[1208] in Public-Access_Computer_Systems_Forum
OPAC Hackers???
daemon@ATHENA.MIT.EDU (Ernest Perez)
Mon Sep 14 12:33:02 1992
Date: Mon, 14 Sep 1992 11:17:52 CDT
Reply-To: Public-Access Computer Systems Forum <PACS-L%UHUPVM1.BITNET@mitvma.mit.edu>
From: Ernest Perez <EPEREZ%UTDALLAS.BITNET@mitvma.mit.edu>
To: Multiple recipients of list PACS-L <PACS-L%UHUPVM1.BITNET@mitvma.mit.edu>
----------------------------Original message----------------------------
Excerpt from a recent message on the net...
>From: riddle@is.rice.edu (Prentiss Riddle)
>Subject: GopherCon '92 trip report
>Next came security concerns involved in running a public Gopher client
>(a Gopher client accessible via telnet or on a public terminal which is
>not tied to a particular user's account). There have already been
>cases of such Gopher clients being used by system crackers to "launder
>IP addresses". The Gopher practice of leaving people at the "front
>door" of a telnet site is dangerous (library systems are particularly
>notorious about having crackable systems accessible through the same
>port as the online catalog).
Hmmm..."library systems are particularly notorious about having crackable
systems accessible through the same port as the online catalog".
How did OPACs get to be "particularly notorious"? Are they? I haven't seen
floods of network or printed reports highlighting this desperate situation.
Does anyone have valid reports of disasters, crashing and burning, via an OPAC
open door? Or, for that matter, of hackers inadvertently erasing the
bibliographic database or indulging in OPAC grafitti? :-)
I'd be interested in any comments about this matter. What with all the
directories like Hytelnet, and the CWAIS menus for autoconnect via TELNET to
remote OPACs....
-ernest
..............................
Ernest Perez, Ph.D
Access Information Associates
2183 Buckingham, Suite 106
Richardson TX 75081
214-530-4800
INTERNET: eperez@utdallas.edu
BITNET: eperez@utdallas
..............................
The standard disclaimer: No it wasn't me; someone must have used my password.
