Visit https://ebookultra.

com to download the full version and

explore more ebooks or textbooks

Practical Hadoop Security 1st ed. Edition Lakhe

_____ Click the link below to download _____

https://ebookultra.com/download/practical-hadoop-
security-1st-ed-edition-lakhe/

Explore and download more ebooks or textbooks at ebookultra.com

Here are some recommended products that we believe you will be
interested in. You can click the link to download.

Hadoop Security Protecting Your Big Data Platform 1st

Edition Ben Spivey

https://ebookultra.com/download/hadoop-security-protecting-your-big-
data-platform-1st-edition-ben-spivey/

Hadoop in Action Chuck Lam

https://ebookultra.com/download/hadoop-in-action-chuck-lam/

Hadoop For Dummies 1st Edition Dirk Deroos

https://ebookultra.com/download/hadoop-for-dummies-1st-edition-dirk-
deroos/

Cloud storage security a practical guide 1st Edition

Wheeler

https://ebookultra.com/download/cloud-storage-security-a-practical-
guide-1st-edition-wheeler/
Endpoint Security 1st ed Edition Mark Kadrich

https://ebookultra.com/download/endpoint-security-1st-ed-edition-mark-
kadrich/

Thor s Microsoft security bible a collection of practical

security techniques 1st Edition Timothy ''Thor'' Mullen

https://ebookultra.com/download/thor-s-microsoft-security-bible-a-
collection-of-practical-security-techniques-1st-edition-timothy-thor-
mullen/

Practical OpenCV 1st ed Edition Brahmbhatt

https://ebookultra.com/download/practical-opencv-1st-ed-edition-
brahmbhatt/

Security guide to network security fundamentals 3rd ed

Edition Mark D Ciampa

https://ebookultra.com/download/security-guide-to-network-security-
fundamentals-3rd-ed-edition-mark-d-ciampa/

Information Security Governance A Practical Development

and Implementation Approach 1st Edition Krag Brotby

https://ebookultra.com/download/information-security-governance-a-
practical-development-and-implementation-approach-1st-edition-krag-
brotby/
Practical Hadoop Security 1st ed. Edition Lakhe Digital
Instant Download
Author(s): Lakhe, Bhushan
ISBN(s): 9781430265443, 1430265442
Edition: 1st ed.
File Details: PDF, 5.33 MB
Year: 2014
Language: english
For your convenience Apress has placed some of the front
matter material after the index. Please use the Bookmarks
and Contents at a Glance links to access them.
Contents at a Glance

About the Author���������������������������������������������������������������������������������������������������������������xiii

About the Technical Reviewer�������������������������������������������������������������������������������������������� xv
Acknowledgments������������������������������������������������������������������������������������������������������������ xvii
Introduction����������������������������������������������������������������������������������������������������������������������� xix

■■Part I: Introducing Hadoop and Its Security ������������������������������������������������ 1

■■Chapter 1: Understanding Security Concepts �������������������������������������������������������������������3
■■Chapter 2: Introducing Hadoop����������������������������������������������������������������������������������������19
■■Chapter 3: Introducing Hadoop Security ������������������������������������������������������������������������37

■■Part II: Authenticating and Authorizing Within Your Hadoop Cluster �������� 49
■■Chapter 4: Open Source Authentication in Hadoop���������������������������������������������������������51
■■Chapter 5: Implementing Granular Authorization�����������������������������������������������������������75

■■Part III: Audit Logging and Security Monitoring����������������������������������������� 95

■■Chapter 6: Hadoop Logs: Relating and Interpretation�����������������������������������������������������97
■■Chapter 7: Monitoring in Hadoop�����������������������������������������������������������������������������������119

■■Part IV: Encryption for Hadoop����������������������������������������������������������������� 143

■■Chapter 8: Encryption in Hadoop�����������������������������������������������������������������������������������145

v
■ Contents at a Glance

■■Part V: Appendices����������������������������������������������������������������������������������� 169

■■Appendix A: Pageant Use and Implementation��������������������������������������������������������������171
■■Appendix B: PuTTY and SSH Implementation for Linux-Based Clients��������������������������177
■■Appendix C: Setting Up a KeyStore and TrustStore for HTTP Encryption������������������������181
■■Appendix D: Hadoop Metrics and Their Relevance to Security�������������������������������������183

