Index Journeys
RFC 602 UNKNOWN SECURITY · ACCESS CONTROL · INFRASTRUCTURE

Network Security: "The stockings were hung by the chimney with care"

Early ARPANET security vulnerabilities and warnings

On rfc-editor.org ↗
PUBLISHED
December 1973
AUTHORS
R.M. Metcalfe
STREAM
Legacy
DOI
10.17487/RFC0602

RFC text

Original text · RFC Editor View on rfc-editor.org ↗ 
Arpa Network Working Group                             Bob Metcalfe (PARC-MAXC)
Request for Comments: 602                                              Dec 1973
NIC #21021



           "The Stockings Were Hung by the Chimney with Care"


The ARPA Computer Network is susceptible to security violations for at least
the three following reasons:

(1)  Individual sites, used to physical limitations on machine access, have
     not yet taken sufficient precautions toward securing their systems
     against unauthorized remote use.  For example, many people still use
     passwords which are easy to guess:  their fist names, their initials,
     their host name spelled backwards, a string of characters which are
     easy to type in sequence (e.g. ZXCVBNM).

(2)  The TIP allows access to the ARPANET to a much wider audience than
     is thought or intended.  TIP phone numbers are posted, like those
     scribbled hastily on the walls of phone booths and men's rooms.  The
     TIP required no user identification before giving service.  Thus,
     many people, including those who used to spend their time ripping off
     Ma Bell, get access to our stockings in a most anonymous way.

(3)  There is lingering affection for the challenge of breaking
     someone's system.  This affection lingers despite the fact that
     everyone knows that it's easy to break systems, even easier to
     crash them.

All of this would be quite humorous and cause for raucous eye
winking and elbow nudging, if it weren't for the fact that in
recent weeks at least two major serving hosts were crashed
under suspicious circumstances by people who knew what they
were risking; on yet a third system, the system wheel password
was compromised -- by two high school students in Los Angeles
no less.

We suspect that the number of dangerous security violations is
larger than any of us know is growing.  You are advised
not to sit "in hope that Saint Nicholas would soon be there".



RMV:rmv

AI ELI5

On this page
PROBLEMThe early ARPANET had multiple security weaknesses: many systems used guessable passwords, TIP access points were publicly listed with no authentication required, and some people enjoyed breaking into systems as a challenge.
MECHANISMThe RFC documents three categories of vulnerability and cites recent real incidents, including two major hosts that were crashed and an administrator password compromised by high school students in Los Angeles.
EARLY WARNING HEEDEDThis early warning helped motivate better security practices in network systems and demonstrated that network security was a serious problem that required intentional design.

§1The Three Main Vulnerabilities

RFC 602 identifies three fundamental security problems in the ARPANET:

Weak passwords: Many users still chose passwords that were easy to guess: their first names, initials, their host name spelled backwards, or sequences of letters that were easy to type in sequence (such as ZXCVBNM). This assumption that physical access controls were sufficient to protect systems made sense locally, but not on a network.

Open access points: The Terminal IMP (TIP) allowed untrained users to access the network with no authentication. TIP phone numbers were posted publicly, like handwritten notes in phone booths and men's rooms. Anyone with a modem could try to dial in.

The challenge: Despite—or perhaps because of—how easy it was to break into systems, some people pursued it as a game. They knew the risks but were drawn to the challenge of defeating someone's security.

Passwords were too easy to guess. You could dial in without proving who you were. And some people thought breaking in was fun.

§2Recent Attacks

The RFC's authors make clear that this is not a theoretical problem. In recent weeks, at least two major serving hosts had been crashed by attackers who knew what they were doing and took the risk anyway. On a third system, the system administrator's password had been compromised—by two high school students in Los Angeles, no less.

These were not accidental mishaps; they were deliberate attacks on critical systems. The sheer fact that teenagers with modems could compromise major ARPA-supported systems was alarming to the network operators.

Real attacks had already happened. Actual computers on the network got knocked down. People who shouldn't have been able to get in, did.

§3A Serious Call to Arms

The tone of RFC 602 is unusual for a technical document. Its title echoes the opening of a famous Christmas poem ("The Stockings Were Hung by the Chimney with Care"), framing the warning in holiday language. Yet the message is clear and urgent: network operators should not sit idle in "hope that Saint Nicholas would soon be there."

The RFC's publication signaled to the network community that security vulnerabilities were not just embarrassing bugs to hide—they were a serious concern affecting the reliability and trustworthiness of the entire ARPANET. Systems needed deliberate, careful security design.

The note uses funny language, but the message is serious: stop waiting for someone else to fix this. You have to lock the doors yourself.