet security obviously should be a concern to the more than two-thirds of the respondents who indicated that they were using communications links between Unix and non-Unix systems for file transfer, terminal emulation, Transmission Control Protocol/ Internet Protocol, and E-mail. Unix's popularity is partly because of the variety of Unix-based products out today. But because of the independent development work that has been done on Unix, the user is often faced with the fact that one Unix product is not always the same as another. In reality, there are a number of Unix versions that share only certain features and security vulnerabilities. Unix's ready availability and portability have caused it to be the operating system of choice for both academicians and new companies develo- ping computer systems. Vendors that use it as the operating system for a hardware platform tailor Unix to suit their own needs. Usually this tailoring occurs inside the kernel. "What is Unix, really?" Unix is composed of a set of tools and applications that run on top of a base, or kernel, that handles the low-level functions. The tailoring inside the kernel would not be readily visible to users even though it may be extensive. For example, Unix is notorious for having a file system that is hard to repair and maintain. Thus, some vendors completely rewrite the file system internals in hope of improving their market edge and the stability of their system. While that vendor's system may be better, the result is that Unix often becomes a label on a set of services that appear to be the same to the user but are in fact very different inside. The University of California at Berkeley has become the center for much of the academic development that is now the basis for one of the two major versions of Unix available in the market -- Unix Version 4.2. AT & T's Unix System V, whose latest release -- Version 3.2, available since last fall -- contains major improvements in security. The Berkeley and AT & T versions are similar in some ways, but they are different enough to cause confusion. While many of the basic tool kits are the same, there are enough significant differences to warrant a parti- tioning of the market. Some vendors have chosen System V, and others have chosen 4.2. Not all of the applications running on one system run on the other. The industry has recognized these problems and has, for this and other reasons, tried to organize a "standard" Unix. There are competing organi- zations trying to create the standard Unix, including the Open Software Foundation (OSF), Unix International, Inc., the Institute of Electrical and Electronics Engineers (IEEE) in association with the National Institute of Standards and Technolog (NIST) and X/Open Consortium Ltd. The hope is that standardization will help make the operating system more consistent and thus more secure. As the standardization and security certification efforts heighten, more and more inspection of the development process and the structure of the actual code will be required. So far, the lack of development controls has created a potential for undesirable code to reside within the system and to be difficult to find. But these weaknesses may also portend Unix's greatest strength: The operating system's very openness and the scrutiny devoted to it will make it difficult for the bugs to remain in place forever. Since no single vendor has control over Unix, no single vendor can control or cover up the problems. Over the next few years, most of the unknowns in Unix hopefully will be understood and repaired. "Unix insecurity" The fact remains that Unix does have many sceurity vulnerabilities that are well known to computer and network managers. These weaknesses are also well known to hackers, computer hobbyists and others who may be interested in testing their technological skills. They have easy access to published articles, Unix documentation and bulletin-board information sources on back doors into Unix. The Unix security problem is composed of Unix-specific and non-Unix- specific elements. Unix-specific sceurity risks are those inherent in the architecture of th eoperating system and therefore are not likely to disappear from most existing Unix systems in the near future. Included in this classification are the "superuser" user category, which provides universal access, and the "setuid" and "setgid" system calls. Non-Unix-specific security risks are those associated with the normal usage of computer systems and software. On a Unix system, these can lead to great damage because of how Unix functions. Included in this category are the risks in having software conatin back doors or Trojan horses as well as unsecured physical locations where networks, computer rooms, terminals, tapes and disks can be accessed by unauthorized persons. "Unix-specific issues" The inherent operating qualities of Unix create a vulnerability that opens the doors to some security attacks. For the Unix-proficient, these struc- tures can be summarized in the superuser, setuid and setgid functions. A user who becomes a superuser is able to remove all the security barriers that exist within Unix. Thus, one problem deals with keeping unauthorized users from becoming superusers. This problem is common to a variety of Unix systems and has a rather standard set of administrative solutions. Many of the tools and utilities in Unix need to change modes into superuser for a brief period of time in order to reach some service that the system calls. When properly executed, these place the program executing them into superuser status. In most cases, such programs are well debugged and there is little risk of decreasing the stability of the system. However, teh existence of a mechanism that allows the garnting of unlimited privileges to some programs can be easily exploited. The xeploitation can occur through poor design or through maliciousness. There are many documented cases of poorlydebugged and/or maliciously designed programs being run in this mode and creating inadvertent or intentional damage. In one case, an administrator wrote a program that, among other things, allowed users store information in