The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / n_z / nia052.hac < prev next >

Wrap

Text File | 2003-06-11 | 16.8 KB | 407 lines

ZDDDDDDDDDDDDDDDDDD? IMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM; ZDDDDDDDDDDDDDDDDDD? 3 Founded By: 3 : Network Information Access : 3 Founded By: 3 3 Guardian Of Time 3D: 12SEP90 :D3 Guardian Of Time 3 3 Judge Dredd 3 : Guardian Of Time : 3 Judge Dredd 3 @DDDDDDDDBDDDDDDDDDY : File 52 : @DDDDDDDDDBDDDDDDDDY 3 HMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM< 3 3 IMMMMMMMMMMMMMMMMMMMMMMM; 3 @DDDDDDDDDDDDDDDD6System Security Part 02GDDDDDDDDDDDDDDY : Security For The User : HMMMMMMMMMMMMMMMMMMMMMMM< Introduction: Welcome to Nia's System Security Series Part 02, in this particulare file I will be attempting to describe to you Security as it relates to the user and from the vantage point of the system operator. $_Dialups User Security begins when you FIRST logon to a system. You are asked for your username and a password. Some systems can have more than ONE password. There are actually Seven different types of Logins: 1) LOCAL 2) DIALUP 3) REMOTE 4) NETWORK 5) BATCH 6) DETACHED 7) SUBPROCESS Logins are either INTERACTIVE or NONINTERACTIVE. Interactive logins is a login made in a series of steps in which the user provides information. Noninteractive logins is a login that the system will perform all the functions needed, without any user interaction. Different types of interactive and noninteractive logins follows: LOCAL interactive DIALUP interactive REMOTE interactive NETWORK noninteractive BATCH noninteractive DETAHED depends SUBPROCESS noninteractive Local login is performed by users from a terminal connected directly to the central processor or to a terminal server that communicates directly with the central processor. Dialup Logins are when you log in to a terminal that uses a modem, to make your connection to the system. Remote Logins are when you log in to a node over the network, you request that node by entering the DCL command SET HOST. This login is known as a remote login. The node you reach immediately asks you for a user name and password. Network Logins are performed for you when you access files stored in a directory on another node or when you initiate some other type of network task on a remote node. When you wish to copy files or messages, you would specify the desired node and an optional access control string, where the access control string includes your user name and password for the remote node. An example is below: $DIRECTORY PARIS"CRAND password"::WORK2:[PUBLIC]*.*;* The above example, user CRAND has an account on remote node PARIS and enters the following command to get a directory listing of all the files in the [PUBLIC] directory on disk WORK2: Proxy Logins are very good for security, reason is this, when using Proxy Logins, you never enter a password, the system automatically does this for you. Your password is never echoed back to you, and passwords are never exchanged between systems. And finally proxy logins keep all password files away from where budding young hackers might be looking, like the root or in command files. Batch Logins are quite usefull for doing things on a VMS system. For instance, you could have a program that would activate the payroll program after 7:00pm ( and assumeing that you have modified the payroll program ), you could set the time to whatever you want, OR suppose you have set up a time bomb: SUBMIT/AFTER=19:00 PAYROLL.COM When the time comes to be, your user account is logged and a record is kepted. So if modifying programs make sure that you erase all logs and such. Logging in is an important part of the system, for if you can not log in, then you can not complete jobs, perform tasks, and such other things. All ports and terminals should be monitored frequently and any problems to be noted. Never assume that something is ok, check all problems, questions and refer to the manuals and DEC personal for assistance. $_Passwords There are several types of passwords on a VMS system. Most users need to provide a USER PASSWORD when they log in. Some users also need to provide a system password to gain access to a particular terminal before logging in with their user password. Users on systems w/ high security requirements need to provide PRIMARY PASSWORDS and SECONDARY PASSWORDS. When you assign a password VMS operating system applies a ONE-WAY ENCRYPTION ALGORITHM to all passwords as it stores them. Encryption refers to a method of encoding in an effort to conceal it. ONE-WAY ALGORITHMS DO NOT USE A KEY. Thus, if a user obtains the encryption algorithm and the encoded password, that user COULD DEDUCE the actual password only by trying all possible input values. So in english it IS possible to create the format of password encryption as the VMS system. Remember this, if you use an Enlish Dictionary format to create your password, you will then be able to get the password. It may take some time, but it is possible. Problem is this, most system managers are either trying to get users to use NON-ENGLISH words or use the /GENERATE password format which ill generate your password automatically. System passwords control access to particular terminals and are required at the discretion of the security manager. They are necessary to control access to terminals that might be targets