==Phrack Inc.==

                     Volume Three, Issue 27, File 5 of 12


                                    COSMOS

                   COmputer System for Mainframe OperationS

                                   Part Two

                                by King Arthur


     This article will present solutions to the computer security problems
presented in my previous file.  The following are simple but often neglected
items which if properly treated can immensely increase your company's computer
security.  These points apply not merely in regards to COSMOS, but to all
computers in all companies.


A) Dial-Up Security:

     When securing a computer system, regardless of its type, it's important to
remember this: the only way someone can remotely access your system is if there
is a dial-up line leading to that system.  If your system has a dial-up, make
sure that you have taken every possible precaution to secure that line.  "The
one piece of advice I would give is:  Be careful with dial-up lines," says
Bellcore's Ed Pinnes.

     Dave Imparato, Manager of Database Management at New York Telephone, says,
"We have devices that sit in front of our computers that you have to gain
access to.  In order to even get to COSMOS, there are three or four levels of
security you have to go through, and that's before you even get to the system."

Rules for protection of Dial-Up lines:

1.  Have as few dial-up lines as possible.  Private lines or direct connections
    are often a viable replacement for dial-up lines.

2.  If you must have phone lines going to your computer, use external hardware,
    if possible.  For instance, the Datakit Virtual Circuit Switch (VCS) will
    require a user to specify an "access password" and a system destination to
    specify which system you are calling.  The VCS would then connect you to
    the requested system which would prompt you for a login and password.
    Using hardware similar to this serves a double purpose:

         A) It is harder for someone to get into your computer, due to
            additional passwords;

         B) Employees need only dial a single number to access a number of
            systems.

    Another good type of hardware is a callback modem.  A callback modem will
    prompt users for a login and password.  If these are correct, the modem
    will automatically callback to a predetermined number.  At that point you
    would login to the computer.  The advantage of callback is that unless a
    call is placed from a certain phone, there is no way to connect.
    Unfortunately, this is not always efficient for systems with large numbers
    of users.

    Lastly, and the most effective means of access, is to have a system which
    does not identify itself.  A caller has to enter a secret password, which
    doesn't display on the screen.  If a caller doesn't type the correct
    password, the system will hang up, without ever telling the caller what has
    happened.

3.  If you ever detect "hackers" calling a certain number, it is advisable to
    change that number.  Phone numbers should be unlisted.  According to a
    hacker, he once got the number to an AT&T computer by asking directory
    assistance for the number of AT&T at 976 Main Street.

4.  If dial-up lines aren't used on nights or weekends, they should be
    disabled.  Computer hackers usually conduct their "business" on nights or
    weekends.  The COSMOS system has the ability to restrict access by time of
    day.


B) Password Security:

     Using the analogy between a computer and a file cabinet, you can compare a
password to the lock on your file cabinet.  By having accounts with no
passwords you are, in effect, leaving your file cabinet wide open.  A system's
users will often want passwords that are easy to remember.  This is not an
advisable idea, especially for a database system with many users.  The first
passwords tried by hackers are the obvious.  For instance if MF01 is known to
be the user name for the frame room, a hacker might try MF01, FRAME, MDF, or
MAINFRAME as passwords.  If it's known to a hacker that the supervisor at the
MDF is Peter Pinkerton,  PETE or PINKERTON would not be very good passwords.

Rules for password selection:

1.  Passwords should be chosen by system administrators or the like.  Users
    will often choose passwords which provide no security.  They should not be
    within the reach of everybody in the computer room, but instead should be
    sent via company mail to the proper departments.

2.  Passwords should be changed frequently, but on an irregular basis -- every
    four to seven weeks is advisable.  Department supervisors should be
    notified of password changes via mail, a week in advance.  This would
    ensure that all employees are aware of the change at the proper time.  One
    thing you don't want is mass confusion, where everybody is trying to figure
    out why they can't access their computers.

3.  System administrators' passwords should be changed twice as often because
    they can allow access to all system resources.  If possible, system
    administrator accounts should be restricted from logging in on a dial-up
    line.

4.  A password should NEVER be the same as the account name.  Make sure that
    ALL system defaults are changed.

5.  Your best bet is to make passwords a random series of letters and  numbers.
    For example 3CB06W1, Q9IF0L4, or F4W21D0.  All passwords need not be the
    same length or format.  Imparato says, "We built a program in a PC that
    generates different security passwords for different systems and makes sure
    there's no duplication."

