207 lines
9.0 KiB
Plaintext
207 lines
9.0 KiB
Plaintext
|
THIS IS A COMBINATION OF FILES UPLOADED TO PDSE BY DAVID GEERINCK OF
|
|||
|
|
HACKETTSTOWN, NJ, ON 10/17/85
|
|||
|
|
********************************************************************
|
|||
|
|
|
|||
|
|
Msg # 583 Dated 09-13-84 06:27:16
|
|||
|
|
From: DON BEILFUSS
|
|||
|
|
To: CONFIDENTIAL
|
|||
|
|
Re: BOARD CRASHING
|
|||
|
|
|
|||
|
|
Bob, and others: First of all, thanks Bob for helping the other
|
|||
|
|
evening with my board crashing problem. I have spent considerable time
|
|||
|
|
on the data and this is what I have concluded.
|
|||
|
|
|
|||
|
|
1. Someone using the name, Walter Koenig, uploaded a file called
|
|||
|
|
STARS3.EXE to my board. (the Trojan Horse, if you will)
|
|||
|
|
2. Within the next day, I had executed the program to see what it was.
|
|||
|
|
3. It creates a starfield background that could be used as part of a
|
|||
|
|
game, like STARTREK.
|
|||
|
|
4. One of the program's actions is to copy RBBS-PC.DEF to RBBS-PC.
|
|||
|
|
5. 24 hours after uploading, Walter logged on again and downloaded
|
|||
|
|
RBBS-PC (I didn't even know it was there)
|
|||
|
|
6. Within 4 minutes, a call came in with the user identifying himself
|
|||
|
|
as a Remote Sysop.
|
|||
|
|
7. During this call, he used Sysop #8 to give a user sysop level access.
|
|||
|
|
8. Naturally, after he escaped into DOS, he listed my password file,
|
|||
|
|
deleted the RBBS-PC file, and did what ever else someone like this
|
|||
|
|
does for cheap thrills.
|
|||
|
|
See next message...
|
|||
|
|
|
|||
|
|
|
|||
|
|
Msg # 584 Dated 09-13-84 06:35:22
|
|||
|
|
From: DON BEILFUSS
|
|||
|
|
To: CONFIDENTIAL
|
|||
|
|
Re: BOARD CRASHING CON'T
|
|||
|
|
|
|||
|
|
9. The username that he used for subsequent logons was Moe Greene.
|
|||
|
|
|
|||
|
|
I took the following action. I changed all of the Sysop functions to
|
|||
|
|
require a higher level of access than the Sysop is granted on logon.
|
|||
|
|
This appeared to stifle his access to DOS, but I did a few more things
|
|||
|
|
to help insure the system.
|
|||
|
|
|
|||
|
|
1. I downgraded all special users to normal access levels.
|
|||
|
|
2. I changed all of my passwords on Files and Groups
|
|||
|
|
3. I changed the name of my password files.
|
|||
|
|
4. I patched my RBBS-PC.EXE file to use a different filename for
|
|||
|
|
configuration. Norton works well for this.
|
|||
|
|
5. I put all restricted functions at security levels far beyond
|
|||
|
|
the Sysop Access Level.
|
|||
|
|
6. I altered my directory structure to reflect a more concise restricted
|
|||
|
|
area for the BBS in that particular background partition.
|
|||
|
|
7. I left both usernames on the system with levels below minimum and
|
|||
|
|
a message for both Walter and Moe. See next message.
|
|||
|
|
|
|||
|
|
Msg # 585 Dated 09-13-84 06:43:09
|
|||
|
|
From: DON BEILFUSS
|
|||
|
|
To: CONFIDENTIAL
|
|||
|
|
Re: BOARD CRASHING CON'T
|
|||
|
|
|
|||
|
|
This morning when I checked the system, Moe had been on again and this
|
|||
|
|
time he left a message that RBBS had a large hole in it and he had
|
|||
|
|
"taken my system". During the evening two days ago, I caught him using
|
|||
|
|
the system identified as one of my friends. I knewthis because my
|
|||
|
|
friend was out of town on vacation, but obviously he didn't know that.
