To : VMSSystem Managers
From : SecurityManager
Subiect : SecurityAgainst Hackers

	Recentiv,we haveseen anumberotoccurrences	Intnuder trled to pass (as aiready happens tor
	of poopie logging in to CERN VAXs viaunautho-	VXCRNA). Closing the EXCITE/lNDEX gap is
	risod accounts and establishir~ new accounts for	equally difficult since it implies ciosing access from
	themselves or aiterina existing accounts for their	a set of X25 addresses, some ot which might be
	own use. L~st year, t-his happened malnly to the	legitimately empioyed by valid CERN users.
	VXGli-T machine and on two occasions, time was	Most of the following points are fully described in
	lost aner malidous darnsge was done.	the VMS V4 System Security manue'
	Sincethe start of February, VXCRNA has been the	~ The most obvious first precaution i ,or all users
	main tanget, but not the only one; VXDEV,	to have effective passwords. Cases where user-
	VXMERL, VXOMEG have been affected also. On	name = password shouid be positively banned. At
	VXCRNA, the effects have been less severe in	first sight, the only risk in having such trivial pass-
	temms of actual damage (although at least one	words wouid be the loss or corruption of that user's
	system crash can be traced to the running of a	files. However, once inside the system, a VMS-
	privileged prograrn by the intruder). However, se-	knowledgeable intruder may well find other inter-
	veral members of the support team have had to	esting possibilities. VMS is not hacker-proof, espe-
	spend a lot of time invest~gating these incidents	cially if some of the following items are not re-
	and re~airing the damage and a few users have	spectsd. A simple DCL command file can be used
	had their accounts made temporarily unavallable	to check tor such useless passwords.
	when tine Intruder(s) changed the password or	However,eventhisn~leisnotsufficient.Usingfirst
	when the support team suspended access to them	names as passwords is almost equally useless; or
	aftertheyhadbeenusedtoentertheVAX.	initials; or IBM login codes. System managers
	We will leave aside for now the question of how	shouid enforce min~mum length passwords, say a
	such hackers" tirst get access to privileged ac-	minimum of 5 characters. In the limit, the use of
	counts in a given machine. Once they get such	passwordexpirytimesmightbenecessary~forcing
	access, these people are very knowledgeable	reqular changes of password. This last ~tem, for-
	about VMS and they can set themselves up many	cing password channes, micht be thought to re-
	otherways into the sYslem. It hastaken much effort	duce the user-friendl~ness of VMS (as do most of
	to resch the stage where we now believe that they	the suggestions in this paper), but it wouid be
	can do no funher harm Inside VXCRNA and even	useful to trace accounts unused for a long time;
	now,we accentthattheremay sffllbeways In which	these are exactlythe accounts that hackers pickon
	they can log [n.	to adapt for their own use.
	Who are these people and how do they access	Where a user has some special privilege (and this
	CERN. Apart from the occasional hacker who may	shouid be kept to a minimum), such reqular chan-
	be a user on some connected system who gets	oes shouid be enforced and perhaps the minimum
	bored late at nicht and tries to see what he can	bength shouid be longer. Apart from the obvious
	reachandwhatfiunhecanhsve~thereseemstobe	privile~es to be careful with (SETPRV, SYS',
	a dub based in Germanv called the "chaos club"	CMK~NL, BYPASS, OPER, etc) are DETACH and
	whose collective hobby ls hacking systems con-	READALL. The-first gives its owner Ihe possibilitY
	nected to Dublic X25 netwo~s. We have identifled	to Issue a RUN/UIC= command where the UlO
	one member of this dub in Dusseldorf and the	couid be a system IDI The second gives write
	'NNorking alias of a second in Berlin. We are cur-	access to all file headers, thus allowing its owner
	rently investigating what steps we can take to	to change a file protection, for example.
	curtall their anti-social activities.	~ Users shouid NOT keep passwords in files on
	This paperlists afew hintson howto makesystems	disc, for example to helpthem log in to another VAX
	a little more secure. It must be emphasised that	across the network. This compromises not onlv the
	AilCERN systems must be protected. The people	account being hacked, but the corresponding -VAX
	doing this hacking are very ingenlous. They know	also.
	all about networks. We have seen evidence that	Some terrninals alIow their owners to store cha-
	theyenterCERNviaonesystemand use DECNET	racterstringsin memoryto beactivated on asingle
	to get to their real target system. Even if all CERN	or multiple keystroke(s). Unless you can be sure
	systems were fully Drotected, it miaht not be	that your terminal is totally secure (either in a
	enoygh. There wouid still remain twolarge gaus	permanenUy locked office or at home and out of
	through which they might pass. One is via tha	reach of ths childrenll), then you shouid not store
	CERN EXCITE networic where they wouid 109 Into	Iwin sequences in the memory of your terminal.
	INDEX and then connect to anY VAX; the second	^ ~rhe BACKUP program stores the command
	isthrouGh asystem outside CEhN, forexample, on	string used to create a backup save set in the save
	INFNET and then into CERN via DECNET.	set itself. If you use DECNET to create a backup
	Stopping the second of these might be possible if	save set and you include the usemarne and pass-
	weencouragethesystemmanagersofallsystems	word in the command string in the form node"u-

	on the networktotake the same steps asdescribed	semame password~::	then the password will ap-

inthisnotewiththethreatthatwewouidbeobliged ~, pear in ciear text in the save set. We have com-
to ciose the link to any system though which an ~ ' plained to the author of BACKUP about this but
~',
g~_

there is little chance of a solution.

