105 lines
4.2 KiB
Plaintext
105 lines
4.2 KiB
Plaintext
|
|
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
- ---------------------------------------------------------------------------
|
|
CA-91:04 CERT Advisory
|
|
April 18, 1991
|
|
Social Engineering
|
|
- ---------------------------------------------------------------------------
|
|
|
|
DESCRIPTION:
|
|
|
|
The Computer Emergency Response Team/Coordination Center (CERT/CC) has
|
|
received several incident reports concerning users receiving requests
|
|
to take an action that results in the capturing of their password. The
|
|
request could come in the form of an e-mail message, a broadcast, or a
|
|
telephone call. The latest ploy instructs the user to run a "test"
|
|
program, previously installed by the intruder, which will prompt the
|
|
user for his or her password. When the user executes the program, the
|
|
user's name and password are e-mailed to a remote site. We are
|
|
including an example message at the end of this advisory.
|
|
|
|
These messages can appear to be from a site administrator or root. In
|
|
reality, they may have been sent by an individual at a remote site, who
|
|
is trying to gain access or additional access to the local machine via
|
|
the user's account.
|
|
|
|
While this advisory may seem very trivial to some experienced users,
|
|
the fact remains that MANY users have fallen for these tricks (refer to
|
|
CERT Advisory CA-91:03).
|
|
|
|
IMPACT:
|
|
|
|
An intruder can gain access to a system through the unauthorized use of
|
|
the (possibly privileged) accounts whose passwords have been
|
|
compromised. This problem could affect all systems, not just UNIX
|
|
systems or systems on the Internet.
|
|
|
|
SOLUTION:
|
|
|
|
The CERT/CC recommends the following actions:
|
|
|
|
1) Any users receiving such a request should verify its authenticity
|
|
with their system administrator before acting on the instructions
|
|
within the message. If a user has received this type of
|
|
request and actually entered a password, he/she should immediately
|
|
change his/her password to a new one and alert the system
|
|
administrator.
|
|
|
|
2) System administrators should check with their user communities
|
|
to ensure that no user has followed the instructions in such
|
|
a message. Further, the system should be carefully examined for
|
|
damage or changes that the intruder may have caused. We also
|
|
ask that you contact the CERT/CC.
|
|
|
|
3) The CERT/CC urges system administrators to educate their users
|
|
so that they will not fall prey to such tricks.
|
|
|
|
- ---------------------------------------------------------------------------
|
|
SAMPLE MESSAGE as received by the CERT (including spelling errors, etc.)
|
|
|
|
OmniCore is experimenting in online - high resolution graphics
|
|
display on the UNIX BSD 4.3 system and it's derivitaves. But, we
|
|
need you're help in testing our new product - TurboTetris.
|
|
So, if you are not to busy, please try out the ttetris game in your
|
|
machine's /tmp directory. just type:
|
|
|
|
/tmp/ttetris
|
|
|
|
Because of the graphics handling and screen-reinitialazation, you will
|
|
be prompted to log on again. Please do so, and use your real password.
|
|
Thanks you for your support. You'll be hearing from us soon!
|
|
|
|
|
|
OmniCore
|
|
|
|
END OF SAMPLE MESSAGE
|
|
- ---------------------------------------------------------------------------
|
|
|
|
If you believe that your system has been compromised, contact CERT/CC via
|
|
telephone or e-mail.
|
|
|
|
Computer Emergency Response Team/Coordination Center (CERT/CC)
|
|
Software Engineering Institute
|
|
Carnegie Mellon University
|
|
Pittsburgh, PA 15213-3890
|
|
|
|
Internet E-mail: cert@cert.org
|
|
Telephone: 412-268-7090 24-hour hotline:
|
|
CERT/CC personnel answer 7:30a.m.-6:00p.m. EST,
|
|
on call for emergencies during other hours.
|
|
|
|
Past advisories and other computer security related information are available
|
|
for anonymous ftp from the cert.org (192.88.209.5) system.
|
|
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: 2.6.2
|
|
|
|
iQCVAwUBMaMwonVP+x0t4w7BAQEI/AQAl7BswkcbCnc2DCnwbIq2ClKqIMjV6Mvf
|
|
eqBWDI3CAhHGSgpAhdJ8IuVbQMbYf1i+8MNVcd7Euw0sUCmF2NYsV2EfbiNDR/BU
|
|
hv8/xJQdhud5em3UK1G3Yia0vntwk3QGYJ2kFT5Aoth4xOQl9N7QgGot3pl704WJ
|
|
3WGz5eI0B/s=
|
|
=n45G
|
|
-----END PGP SIGNATURE-----
|
|
|