On Wed, 16 Sep 2015, jwsmobile wrote: Not very hard to stop it, but the damage that it does to the files (RSA encryption) is irreparable, unless you pay the ransom. A significant percentage of the victimes pay up! A few people have reported that the malevolent assholes are honorable, and do provide a working key. A small few report NOT getting the decryption key. Without major distributed work on it, decryption through brute force key trials would take millenia. The purveyors of one variant were stopped, and their key database revealed. I don't know if or why they are still alive. It relies on social engineering (suckers). Sometimes PDF files, but, I now think that I got it by falling for a fake Adobe upgrade popup.

Just remember that those older systems may well have had any number of security issues of their own. They did benefit a lot from "security by obscurity" as well as the fact that they weren't connected to the Internet. I never had any incentive to look for holes in CDC operating systems, but I still remember a simple hole I found in OS/360, about a month after I first wrote a program for that OS. It allowed anyone to run supervisor mode code with a couple dozen lines of assembler source code. I found it on OS/PCP 19.6, but I noticed in graduate school that it still worked on the university's 370 running OS/MVS 21.7. (The magic? Use the OS service to give a symbolic name to a location in your code, with a well chosen name, then give that name as the name of the "start I/O appendage" in an EXCP style I/O request.) paul

Cyber systems didn't get much love from the H/P kids back in the day :O http://phrack.org/issues/18/5.html That said; NOS is one of the few mainframe systems ever really discussed in Phrack... MVS/TSO and VM/CMS you also see occasionally, but beyond that, it seems like most of the G-files were focused on midrange systems ... UNIX, VMS, MPE, PRIMOS, TOPS and the like. Very little discussion of many of the mainframe vendors ... There are a few Youtube videos where I guess people have done presentations at Defcon or something recently, about mainframe security ... kind of neat to watch ... of course, the z/OS they show has got all kinds of POSIX stuff grafted onto it and ... it's fairly indistinguishable from something older that I would recognize... like MVS 3.8J :O Best, Sean On Wed, Sep 16, 2015 at 2:29 PM, Paul Koning <paulkoning at comcast.net> wrote:

On 09/16/2015 12:23 PM, Sean Caron wrote: Sad that they don't have any early software. In the beginning there was COS (Chippewa Operating System), followed by SCOPE (which doesn't really describe a specific OS, but more on that later). On the 6000, both were essentially PP-oriented, leaving the CP to do the real work. MACE was essentially a bootleg product mostly done a night on the Arden Hills QA floor by (Dr.) Dave Callender (he of the bats) and Greg Mansfield (whom I had the privilege of introducing to the delights of gelato--but that's another issue. Greg wanted a slimmed-down operating system for the CE community--hence, the name "Mansfield's Answer to Customer Engineering). Greg, unfortunately, was your basic geek, not good with people, but very talented. Without Dave's promotion, I doubt that it would have gotten anywhere. MACE did make its way into the academic community. I believe that Purdue added and extended it quite a bit. One aspect is that the OS was considerably more CP-involved than SCOPE. So, for the interactive stuff like PLATO, MACE was re-named KRONOS and launched as a separate official product. At the user level, the two were pretty much compatible, but internally, they were very different. For example, SCOPE had a rather elaborate disk driver, called 1SP (for "Stack Processor"), which sorted and prioritized disk requests based *partly* on the distance that a seek to cylinder involved. KRONOS on the other hand, used a much simpler "first-come, first-served" principle. Mostly, it was a battle of cultures. SCOPE was maintained out of Palo Alto (Porter Drive) and later, Sunnyvale (Moffet Park Drive) and KRONOS out of Arden Hills. Sometime around the advent of the Cyber 70 series, management made a non-decision (with 128 vice presidents, how could it be otherwise?) So, KRONOS was re-christened NOS (network operating system) and SCOPE became NOS/BE (batch environment). Eventually, enough of the BE aspect was rolled into NOS that only one--NOS survived. Besides, CDC was doing their best to get rid of as much staff as they could at CDC Sunnyvale. Certain key people, however, refused to transfer, so it took well into the 80s before the last light went out in Sunnyvale. Now, that's about Cyber 70/6000 NOS/SCOPE. The 7600 was a very different beast. For one, the 7000 PPs didn't run as slots in a barrel--they were fully independent. Secondly, the PPs were hard-assigned a buffer region each in SCM--they did not have unfettered access to memory. This meant that the PP-resident aspect of 6000 SCOPE (and KRONOS) was unworkable on the 7600. So, 7000 SCOPE was born--mostly, what I saw was SCOPE 2 and SCOPE 2.1. With the PPs dedicated to pretty much nothing but simple I/O, the whole business of job control and user interface fell to the CP. Note that the 7600 had very fast SCM, but not much of it, so storage of transient programs was left to slower LCM. The scheme adopted was to have various functions of the OS be nested, matryoshka-doll style with the user program in the inside. So outside of the user program, you could have the job supervisor, then the record manager, then the buffer manager and so on.. So 7600 SCOPE was nothing like 6000 SCOPE (or NOS). There were other 6000-series operating systems, not very well known to this day. For example, the ROVER people had their own version of what I assume was an early SCOPE--I'm not certain if this has been declassified even today, so the less said the better. There was TCM, Time-Critical Monitor which claimed to have a maxiumum average event latency of 100 nsec ZODIAC was built on the TCM OS, used lots of ECS in multi-mainframe configurations to host "chains" of real-time transactions (a bit complex to explain) that essentially operated with its own I/O and filesystem. Life was interesting back then... By the time you hit the 80s and the CYBER 180, not so much. --Chuck

