==Phrack Inc.== Volume Three, Issue 27, File 5 of 12 COSMOS COmputer System for Mainframe OperationS Part Two by King Arthur This article will present solutions to the computer security problems presented in my previous file. The following are simple but often neglected items which if properly treated can immensely increase your company's computer security. These points apply not merely in regards to COSMOS, but to all computers in all companies. A) Dial-Up Security: When securing a computer system, regardless of its type, it's important to remember this: the only way someone can remotely access your system is if there is a dial-up line leading to that system. If your system has a dial-up, make sure that you have taken every possible precaution to secure that line. "The one piece of advice I would give is: Be careful with dial-up lines," says Bellcore's Ed Pinnes. Dave Imparato, Manager of Database Management at New York Telephone, says, "We have devices that sit in front of our computers that you have to gain access to. In order to even get to COSMOS, there are three or four levels of security you have to go through, and that's before you even get to the system." Rules for protection of Dial-Up lines: 1. Have as few dial-up lines as possible. Private lines or direct connections are often a viable replacement for dial-up lines. 2. If you must have phone lines going to your computer, use external hardware, if possible. For instance, the Datakit Virtual Circuit Switch (VCS) will require a user to specify an "access password" and a system destination to specify which system you are calling. The VCS would then connect you to the requested system which would prompt you for a login and password. Using hardware similar to this serves a double purpose: A) It is harder for someone to get into your computer, due to additional passwords; B) Employees need only dial a single number to access a number of systems. Another good type of hardware is a callback modem. A callback modem will prompt users for a login and password. If these are correct, the modem will automatically callback to a predetermined number. At that point you would login to the computer. The advantage of callback is that unless a call is placed from a certain phone, there is no way to connect. Unfortunately, this is not always efficient for systems with large numbers of users. Lastly, and the most effective means of access, is to have a system which does not identify itself. A caller has to enter a secret password, which doesn't display on the screen. If a caller doesn't type the correct password, the system will hang up, without ever telling the caller what has happened. 3. If you ever detect "hackers" calling a certain number, it is advisable to change that number. Phone numbers should be unlisted. According to a hacker, he once got the number to an AT&T computer by asking directory assistance for the number of AT&T at 976 Main Street. 4. If dial-up lines aren't used on nights or weekends, they should be disabled. Computer hackers usually conduct their "business" on nights or weekends. The COSMOS system has the ability to restrict access by time of day. B) Password Security: Using the analogy between a computer and a file cabinet, you can compare a password to the lock on your file cabinet. By having accounts with no passwords you are, in effect, leaving your file cabinet wide open. A system's users will often want passwords that are easy to remember. This is not an advisable idea, especially for a database system with many users. The first passwords tried by hackers are the obvious. For instance if MF01 is known to be the user name for the frame room, a hacker might try MF01, FRAME, MDF, or MAINFRAME as passwords. If it's known to a hacker that the supervisor at the MDF is Peter Pinkerton, PETE or PINKERTON would not be very good passwords. Rules for password selection: 1. Passwords should be chosen by system administrators or the like. Users will often choose passwords which provide no security. They should not be within the reach of everybody in the computer room, but instead should be sent via company mail to the proper departments. 2. Passwords should be changed frequently, but on an irregular basis -- every four to seven weeks is advisable. Department supervisors should be notified of password changes via mail, a week in advance. This would ensure that all employees are aware of the change at the proper time. One thing you don't want is mass confusion, where everybody is trying to figure out why they can't access their computers. 3. System administrators' passwords should be changed twice as often because they can allow access to all system resources. If possible, system administrator accounts should be restricted from logging in on a dial-up line. 4. A password should NEVER be the same as the account name. Make sure that ALL system defaults are changed. 5. Your best bet is to make passwords a random series of letters and numbers. For example 3CB06W1, Q9IF0L4, or F4W21D0. All passwords need not be the same length or format. Imparato says, "We built a program in a PC that generates different security passwords for different systems and makes sure there's no duplication." 6. It's important to change passwords whenever an employee leaves the company or even changes departments. Imparato says, "When managers leave our organization, we make sure we change those passwords which are necessary to operate the system." 