6.  It's important to change passwords whenever an employee leaves the company
    or even changes departments.  Imparato says, "When managers leave our
    organization, we make sure we change those passwords which are necessary to
    operate the system."

7.  The Unix operating system has a built-in "password aging" feature, which
    requires a mandatory change of passwords after a period of time.  If you
    run any Unix-based systems, it's important to activate password aging.

8.  When you feel you have experienced a problem, change ALL passwords,  not
    just those passwords involved with the incident.


C) Site security:

     There have been a number of articles written by hackers and published in
2600 Magazine dealing with garbage picking or what hackers call "trashing".
It's important to keep track of what you throw out.  In many companies,
proprietary operations manuals are thrown out.  COSMOS itself is not a
user-friendly system.  In other words, without previous exposure to the system
it would be very difficult to operate.  Bellcore's Beverly Cruse says, "COSMOS
is used in so many places around the country, I wouldn't be surprised if they
found books... in the garbage, especially after divestiture.  One interesting
thing about a COSMOS article written by hackers, is that there was a lot of
obsolete information, so it shows that wherever the information came from... it
was old."

Rules for site security:

1.  Although it may seem evident, employees should be required to show proper
    identification when entering terminal rooms or computer facilities.  It's
    doubtful that a hacker would ever attempt to infiltrate any office, but
    hackers aren't the only people you have to worry about.

2.  Urge employees to memorize login sequences.  It's a bad idea for passwords
    to be scribbled on bits of paper taped to terminals.  Eventually, one of
    those scraps may fall into the wrong hands.

3.  Garbage should be protected as much as possible.  If you use a private
    pick-up, keep garbage in loading docks, basements, or fenced-off areas. If
    you put your garbage out for public sanitation department pick-up, it's a
    good idea to shred sensitive materials.

4.  Before throwing out old manuals or books, see if another department could
    make use of them.  The more employees familiar with the system, the less of
    a chance that there will be a security problem.

5.  Printing terminals should be inspected to make sure that passwords are not
    readable.  If passwords are found to echo, check to see if the duplex is
    correct.  Some operating systems allow you to configure dial-ups for
    printer use.


D) Employee Security:

     When a hacker impersonates an employee, unless he is not successful there
is a great chance the incident will go unreported.  Even if the hacker doesn't
sound like he knows what he's talking about, employees will often excuse the
call as an unintelligent or uninformed person.  It's unpleasant to have to
worry about every call with an unfamiliar voice on the other end of the phone,
but it is necessary.

Rules for employee security:

1.  When making an inter-departmental call, always identify yourself with:
    1) Your name; 2) Your title; and 3) Your department and location.

2.  Be suspicious of callers who sound like children, or those who ask you
    questions that are out of the ordinary.  Whenever someone seems suspicious,
    get their supervisor's name and a callback number.  Don't discuss anything
    sensitive until you can verify their identity.  Don't ever discuss
    passwords over the phone.

3.  When there is a security problem with a system, send notices to all users
    instructing them not to discuss the system over the phone, especially if
    they do not already know the person to whom they are talking.

4.  Remind all dial-up users of systems, before hanging up.

5.  If security-minded posters are put up around the workplace, employees are
    bound to take more care in their work and in conversations on the phone.

6.  If managers distribute this and other computer security articles to
    department supervisors employee security will be increased.


E) General Security:

     Bellcore recently sent a package to all system administrators of COSMOS
systems.  The package detailed security procedures  which applied to COSMOS and
Unix-based systems.  If you are a recipient of this package, you should re-read
it thoroughly to ensure that your systems are secure.  Cruse says, "Last
year... I had a call from someone within an operating company with a COSMOS
security problem.  All we really did was give them documentation which reminded
them of existing security features...  There is built-in security in the COSNIX
operating system...  We really didn't give them anything new at the time.  The
features were already there; we gave them the recommendation that they
implement all of them."

     If you feel you may not be using available security features to the
fullest, contact the vendors of your computer systems and request documentation
on security.  Find out if there are security features that you may not be
currently taking advantage of.  There are also third party software companies
that sell security packages for various operating systems and computers.

     Computer security is a very delicate subject.  Many people try to pretend
that there is no such thing as computer crime.  Since the problem exists, the
best thing to do is to study the problems and figure out the best possible
solutions.  If more people were to write or report about computer security, it
would be easier for everyone else to protect themselves.  I would like to see
Bellcore publish security guidelines, available to the entire
telecommunications industry.  Keep in mind, a chain is only as strong as its
weakest link.
_______________________________________________________________________________