The Hacker Chronicles - A…the Computer Underground/The Hacker Chronicles - A Tour of the Computer Underground (P-80 Systems).iso/network/nia52

Text File | 1992-09-26 | 17KB | 409 lines

 ZDDDDDDDDDDDDDDDDDD? IMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM; ZDDDDDDDDDDDDDDDDDD?
 3   Founded By:    3 :  Network Information Access   : 3   Founded By:    3
 3 Guardian Of Time 3D:            12SEP90            :D3 Guardian Of Time 3
 3   Judge Dredd    3 :        Guardian Of Time       : 3   Judge Dredd    3
 @DDDDDDDDBDDDDDDDDDY :            File 52            : @DDDDDDDDDBDDDDDDDDY
          3           HMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM<           3
          3                IMMMMMMMMMMMMMMMMMMMMMMM;              3
          @DDDDDDDDDDDDDDDD6System Security Part 02GDDDDDDDDDDDDDDY
                           : Security For The User :
                           HMMMMMMMMMMMMMMMMMMMMMMM<

Introduction:

Welcome to Nia's System Security Series Part 02, in this particulare file I will
be attempting to describe to you Security as it relates to the user and from the
vantage point of the system operator.

$_Dialups

User Security begins when you FIRST logon to a system.  You are asked for
your username and a password. Some systems can have more than ONE password.

There are actually Seven different types of Logins:

1) LOCAL
2) DIALUP
3) REMOTE
4) NETWORK
5) BATCH
6) DETACHED
7) SUBPROCESS

Logins are either INTERACTIVE or NONINTERACTIVE.  Interactive logins is a
login made in a series of steps in which the user provides information.
Noninteractive logins is a login that the system will perform all the
functions needed, without any user interaction.

Different types of interactive and noninteractive logins follows:

LOCAL         interactive
DIALUP        interactive
REMOTE        interactive
NETWORK       noninteractive
BATCH         noninteractive
DETAHED       depends
SUBPROCESS    noninteractive

Local login is performed by users from a terminal connected directly to the
central processor or to a terminal server that communicates directly with the
central processor.

Dialup Logins are when you log in to a terminal that uses a modem, to make
your connection to the system.

Remote Logins are when you log in to a node over the network, you request
that node by entering the DCL command SET HOST.  This login is known as a
remote login. The node you reach immediately asks you for a user name and
password.

Network Logins are performed for you when you access files stored in a
directory on another node or when you initiate some other type of network
task on a remote node.  When you wish to copy files or messages, you would
specify the desired node and an optional access control string, where the
access control string includes your user name and password for the remote
node.  An example is below:

$DIRECTORY PARIS"CRAND password"::WORK2:[PUBLIC]*.*;*

The above example, user CRAND has an account on remote node PARIS and enters
the following command to get a directory listing of all the files in the
[PUBLIC] directory on disk WORK2:

Proxy Logins are very good for security, reason is this, when using Proxy
Logins, you never enter a password, the system automatically does this for
you.  Your password is never echoed back to you, and passwords are never
exchanged between systems.  And finally proxy logins keep all password files
away from where budding young hackers might be looking, like the root or in
command files.

Batch Logins are quite usefull for doing things on a VMS system. For
instance, you could have a program that would activate the payroll program
after 7:00pm ( and assumeing that you have modified the payroll program ),
you could set the time to whatever you want, OR suppose you have set up a
time bomb:

SUBMIT/AFTER=19:00 PAYROLL.COM

When the time comes to be, your user account is logged and a record is
kepted.  So if modifying programs make sure that you erase all logs and
such.

Logging in is an important part of the system, for if you can not log in,
then you can not complete jobs, perform tasks, and such other things.  All
ports and terminals should be monitored frequently and any problems to be
noted.  Never assume that something is ok, check all problems, questions and
refer to the manuals and DEC personal for assistance.

$_Passwords

There are several types of passwords on a VMS system.  Most users need to
provide a USER PASSWORD when they log in.  Some users also need to provide a
system password to gain access to a particular terminal before logging in
with their user password.  Users on systems w/ high security requirements
need to provide PRIMARY PASSWORDS and SECONDARY PASSWORDS.

When you assign a password VMS operating system applies a ONE-WAY ENCRYPTION
ALGORITHM to all passwords as it stores them.  Encryption refers to a method
of encoding in an effort to conceal it.  ONE-WAY ALGORITHMS DO NOT USE A
KEY.  Thus, if a user obtains the encryption algorithm and the encoded
password, that user COULD DEDUCE the actual password only by trying all
possible input values.

So in english it IS possible to create the format of password encryption as the
VMS system.  Remember this, if you use an Enlish Dictionary format to create
your password, you will then be able to get the password.  It may take some
time, but it is possible.  Problem is this, most system managers are either
trying to get users to use NON-ENGLISH words or use the /GENERATE password
format which ill generate your password automatically.