for unauthorized use, such as dialups and public terminal lines. Often when an account is set up your first name is used, and from there it is up to YOU to change your password, unless your password has the privilege of LOCKPWD, which means that you can NOT change your password. Common passwords are as follows: Your name Name of a family member or loved one Name of a pet Favorite Automobile Name of hometown Name of a boat (or YOUR boat) Any name associated with work. Such as company, projects, or groups And any other item that bears a strong personal association to you The above list is the most common that people use. The problem with a person creating a password is that, your mind works in a matter where you think you pulled out a word, that to you, is random, but to somone else, it suits you just perfectly. So when creating accounts, you should use the /GENERATE command, and that would just about eliminate any chance of a password that reminds someone about you. When creating passwords, you must do the following: $SET PASSWORD Old password: New password: Verification: If you do not complete the correct sequence, it will not take, also i fyou are under the amount of minimum length for your password the system will automatically tell you. If you want the system to automatically generate passwords, just do the following: $SET PASSWORD/GENERATE=8 old password: apsjawpha aps-jaw-pha oorsoult oor-soult guamixexab gu-a-mix-ex-ab impsapoc imps-a-poc ukchafgoy uk-chaf-goy Choose a password from this list or press RETURN to get a new list New password: Verification: $ The above, shows only five passwords to choose from, and the system will give you the syllable version of the same word to the right. Most people will take the syllable version, 'cause its easier ( meaning if you picked oor-soult, your password would be OORSOULT not OOR-SOULT ). If your password las the flag PWDLIFETIME=30, your password would then expire in 30 days from the current date issued. You will be notified when your password is due with the following message: WARNING -- Your password expires on Thursday 30-SEP-1990 15:00 If your account is set with the /GENERATE=xx, then you will then be automatically shown your list of five words to pick from. If you do not have the /GENERATE=xx then you will be prompted for your New Password only. Make a note, if you are EVER asked to change your pw, do it. For if you loose access to the system, you must get the system manager to restore your pw privileges to you. You are encouraged to add digits to your passwords, for that will increase the combinations of letters. For example: Six Character password using letters equals out to 300 Million Combinations Six Character password using BOTH Letters/Numbers equals out to 2 Billion! You can have Secondary passwords as well as primary passwords, so if you run into one, it will look like this: NIA .. VMS Version 5.0 Username: Guardian of Time Password: xxxxxxxx Password: xxxxxxxxxx If you wish to add to your account a secondary password, do the following $SET PASSWORD/GENERATE=8/SECONDARY That will generate a password of eight character length, and it will be the secondary password. It is suggested that with System Accounts, or accounts with full privileges that you use a secondary password, and use the /GENERATE=xx Modifier, that way, your password would be next to impossible to hack. Also remember that with two passwords you have about fifteen to thirty seconds to enter the password, if not, the system will automatically log you off. Some Password Tips: Select reasonably long passwords that cannot be easily guessed. Avoid using words in your national language that woule appear in a dictionary. Consider including digits in your passwords. Alternatively, let the system generate passwords for you automatically. Never write down your password. You should have it memorized. Give your password to other users only under special circumstances. Change it immediately after the need for sharing has passed. Do not include your password in any file, including the body of an electronic mail message. Before you log in to a previously turned ON terminal, invoke the secure terminal server feature ( If it is enabled ), with the BREAK key. Unless you share your password, change it every three to six months. DIGITAL worns against sharing passwords ( don't we all? ). If you share your password, change it immediately. Chage your password immediately if you have any reason to suspect it might have been dsicovered. Report such incidents to your security manager. Do NOT use the same password for your accounts on multiple systems. But some dummy always will, and they get what they deserve. $_Account Expiration Times When your acceount is created, the security manager may decide to specify a period of time after which the account will lapse ( for example, if you will only need the account for a specific purpose for a limited time). At universities, studen accounts are typically authorized for a single semester at a time. Expired accounts automatically deny logins. Users receive NO ADVANCE WARNING message prior to the expiration date, so it IS important to know in advance what your account duration will be. The account expiration resides in the UAF record, which can be accessed and displayed only through the use of the VMS authorize Utility by users with the