Comment by NoZebra120vClip | Hacker News Reader

Comment by NoZebra120vClip | Hacker News Reader

NoZebra120vClip

Alright, did I tell my college sysadmin story already? This is the perfect place to drop it.

1990, freshman in college, Pascal class on AT&T Unix SVR3 3B2 cluster named "earth", "wind", and "fire". We'd just learned our way around "vi" and how to "uvapc" our Pascal source into a.out.

I discovered anonymous ftp, and "make", and I quickly rose to become the gaming king of Pascal class. I had ularn, nethack, megs and megs of games crammed in my no-quota $HOME, and I'd opened permissions for everyone else to access and play them. I often chit-chatted with a classmate or two over "write" or "ytalk".

Not content to merely play games, I became mischievous with the system and its inner workings. I created a .profile and a .plan, the latter of which used VT100 cursor escape sequences to self-modify the screen, such as changing my $HOME to "/" and I also made a boastful comment about having root access.

It was all in good fun, and then came the day that I discovered /etc/passwd and I attempted to "su" to every single system account I found listed. I mean some of their passwords were just "*" so they must've been wide open!!1

I soon received ominous, chilling email from the unseen sysadmin of the whole cluster. He described to me everything I'd done up to this point, and he informed me that saying I have root access is like telling airport officials that I have a bomb. That point definitely drove it home to me as a young and dumb hacker.

So, for the rest of my short college career, while I did some silly "extra-curricular" things with my own compute resources, I was careful to not try and break system security, or even say that I had, for fear of the wrath of the unseen sysadmin.

> AT&T Unix SVR3 3B2 cluster named "earth", "wind", and "fire".

Not related to sudo, but this brought back a memory of the cluster I had access to during my college internship. 6 computers, I don't remember what kind or vendor. Named after the starter Pokemon for generations 1 & 2. They were in the rear of the room behind a cage I did not have a key for.

One day a sysadmin came into the room asking "Uhhh... I'm looking for a... totodile?" The way he pronounced totodile made it clear he had no idea what a pokemon was.

He had to remove it and replace something, didn't really give us any details. A few days later he brought the server back and hooked it back up to the cluster. The very first thing we did was rename it to Croconaw. (The evolved form of Totodile).

Schools are supposed to be the place where students can break things and break rules. It's part of the education.

learning that if you get caught you're going to be held accountable for your actions is also part of the education.

it's not as if they executed OP. telling a kid to stop screwing around is pretty reasonable.

During college in the mid 2000s I discovered that the network share with all corporate data was accessible (read only) to everyone.

The only way it was not immediately obvious was because only sub folders were assigned a drive letter, and the network share was hidden in the UI. I found a way around that in the Windows open dialog and then was able to trigger Explorer to the top level directory.

The share also contained private data of applicants (names, addresses, date of birth, education history) which was most concerning to us.

With some friends we wrote a document showing what we found (not explaining how to do it) and posted it to an internal message board. We also sent copies via email to our IT teacher, sysadmin and the principle. Shortly after the sysadmin invited us for a chat and basically told us not to do that again.

A couple of hours later we were invited to the principles office. The principle was away at the time, but the vice principle - who wanted to make a name for himself - immediately suspended us all and said he'd discuss it with the principle but said most likely we would be expelled, and they may need to involve the police.

Our main concern in the post we made was that personal data was effectively publically accessible (to anyone who connects to ethernet - you didn't even need to log in). Even before GDPR, our country had very strong data protection laws which this would have breached.

A few days later a parent sent a letter to the principle, effectively restating what we said, with added threats of reporting them for violating data protection of minors. Strangely after that the issue was dropped and we were allowed back...

Which goes to show us this computer thing is a learning experience for schools as well. We've come a long way since, and with things like ML we get the same experience.

Principal. Dunno if the principal had any principles.

Completely lost on me “babying kids and not showing them that actions can have consequences” is fetishised as soon as computers are involved. I guess because we all grew up doing this stuff.

As an adult that writes software used by a lot of students in a classroom environment, I am glad to see that the spirit it still alive whenever I have a Sentry error come through indicating quite clearly that someone is trying to cheat by dicking around in dev tools. However I’m also certainly going to make the troublemakers shit their pants with a strongly worded console.log().

They got lucky. There have been many people who even tried to responsibly report a bug, and were treated as if they were misusing the resource.

This is not just an education thing. Remember recently when there was a St. Louis reporter who found a glaring privacy violation in a Missouri state website (in that the website for whatever reason included people's SSN in the clear, but commented out. That reporter was initially treated as if they'd hacked the website and the governor of Missouri publicly spoke and said as much. Fortunately they weren't prosecuted, but even after prosecutors declined to do so, the governor still publicly called the reporter a "hacker".

My similar story: I wrote a script that tries all the words from a spellchecker I found as passwords for each user (a really naive dictionary attack). The angry admin did came as apparently each wrong attempt generated a beep on some station in their room (these were dos times iirc and the admins were just high school kids).

So did you have root access? I can’t figure out if you attempt to su all the system accounts worked or not.

Nowadays /etc/passwd is world-readable and passwords are in /etc/shadow but perhaps /etc/passwd used to store the hashed passwords as well.

I, of course, did not have root access or any access that I shouldn't have had.

/etc/passwd indeed stored the hashes in SVR3, and there was no such thing as /etc/shadow. I was naive enough not to understand hashes, and so I figured that those jumbled letters in the file had to be the actual passwords, and if "*" was in an entry then "*" was, of course, the password! Why didn't it work?!!?

If you read the source of ‘cat’ and ‘more’ you’ll see that if they are reading /etc/passwd they replace the passwords of system users with ‘*’, unless you are uid 0.

When ‘less’ was created, there was a bug where when you scrolled upwards the passwords would be revealed, so it was decided that the passwords should be replaced with actual asterisks and stored in individual files per-user.

For security, these files were given access rights only for the owning user, and immediately deleted, with an encoded copy of their inode number being stored in /etc/shadow.

Fun fact: forced password changes were initially introduced when disks were getting full and deleted inodes of user password files were due to be overwritten. “For security reasons” was correct but misinterpreted.

> If you read the source of ‘cat’ and ‘more’ you’ll see that if they are reading /etc/passwd they replace the passwords of system users with ‘*’, unless you are uid 0.

That sounds so wrong, anything from a user-written program, `ed`, etc to a symlink/hardlink could read the password.

Sounds wrong because it is wrong, pure unadulterated intentional B.S.; don't know why the commenter decided to yank our chains like this.

I believe there is a meme in chat rooms where trolls get unsuspecting users to reveal their passwords by convincing them that the chat replaces it with "***" and so forth. Perhaps the GP is riffing on this.

Back in the day, not only did /etc/passwd contain (unsalted) hashed passwords, but many publicly accessible hosts were configured to allow anonymous FTP and let you browse the entire fileystem. I would never do this myself, naturally, but people collected those things and run crack on for days to get passwords for accounts.

Man, the internet's no fun anymore.

Reply on news.ycombinator.com