System passwords control access to particular terminals and are required at
the discretion of the security manager.  They are necessary to control
access to terminals that might be targets for unauthorized use, such as
dialups and public terminal lines.

Often when an account is set up your first name is used, and from there it
is up to YOU to change your password, unless your password has the privilege
of LOCKPWD, which means that you can NOT change your password.

Common passwords are as follows:

Your name
Name of a family member or loved one
Name of a pet
Favorite Automobile
Name of hometown
Name of a boat (or YOUR boat)
Any name associated with work.  Such as company, projects, or groups
And any other item that bears a strong personal association to you

The above list is the most common that people use.  The problem with a
person creating a password is that, your mind works in a matter where you
think you pulled out a word, that to you, is random, but to somone else, it
suits you just perfectly.  So when creating accounts, you should use the
/GENERATE command, and that would just about eliminate any chance of a
password that reminds someone about you.

When creating passwords, you must do the following:

$SET PASSWORD
Old password:
New password:
Verification:

If you do not complete the correct sequence, it will not take, also i fyou
are under the amount of minimum length for your password the system will
automatically tell you.

If you want the system to automatically generate passwords, just do the
following:

$SET PASSWORD/GENERATE=8
old password:

apsjawpha     aps-jaw-pha
oorsoult      oor-soult
guamixexab    gu-a-mix-ex-ab
impsapoc      imps-a-poc
ukchafgoy     uk-chaf-goy

Choose a password from this list or press RETURN to get a new list
New password:
Verification:
$

The above, shows only five passwords to choose from, and the system will
give you the syllable version of the same word to the right.  Most people
will take the syllable version, 'cause its easier ( meaning if you picked
oor-soult, your password would be OORSOULT not OOR-SOULT ).

If your password las the flag PWDLIFETIME=30, your password would then
expire in 30 days from the current date issued.  You will be notified when
your password is due with the following message:

WARNING -- Your password expires on Thursday 30-SEP-1990 15:00

If your account is set with the /GENERATE=xx, then you will then be
automatically shown your list of five words to pick from.  If you do not
have the /GENERATE=xx then you will be prompted for your New Password only.

Make a note, if you are EVER asked to change your pw, do it.  For if you
loose access to the system, you must get the system manager to restore your
pw privileges to you.

You are encouraged to add digits to your passwords, for that will increase
the combinations of letters.  For example:

Six Character password using letters equals out to 300 Million Combinations
Six Character password using BOTH Letters/Numbers equals out to 2 Billion!

You can have Secondary passwords as well as primary passwords, so if you run
into one, it will look like this:

NIA .. VMS Version 5.0

Username: Guardian of Time
Password: xxxxxxxx
Password: xxxxxxxxxx

If you wish to add to your account a secondary password, do the following

$SET PASSWORD/GENERATE=8/SECONDARY

That will generate a password of eight character length, and it will be the
secondary password.

It is suggested that with System Accounts, or accounts with full privileges
that you use a secondary password, and use the /GENERATE=xx Modifier, that
way, your password would be next to impossible to hack.

Also remember that with two passwords you have about fifteen to thirty
seconds to enter the password, if not, the system will automatically log you
off.

Some Password Tips:

Select reasonably long passwords that cannot be easily guessed.  Avoid using
words in your national language that woule appear in a dictionary.  Consider
including digits in your passwords.  Alternatively, let the system generate
passwords for you automatically.

Never write down your password.  You should have it memorized.

Give your password to other users only under special circumstances.  Change
it immediately after the need for sharing has passed.

Do not include your password in any file, including the body of an
electronic mail message.

Before you log in to a previously turned ON terminal, invoke the secure
terminal server feature ( If it is enabled ), with the BREAK key.

Unless you share your password, change it every three to six months.
DIGITAL worns against sharing passwords ( don't we all? ).  If you share
your password, change it immediately.

Chage your password immediately if you have any reason to suspect it might
have been dsicovered.  Report such incidents to your security manager.

Do NOT use the same password for your accounts on multiple systems.  But
some dummy always will, and they get what they deserve.

$_Account Expiration Times

When your acceount is created, the security manager may decide to specify a
period of time after which the account will lapse ( for example, if you will
only need the account for a specific purpose for a limited time).  At
universities, studen accounts are typically authorized for a single semester
at a time.  Expired accounts automatically deny logins.

Users receive NO ADVANCE WARNING message prior to the expiration date, so it
IS important to know in advance what your account duration will be.  The
account expiration resides in the UAF record, which can be accessed and
displayed only through the use of the VMS authorize Utility by users with
the SYSPRV privilege or equivalent -- normally your system or security
manager.