|
|||
|
|
We chatted at bit and I definitely proved it was a masquerade through
|
|||
|
|
one or another false statements that my friend would not have been
|
|||
|
|
tripped up on. Also the typing skills and vocabulary were that of some-
|
|||
|
|
one in junior high instead of an adult technical specialist.
|
|||
|
|
|
|||
|
|
One last note, anyone who reads this message and uses the Astrix
|
|||
|
|
Computer System has had their password compromised. If you are in the
|
|||
|
|
habit of using the same password on all of the boards that you frequent,
|
|||
|
|
you may want to start using a different one.
|
|||
|
|
|
|||
|
|
The users of this bulletin board should be aware of a very scary thing
|
|||
|
|
that happened recently on a bulletin board in the Rockville/Gaithersburg
|
|||
|
|
area. Some clown UPLOADed a BASIC program called SECRET.BAS. Then he left
|
|||
|
|
a message to all users claiming he had hacked this program from a mainframe
|
|||
|
|
and he was having a problem getting it to run on his personal computer. He
|
|||
|
|
asked anyone who could get the thing to run to leave him a message telling
|
|||
|
|
him about it. (Which of us could resist such a plea?)
|
|||
|
|
As it turned out the program ran fine and this #$%&^* knew it! What the
|
|||
|
|
program did was to erase all the files on the disk(s) on the computer that
|
|||
|
|
ran it!! ALL THE FILES ... ON ALL THE DISKS !!!
|
|||
|
|
After a couple of users lost their disks the word got around and the
|
|||
|
|
"killer" progam was deleted from the bulletin board. But it could happen
|
|||
|
|
again. It could happen here.
|
|||
|
|
Please y'all, be careful. Look over the programs you DOWNLOAD before you
|
|||
|
|
run them (or have good and recent backups).
|
|||
|
|
|
|||
|
|
|
|||
|
|
Bruce N. McCausland
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
The following is from MEMO DANGER in the PCSHARE subconference of
|
|||
|
|
CONTACT (at UC Berkeley):
|
|||
|
|
|
|||
|
|
<<< MEMO DANGER - 104 lines, 1 append(s) >>> from DAY15 on 08/15/85 at 05:40:21
|
|||
|
|
|
|||
|
|
WARNING! DANGEROUS PROGRAMS
|
|||
|
|
|
|||
|
|
I just found the following file on a local bulletin board. It's
|
|||
|
|
difficult to believe that people can be this vicious. Please do
|
|||
|
|
everything you can to spread the word.
|
|||
|
|
|
|||
|
|
Burt Alperson
|
|||
|
|
|
|||
|
|
The file:
|
|||
|
|
|
|||
|
|
|
|||
|
|
====================== BULLETIN #1 =======================
|
|||
|
|
|
|||
|
|
The following 2 Articles I got from 2 magazines (I will give the reference
|
|||
|
|
at the end of the article), and I thought that you might like to see this.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
WARNING!
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
Warning: Someone is trying to destroy your data. Beware of the SUDDEN upsurge
|
|||
|
|
of "Trojan Horse" programs on Bulletin Boards and in the public domain. These
|
|||
|
|
programs purport to be useful utilities, but, in reality, they are designed to
|
|||
|
|
sack your system.
|
|||
|
|
|
|||
|
|
One has shown up as EGABTR, a program that claims to show you how to maximize
|
|||
|
|
the features of IBM'S Enhanced graphics Adapter, and has also been spotted as
|
|||
|
|
a new super-directory program. It actually erases the file allocation tables
|
|||
|
|
on your hard disk. For good measure, it asks you to put a disk in Drive A:,
|
|||
|
|
then another in Drive B:. After it has erased those FATs too, it displays,
|
|||
|
|
|
|||
|
|
" Got You! Arf! Arf! "
|
|||
|
|
|
|||
|
|
Don't run any public-domain program that is not a known quantity. Have someone
|
|||
|
|
you know and trust vouch for it. ALWAYS examine it FIRST with DEBUG, looking
|
|||
|
|
for all the ASCII strings and data. If there is anything even slightly
|
|||
|
|
suspicious about it, do a cursory disassembly. Be wary of disk calls
|
|||
|
|
(INTERRUPT 13H), especially if the program has no business writing to the disk.
