Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!rutgers!clyde!cbatt!ukma!david
From: david@ms.uky.csnet (David Herron, Resident E-mail Hack)
Newsgroups: news.admin,news.sysadmin
Subject: Re: woops, boy am I dum.
Message-ID: <6473@ukma.ms.uky.csnet>
Date: Sat, 2-May-87 11:58:17 EDT
Article-I.D.: ukma.6473
Posted: Sat May  2 11:58:17 1987
Date-Received: Tue, 5-May-87 05:46:42 EDT
References: <496@gouldsd.UUCP> <574@sdiris1.UUCP>
Reply-To: david@ms.uky.csnet (David Herron, Resident E-mail Hack)
Organization: U of Kentucky, Mathematical Sciences
Lines: 35
Keywords: sources - previous assertions, justified flames, etc.
Xref: mnetor news.admin:403 news.sysadmin:193

In article <574@sdiris1.UUCP> res@sdiris1.UUCP (Robert Sanders) writes:
>In article <496@gouldsd.UUCP>, mjranum@gouldsd.UUCP (Marcus J Ranum) writes:
>.. but the key fact in UUCP comms
>is the fact documented in the manuals that ALL intersystem traffic is
>handled in PUBLIC access files, and can be intercepted/tampered with/faked
>by anyone, with fair ease.  If your own system administration tells you in
>the agreement you have with them to use the system that your mail is
>private, it may be qualified as E-Mail within your own system.. but inter-
>system traffic cannot be presumed private.

Please get your facts straight on this.  (at least) for the Berkeley
versions of UUCP (4.2 and 4.3) the files are kept in directories
whose mode is 0755, but the files themselves are all owned by uucp
and mode 0600.  If you stop and think about it, all the programs
which deal with the spooling areas are setuid to uucp, meaning that
they can easily deal with the files being at 0600 (etc).

Other parts of the system are public... /usr/spool/uucppublic (or
your local equivalent) for instance.  File transfers have to be into
a globally writable place.  etc

and yes you can easily fake e-mail.  but you can also easily fake
e-mail on the arpanet (telenet host 25; start talking to the remote
smtp daemon), and on bitnet (make a bsmtp format file and punch
it to some bsmtp daemon somewhere; be on a urep site and be listed
in /usr/lib/rscs/PRIVUSERS and you can override the apparent from-user
and from-site to make it appear as if the mail came from anywhere).



-- 
-----   David Herron,  cbosgd!ukma!david, david@UKMA.BITNET, david@ms.uky.csnet
-----  (also "postmaster", "news", and the Usenet map maintainer for Kentucky.)
-----                 "Doodle, doodle, dee;                Wubba, wubba, wubba"
/*