Snooping ISP admin??

Greetings All,

Question for the group:  I have encountered a situation that causes me
to believe an ISP is snoopingthrough encrytped mail.  It seems that
PGP'd mail has aroused the curiosity of an ISP (not hooked.net).. I have
encountered "POP3 account in use by another user" several times in the
past few days and I am the only user... wondering if that "in use"
messsage is the result of a clumsy sysadmin being caught with his hand
in the cookie jar.  Any thoughts from the group???  If those more
knowledgeable than I deem these NOISE... my sincere apologies.

regards,
Michael E. Carboy
carboy@hooked.net
carboy@carboy.com

Michael E. Carboy writes:
> 
> Greetings All,
> 
> Question for the group:  I have encountered a situation that causes me
> to believe an ISP is snoopingthrough encrytped mail.  It seems that
> PGP'd mail has aroused the curiosity of an ISP (not hooked.net).. I have
> encountered "POP3 account in use by another user" several times in the
> past few days and I am the only user... wondering if that "in use"
> messsage is the result of a clumsy sysadmin being caught with his hand
> in the cookie jar. 

It's from a clumsy programmer- popd is known to hang up under
certain conditions.

> Any thoughts from the group??? 

If the sysadmin is reading your PGP mail, let him.  It's very very
unlikely that he has the resources available to crack a PGP
message in this century.


-- 
Eric Murray  ericm@lne.com  ericm@motorcycle.com  http://www.lne.com/ericm
PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03  92 E8 AC E6 7E 27 29 AF

On Mon, 23 Sep 1996, Michael E. Carboy wrote:

> Greetings All,
> 
> Question for the group:  I have encountered a situation that causes me
> to believe an ISP is snoopingthrough encrytped mail.  It seems that
> PGP'd mail has aroused the curiosity of an ISP (not hooked.net).. I have
> encountered "POP3 account in use by another user" several times in the
> past few days and I am the only user... wondering if that "in use"
> messsage is the result of a clumsy sysadmin being caught with his hand
> in the cookie jar.  Any thoughts from the group???  If those more
> knowledgeable than I deem these NOISE... my sincere apologies.
	All I got to say is that if a admin wanted to get your mail using
POP3 would be last thing one would try. Since the admin reign over the
machine he could just copy your mail file and do what he wishes at this
point. Besides most admins including myself really want to bother talking
to users most of the time let alone read there mail.

							Carlos

> 
> Greetings All,
> 
> Question for the group:  I have encountered a situation that causes me
> to believe an ISP is snoopingthrough encrytped mail.  It seems that
> PGP'd mail has aroused the curiosity of an ISP (not hooked.net).. I have
> encountered "POP3 account in use by another user" several times in the
> past few days and I am the only user... wondering if that "in use"
> messsage is the result of a clumsy sysadmin being caught with his hand
> in the cookie jar.  Any thoughts from the group???  If those more
> knowledgeable than I deem these NOISE... my sincere apologies.

An admin could just copy the mail spool file to a safer place, then read
through at their leisure.

Unless its someone totally clueless (which some ISP's are), I doubt that
they are pulling off the pop3d.  It could be that your mail spool file is
locked by a mail transport agent, and that is why that error message is
occuring.

Any thoughts?

On Mon, 23 Sep 1996, Douglas R. Floyd wrote:

> > 
> > Greetings All,
> > 
> > Question for the group:  I have encountered a situation that causes me
> > to believe an ISP is snoopingthrough encrytped mail.  It seems that
> > PGP'd mail has aroused the curiosity of an ISP (not hooked.net).. I have
> > encountered "POP3 account in use by another user" several times in the
> > past few days and I am the only user... wondering if that "in use"
> > messsage is the result of a clumsy sysadmin being caught with his hand
> > in the cookie jar.  Any thoughts from the group???  If those more
> > knowledgeable than I deem these NOISE... my sincere apologies.
> 
> An admin could just copy the mail spool file to a safer place, then read
> through at their leisure.
> 
> Unless its someone totally clueless (which some ISP's are), I doubt that
> they are pulling off the pop3d.  It could be that your mail spool file is
> locked by a mail transport agent, and that is why that error message is
> occuring.
> 
> Any thoughts?
> 

This is probably somewhat system dependant, but I'm guessing that any 
lock on the file "could" generate the message that the account is "in use."

