CIAC A-12

Published in

· 4 years ago

  

                                DRAFT 
________________________________________________________________________ 
              THE COMPUTER INCIDENT ADVISORY CAPABILITY 

                                 CIAC 

                      INFORMATION    BULLETIN 
________________________________________________________________________ 

DECNET Hacker Attack Alert 

January 18, 1990, 1430 PST                                      Number A-12 

CIAC has recently been advised of a series of hacker attacks on DECnet  
systems.  Hackers are using a variety of techniques to break into systems, 
including entering through system accounts (e.g., SYSTEM) or through  
user accounts in which the account name and password are identical.  Other  
hackers are using more sophisticated techniques. 
  
Once the hackers have broken into a system, they may cause a variety of  
problems.  They may become privileged users, and then leave executable  
images.  CIAC has also been advised that VMSMAIL_PROFILE.DATA may be  
altered to cause mail sent to the system manager and other accounts to  
be intercepted.  (Since mail delivery may be compromised, it may not be  
advisable for VMS system managers to alert users of these threats using  
electronic mail.)  In addition, they may modify RIGHTSLIST.DAT, causing  
problems with Access Control Lists. 

CIAC recommends that DECnet administrators increase monitoring activity. 
It is important to check for default account passwords and user accounts  
in which the user name is the same as the password.  However, the more  
sophisticated penetration methods may be difficult to detect.  At a  
minimum, you may want to ensure that all your privileged accounts are  
authorized. 

If you have questions, please contact CIAC: 

        Eugene Schultz (415) 422-8193 or (FTS) 532-8193  
        FAX:  (415) 423-0913 or (FTS) 543-0913 

CIAC's 24-hour emergency hot-line number is (415) 971-9384 

or send e-mail to:  ciac@tiger.llnl.gov 
  
Neither the United States Government nor the University of California 
nor any of their employees, makes any warranty, expressed or implied, or 
assumes any legal liability or responsibility for the accuracy, 
completeness, or usefulness of any information, product, or process 
disclosed, or represents that its use would not infringe privately 
owned rights.  Reference herein to any specific commercial products, 
process, or service by trade name, trademark manufacturer, or 
otherwise, does not necessarily constitute or imply its endorsement, 
recommendation, or favoring by the United States Government or the 
University of California.  The views and opinions of authors expressed 
herein do not necessarily state or reflect those of the United States 
Government nor the University of California, and shall not be used for 
advertising or product endorsement purposes.