Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!gatech!akgua!akguc!codas!generic!ablnc!rcpilz
From: rcpilz@ablnc.UUCP (Robert C. Pilz)
Newsgroups: net.unix
Subject: Secure PATH
Message-ID: <184@ablnc.UUCP>
Date: Tue, 26-Aug-86 11:30:14 EDT
Article-I.D.: ablnc.184
Posted: Tue Aug 26 11:30:14 1986
Date-Received: Wed, 27-Aug-86 11:22:55 EDT
Organization: AT&T CHQDPCT M-I-C-K-E-Y M-O-U-S-E, Orlando, Florida
Lines: 41
Keywords: Security

An unsuspecting user discovered someone playing tricks on that
user by inserting a "Trojan Horse" program in a writeable
directory of the unsuspecting user. The program echoed a series
of "}}}}}}}" which are typical of a noisy line and then prompted
the user for his/her login and passwd. The results of these prompts
were stowed and the login sequence was imitated. The trickster
was too dumb to not have the program remove itself though, and
the program was discovered. This type of program is not new,
it has been discussed at many lengths in many program journals.
It usually only tricks the new users, but a system that experiences
a lot of line noise will bring down anyone's guard.
My reasoning on this problem is that the user's PATH variable
was not as secure as it should be. According to the man page for sh(1),
the default value of PATH is :/bin:/usr/bin. This allows THREE directories
to execute programs: the CURRENT DIRECTORY, /bin and /usr/bin.
Usually /etc/profile adds directories to the PATH as do the users'
.profile files. The problem is that the current directory is
first. 
In my .profile, I have eliminated the beginning : in my path. If a
program to be executed is not in a directory indicated in my PATH,
I execute it by "./". This is not a BIG hurdle but it is more
secure.
I am going to propose that the version of UNIX System Software that
comp centers give to their users be a secure one. Let the users
lower the security level to themselves if they wish. But we should
not give them that level to start with! When I was in dept 452 at
Bell Labs a similar choice was made. The real work is not
finding these problems and coming up with solutions. The real
work is convincing people that it is for their good and
implementing them.
 
Disclaimer: These are my own opinions, not my company's.

 Robert Pilz
 AT&T                           -------       ____   _______   _____   _______
 Room  4SC24                  -====------    / __ \ |__   __| /   _ \ |__   __|
 2301 Maitland Center Pkwy   -======------  | <__> |   | |    \  \ \_\   | |
 Maitland, Fl  32751         -======------  |  __  |   | |    /   \ __   | |
		              -====------   | |  | |   | |   |  (\ / /   | |
 ablnc!rcpilz                   -------     |_|  |_|   |_|    \_____/    |_|
 (305) 660-6990