Index���������������������������������������������������������������������������������������������������������������������������������191

vi
Introduction

Last year, I was designing security for a client who was looking for a reference book that talked about security
implementations in the Hadoop arena, simply so he could avoid known issues and pitfalls. To my chagrin, I couldn’t
locate a single book for him that covered the security aspect of Hadoop in detail or provided options for people who
were planning to secure their clusters holding sensitive data! I was disappointed and surprised. Everyone planning to
secure their Hadoop cluster must have been going through similar frustration. So I decided to put my security design
experience to broader use and write the book myself.
As Hadoop gains more corporate support and usage by the day, we all need to recognize and focus on the
security aspects of Hadoop. Corporate implementations also involve following regulations and laws for data
protection and confidentiality, and such security issues are a driving force for making Hadoop “corporation ready.”
Open-source software usually lacks organized documentation and consensus on performing a particular
functional task uniquely, and Hadoop is no different in that regard. The various distributions that mushroomed in last
few years vary in their implementation of various Hadoop functions, and some, such as authorization or encryption,
are not even provided by all the vendor distributions. So, in this way, Hadoop is like Unix of the ’80s or ’90s: Open
source development has led to a large number of variations and in some cases deviations from functionality. Because
of these variations, devising a common strategy to secure your Hadoop installation is difficult. In this book, I have
tried to provide a strategy and solution (an open source solution when possible) that will apply in most of the cases,
but exceptions may exist, especially if you use a Hadoop distribution that’s not well-known.
It’s been a great and exciting journey developing this book, and I deliberately say “developing,” because I believe
that authoring a technical book is very similar to working on a software project. There are challenges, rewards, exciting
developments, and of course, unforeseen obstacles—not to mention deadlines!

Who This Book Is For

This book is an excellent resource for IT managers planning a production Hadoop environment or Hadoop
administrators who want to secure their environment. This book is also for Hadoop developers who wish to
implement security in their environments, as well as students who wish to learn about Hadoop security. This book
assumes a basic understanding of Hadoop (although the first chapter revisits many basic concepts), Kerberos,
relational databases, and Hive, plus an intermediate-level understanding of Linux.

How This Book Is Structured

The book is divided in five parts: Part I, “Introducing Hadoop and Its Security,” contains Chapters 1, 2, and 3; Part II,
“Authenticating and Authorizing Within Your Hadoop Cluster,” spans Chapters 4 and 5; Part III, “Audit Logging and
Security Monitoring,” houses Chapters 6 and 7; Part IV, “Encryption for Hadoop,” contains Chapter 8; and Part V holds
the four appendices.

xix
■ Introduction

Here’s a preview of each chapter in more detail:

• Chapter 1, “Understanding Security Concepts,” offers an overview of security, the security
engineering framework, security protocols (including Kerberos), and possible security attacks.
This chapter also explains how to secure a distributed system and discusses Microsoft SQL
Server as an example of secure system.
• Chapter 2, “Introducing Hadoop,” introduces the Hadoop architecture and Hadoop
Distributed File System (HDFS), and explains the security issues inherent to HDFS and why
it’s easy to break into a HDFS installation. It also introduces Hadoop’s MapReduce framework
and discusses its security shortcomings. Last, it discusses the Hadoop Stack.
• Chapter 3, “Introducing Hadoop Security,” serves as a roadmap to techniques for designing
and implementing security for Hadoop. It introduces authentication (using Kerberos) for
providing secure access, authorization to specify the level of access, and monitoring for
unauthorized access or unforeseen malicious attacks (using tools like Ganglia or Nagios).
You’ll also learn the importance of logging all access to Hadoop daemons (using the Log4j
logging system) and importance of data encryption (both in transit and at rest).
• Chapter 4, “Open Source Authentication in Hadoop,” discusses how to secure your Hadoop
cluster using open source solutions. It starts by securing a client using PuTTY, then describes
the Kerberos architecture and details a Kerberos implementation for Hadoop step by step. In
addition, you’ll learn how to secure interprocess communication that uses the RPC (remote
procedure call) protocol, how to encrypt HTTP communication, and how to secure the data
communication that uses DTP (data transfer protocol).
• Chapter 5, “Implementing Granular Authorization,” starts with ways to determine
security needs (based on application) and then examines methods to design fine-grained
authorization for applications. Directory- and file-level permissions are demonstrated using
a real-world example, and then the same example is re-implemented using HDFS Access
Control Lists and Apache Sentry with Hive.
• Chapter 6, “Hadoop Logs: Relating and Interpretation,” discusses the use of logging for
security. After a high-level discussion of the Log4j API and how to use it for audit logging, the
chapter examines the Log4j logging levels and their purposes. You’ll learn how to correlate
Hadoop logs to implement security effectively, get a look at Hadoop analytics and a possible
implementation using Splunk.
• Chapter 7, “Monitoring in Hadoop,” discusses monitoring for security. It starts by discussing
features that a monitoring system needs, with an emphasis on monitoring distributed clusters.
Thereafter, it discusses the Hadoop metrics you can use for security purposes and examines
the use of Ganglia and Nagios, the two most popular monitoring applications for Hadoop. It
concludes by discussing some helpful plug-ins for Ganglia and Nagios that provide security-
related functionality and also discusses Ganglia integration with Nagios.
• Chapter 8, “Encryption in Hadoop,” begins with some data encryption basics, discusses
popular encryption algorithms and their applications (certificates, keys, hash functions,
digital signatures), defines what can be encrypted for a Hadoop cluster, and lists some of the
popular vendor options for encryption. A detailed implementation of HDFS and Hive data at
rest follows, showing Intel’s distribution in action. The chapter concludes with a step-by-step
implementation of encryption at rest using Elastic MapReduce VM (EMR) from Amazon Web
Services.

xx
 ■ Introduction

Downloading the Code

The source code for this book is available in ZIP file format in the Downloads section of the Apress web site
(www.apress.com).

Contacting the Author

You can reach Bhushan Lakhe at [email protected] or [email protected].

xxi
Part I

Introducing Hadoop and Its Security

Chapter 1

Understanding Security Concepts

In today’s technology-driven world, computers have penetrated all walks of our life, and more of our personal and
corporate data is available electronically than ever. Unfortunately, the same technology that provides so many
benefits can also be used for destructive purposes. In recent years, individual hackers, who previously worked mostly
for personal gain, have organized into groups working for financial gain, making the threat of personal or corporate
data being stolen for unlawful purposes much more serious and real. Malware infests our computers and redirects
our browsers to specific advertising web sites depending on our browsing context. Phishing emails entice us to log
into web sites that appear real but are designed to steal our passwords. Viruses or direct attacks breach our networks
to steal passwords and data. As Big Data, analytics, and machine learning push into the modern enterprise, the
opportunities for critical data to be exposed and harm to be done rise exponentially.
If you want to counter these attacks on your personal property (yes, your data is your personal property) or your
corporate property, you have to understand thoroughly the threats as well as your own vulnerabilities. Only then can
you work toward devising a strategy to secure your data, be it personal or corporate.
Think about a scenario where your bank’s investment division uses Hadoop for analyzing terabytes of data and
your bank’s competitor has access to the results. Or how about a situation where your insurance company decides
to stop offering homeowner’s insurance based on Big Data analysis of millions of claims, and their competitor, who
has access (by stealth) to this data, finds out that most of the claims used as a basis for analysis were fraudulent? Can
you imagine how much these security breaches would cost the affected companies? Unfortunately, only the breaches
highlight the importance of security. To its users, a good security setup—be it personal or corporate—is always
transparent.
This chapter lays the foundation on which you can begin to build that security strategy. I first define a security
engineering framework. Then I discuss some psychological aspects of security (the human factor) and introduce
security protocols. Last, I present common potential threats to a program’s security and explain how to counter
those threats, offering a detailed example of a secure distributed system. So, to start with, let me introduce you to the
concept of security engineering.

Introducing Security Engineering

Security engineering is about designing and implementing systems that do not leak private information and can
reliably withstand malicious attacks, errors, or mishaps. As a science, it focuses on the tools, processes, and methods
needed to design and implement complete systems and adapt existing systems.
Security engineering requires expertise that spans such dissimilar disciplines as cryptography, computer
security, computer networking, economics, applied psychology, and law. Software engineering skills (ranging from
business process analysis to implementation and testing) are also necessary, but are relevant mostly for countering
error and “mishaps”—not for malicious attacks. Designing systems to counter malice requires specialized skills and,
of course, specialized experience.

