Slashdot Mirror

← Back to Stories (view on slashdot.org)

Was This the First Denial of Service Attack?

Posted by timothy on from the read-the-disclaimer-about-calling-first dept.

An anonymous reader writes "Way back in 1974, Dave Dennis, then aged 13, decided to try out the -ext- TUTOR command on the PLATO system at the University of Illinois, and see if he could cause all the terminals of other users to go offline. It worked. And he never got caught. Of course, the powers that be eventually caught on and fixed the -ext- command so terminals by default didn't automatically receive -ext-'s sent from other locations."

3 of 166 comments (clear)

  1. So they could receive commands!? by Darkness404 · · Score: 5, Insightful

    So, let me get this right. You could more or less get a list of addresses, and they would accept commands without question if you just typed in the commands and the right address? Sounds like the worst security system ever.

    --
    Taxation is legalized theft, no more, no less.
    1. Re:So they could receive commands!? by Anonymous Coward · · Score: 5, Insightful

      So, let me get this right. You could more or less get a list of addresses, and they would accept commands without question if you just typed in the commands and the right address? Sounds like the worst security system ever.

      Yeah, but this was 1974, when overly-trusting users used commands to do USEFUL things, rather than cause mischief (or shove adverts in front of you)!

    2. Re:So they could receive commands!? by mysidia · · Score: 5, Insightful

      They were crypted... why would you need to hide a strong password that was crypted? Shadow'ed passwords are an ugly hack.

      Also, if you restrict "shadow" passwords so only root can see them, then suddenly every program that needs to perform authentication must be setuid root...... this is a security risk. In that era, possibly a much larger security risk than the risk of a strong password being cracked.

      The problem wasn't failing to use shadow passwords. It was (1) UNIX users who set weak passwords, and (later), an (2) explosion in computing power, making it easier to attempt to crack the passwords.

      Also, the reverse-engineering of the original DES-based crypt binaries allowed inefficiency that was intentionally contained in the algorithm to slow it down (making use for cracking improbable), to be removed, after years of study.

      The DES-based crypt() algorithm was optimized into fast-crypt which was orders of magnitude faster, and actually made password cracking feasible. If a harder cryptographic algorithm would have been used -- then matters could be very different.

      The latter bit they should have seen coming. The explosion in computing power was by no means a certain development, it wasn't an immediate issue at the time.