SYSPRV privilege or equivalent -- normally your system or security manager. When your account expires, you receive an authorization failure message at your next attempted login. If you need an extension, follow the procedures defined at your site. $_Break In Detection VMS is niffty to this regard, the system will automatically ( if enabled ), after x Number of Hack Attempts disable that account for a period of time. So even IF you got the password, after x number of attempts, the system will continue to log you off. Otherwise the format could look something like this: Username:NIA password:files User Authorization Failure Username:NIA password:text User Authorization Failure Username:NIA password:magazine User Authorization Failure Username:NIA password:textfile <- Correct Pw, but since it detected 3 Hack Attempts User Authorization Failure <- The system will NOT let you on. Username: The time before you could actually log back on, is determined by the security manager, and it could be one hour, one minue, two days, three weeks, whatever the manager decides. $_Network Considerations For Security When switching nodes you have to have an account (unless its public and open to whoever ) the following example is loging into another node: NODE"username password"::disk:[directory]file.typ The problem with this type of a sequence is that you must type the password on the screen, and if anyone happens to be standing by you, they will see your password and node and what directory. Also watch out for placing your string into a command file or any txt or message, because if it can be read, it will be. A proxy login allow users to access files across a network without specifying user name or password in an access control string. This is what a proxy login would look like: $COPY WALNUT::BIONEWS.MEM BIONEWS.MEM What the above did was contact NODE WALNUT and request BIONEW.MEM and copied it back to the orignal system, notice that NO passwords where exchanged visably, so you wouldn't have to worry about password stealing. Also must note that BOTH nodes MUST have a proxy ACCOUNT, if they don't have one, then your out cold. Also remember that you will need to erase the RECALL command, because if you do not do so, another user would be able to view all of your previous commands. That is ONLY if you are still CONNECTED to the system. Once you log off, the RECALL counter is erased automatically. Remember that RECALL can "recall" up to twenty previous commands. If you want to see all of what the RECALL has in store, just type RECALL/ALL and it will list the last twenty commands and a mischevious person could aquire your passwords that way. $_Logging Out Of A System When you leave your terminal/system unlocked or online, someone else could walk on in and pick up where you left off, also if you have SYSPRV then that person could actually start creating accounts, and you wouldn't know it. So make sure that when you leave your office, LO/FULL and make sure that you note the time/date that you where online, shut your system off and lock the door on the way out (unless you can't). At high-security sites, it is common practice to turn off your video terminal every time you log out because the logout message reveals a currently active user name. When users log off after a remote login, the name of the node they return to after the remote logout is also revealed. When a user has accessed multiple accounts remotely over the network, the final sequence of logout commands reveals all the nodes and the user names that are accessible to the user on each nod, with the exception of the name of the furthest node reached. To those who can recognize the operating system from the prompt or a logout message, this will also reveal the operating system, and thus that person could deduct if he has sufficient programming skills what your system is, and maybe even depending if you where careless with your PW, might even be able to hack back onto the system. When logging out of a Hard Copy terminal, make sure that all printouts are ripped off and shredded, burned, trashed or whatever your current site specifies. Print outs should NEVER be thrown away, since people trash, they can get it easily back out and have a hard copy of what you where doing, what accounts that might have been created and passwords that where set up, YOUR passwords are not displayed when you enter one, but if you where modifying user accounts it is possible to have it on print. On dial ups, it is possible to log out and the phone line NOT disconnected, that is a special flag that must be added to your account, that flag is the PERMANENT/HANGUP. To activate it, you must do the following: $SET TERMINAL/PERMANENT/HANGUP You will have to specify your terminal number or name, or port name, that way the system will know how to react. $_Common Commands: DIRECTORY ( or DIR ) LO/HANGUP MODIFY username/PWDLIFETIME=29-15:00 (29 days, expires at 3:00pm) MODIFY username/GENERATE=8 PERMANENT/HANGUP RECALL/ERASE SET PASSWORD SET PASSWORD/GENERATE=8 SET PASSWORD/SECONDARY/GENERATE=10 Note that the MODIFY command must be used in the UAF file (User Authorization File ). Guardian Of Time Judge Dredd Ignorance, Theres No Excuse. For questions or comments write to: Internet: elisem@nuchat Fidonet: 1:106/69.0 or NIA FeedBack P.O. Box 299 Santa Fe, Tx. 77517-0299 [OTHER WORLD BBS]