When your account expires, you receive an authorization failure message at
your next attempted login.  If you need an extension, follow the procedures
defined at your site.

$_Break In Detection

VMS is niffty to this regard, the system will automatically ( if enabled ),
after x Number of Hack Attempts disable that account for a period of time.
So even IF you got the password, after x number of attempts, the system will
continue to log you off.

Otherwise the format could look something like this:

Username:NIA
password:files
User Authorization Failure
Username:NIA
password:text
User Authorization Failure
Username:NIA
password:magazine
User Authorization Failure
Username:NIA
password:textfile          <- Correct Pw, but since it detected 3 Hack Attempts
User Authorization Failure <- The system will NOT let you on.
Username:

The time before you could actually log back on, is determined by the
security manager, and it could be one hour, one minue, two days, three
weeks, whatever the manager decides.

$_Network Considerations For Security

When switching nodes you have to have an account (unless its public and open
to whoever ) the following example is loging into another node:

NODE"username password"::disk:[directory]file.typ

The problem with this type of a sequence is that you must type the password
on the screen, and if anyone happens to be standing by you, they will see
your password and node and what directory.

Also watch out for placing your string into a command file or any txt or
message, because if it can be read, it will be.

A proxy login allow users to access files across a network without
specifying user name or password in an access control string.  This is what
a proxy login would look like:

$COPY WALNUT::BIONEWS.MEM BIONEWS.MEM

What the above did was contact NODE WALNUT and request BIONEW.MEM and copied
it back to the orignal system, notice that NO passwords where exchanged
visably, so you wouldn't have to worry about password stealing.

Also must note that BOTH nodes MUST have a proxy ACCOUNT, if they don't have
one, then your out cold.

Also remember that you will need to erase the RECALL command, because if you
do not do so, another user would be able to view all of your previous
commands.  That is ONLY if you are still CONNECTED to the system.  Once you
log off, the RECALL counter is erased automatically.  Remember that RECALL
can "recall" up to twenty previous commands.  If you want to see all of what the
RECALL has in store, just type RECALL/ALL and it will list the last twenty
commands and a mischevious person could aquire your passwords that way.

$_Logging Out Of A System

When you leave your terminal/system unlocked or online, someone else could
walk on in and pick up where you left off, also if you have SYSPRV then that
person could actually start creating accounts, and you wouldn't know it.  So
make sure that when you leave your office, LO/FULL and make sure that you
note the time/date that you where online, shut your system off and lock the
door on the way out (unless you can't).

At high-security sites, it is common practice to turn off your video
terminal every time you log out because the logout message reveals a
currently active user name.  When users log off after a remote login, the
name of the node they return to after the remote logout is also revealed.
When a user has accessed multiple accounts remotely over the network, the
final sequence of logout commands reveals all the nodes and the user names
that are accessible to the user on each nod, with the exception of the name
of the furthest node reached.  To those who can recognize the operating
system from the prompt or a logout message, this will also reveal the
operating system, and thus that person could deduct if he has sufficient
programming skills what your system is, and maybe even depending if you
where careless with your PW, might even be able to hack back onto the
system.

When logging out of a Hard Copy terminal, make sure that all printouts are
ripped off and shredded, burned, trashed or whatever your current site
specifies.

Print outs should NEVER be thrown away, since people trash, they can get it
easily back out and have a hard copy of what you where doing, what accounts
that might have been created and passwords that where set up, YOUR passwords
are not displayed when you enter one, but if you where modifying user
accounts it is possible to have it on print.

On dial ups, it is possible to log out and the phone line NOT disconnected,
that is a special flag that must be added to your account, that flag is the
PERMANENT/HANGUP.  To activate it, you must do the following:

$SET TERMINAL/PERMANENT/HANGUP

You will have to specify your terminal number or name, or port name, that
way the system will know how to react.

$_Common Commands:

DIRECTORY ( or DIR )
LO/HANGUP
MODIFY username/PWDLIFETIME=29-15:00 (29 days, expires at 3:00pm)
MODIFY username/GENERATE=8
PERMANENT/HANGUP
RECALL/ERASE
SET PASSWORD
SET PASSWORD/GENERATE=8
SET PASSWORD/SECONDARY/GENERATE=10


Note that the MODIFY command must be used in the UAF file (User
Authorization File ).

                            Guardian Of Time
                              Judge Dredd
                      Ignorance, Theres No Excuse.
                  For questions or comments write to:
                         Internet: elisem@nuchat
                           Fidonet: 1:106/69.0
                                  or
                             NIA FeedBack
                             P.O. Box 299
                       Santa Fe, Tx.  77517-0299

[OTHER WORLD BBS]




Downloaded From P-80 International Information Systems 304-744-2253 12yrs+