June 1993 - cypherpunks-legacy

RE:CERT
by Robert Luscombe 09 Jun '93

09 Jun '93

Not having heard of CERT before, and living ten minutes away from their offices at SEI, i checked out their anonymous ftp site (cert.org) and found the CERT faq in the pub directory. From the info THEY provide, it seems like a worthwhile organization. BUT, in their info, they deal with security issues, not copyright infringement. I realise that hidden directories in an incoming dir is a security issue, but it seems to be a thinly veiled attack on the distribution of software of illegal or questionable origins. They do publish security advisories; i would be interested in seeing a list of sites served with notices similar to those julf and soda received. Does anyone have more info on CERT? BTW- SEI at CMU is a scary place. The photo lab i worked for as a messenger had clients there, so i was in the building a couple times a day for more than i year. Because of their DOD affiliation, there are regular protests outside the building. On a normal delivery during one of these protests i was surrounded by guards, searched, and asked some WAY paranoid questions even though the regular guards knew who i was. If you ever happen to be walking the halls of SEI and see the nice big prints of guided missiles and other scary stuff, I probably delivered them. --Robert Luscombe ral(a)telerama.pgh.pa.us | 2201 Sarah Street Apt. 3 robert(a)well.sf.ca.us | Pittsburgh, PA 15203 rluscomb(a)nyx.cs.du.edu | 412/488-0941 (Finger for PGP Public Key)

1 0

CERT
by Sandy 09 Jun '93

09 Jun '93

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT Reply to: ssandfort(a)attmail.com . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Punksters, I would guess that the intent of the letter Eric Hughes got from CERT was to intimidate rather than to raise some arguable issue. I hope Eric plans to ask Ms. Katherine T. Fithen, directly, who the tipster was ("I'm sorry, we do not divulge the names of our confidential informants"), why someone at CERT didn't contact Eric first, what specific allegations were made, etc. I would like to see a copy of such an e-mail message and its response, if any. What say, friend, Eric? Intrudingly yours, S a n d y >>>>>> Please send e-mail to: ssandfort(a)attmail.com <<<<<< ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by smb＠research.att.com 09 Jun '93

09 Jun '93

>Any public spooling directory is fair game for their antics. [...] >My guess is that your CERT problems have NOTHING to do with >PGP distribution. There is only one directory on the cypherpunks site that is writable, and that is the incoming directory and it's not readable. It doesn't have to be. Anyone could create ``incoming/.. '', stick some files in it, and tell his/her friends. The new directory would be readable. Again, I'm not speaking hypothetically here. In our case, it was ..^T, and contained pirated PC software. (We decided not to infect those files with viruses... We didn't even replace them with programs that just printed nasty messages.)

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by smb＠research.att.com 09 Jun '93

09 Jun '93

and what do you make of their report on julf's non-existent ftp area? I don't know. The most charitable interpretation is that CERT is being extremely careful about their own behavior, and they're not going around probing for anonymous ftp on various sites without more than an informant's tip that such a service is offered. Again, though, I'm guessing. I do know that they're short on staff. They certainly can't scan the archives, and a report of a non-existent anonymous ftp area may be sufficiently rare they they never thought to check it. steve, you know me well; you know i'm not a raving lunatic or or a conspiracy-freak nut-case. but i believe it is more than a coincidence that soda and penet were suddenly tarred by the same brush. Of course you're not a raving lunatic. Certainly, you rave at times, but I don't think I've ever called you a lunatic... perhaps cert is being used as a weapon, as marc suggested. that is the most benign interpretation i can think of. so i ask you again: don't you think cert might be jeopardizing its effectiveness through these actions? You're right -- the coincidence, if coincidence it is, is quite odd. I'm more disturbed by the question of how CERT got the information; a more common report would be from an administrator who found such unwanted deposits, and who reported to CERT what sites sent them or retrieved them. CERT will certainly hurt itself if it allows itself to be used. But if most such reports are accurate, welcomed by the administrators, and obtained from legitimate sources, they won't have a problem. I'm going to stop speculating, though. I'll send a note to various folks at CERT (though without mentioning either cypherpunks, soda, or anon.penet by name), and ask them what their policy is on such reports, and in general where they come from. --Steve Bellovin

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by smb＠research.att.com 09 Jun '93

