Network Security: "The stockings were hung by the chimney with care"
A warning about weak passwords, unauthenticated TIP access and break-ins.
Metcalfe, R.M., ""The stockings were hung by the chimney with care"", RFC 602, DOI 10.17487/RFC0602, December 1973, <https://www.rfc-editor.org/info/rfc602>.
@misc{rfc602,
series = {Request for Comments},
number = 602,
howpublished = {RFC 602},
publisher = {RFC Editor},
doi = {10.17487/RFC0602},
url = {https://www.rfc-editor.org/info/rfc602},
author = {R.M. Metcalfe},
title = {{"The stockings were hung by the chimney with care"}},
pagetotal = 1,
year = 1973,
month = dec,
} RFC text
Arpa Network Working Group Bob Metcalfe (PARC-MAXC)
Request for Comments: 602 Dec 1973
NIC #21021
"The Stockings Were Hung by the Chimney with Care"
The ARPA Computer Network is susceptible to security violations for at least
the three following reasons:
(1) Individual sites, used to physical limitations on machine access, have
not yet taken sufficient precautions toward securing their systems
against unauthorized remote use. For example, many people still use
passwords which are easy to guess: their fist names, their initials,
their host name spelled backwards, a string of characters which are
easy to type in sequence (e.g. ZXCVBNM).
(2) The TIP allows access to the ARPANET to a much wider audience than
is thought or intended. TIP phone numbers are posted, like those
scribbled hastily on the walls of phone booths and men's rooms. The
TIP required no user identification before giving service. Thus,
many people, including those who used to spend their time ripping off
Ma Bell, get access to our stockings in a most anonymous way.
(3) There is lingering affection for the challenge of breaking
someone's system. This affection lingers despite the fact that
everyone knows that it's easy to break systems, even easier to
crash them.
All of this would be quite humorous and cause for raucous eye
winking and elbow nudging, if it weren't for the fact that in
recent weeks at least two major serving hosts were crashed
under suspicious circumstances by people who knew what they
were risking; on yet a third system, the system wheel password
was compromised -- by two high school students in Los Angeles
no less.
We suspect that the number of dangerous security violations is
larger than any of us know is growing. You are advised
not to sit "in hope that Saint Nicholas would soon be there".
RMV:rmv
ISO Plain Language
On this page
§1Three Sources of Security Risk
The RFC identifies three reasons for security violations. Some sites had not adapted to remote access and still used easy-to-guess passwords, such as first names, initials, reversed host names or keyboard sequences. TIP phone numbers were publicly posted, and a TIP did not require user identification before providing network access. The author also describes a continuing interest among some people in breaking into systems.
Some passwords were easy to guess, and a person could reach a TIP without first identifying themselves. The author also says some people treated breaking into systems as a challenge.
§2Incidents the Author Cites
The author says the situation would be humorous if recent events were not serious: at least two major serving hosts had crashed under suspicious circumstances in recent weeks, and a system wheel password had been compromised by two high school students in Los Angeles. The RFC does not give names for these systems or further details about the incidents.
The author points to recent incidents as evidence that the risks were real. The note does not identify the affected hosts.
§3A Call to Take the Risk Seriously
The author suspects that dangerous security violations are increasing and may be more common than the community knows. The RFC ends by warning readers not to wait passively for a solution.
The author urges people responsible for network systems to act rather than assume that someone else will solve the security problem.