^ From time to time, bugs or security gaps are
reported In particular versions ot VKAS. These
shouid be ciosed as soon as a fix is avallable. For
example, under VMS x.x, any user in the system
can xxxxxxxxxxxxxxxxxxxxxxxxx to the system
xxxxxxxxxxxxxxxx(andonother xxxxxxx
xxxxxxxxxx in the system). This is equivalent to the
xxxxxx xxxxxxxxx and can lead to abuse. The
publishad protection against this is to set the fol-

	lowing command	into	the

xxxxxxxxxxxxxxxxxxxxxxxx

$xxxxxxxxxxxxxxxxxxxxx
$xxxxxxxxxxxxxxxxxxxxx

XXXXXXXXXXXXXXXXXXXX
This bug is fixed in VMS x.x.

~ System managers rolght consider restricted ac-
cess to certain privileged accounts during nights
and weekends. This is easy to implement using the
primary/secondary options in the authorisation tile
and a command file nun at regular times. Accounts
such as xxxxxxx and xxxxxxxxxxxx shouid allways
be disabled when not in active use and their pass-
words shouid allways be channed trom the VMS
default. However, dossthe SYStEMaccount need
to be open all weekend when you know it will not
be needed until Monday? PerhaDs such accounts
shouid be disabled for access in IxIE1 WORK mode
or from DIALUP lines. And so on.

A particular case of this is the xxxxx acoount. In
general, xxxxxxxxxxxxxx are not careful with their
passwords, especially on a site with many VAXs.
It is strongly su~gested that xxxxx shouid be ge-
nerally disabled ualess xxxxxxxxxxxxxx have been
called. A trivial command file run by any privileged
user (OPS or SYSTEM) couid be written to enable
it. If you want xxxxx xxxxxxx to be able to look at
your error log without your enabling their acoount
they couid be given a non-privileged account and
access to the enor log via an access control entry.
While xxxxxxxxxxxxx might (will) not like this, it is
standard practice in many Digital offices as well as
at some user sites.

~ Some files shouid be protected by security access
control entrlies such that cerlain types of access to
them are logged. Examples wouid be SYSUAF.-
DAT, VMSIMAGES.DAt, the NET*.DAT files in
SYS$SYSTEM, all page, swap and dump files. A11
thes files have no needio have any "world.4 access
not even read. The RIGHTSLISt.DAT file howe-
ver, does need world-read access but couid have
an access control entry for other types o! access.
Flnally, any xxxxxx and xxx xxxxx xxxxx shouid
have no world access since they may xxxxxxx xxxx

xxxxxxxxx.

~ Some images may be lett generally accessible
butinstalledwith accounting selectively enabled so
that their use is recorded Examples here wouid
include INSTALL, NCP, AUTHOP/IZE, ACCOUN-
TING. The alm is not to stop them being used (a
ciever hacker couid eastly get round this) but to be
able to see when they are used and by whom.

ú The varlous VM9 xwxxxxx xxxxxx shouid be
xxxxxxx. These will 1= breakin attemPts, changes
to the authorisation hhe and so on. These can be
linked to CERN-written progrms which will, for
exarnple, kill any unauthorised process which iries

to change the authorisation file, ciose a DECNET
link which is being used to hack the system, send
warning messages to a given account or accounts
when such inc~dents occur; and so on. These
programs are available from xxxxxxxxxxx

	If you have xxxxxxxxxxxxxxx your system couid
be usedas a''portof entry..forthese hackers.There
exists a standard xxxxxx utility called xxxxxxxxxxxx
which will allow the system managerto set up a list
of DTE (X25 addresses) to or from which calls are
allowed or excluded; a list of users who are allowed
to use X25 to gain access to or from a remote
system; and a list of "objects'' (programs) which are
accessible via X25 for remote users. Although this
might seem a little heavy - and the documentation
maY nesd to be read several times before it is
understood - X25 system managers are strongly
encouraged to oonsult the xxx documentation for
more details on xxxxxxxxxxxx.

~ Other network products, e.g. J-NET, may have
their own security gaps. We have done some
simple tests on TCP/IP and EAN and found the
following.

I n TCP/IP, the system mana er can declare server
processes. It seams that T2P/IP starts such pro-
cesses with whatever privilege it itself is installed
with. Since this usually inclndes CMKRNL, your
system is thus vuinerable to simple coding errors
by the author of the server, without even consi-
dering the dangers of hackers! We are investiga-
ting this.

EAN has an even bigger loophole. When users
register with EAN they are asked for an EAN
password. This is then stored in a file on the users
account with a standard name - in ciear text.
Further, this file is created by EAN with world read
privilege! Although users arc requested to choose
a different password to their VMS passwords. ma-
ny use the same password. We are investigating
making this file less accessible. System managers
with EAN installed are invited to contact me for the
name of this tile.

~ 11 you suspect that your system has been hacked,
isolate the account used as soon as possible.
Making it xxxxxxx is not enough since batch and
network jobs can still Dass~ Use the xxxxxxxxx
quallfler in AUTHORIZL. Also, check that the hac-
ker has not altered other records if you suspect he
had privilege. xxxxxxxxxxxxx has a trivial com-
mand file to check for this. Finally, check that
strange files were not created in the "attacked''
account. ~
(Speclel Thanx to A.S.) 6: ~,

Vic. & Obi ~ ~ ~ r

Kinder an die hacht

"The reech 3f children~ steht (r
"Gefahrenzrne" bei Syste,,-Mansgern,
die Hacken als antisoziale ratigkeit
schildern. Das widerlegt ~hilfe

Hacker" in dieser Ausgabe. "2 bie 3X
Dffener . Kommunikat~on, frei und
unzensiert auf a]len hodien" fordert
HultihEdiaGruppE ninusDeltaT. Diesen
Anteil haben Hacker au' den
Rechner~ysten,en - auch auf VAXer -

	noch langst nicht erreicht.	Hau

