Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!rochester!cornell!uw-beaver!mit-eddie!ll-xn!ames!sdcsvax!ucsdhub!hp-sdd!hplabs!ucbvax!UMKCVAX2.BITNET!MCKEEVER
From: MCKEEVER@UMKCVAX2.BITNET
Newsgroups: comp.os.vms
Subject: Audit alarms and the Security problem.
Message-ID: <8706252037.AA25984@ucbvax.Berkeley.EDU>
Date: Wed, 24-Jun-87 11:08:00 EDT
Article-I.D.: ucbvax.8706252037.AA25984
Posted: Wed Jun 24 11:08:00 1987
Date-Received: Sat, 27-Jun-87 04:22:31 EDT
Sender: daemon@ucbvax.BERKELEY.EDU
Distribution: world
Organization: The ARPA Internet
Lines: 46


Hobbit at Rutgers Writes...

<Turning on "authorization" security audits will not catch people using
<the hole.  Since the hole involves directly $GETting and $PUTting your
<own records, it completely bypasses the call to the audit mechanism in
<$setuai, thus you lose.  A proper ACL, however, may inform you when someone
<opens the file for write...
<
<_H*

I was afraid that would happen.  I had a faint hope though that this would
not be the case.  His ACL idea sounds sound.  (Sounds sound??)  Oh well,
I'm not an English major.  Thanks for the information Hobbit.  And tell Bilbo
I said Hi... ;-)

Phil Wherry from the MITRE Corporation writes that I left something out
of the my recommendation for the audit alarm...  It should have been:

        $ SET AUDIT/ALARM/ENABLE=(AUTH, ACL, AUDIT)

In this way, all auditing changes will be logged, including turning off
audit alarms.  Phil also points out that someone with priv's could shut
down OPCOM or keep it from coming up at all.  That's true.  The main
thrust of my submission was to catch non-priv hackers.  I assumed that
the type of priv's needed to get around this would not be granted to
individuals that couldn't be trusted.  And if you give any of the ALL
class of priv's (CMKRNL, SYSPRV, BYPASS, READALL, SYSNAM,...) to someone,
they can own your system in a number of ways that are all a lot easier to
do than trying to take advantage of the security hole.  But Phil makes a
valid point.  Thanks.

Thanks to all that responded.

-------------------------------------------------------------------------
     UMU   UMUMUMUMUM
     UMU   UMUMUMUMUM            Brian McKeever
     UMU   UMUMUMUMUM
     UMU   UMUMUMUMUM            University of Missouri Kansas City
      U   UM        U            Computer Science
  U      UM     UM      UM       4747 Building Rm. 219
  UMUMUMUM     UMUM    UMUM      5100 RockHill Rd.
  UMUMUMUM     UMUM    UMUM      Kansas City, MO  64110
  UMUMUMUM     UMUM    UMUM      BITNET:  MCKEEVER@UMKCVAX1
  UMUMUMUM     UMUM    UMUM
-------------------------------------------------------------------------