|
|||
|
|
Run your system in Floppy only mode with write protect tabs on the disk or junk
|
|||
|
|
disks in the drives.
|
|||
|
|
|
|||
|
|
Speaking of Greeks bearing gifts, Aristotle said that the unexamined life is
|
|||
|
|
not worth living. The unexamined program is not worth running.
|
|||
|
|
|
|||
|
|
- The Editors of PC
|
|||
|
|
July 23, 1985
|
|||
|
|
Volume 4, Number 15
|
|||
|
|
|
|||
|
|
|
|||
|
|
Another bit of information I got from the ARPANET: Be careful what you put into
|
|||
|
|
your machine. There is out there making the rounds of the REMOTE BULLETIN
|
|||
|
|
BOARDS a program called VDIR.COM. It is a little hard to tell what the
|
|||
|
|
program is suppose to do.
|
|||
|
|
|
|||
|
|
What it actually does is TRASH your system. It writes garbage onto ANY disk it
|
|||
|
|
can find, including hard disks, and flashes up various messages telling you
|
|||
|
|
what it is doing. It's a TIME BOMB: once run, you can't be sure what will
|
|||
|
|
happen next because it doesn't always do anything immediately. At a later
|
|||
|
|
time, though, it can CRASH your system. Does this remind you of some of the
|
|||
|
|
imbecilic copy-protection schemes threatened by companies such as Vault and
|
|||
|
|
Defendisk? Anyway, you'd do well to avoid VDIR.COM. I expect there are a
|
|||
|
|
couple of harmless-perhaps even useful-Public Domain programs floating about
|
|||
|
|
with the name VDIR; and, of course, anyone warped enough to Launch this kind
|
|||
|
|
of Trap once, can do it again. Be careful about untested "Free" software.
|
|||
|
|
|
|||
|
|
Computing at Chaos Manor
|
|||
|
|
From the living Room
|
|||
|
|
By Jerry Pournelle
|
|||
|
|
BYTE Magazine, The small systems Journal
|
|||
|
|
|
|||
|
|
|
|||
|
|
###############################################################################
|
|||
|
|
|
|||
|
|
Well there it is, If you happen to see any of these files on this, or any other
|
|||
|
|
RBBS, IBBS, FIDO or any other board, PLEASE leave the SYSOP a message or a
|
|||
|
|
and let him know about the file. I will List 2 other Files that I am aware of
|
|||
|
|
that will also do damage as has been reported in the past:
|
|||
|
|
|
|||
|
|
1. STAR.EXE presents a screen of stars then copies RBBS-PC.DEF
|
|||
|
|
and renames it. The caller then calls back later and d/l the
|
|||
|
|
innocently named file, and he then has the SYSOP'S and all the
|
|||
|
|
Users passwords.
|
|||
|
|
|
|||
|
|
2. SECRET.BAS This file was left on an RBBS with a message saying
|
|||
|
|
that the caller got the file from a mainframe, and could not get
|
|||
|
|
the file to run on his PC, and asked someone to try it out.
|
|||
|
|
When it was executed, it formatted all disks on the system.
|
|||
|
|
|
|||
|
|
We must remember, that there are a Few idiots out there who get great pleasure
|
|||
|
|
from destroying other peoples equipment. Perverted I know, but we, the serious
|
|||
|
|
computer users must take an active part in Fighting against this type of stuff,
|
|||
|
|
to protect what we have. Be sure to spread this bulletin to other Boards
|
|||
|
|
across the country so that as many people as possible will be aware of what is
|
|||
|
|
going on. Thanks alot!
|
|||
|
|
|
|||
|
|
........................ Kerry
|
|||
|
|
The Flint Board
|
|||
|
|
Flint, Mich
|
|||
|
|
(313) 736-8031
|
|||
|
|
|
|||
|
|
+++ CREATED 08/13/85 22:35:52 BY +PW/BURT +++
|
|||
|
|
|
|||
|
|
*** CREATED 08/15/85 05:40:51 BY PCSHARE ***
|
|||
|
|
|