=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=   F.U.C.K. - Fucked Up College Kids - Born Jan. 24th, 1993 - F.U.C.K.   =
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

                           Security is Obscure
                           ~~~~~~~~~~~~~~~~~~~

"Obscure (adj.): [...] 4. Not famous or well-known. 5. Difficult to 
understand." -- _The American Heritage Dictionary_, 2nd ed., 1983.

Okay, so it's an old dictionary. But the meaning of the word "obscure" 
really hasn't changed much in the last decade. 

I wanted to write this file as a word of encouragement to beginning 
hackers who think everything has already been done and security 
everywhere is tighter than the pope's ass (but not the alterboy's, ha 
ha). I intend to illustrate the base ignorance of many system 
administrators who know less about unix than the average hobo does. 

Security is obscure in the sense of the first meaning I quoted; most 
*.edu systems have admins who haven't got the slightest clue as to how
they can secure their system, as well as letting their users (recall that
the weakest link in any "secure" system is usually the people who use it)
choose poor passwords. Thus, if Joe Admin sets up a system and restricts
access to dial-up and computer labs, Joe Hacker will still be able to get
in using Joe User's password ("sex") and a modem. 

One case I wanted to mention specifically in this file happened over the 
course of the past few weeks. I requested and received a copy of an 
unnamed school's passwd file from an unnamed source (you know who you 
are. Thanks again!) after he told me that it was unshadowed and 
world readable. I ran jack on it using a few wordlists before I 
found out that the passwd binary forced users to use non-dictionary 
passwords. Then, because I was bored and needed to brush up on my C 
knowledge (very little, actually), I whipped up a program to output all 
possible 8-character printable password combinations. After some quick 
calculations, I discovered that I would need at least 6,500 9-gig Seagate 
drives and several decades to store all the combinations and use them 
with jack. Discouraged, I dropped the matter for a while.

Then a co-worker asked me to step her through the "reading email" 
process on her account, which happened to be on the system in question. An
account she had never used. One with the default password still in place.

I helped her log in and incidentally discovered that default student 
passwords on this particular system were the first 8 digits of the 
social security number. I also found that the .login script *didn't 
force first-time users to change their password*! I guided her through 
the "changing your password" stage and was astounded to find that this 
poor-security system forced users to use non-dictionary passwords but 
wasn't set up to force an initial password change. 

I let it sit for about a week before I got around to modifying my 
program to output combinations of 8-digit numeric combinations. After 
further trimming it down to output only the combinations beginning with 
521, 522, 523, 524, and 525 (CO-issued SSNs) (the "full" output would 
take about 110 megs), I had a 5-meg wordlist file that has netted me 
over 60 accounts from this system. These accounts were snagged over a 
total period of about 10 hours or so, and I used my very limited SSN 
list. Imagine how many I would have if I used the "full" SSN output and 
gave jack a few weeks.

The second definition of "obscurity" that I quoted does not seem to 
apply at first; most people who work with computers have some 
understanding of security, and admins should be especially aware of 
security issues. Yet I have found and continue to find just the opposite, 
nearly every day. This is why you should use PGP and SSH; why should you 
trust your admin to secure his system? If you have faith in his sysadmin 
skills but I have reason to believe otherwise, then you'll be the one 
who loses when I start hanging out in your home directory.

As an addendum to this file, I'm including "Things overheard while scanning
cell frequencies". I started it as a separate file, but I don't have nearly
enough:

"Oh shit, I just ran a red light."
"People can listen to cellular conversations with one of them hand-held
walkie-talkies."

-Legion

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
= Questions, Comments, Bitches, Ideas, Rants, Death Threats, Submissions  =
= Mail: jericho@dimensional.com                       (Mail is welcomed)  =
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=  To receive new issues through mail, mail jericho@dimensional.com with  =
=   "subscribe fuck". If you do not have FTP access and would like back   =
=    issues, send a list of any missing issues and they will be mailed.   =
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
= Files through AnonFTP FTP.DIMENSIONAL.COM/users/jericho/FUCK            =
=                       FTP.SEKURITY.ORG/pub/zines/fucked.up.college.kids =
=                       FTP.PRISM.NET/pub/users/mercuri/zines/fuck        =
=                       FTP.WINTERNET.COM/users/craigb/fuck               =
=                       FTP.GIGA.OR.AT/pub/hackers/zines/FUCK             =
=                       ETEXT.ARCHIVE.UMICH.EDU/pub/Zines/FUCK            =
= Files through WWW: http://www.dimensional.com/~jericho                  =
=                    http://www.prism.net/zineworld/fuck/                 =
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=       (c) Copyright. All files copyright by the original author.        =
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

