Posted by andros 1 day ago
I know just the poetry to go with that story:
The Moving Finger writes; and, having writ,
Moves on: nor all thy Piety nor Wit
Shall lure it back to cancel half a Line,
Nor all thy Tears wash out a Word of it.
some people had these setups and just never saw a lot of traffic because the boxes werent broadly routed on the internet etc. or internal.
now with all the scans and automated spamming by parties its totally unthinkable. most of my server bandwidth despite my efforts is going to this.. (thankfully down pay for that per bytes anymore!)
this scenario still happens today.
We had a lot of printers around the labs in our university, and they were high-speed, high-capacity. And in the earliest days of multi-user and time-sharing, the hardcopy terminal was actually the default, where the fabled "glass terminal" came along later!
So you have a highly secure system and it's outputting important log entries that may need to be examined later, in the case of a malfunction or a compromise attempt. So you send the most important output to your printer, and you get an offline, immutable audit trail to back up your most important log files.
That seems like a very routine and pragmatic step. In the intervening decades, there were many logging strategies, and many of them admitted for "covering your tracks" by hackers who could erase logs and destroy evidence if the admins weren't careful.
But again, if a 2-minute "finger" interval was causing a paper log overflow, the admins could have mitigated that, but perhaps they were justified in telling the kid to knock off the frivolous resource usage.
However, as I worked for an ISP back in those days as well, I can tell you that log overflows were crazy-making. We had a particular system that acted as primary DNS for many customers. And many customers who were brand-new to the Internet and brand-new to this DNS thing were not real good at configuring it according to standards. And so we had a NOC with projection monitors that monitored system status in various ways, and one of them was tailing our syslog file.
And all day long I kept seeing DNS errors. "Lame delegation" was the winner overall, but there were so many. I was so young and had no privileges or knowledge to fix them. But I helplessly watched them scroll, knowing there were issues, slowdowns, and inefficiences that I couldn't solve for them. Sorry guys.
To answer the sibling post below, I had a 1GB drive at home around that time, enough to store text logs cheaply. Logrotate is apparently from 1996.
There was no disc quota or significant restriction on the resources available to us, so I became a video game mogul. I found all the freeware download sites, and I became an expert on portability, tweaking and compiling game software to run on our idiosyncratic system.
As students, we made extensive use of "finger", "w", "who", and "write". We also knew the existence of "wall" and the like. So it was de rigeur for us all to write a little something into our .project and our .plan files. I took it much further, and discovering VT100 escape sequences, produced an animated .plan file which erased and mutated some of the immutable datapoints displayed, such as replacing my $HOME directory with "/" and some script-kiddie flexes like "I have root access... you know!"
Subsequently I explored the system extensively and eventually found /etc/passwd, and for reasons, attempted to "su" to every single account I found in there, most of them being system maintenance accounts. Due to logging and auditing, of course, these blatant, brazen failures captured the attention of the unseen administrator.
I received an email that made my blood run cold. The admin (and I still remember his name 37 years later) told me everything I had done in detail, and said that claiming "root access" was equivalent to telling airport officials that I was carrying a bomb. And there were no academic sanctions or threats in this email, but his veritable omniscience and dead-serious tone made me reconsider many of my life choices at the age of 19. Today, I am thankful for this guy putting things into perspective, that Unix was not just a huge game of Zork or Nethack, and he definitely inspired my career goal as systems admin.
But, anyway this was on SunOS and specifically some Sun4c machines with a PROM password. I discovered a couple of new machines were put into the labs without a PROM password, so you could press STOP-A and get into the forth debugger, and read/write system memory. This seemed interesting, but I wasn't sure what I should be changing.
Then one day, I was reading some documentation, and there was a system call [1] that returned a pointer to some information about the current process (or maybe it was for a specific pid), and one of those fields was marked as reserved. I discovered that the field seemed to contain some kind of pointer, but I couldn't de-reference it, so I guessed it was something in kernel space, probably the information about the task needed for the task switcher. This also seemed interesting!
Using the PROM monitor to dump memory starting at that address gave a lot of interesting stuff, and at something like offset 22 there was a pointer to another structure and dumping the memory at this one showed my uid and gid, IIRC the uid was offset 6. Sure enough, overwriting the uid changed the euid of my process.
So, I could reliably get root on any machine without a PROM password by running my program, using the PROM to read the contents of the address it printed out, add 22, use the PROM to read that address, add 6 and write a zero to that address. (Assuming they are the correct numbers after 30 years of brain rot).