certain privileged directories. The program used a file, itself in a privileged directory, to control the directories that were to be written into. Unfortunatley, the file contained an entry for its own directory. A user saw this and rewrote the entire file, giving himslef the ability to write into any directory in the system. Were he malicious, he could easily have placed viruses, Trojan horses, back doors, or other programs in any system or user directory. Thus, any program capable of reaching superuser status needs to be care- fully managed and certified. In an environment that is open and free, what often happens instead is that software can be passed from one machine to another without proper certification. In one experiment, a researcher gave one such maliciously designed program to a nonprivileged Unix installation user and observed its migration to the status of a privileged program within a few days. Software travels quickly, and seemingly useful software travels even more quickly. Thus, while the mechanism within Unix can be safeguarded, it is more difficult to ensure that the people around Unix will act with the proper caution. "Non-Unix-specific issues" This scenario leads to the non-Unix-realted aspects of security. There are two popular methods for attacking a computer system -- a Trojan horse and a back door. These two types of attacks are used in many types of systems, not just Unix systems. A Trojan horse is a program that contains code whose instruction is to do some kind of damage. For all practical purposes, the program provides some useful service. However, it also contains logic that will do something other than what the program was intended to do. These Trojan hore programs have caused a variety of damage, ranging from corrupting files to surreptiously sending files across a network to someone who otherwise would not have access to the transferred data. A back door is similar to a Trojan horse except that it is a piece of code that is left behind to be triggered by an outside agent. The person who inserted the back door activates the code. Once activated, it responds to the commands of the intruder. The Internet virus in the Unix E-mail system allegedly came in through such a back door. In Unix, these and similar attacks pose special dangers because, by judicious manipulation, the attacker can become a superuser and gain access to anything in the machine. These unsophisticated computer attacks can be very effective in Unix, more so than in some other systems. "Other openings" In addition to ecternally produced Trojan horses and back doors, two mechanisms within Unix are important to security. When users enter a command in Unix, the system searches for the program named by that command along a search list of names defined by the variable "PATH." If this search list is altered in some fashion, everyday users can be invoking Trojan horse programs that are disguised to look like standard programs. In general, PATH is set up to search through a standard set of drirectories for the program. If PATH is altered to search through a directory that has not been allocated privi- leged status and does not belong to the user typing commands, then any program placed in that directory could be chosen before the standard program. Thus, one alteration to PATH can lead to an endless set of bogus programs. A security audit product currently on the market uses such a technique to determine if the security of the system has been breached. The security audit program masquerades as the common utility "ls." When "ls" is invoked, a security audit is done in addition to the normal work "ls" usually performs. While this use of the mechanism is for security reasons, other uses may not be for that purpose. Ensuring that PATH is not altered can control accidental triggering of malicious programs. The sceond major security concern found within Unix is the connection of the system to the network. Unix systems, by and large, tend to be connected to networks. Hiwever, besides their valuable use as user and data connectors, networks can also be thought of as vehicles for bringing in uncertified software and sending out private data. Unix has many tools that will alow it to become part of the growing commu- nity of newtwork users within the industry. The Unix-to-Unix Copy Program is one such mechanism that allows the system to send and receive mail and script files from users on other systems. In addition, network file systems represent another threat by requiring users to reach across the network for their file systems. This intimate link between users and their file systems can potentially be more easily intercepted than when this communication takes place within a single internal system. The network in effect puts the Unix system out in the open, where it may be more vulnerable to access attempts. Network connectivity also creates a need for adequate physical security. Many precautions must be taken to provide enough security for a Unix system just as for any other system. While Unix's physical sceurity requierments are no different from any other system, the availability of ways to connect to other systems over the network, local or worldwide, makes physical security harder to achieve than with other systems of lesser capability. "Securing Unix" While it may appear that Unix users are without protection, that is not the case at all. While Unix is not as strong as many in information security would like, newer versions of Unix have improved security, and additional tools are available to make Unix more secure. There are also future developments that will increase the ease of security management. Systems using Unix can be better protected. Yet, they are only as secure as their systems administrators allow them to be. The security of any operating system can be attributed directly to how well that system has been administratively reviewed and secured. IS must set up accounts, create passwords, add new software to the systems and give access rights to various pieces of data. The dynamics of admini- stering a system dictate ongoing change in the access and relationship of the various accounts, files and