Conference 7.286::digital

    ...and the security fences were turned off and the T-Rex's got out
    and...

    Is it just me, or does it make sense to discuss a customer's security
    measures (or lack there of) in this medium??
    
    Chuck

    I think the base noter may be concerned that if they WERE using
    Digital's security products and the intruders broke in ANYWAY, then we
    had better go back to the drawing board.
    
    It would appear to me, though, that if someone is good enough and they
    want to break into a computer system badly enough, they could do it
    regardless of how many security products are on the system.
    
    The case with the DOD proved that...
    
    

RE: Note 3538.0 by MSDOA::MULDOWNEY

>    I have recently read that some hackers had broken into some GE
>    computers via the INTERNET.  Does anyone know if GE was using any
>    SECURITY products such as the DIGITAL SEAL software?

Why do you want to know?

	- mark

    To find out more about the topic, read:
    
    Firewalls and 
    Internet Security
    
    Repelling the Wily Hacker
    
    
    By:   Cheswick and Bellovin
    
    From: Addison-Wesley Professional Computing Series
    
    I recommend this book for anyone who is planning to hook into the
    internet.  I especially enjoyed the part about the infamous "Berferd"
    hacker, who was eventually traced to Holland.
    
    The authors, Cheswick and Bellovin, are both senior researchers at AT&T
    Bell Laboratories, where thay have designed and maintain AT&T's
    internet gateway.
    
    The book is available through the Digital library network.
    
    Happy reading,
    
    Sean 

    The break at GE has been covered fairly well in the internet mailing
    list 'firewalls'.
    
    From the description of how the break occured, it could not have been a
    SEAL- they use logins on the bastion machine, and we are quite specific
    about not doing that on SEAL.
    
    It also was not a particularly complex break, it was users with dumb
    passwords.

    re.5 read it,twice,loved it and it is required reading for anybody
    re.6-good points.Every system has its leaks.A lot of clients double
    lock the front door and leave the back door open-dumb passwords is the
    most common.I would venture to suggest that if SEAL is properly
    installed and ALL other exits blocked,then it is IMPOSSIBLE to
    compromise a system except by a)tunnelling or b)random discovery of
    the strongest authentication key.You can do nothing about a) since it
    requires an internal security leak-all you can do is log and for b),all
    you can do is log.

	.0 probably has very honourable intentions and maybe
	is concerned for potential problems/opportunities for
	Digital.  I don't see why some of the replies here are
	so disparaging.

	From what I have read, the security systems in use were
	not S.E.A.L. but they are described as "firewall".  They
	were of the type "single bastion host"  which is the
	poor cousin of an effective S.E.A.L. configuration and
	is mentioned in the Digital Firewall Service (aka S.E.A.L.)
	as being not as strong as a S.E.A.L. approach.

	Real damage was done during this break-in, and Digital
	Firewall Service Business Management are informed and have
	sent briefing memos to Digital's security population.

	In short, there is some opportunity here for Digital but
	like the recent Pentium incidents, we should probably be
	circumspect in how we expolit it.

    
    My intentions were not to discuss any customers security measures.  The
    break in has been discussed in various public forums.  However I have
    not seen any mention of the use of any security measures being used by
    the customer.  I am in sales and I know my customers will be asking me.
    I was just trying to be prepared to discuss the issue with my
    customers.
    
    I will use other mediums to find out!
    
    Jim                                                              
    

I'm reminded of a story in Cliff Stowell's book, the title of which I forget,
right now (the Cuckoo's Egg?).

Seems the easiest way to get a password is to ask...

Imagine this scenario...    Find the phone number of the computer control room 
of the system you're targeting.  Turn on your vacuum cleaner to simulate 
"computer room" noise.  Go into the next room so the noise isn't *too* loud and
call the phone number.  If you've done your homework enough, looked in a 
newsgroup or two, called before and ask for "Joe" and found out "Mary" was
actually on duty, etc, you know who to ask for.  Just call on the wrong shift
so Mary's not there, but ask for her anyway:

Hacker: "Hi, is Mary there?"

Dutiful Operator: "No, she works the day shift.  This is Ralph."

H: "Oh, yeah.  Is it that late already?  I've been working here at the 
switching center all day." (vacuum/computer fan whirring in the background)
"We're trying to debug the new modem bank. Can you tell me the Password?"

Dupe: "Sure, it's 'SYSTEM.'"

H: "Thanks, alot, Ralph, old buddy."


Bruce