So, anyway, I had a bit of fun locally, and noticed that there was a memory mapped file that let you read the PROM contents. I then decided that I wanted to examine this on a machine that had a PROM password set, but this was harder than I expected. My initial plan was to rsh into the other machine as root, but that was forbidden by policy (and this would have been logged). I then thought about creating a setuid script with my new found root access, but that was thwarted as each machine had NFS mounted with root-squashing and their own local root partition. So, I decided I needed to create an additional "system" user in /etc/passwd with a password I knew (because that owned the binaries and wouldn't have root squash). The specifics of what went wrong I forget now because things rapidly got stressful so a lot of it became a blur, but the long and the short of it was that I managed to completely delete the NIS password file on that machine and so I couldn't log into it any more to attempt to undo my damage. However, I discovered that the non-NIS passwd file was still intact, and so I had to use my previous PROM trick to hack the "bin" user on a different machine, which allowed me to rsh as "bin" into the machine I'd just trashed (and that would definitely have stood out in the logs). Once I had a shell as "bin" on that machine, I was able to use the PROM trick again to upgrade that to a root shell and undo the damage I'd done before.
Some time later, there was some other root exploit knocking around, and I used that on a machine with a PROM password set, and discovered I could easily read what the password was just by reading that memory mapped file. As luck would have it, every machine had the same PROM password, and so from that point I could always have gotten root if I wanted it, but was always too worried about causing other damage that I never actually used it.
However, when I later became a sysadmin at the university, the other sysadmin was very confused one time when I did the same hacking root trick after he'd managed to mess up something similar on the root partition of a couple of machines and he thought he'd have to reinstall them all!
I just did STOP-A and entered the PROM password that he'd never told me, and did the same thing I'd done before and just said "yeah, we should probably change this password as it's the same as it was 2 years ago". The process of changing the password was annoyingly fiddly as the PROM password change tool was designed to only work on the console, which is why they'd never changed, so I wrote something to pretend to be an actual TTY so I could update all 100 odd machines remotely via rsh instead of logging on at the console of each of them. Fun times!
[1] I have some recollection it was an ioctl, but I'm a bit hazy on that now as it was over 30 years ago. I suspect it was the SunOS 4.3 version of the prpsinfo structure described in this: https://www.typewritten.org/Manual/Sun/SunOS/5.1/SPARC/man4/...
Maybe the answer is to define a plan base URL as a DNS TXT resource on a particular DNS domain. For instance, I added the string `< plan https://bi6.us/PL/ >` as a TXT resource at _plan.hamrick.rocks. It should now be a trivial task to write a program called `finger-ng` that when I type `finger-ng meadhbh@hamrick.rocks`, it queries the TXT record at `_plan.hamrick.rocks`, extracts the plan base URL and then retrieves and displays a text document found at `https://bi6.us/PL/meadhbh%40hamrick.rocks`. I guess you could serve up a text/plain, text/html or even image/avif if you wanted to.
This, of course, assumes `bi6.us` is set up to allow me to update that file, but this is also straight-forward. Anyway, check back in a couple days and I'll have some code and I'll write the RFC/ID next week.
EDIT: I wrestled with apache and got it to understand files under www.bi6.us/PL/ should be served as text/dsd+plain, so you can hit `HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS` and get something that looks legit. And sure enough, HTTPS://BI6.US/PL/MEADHBH%40HAMRICK.ROCKS encodes to a smaller QR code than https://bi6.us/PL/meadhbh%40hamrick.rocks. (Though it looks like the HN text beautifier doesn't automagically produce links for URLs beginning with upper-case HTTPS.)
EDIT EDIT: Hmm... still doesn't say anything about privacy. What if you wanted to have a different _plan file for friends, a _plan file for family and a _plan file for co-workers? Clearly deep thoughts must be thunk.
Also if you wanted a .plan for different people you would code your own server as in the article and tie it to a different “user”. The original server ties .plan files to username home dirs but there’s nothing stopping you from changing how that effectively works on your own server.
The start page exists because finger has no discovery layer. finger @host lists users. lookit makes that list selectable, so you can wander a server instead of querying one address at a time.
I just released a v0.2 beta, feedback welcome: https://github.com/jonathandeamer/lookit/releases/tag/v0.2.0...
Perhaps a global database or a parallel project like a search engine focused on fingering is needed. The sources are scattered, and clients like yours would greatly benefit from that.
I'd also like to mention that if you have Emacs, I also have my own client: https://git.andros.dev/andros/efinger.el
Was definitely an inspiration for lookit. And yes, a search engine would be cool!
The easiest modern solution would probably be git pulling from an Onion address (running git daemon so it's read only). Then, when your machine is on, people that want updates would just
git pull git://abcdef1234567890.onion/fingerfood.git
Thx for the mention blogger!
https://github.com/ESWAT/john-carmack-plan-archive/tree/mast...
(1) Looks like great reading. (2) Who compiled the archive, and how? This feels like one of those situations where a person records the evening news onto VHS for decades; except here they were running finger every day for decades? (3) Is there a more mobile-friendly way to browse it?
Couple hours later, i get pinged in Teams by someone in the security group who, who was flagged for my activity. No harm, but he said that they watched it because it had been used for malware. Said I shouldn't use it unless i had some business need, would need to do a request apparently.