wcSECURE "The Platinum Standard of BBS Caller Verification" BBS Security Hints & Tips from the Author of wcSECURE, Joe Goeller. In the world of BBS's, there are several types of Sysops. Most of them can be broken down into two groups. Those that verify, and those that don't. For those Sysops who don't care who connects to their BBS, or if they are using a dozen fake log in accounts to cheat the time or file downloading limits, this file and the wcSECURE program won't be of much use to you. I wrote the program and then followed up with this hints file in an effort to aid the newer sysop with the chore of operating a fine tuned BBS. Before we dive into the core of the Hints & Tips, I've decided to relate a short story to you about one of our local sysops. I'll leave all names and factual references out of this document to preserve their privacy. About 1 1/2 years ago, a local caller to the board decided to open up their own BBS. Being a freelancing, non verifying type, this sysop opened up the BBS to all callers, no limits, no verification, etc.... About 6 months ago, this Sysop spent numerous e-mail messages back and forth to me, talking about all the problems this sysop had developed as a result of not verifying callers, and allowing anyone onto the BBS. This sysop wanted to know what they could do to stop all the trouble that had occured as a result of this open ended BBS. My first advise was to limit access, until callers could be verified, at least to some degree. This sysop was concerned about being labeled a "control freak" (kiddie hackers often refer to BBS sysops that verify their callers as "control freaks", because they can't have their 12 or so log in names to defeat any time or downloading limits) After some hard months, and trying to get a handle on things, this sysop was able to take the "control" back from the kiddie hackers. Moral to the story: "Verify your callers from Day 1 and avoid all of the problems in the future!" One important thing to keep in mind. Your BBS is an extension of your home or office. You don't permit people you don't know to roam around your house for as long as they want or do anything they want while they are there, do you? Of course not. You are the sysop of YOUR BBS. You can have as little or as much involvement in your BBS as you'd like. If you're running it parttime and only a few hours a day, screening your callers may not be as important. But if you're on-line 24 hours a day, and become a popular system, you'll want to have a handle on your callers, so that everyone has a fair chance to call your system (and not have the kiddie hackers with 12+ log in names tying up YOUR BBS for hours everyday). Onto the Hints & Tips: Tip #1: Only use REAL NAMES for logging in. BBS's which allow alias names for logging in will have tremendous difficulty in keeping track of things. Additionally, many kiddie hackers refuse to use their real name on BBS's, and as such, won't call those BBS's which require them! Tip #2: Require REAL phone Numbers & other Caller Information. If you get to be a popular BBS, you'll want to be able to make sure your caller database is complete, not only for the liability concerns, but for security as well. Tip #3: Verify your callers! How you verify your callers is your choice. Voice verification offers a high degree of security for your BBS. Voice verification, plus a screening program, such as wcSECURE will give you the most secure environment. Part of the reason I created wcSECURE was out of my own personal need. I wanted something that would tell me if someone was duplicated on the system. There are some freeware programs which give you a printout of duplicated caller information, but I found these to be difficult to use at best. By checking for duplicated information from the callers very first call, I found this to be highly effective in screening callers. Many callers with multi-first names like Richard, were calling back a week or so later with RICH, RICK, etc. In the first week of beta testing, 2 callers using this approach were accurately identifed by wcSECURE. Continued use has shown that numerous callers are calling back with variations of their first names. Honest mistake or ???? Tip #4. Have a consistant policy regarding people who try and cheat your BBS. By always handling the "less than honorable" callers the same way, you eliminate the "personal" attack that some callers may feel. If you set down the rules, and someone violates the rules, they should realize what will happen to them and not feel that they are being singled out for some reason. Tip #5. (WC 4.0x and newer) Place your disclaimer in your QUESNEW (New User Questionnaire) file. By displaying this file and the all important qualifying question "Do you agree to follow the rules" (or what ever is correct for your BBS) within the new caller questionnaire, you can politely "hang up" on the caller if they answer no. What makes this so great, is that the caller is never logged into the BBS, and you don't have to worry about them! (If you'd like more info on specifically how to do this, please feel to contact me!) Tip #6. Use Wildcats! Built in fake number screening. When someone logs into your BBS using 111-111-1111 as their phone number, Wildcat! will send them a display file, then log them off. Wildcat! has this feature fairly well documented, however, if you'd like help in setting up the text file which contains the bogus phone numbers, just let me know. Tip #7. Use Wildcats! built in alias name filter. By requiring real names, you can effectively prevent callers using names like "master blaster" or "ghost rider" from calling your BBS. Wildcat! does an excellent job in this regard, and with a comprehensive filtering file, you'll deter most fake names from even logging in! Tip #8. Always use Wildcat! BBS software. It not only give you and your callers the easiest BBS to use and operate, it also gives you the most secure BBS! My goal with this hints file, and the program wcSECURE is to give sysops an edge on the problem callers, that are out there, and that will try all sorts of things to cheat YOUR BBS. I hope this information is helpful, and if you'd like additional help with BBS security, feel free to contact me (the info is posted in the SYSOP.DOC file). Joe Goeller has been a Wildcat! Sysop for 4 years, and has been a specialist in the area of digital security for nearly a decade. (Wildcat! is a registered Trade Mark of Mustang Software, Inc)