OMOND@DHDEMBL5.BITNET (Roy Omond) (01/31/86)
In message <8601241057.AA22688@stracs.cs.strath.ac.uk> Jon R Malone writes about hackers gaining access to objects they should not have access to. Here is one method they may have used : All system managers/programmers should be aware of the "feature" in VMS 4.2 such that by default, any non-privileged user can set an ACL on logical name tables, *even on LNM$SYSTEM_TABLE*, to give him/herself write access to that table. e.g. Edit/Acl/Obj=Log LNM$System_Table and then (IDENTIFIER=[ANYUSER],OPTIONS=...,ACCESS=READ+WRITE+CONTROL) This is entirely equivalent to giving that user SYSNAM privilege; now you can imagine what fun you could have if you redefine SYS$SYLOGIN to point to your own procedure to do all sorts of things as soon as any genuinely privileged user logs in. It could even be so clever as to delete itself, repoint SYS$SYLOGIN at its genuine place etc. etc. etc. thus covering up traces of itself. What all system managers should do is to stick an ACL on LNM$SYSTEM_TABLE allowing (IDENTIFIER=[*,*],...,ACCESS=READ) only. Note, you ought to do this in SYSTARTUP since ACLs for logical name tables disappear on shutdown. Roy Omond (European Molecular Biology Laboratory, Heidelberg)