Hackers Underworld 2: Forbidden Knowledge/Hackers Underworld 2: Forbidden Knowledge.iso/UNDERGRD/VOL_3/CUD330.TXT

Internet Message Format | 1994-11-01 | 43KB

Received: from UICVM.UIC.EDU by vax2.cstp.umkc.edu; Fri, 16 Aug 91 18:20 CDT
Received: from NIU.BITNET by UICVM.uic.edu (IBM VM SMTP R1.2.2MX) with BSMTP id
 2455; Fri, 16 Aug 91 18:20:04 CDT
Date: Fri, 16 Aug 91 15:49 CDT
From: [e-mail]
Subject: Cu Digest, #3.30
To: [e-mail]
Message-id: <[e-mail]>


Computer Underground Digest--Fri Aug 16, 1991 (Vol #3.30)

       Moderators: Jim Thomas and Gordon Meyer ([e-mail])

CONTENTS, #3.30 (AUGUST 16, 1991)
Subject: File 1--Review: PRACTICAL UNIX SECURITY (Garfinkel and Spafford)
Subject: File 2--Review of "Practical Unix Security" (Garfinkel & Spafford).
Subject: File 3--Cyberspace and the Legal Matrix: Laws or Confusion? (Reprint)
Subject:  File 4--Mystery Lurks In The Death of INSLAW Reporter

           ARCHIVIST: BRENDAN KEHOE
           RESIDENT CONVALESCENT: BOB KUSUMOTO
           ULTRA-SCANMEISTER: BOB KRAUSE

CuD is available via electronic mail at no cost. Printed copies are
available by subscription.  Single copies are available for the costs
of reproduction and mailing.

Issues of CuD can be found in the Usenet alt.society.cu-digest news
group, on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of LAWSIG,
and DL0 and DL12 of TELECOM, on Genie, on the PC-EXEC BBS at (414)
789-4210, and by anonymous ftp from ftp.cs.widener.edu,
chsun1.spc.uchicago.edu, and dagon.acc.stolaf.edu.  To use the U. of
Chicago email server, send mail with the subject "help" (without the
quotes) to [e-mail].

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted as long as the source
is cited.  Some authors do copyright their material, and they should
be contacted for reprint permission.  It is assumed that non-personal
mail to the moderators may be reprinted unless otherwise specified.
Readers are encouraged to submit reasoned articles relating to the
Computer Underground.  Articles are preferred to short responses.
Please avoid quoting previous posts unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
            responsibility for ensuring that articles submitted do not
            violate copyright protections.

----------------------------------------------------------------------

Date: Wed, 14 Aug 1991 11:22:00 CDT
From: "Jim Thomas" <[e-mail]>
Subject: File 1--Review: PRACTICAL UNIX SECURITY (Garfinkel and Spafford)

Review of: _Practical UNIX Security_, by Simson Garfinkel and
Gene Spafford. Sebastopol, (Calif): O'Reilly & Associates, Inc.
481 pp. $29.95 pb.

Because I know virtually nothing about UNIX, I am eminently qualified
to comment on the Garfinkel/Spafford (G&S) volume. If I can understand
and learn from it, anybody can. I have no idea whether UNIX Whizzes
will find the tome worthwhile, but as a UNIX beginner, I judge the
book a first-rate primer for inquisitive, but uninformed, neophytes.

To label the G&S book a "security" manual is misleading. Their
introductory warning to would-be hackers who would interpret the book
as in invitation to break into the authors' systems is perhaps a bit
melodramatic (p. xxvii), but the book is about security as M*A*S*H is
about war. I suspect system administrators, such as the following
reviewer who is plagued by the screw-ups of folks like me who learn by
punching in commands to see what they do--would hope users read _UNIX
Security_  on the chance it would make them (the users, not the
sysads) better citizens and cause them (the sysads, not the users)
less hassle in answering obvious questions.

I'd guess that most users do not learn UNIX by taking classes, but
rather by trial and error, pestering the pros, and maybe even
purchasing a book or two.  Unlike the detailed "how to" books, such as
_UNIX Made Easy_ (an oxymoronic title) that cover a wide range of UNIX
uses and commands from programming to learning the intricacies of vi,
_UNIX Security_ is more basic, focused, and appropriate for the UNIX
newnicks.  Despite the focus on security, the book's emphasis is on
responsible system use by teaching, step-by-step, those aspects of use
at which security requisites arise. Such lessons obviously require an
overview of the basics, which the authors provide.

They begin with an overview of the history of UNIX dating from the
Mid-1960s with Multics to the rewriting and playful renaming of
Multics to UNIX derived from the fact that Multics tried to to
multiple things, and UNIX just one: Run programs (p. 7).  But, the
openness and ease of UNIX also had a major drawback:  The early
versions were not secure. Many of the original problems were the
result of holes in the software itself, but--and the authors stress
this throughout--the most serious security lapses are the result of
human error or indifference.

Cracking into any system in most cases requires access to an account
and then using that account to penetrate deeper by using various
tricks to obtain root privileges.  As a consequence, the first line of
defense, argue the authors, is to assure that unauthorized logins are
prevented. There is little new for sysads in the book's first
substantive chapter, "Users, Groups, and the Superuser." But the new
user will find this explanation, along with the various charts
clarifying what all those symbols mean when we list the /etc/group
file, quite helpful.  Subsequent chapters explaining files, defending
accounts, and securing data provide useful examples that can serve as
exercises for the beginner in ferreting out the complexity of UNIX as
well as for protecting one's own account against intruders. What for
experienced users might seem mundane serves newer users with ways to
develop and test knowledge of *one's own* account. The periodic
distinctions between legitimate curious use and inappropriate abuse
provide guidelines that encourage exploration while reminding the user
of the courtesies owed to the sysads and others.

For those active on the nets, a five chapter section on modems, UUCP,
Networks and Security, Sun's NFS, and other topics condenses much of
Quarterman's $50 _The Matrix_ into a few comprehensible chapters.
Although intended more for those setting up systems than using them,
the discussion illustrates what occurs when we dial into a UNIX system
and summarizes various operations of remote systems, including sending
mail and file transfer. I found that the general discussion helped
clarify the occasional error message and helps to use other systems
more efficiently, ranging from moving around within them to using ftp
and telnet.

Sysads may find little new in the discussion of what to do when a
breakin occurs, but the step-by step procedures might serve as a
mindful checklist. The cardinal rules--"don't panic" and "document"
are sound for all computer users when they suspect intrusion, and
inexperienced users should find the discussion helpful in reviewing
how systems track and identify other users.

Although most users do not encrypt files and know nothing about the
process, the early discussion of the process (pp 29-31) provides an
understandable overview of what encryption is and how it works.  With
increasing emphasis on secure systems, discussions of encryption also
increase, and even for those of us who are functionally illiterate, it
helps to know what salt is and what it does to our password. Chapter
18 is devoted to a more detailed summary of encryption systems,
including ROT13 and crypt.

The chapter on "Computer Security and U.S. Law" is too brief.  G&S
explain the legal options for prosecution and remind readers of the
hazards of criminal prosecution, which include law enforcement
illiteracy, the problems of search warrants, and the dangers of
equipment seized as evidence. Alluding to the experience of Steve
Jackson Games, where la