programs. Without careful and deliberate execution, the best automated mechanisms can be subverted. Beyond the system administrators, the vendors of systems with known weaknesses also have responsibilities to pay more attention to system security. They need to provide information and pass on timely patches to their customers when holes are discovered in their systems. They will have to work to increase their systems' security to stem lost sales opportunities as well as to prevent potential lawsuits, which, even if unsuccessful, can become public relations nightmares. While there may not always be enough pressure put on vendors solely by corporations requiring a secure Unix, the federal government has been quite active in seeking ways to induce security within the vendor community. Over the next few years, the government will strengthen the security requirements of all the systems -- Unix or otherwise -- that it procures, and as commercial vendors comply with these regulations, these products will become available to the private sector. Thus, systems purchased in 1992 should, in all likelihood, have significant security improvements over today's systems. In any case, the government-vendor cooperatie relationship can be examined in a number of ways. The current conflict over standards affects Unix security, and that is what links the vendor community with the federal government, which holds a major stake in Unix security. (The government purchased $1.93 billion worth of Unix systems in 1988, with approximately two-thirds of that eramarked for the defense agency.) According to recent published reports, US Department of Defense officials are so concerned about the security aspects of both AT & T's System V and OSF's Unix offering that they may try to force the two groups together to come up with an acceptable operating system. Recently, in response to the latest outbreak of computer viruses, the Defense Department formed the Computer Emergency Response Team (CERT). CERT is a group of experts who will be available to fly to federal sites around nation to assist in fighting viruses. Last December, /Usr/Group, the Unix trade association, applauded the establishment of CERT and suggested that the computer industry supplement these government efforts by agreeing on standard procedures for dealing with emergencies such as viruses. The user group recommended considering the best way to disseminate information when computer networks are artificially congested through viruses or other exceptional network problems. The government also supports Unix security improvements through its testing procedures. In late 1986, the National Security Agency's National Computer Security Center studied a prototype secure system derived from AT & T's Unix System V, Release 2. The study assigned that system with the B2-level of assurance requirements defined in the Trusted Computer System Evaluation Criteria (TCSEC). The study concluded that is possible to build a B2, B3, or A1 system with an interface very much like that of Unix. However, it also concluded that major problems exist with today's common Unix implementations. Fortunately, vendors have started to respond to the government's security concerns. Several firms have announced secure versions of Unix to help them capture contracts with organizations such as aerospace companies. The Department of Defense issued Directive 5200.28 last year, requiring that by 1992 virtually all multiuser computer systems meet at least the C2 level of the TCSEC. This level provides for need-to-know protection, audit capabi- lity, and user accountability. Certain vendors have announced that they are seeking even higher levels of security. AT & T's next release of Unix is expected to have C2-level security features. In addition, the Department of Commerce's NIST, which develops standards for the civilian agencies of the federal government and interfaces with the private sector, has a Unix security project. Posix is concerned with security standards efforts associated with IEEE P1003.6, which is an inetrface-specific standard. The objectives and scope of this effort are to establish functional interface standards consistent with but not limited by the TCSEC. Elements of Posix wil include basic security mechanisms, discre- tionary access controls, auditability mechanisms and nondiscretionary access controls. Without a doubt, Unix security will improve over time. How it will improve and the costs involved in increased security are less certain. Those decisions await the push of an organized IS community. IS has a major stake in improving Unix security, but only such that the security serves other IS needs. If upgrading Unix security interferes with information flow or complicates network management, it will continue to receive insuffiecient attention. A balance between production and protec- tion will have to be addressed. IS managers have an absolute right to impress upon vendors their interest in security improvements within certain rpoduct lines. IS can also make it quite clear to the Unix standards groups that these organizations must agree on security as a priority area, aside from their other disagreements concerning standards. Finally, IS can advise and work with the government to define the security needs of the private sector. Firms should get into both the definition and decision loops at this time or be prepared to stand around and complain after some very essential decisions have been made. By that time, it may be too late to do very much. The Internet virus attack brought Unix security problems out into the open. Ironically, the attack took place while major efforts were already under way to improve the security of this operating system. Eventually, secure Unix may no longer be a contradiction in terms. ============================================================================ Did you like it? I hope so. Thanks a bunch to Nightcrawler (516) for contributing it! Welp, that's all for ATI35. ATI36 will be out within the next week. We promise. Look forward to a LOT of good stuff. In the meantime, stay cool, and remember....It's better to be pissed off then pissed on! Ciao... !