Path: utzoo!attcan!uunet!husc6!mailrus!rutgers!aramis.rutgers.edu!porthos.rutgers.edu!webber
From: webber@porthos.rutgers.edu (Bob Webber)
Newsgroups: news.admin
Subject: Re: [Status] Re: sendsys
Message-ID: <Jul.2.03.29.52.1988.8114@porthos.rutgers.edu>
Date: 2 Jul 88 07:29:53 GMT
References: <171@lakart.UUCP> <Jun.30.03.45.06.1988.23248@aramis.rutgers.edu> <9811@g.ms.uky.edu>
Organization: Rutgers Univ., New Brunswick, N.J.
Lines: 36

In article <9811@g.ms.uky.edu>, david@ms.uky.edu (David Herron -- One of the vertebrae) writes:
> In article <Jun.30.03.45.06.1988.23248@aramis.rutgers.edu> Bob.Webber@aramis.RUTGERS.EDU writes:
< <Yes, it is now clear that it was not me who sent out the message.  I
< <am told that the messages were actually fed in at the rutgers gateway
< <itself via the joys of Eric Fair's nntp.
< 
< It would have been just as trivial to generate those sendsys messages
< without NNTP -- MORE trivial even, because wouldn't have to learn
< the NNTP protocol.  ...
< would have worked for someone ON rutgers.  So what's the point?  Why
< imply that NNTP is evil because it allows such things?

At a networked site like rutgers, berkeley, etc., it is alot easier to
hack something like nntp than it is to get modem access.  Such sites are
also more likely to have people interested in fiddling with the system
a little bit.  Anyway, there was no BIG point here, I was just mentioning
that nntp was apparently how rutgers was hacked this time -- the sysadmin
for rutgers told me this, it is not idle speculation as to how it was done.
NNTP has had a number of very bad effects on the net, but its security is
the most minor of them.

< <Apparently the backbone takes care of its own.
< 
< Would you care to explain this?
<...
< with this case?  The messages could have been made by ANYBODY on the
< internet -- well, that depends on the Mel's configuration file -- who
< knows enough about the protocols to make the posting. 

While it could have been made by ANYBODY, it was actually done by
specific people.  That person is known to the sysadmin of rutgers --
as well as a number of others.  These people are participating in the
act after the fact by shielding the person responsible from the public
response they deserve.  ANY QUESTIONS?

-- BOB (webber@athos.rutgers.edu ; rutgers!athos.rutgers.edu!webber)