Could be a lock which was not cleared from a previous session, a backup 
system that wants exclusive reads on the files, etc., not necessarily 
another POP3 session. As for the sysadmin side, yes, there are other, 
easier methods of getting at the mail file. OTOH, could be someone inside 
an ISP (or not), who does not have access to the file structure, but did 
somehow obtain passwords through other means. Any ISP of any size will 
have different levels of access for different employees, and the 
graveyard helpdesk shift can get fairly dull ...

It is more than likely a system-related problem with a file lock, though.

I'd suggest changing your password, and making sure that you don't use a 
dictionary word or obvious permutation thereof. If you continue to have 
problems, check with the ISP about your "technical difficulties", and see 
what they come up with.

Just my $.02

- r.w.

> > Question for the group:  I have encountered a situation that causes me
> > to believe an ISP is snoopingthrough encrytped mail.  It seems that
> > PGP'd mail has aroused the curiosity of an ISP (not hooked.net).. I have
> > encountered "POP3 account in use by another user" several times in the
> > past few days and I am the only user... wondering if that "in use"
> > messsage is the result of a clumsy sysadmin being caught with his hand
> > in the cookie jar.  Any thoughts from the group???  If those more
> > knowledgeable than I deem these NOISE... my sincere apologies.
> 
> An admin could just copy the mail spool file to a safer place, then read
> through at their leisure.
> 
> Unless its someone totally clueless (which some ISP's are), I doubt that
> they are pulling off the pop3d.  It could be that your mail spool file is
> locked by a mail transport agent, and that is why that error message is
> occuring.
> 
> Any thoughts?

As someone who has operated an ISP himself, I would say that the
likelihood of this being a system problem is very high. Especially if this
is a relatively new ISP, or if they've upgraded anything at all on their
mail server, it's pretty easy to break the delicate balance of daemons and
permissions such that this problem could easily occur.

It's worth a call to their technical support line (I know.. I'm sure it's
always busy) just to inform them of the problem. Sometimes it'll time out
(if it's one kind of problem) and sometimes it'll hang there until a lock
file is specifically removed (a different kind of problem).

All other comments regarding the likelihood that a sysadmin would try to
read mail in the real environment apply. 

Jason

-----BEGIN PGP SIGNED MESSAGE-----

On Mon, 23 Sep 1996, Michael E. Carboy wrote:

> Greetings All,
> 
> Question for the group:  I have encountered a situation that causes me
> to believe an ISP is snoopingthrough encrytped mail.  It seems that
> PGP'd mail has aroused the curiosity of an ISP (not hooked.net).. I have
> encountered "POP3 account in use by another user" several times in the
> past few days and I am the only user... wondering if that "in use"
> messsage is the result of a clumsy sysadmin being caught with his hand
> in the cookie jar.  Any thoughts from the group???  If those more
> knowledgeable than I deem these NOISE... my sincere apologies.

Any sysadmin using POP3 to snoop through your mail would have to be a complete
moron.  It's much easier to just "cat /usr/spool/mail/user" which is
undetectable.  The sysadmin could then use touch to set the "last read" value
to the previous value.  Anyone with complete access to the POP3 server would
be able to snoop through anyone's mail undetected.  My guess is that you are
getting that error from a stale lockfile.  If any sysadmin is snooping through
your mail, you wouldn't know it.

Mark
- -- 
PGP encrypted mail prefered.
Key fingerprint = d61734f2800486ae6f79bfeb70f95348
http://www.voicenet.com/~markm/

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3
Charset: noconv

iQEVAwUBMka/4CzIPc7jvyFpAQGc8gf/WgKKIzTnh+FO3V8YLEn4ZjFL1SVtMzyT
SsOQ+DXiEPt4Cul4PKGaBtmkvJoVgUuVp6HanbQAtsQhCBi/P5xrVU2lvIjx4K/+
c0PfSmbpc8GrAy8QeCpGMRkBYOgPyqG3A+v7nG7NGcxsShiGewMbAfjpKz/mKjsU
tqAc5VUHTAIbuvUW8OUss0u8/6DmRFcfxNmtGJXw7bgfnxilwpRsW5cUEyJaO0ni
pBbiN41nssXP5pYN75odZBzEpycmwdRfLaEHCIV0yKFSfugYNI5mUWqpMVxe25bL
csel/zdg07B3NRvLg3LJ6kf73WUS3U+KDl7Rgt7Yv0qbEZRl+hk4fA==
=DIH1
-----END PGP SIGNATURE-----