7. The Unix operating system has a built-in "password aging" feature, which requires a mandatory change of passwords after a period of time. If you run any Unix-based systems, it's important to activate password aging. 8. When you feel you have experienced a problem, change ALL passwords, not just those passwords involved with the incident. C) Site security: There have been a number of articles written by hackers and published in 2600 Magazine dealing with garbage picking or what hackers call "trashing". It's important to keep track of what you throw out. In many companies, proprietary operations manuals are thrown out. COSMOS itself is not a user-friendly system. In other words, without previous exposure to the system it would be very difficult to operate. Bellcore's Beverly Cruse says, "COSMOS is used in so many places around the country, I wouldn't be surprised if they found books... in the garbage, especially after divestiture. One interesting thing about a COSMOS article written by hackers, is that there was a lot of obsolete information, so it shows that wherever the information came from... it was old." Rules for site security: 1. Although it may seem evident, employees should be required to show proper identification when entering terminal rooms or computer facilities. It's doubtful that a hacker would ever attempt to infiltrate any office, but hackers aren't the only people you have to worry about. 2. Urge employees to memorize login sequences. It's a bad idea for passwords to be scribbled on bits of paper taped to terminals. Eventually, one of those scraps may fall into the wrong hands. 3. Garbage should be protected as much as possible. If you use a private pick-up, keep garbage in loading docks, basements, or fenced-off areas. If you put your garbage out for public sanitation department pick-up, it's a good idea to shred sensitive materials. 4. Before throwing out old manuals or books, see if another department could make use of them. The more employees familiar with the system, the less of a chance that there will be a security problem. 5. Printing terminals should be inspected to make sure that passwords are not readable. If passwords are found to echo, check to see if the duplex is correct. Some operating systems allow you to configure dial-ups for printer use. D) Employee Security: When a hacker impersonates an employee, unless he is not successful there is a great chance the incident will go unreported. Even if the hacker doesn't sound like he knows what he's talking about, employees will often excuse the call as an unintelligent or uninformed person. It's unpleasant to have to worry about every call with an unfamiliar voice on the other end of the phone, but it is necessary. Rules for employee security: 1. When making an inter-departmental call, always identify yourself with: 1) Your name; 2) Your title; and 3) Your department and location. 2. Be suspicious of callers who sound like children, or those who ask you questions that are out of the ordinary. Whenever someone seems suspicious, get their supervisor's name and a callback number. Don't discuss anything sensitive until you can verify their identity. Don't ever discuss passwords over the phone. 3. When there is a security problem with a system, send notices to all users instructing them not to discuss the system over the phone, especially if they do not already know the person to whom they are talking. 4. Remind all dial-up users of systems, before hanging up. 5. If security-minded posters are put up around the workplace, employees are bound to take more care in their work and in conversations on the phone. 6. If managers distribute this and other computer security articles to department supervisors employee security will be increased. E) General Security: Bellcore recently sent a package to all system administrators of COSMOS systems. The package detailed security procedures which applied to COSMOS and Unix-based systems. If you are a recipient of this package, you should re-read it thoroughly to ensure that your systems are secure. Cruse says, "Last year... I had a call from someone within an operating company with a COSMOS security problem. All we really did was give them documentation which reminded them of existing security features... There is built-in security in the COSNIX operating system... We really didn't give them anything new at the time. The features were already there; we gave them the recommendation that they implement all of them." If you feel you may not be using available security features to the fullest, contact the vendors of your computer systems and request documentation on security. Find out if there are security features that you may not be currently taking advantage of. There are also third party software companies that sell security packages for various operating systems and computers. Computer security is a very delicate subject. Many people try to pretend that there is no such thing as computer crime. Since the problem exists, the best thing to do is to study the problems and figure out the best possible solutions. If more people were to write or report about computer security, it would be easier for everyone else to protect themselves. I would like to see Bellcore publish security guidelines, available to the entire telecommunications industry. Keep in mind, a chain is only as strong as its weakest link. _______________________________________________________________________________