On 09/17/2015 09:04 AM, Paul Koning wrote: I'd love to see them run Zodiac... How far back does their SCOPE collection go? 3.1.6 was the standard for several years, then 3.3. How about 7600 SCOPE--do they have a 7600 emulator? --Chuck

On 09/17/2015 09:58 AM, Paul Koning wrote: CRM/6RM was a direct offshoot of the 7600 SCOPE effort. The 7600 wouldn't be too difficult. What I'd like to see is a STAR-100 emulator, but that would be a very big job--and then, I don't know if any software is still available. Maybe buried in a vault at Lawrence Livermore or NASA Langley. Or maybe someone who kept old archives from ETA might have something. Few CDCers of the time even knew that the STAR-100 existed. I remember that when the initial software design briefings for the Cyber 180 were given that the guy describing the paging software hadn't been aware of the STAR doing this since 1969 or thereabouts. I did get up and tell him that we'd had more experience with 64-bit paging algorithms than anyone else in the company and that it would behoove him to pay us a visit. I don't think he ever did. CDC was full of the NIH syndrome. --Chuck

On 9/17/15 9:58 AM, Paul Koning wrote: but their OS collection is not. they're called "controlfreaks" for a reason.

On 09/16/2015 01:29 PM, Paul Koning wrote: Yup, the classic breakin was you set up an exception handler with SPIE (specify program interrupt exit, I think) and then do a divide by zero. This gives the handler the PSW of the problem program. You turn the P bit of the PSW off and return. The stock OS would actually ALLOW you to DO this, and just return to the user program now in supervisor state! It was a VERY simple fix, you just don't allow any exception handler to change the state of the P bit. But, MANY systems did not do that check. So MANY other weaknesses could easily be caused by accident. Like, the file that contained valid account numbers was often not protected. Anybody could just print out that file. Jon

On 09/16/2015 01:10 PM, Chuck Guzis wrote: It would be much harder. In general, browsers do not activate just any file you would download. There are weaknesses in various graphical/video add-ons to browsers that may cause vulnerabilities. But, in GENERAL, malware in videos, etc. would either do nothing at all when sent to the add-on program, or get a message saying something like "this script contains macros, executing it could be a security risk: Yes / No" I've been browsing quite fearlessly with Linux systems for about 17 years, and NEVER had any problem. Now, I've also had a Linux web server up for about 15 years, and have had 2 successful penetrations. One was totally innocuous, they just added a phishing web site for a bank, and it was easy to remove. Another attack put in a root kit, and it caused a major mess, including me sending out some infected code to other people. (OOPS, red face!!) These were both done by cracking insecure passwords on my system. The best defense for that is running denyhosts, which counts login failures that IP after a threshold. I set it very tight, two failed attempts within a month and you are out for a year. It was VERY interesting, exactly, to the HOUR, two weeks after I set this up, the 1000 per day attempts to break in dropped to 3 a day. This means the botnets actively track how long the horizon on the login failures is set, and they've been programmed to give up on any node that has a horizon over 2 weeks. Jon

I remember my Salesman (well he was the Company Salesman but we worked together) once recounted an interview he had heard on US Radio... .. Basically they were interviewing a Bank Robber and they asked him why he robbed banks when they had armed guards and heavy security.. .. His response was that they also had lots of money. He said he thought it pointless taking risks robbing the local store when the till might be empty... The same goes for the Crypto Lockers. There are plenty of Windows users who run with un-patched systems and who randomly open attachments and who have lots of money. In any medium sized business there will be dependencies on Browser and Java versions, or on old un-supported software. We are seeing an increase in attacks on Apple software and their monthly patch list is not shrinking and from this:- http://www.cnet.com/uk/news/apple-squashes-serious-security-bug-with-update- to-mac-os-x/ it appears they are resorting to hacks to close doors never a great idea..... .. so if Linux was truly popular I think we might see CryptoLocker attacks. It doesn't need root access, just access to the data, and so long as it can infect the users start up scripts it can hide their documents and anything else they have access to... "Security" isn't just about secure software, it?s a total mind set. One slip and you are doomed. I am pretty careful but even I managed to install the d at mmed Ask tool bar whilst updating Java... .. in my humble opinion many Linux users are rather more blas? about the security of the OS that they should be.... Dave Wade G4UGM if you systems, it is a a

Absolutely true, and I will admit that I have fallen into the trap, too. But, it has worked well so far! Jon