09 Jun '93

Here, in its almost full glory, is the letter that CERT sent to the admin at berkeley. I've removed the addressee, since there's no need to involve that person. I have not, however, removed the name of the sender. Don't you just love that phrase "illegal trading of commercial software"? Based on what you sent out, I confess that I see nothing wrong with CERT's note. They're right -- anonymous ftp is abused that way. I've seen it happen on a fair number of sites -- folks upload packages for others to snarf. The pattern of some of the transactions I've seen suggests that folks are chatting anonymously via IRC or some such, and are using third-party machines as anonymous relay points. Other transaction patterns suggest the creation of sub rosa archives by folks who have no legitimate right to use the machine. Files distributed that way (and I'm speaking here of what I've seen personally, not just rumors from CERT or the net) include copyrighted PC software packages. Now -- there's a lot of room for disagreement about whether or not it's proper to charge for software, or whether or not algorithm patents are or should be valid. But I suspect that most people on the list would agree that if someone has written something that they don't want distributed that way -- as evidenced, for example, by a copyright notice -- their wishes should be respected. That's common courtesy, if nothing else. Similarly, if you want to distribute files, use your own machine. Don't abuse someone else's, when you know perfectly well that that's not a proper use of anonymous ftp. Again -- neither CERT nor I am talking about things like RSA software. That's a can of worms I'm not going to open in this forum. And they're probably not even talking about files that legitimate users are making available. They're talking about abuse of other folks' machines, almost always with neither the knowledge nor the consent of the system owner. And the outcome is predictable; I've seen a number of cases where anonymous ftp has been shut down, to the detriment of the entire community. --Steve Bellovin

3 2

Eudora Mail Gateway
by Kent Hastings 09 Jun '93

09 Jun '93

Eudora Mail Gateway#000# Thanks to FutureNerd for the Mail Gateway suggestion (via private e-mail). It is just the thing for which my associate was looking. (Never use a preposition to end a sentence with.) More questions will be asked of FutureNerd re Eudora privately as we try to get it running, but until then, here is a public thanks for your help. Kent - kent_hastings(a)qmail2.aero.org. #000#

1 0

CERT: the letter from CERT to berkeley.edu admin
by Eric Hughes 09 Jun '93

09 Jun '93

Here, in its almost full glory, is the letter that CERT sent to the admin at berkeley. I've removed the addressee, since there's no need to involve that person. I have not, however, removed the name of the sender. Don't you just love that phrase "illegal trading of commercial software"? Eric ----------------------------------------------------------------------------- To: <someone>@ucbvax.Berkeley.EDU Subject: Possible abuse of anonymous FTP area on berkeley.edu host(s) Organization: CERT Coordination Center From: cert(a)cert.org Date: Wed, 02 Jun 93 16:56:55 -0400 Hello <someone>, I am a member of the CERT Coordination Center. CERT provides technical assistance in response to computer security incidents. Would you please forward this report to the appropriate system administrator(s)? We have been passed information that indicates that the anonymous FTP archive on the following host(s) may be in use by intruders for illegal trading of commercial software: >>>>>>> soda.berkeley.edu /pub/cypherpunks We have not confirmed this information, nor have we identified that the anonymous FTP configuration on the above-listed host(s) is open for abuse. While anonymous FTP areas can be put to good use, the intruder community makes use of them to illegally trade commercial software and other information. Intruders often create "hidden" files or directories in order to conceal their activity. On UNIX hosts, directory and file names of a form such as "..." (dot dot dot), ".. " (dot dot space space), or "..^G" (dot dot control-G) may be used. In some cases, intruders have abused anonymous FTP areas to such an extent that file storage has been exhausted and a system crash or denial of service has resulted. We would encourage you to check your anonymous FTP archive for any such "hidden" files or directories by using the "ls -laR" command. We would appreciate feedback on the name of any software packages found at your site and the number of accesses to that software, if that information is available from your logs. Please e-mail a summary of this information to "cert(a)cert.org" before deleting any such files and directories from your archive. For your information, I have appended some suggestions for anonymous FTP configuration. Thanks for checking into this incident, and please don't hesitate to contact us if we can be of any assistance. Katherine T. Fithen Technical Coordinator CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890 Internet e-mail: cert(a)cert.org (monitored during business hours) Telephone: 412-268-7090 (answers 24 hours a day)

4 3

Mail Gateway
by Kent Hastings 09 Jun '93

09 Jun '93

Mail Gateway Is there a secure (and/or cheap) STMP or UUCP e-mail gateway program to rival Microsoft Mail 3.0 with Gateways. I hear MM3 with a gateway runs $4,000. Be nice if it notified recipients when new mail arrives. Kent - kent_hastings(a)qmail2.aero.org

1 0

Re: CERT: the letter from CERT to berkeley.edu admin
by karn＠qualcomm.com 09 Jun '93

09 Jun '93

This seems to imply pretty strongly that the issue is not PGP, it's the possible abuse of the cypherpunks upload area if it is world writeable. Having CERT go specifically after the distribution of PGP would be pretty amusing considering the several PGP keys I have on my keyring from CERT people. Phil

1 0

CERT: the letter from CERT to berkeley.edu admin
by Eric Hughes 09 Jun '93

09 Jun '93

>Any public spooling directory is fair game for their antics. [...] >My guess is that your CERT problems have NOTHING to do with >PGP distribution. There is only one directory on the cypherpunks site that is writable, and that is the incoming directory and it's not readable. I still don't know what the real accusation is. CERT is straight out of a Kafka novel in this regard. Maybe it's PGP, maybe it isn't, but they don't seem to be offering that information. Eric

1 0