3
Chapter 1 ■ Understanding Security Concepts

Security requirements vary from one system to another. Usually you need a balanced combination of user
authentication, authorization, policy definition, auditing, integral transactions, fault tolerance, encryption, and
isolation. A lot of systems fail because their designers focus on the wrong things, omit some of these factors, or
focus on the right things but do so inadequately. Securing Big Data systems with many components and interfaces
is particularly challenging. A traditional database has one catalog, and one interface: SQL connections. A Hadoop
system has many “catalogs” and many interfaces (Hadoop Distributed File System or HDFS, Hive, HBase). This
increased complexity, along with the varied and voluminous data in such a system, introduces many challenges for
security engineers.
Securing a system thus depends on several types of processes. To start with, you need to determine your security
requirements and then how to implement them. Also, you have to remember that secure systems have a very
important component in addition to their technical components: the human factor! That’s why you have to make sure
that people who are in charge of protecting the system and maintaining it are properly motivated. In the next section,
I define a framework for considering all these factors.

Security Engineering Framework

Good security engineering relies on the following five factors to be considered while conceptualizing a system:
• Strategy: Your strategy revolves around your objective. A specific objective is a good
starting point to define authentication, authorization, integral transactions, fault tolerance,
encryption, and isolation for your system. You also need to consider and account for possible
error conditions or malicious attack scenarios.
• Implementation: Implementation of your strategy involves procuring the necessary hardware
and software components, designing and developing a system that satisfies all your objectives,
defining access controls, and thoroughly testing your system to match your strategy.
• Reliability: Reliability is the amount of reliance you have for each of your system components
and your system as a whole. Reliability is measured against failure as well as malfunction.
• Relevance: Relevance decides the ability of a system to counter the latest threats. For it to
remain relevant, especially for a security system, it is also extremely important to update it
periodically to maintain its ability to counter new threats as they arise.
• Motivation: Motivation relates to the drive or dedication that the people responsible for
managing and maintaining your system have for doing their job properly, and also refers to
the lure for the attackers to try to defeat your strategy.
Figure 1-1 illustrates how these five factors interact.

Strategy

Implementation Reliability

Relevance Motivation

Figure 1-1. Five factors to consider before designing a security framework

4
 Chapter 1 ■ Understanding Security Concepts

Notice the relationships, such as strategy for relevance, implementation of a strategy, implementation of
relevance, reliability of motivation, and so on.
Consider Figure 1-1’s framework through the lens of a real-world example. Suppose I am designing a system to
store the grades of high school students. How do these five key factors come into play?
With my objective in mind—create a student grading system—I first outline a strategy for the system. To begin,
I must define levels of authentication and authorization needed for students, staff, and school administrators (the
access policy). Clearly, students need to have only read permissions on their individual grades, staff needs to have
read and write permissions on their students’ grades, and school administrators need to have read permissions on
all student records. Any data update needs to be an integral transaction, meaning either it should complete all the
related changes or, if it aborts while in progress, then all the changes should be reverted. Because the data is sensitive,
it should be encrypted—students should be able to see only their own grades. The grading system should be isolated
within the school intranet using an internal firewall and should prompt for authentication when anyone tries to use it.
My strategy needs to be implemented by first procuring the necessary hardware (server, network cards) and
software components (SQL Server, C#, .NET components, Java). Next is design and development of a system to meet
the objectives by designing the process flow, data flow, logical data model, physical data model using SQL Server, and
graphical user interface using Java. I also need to define the access controls that determine who can access the system
and with what permissions (roles based on authorization needs). For example, I define the School_Admin role with
read permissions on all grades, the Staff role with read and write permissions, and so on. Last, I need to do a security
practices review of my hardware and software components before building the system.
While thoroughly testing the system, I can measure reliability by making sure that no one can access data they
are not supposed to, and also by making sure all users can access the data they are permitted to access. Any deviation
from this functionality makes the system unreliable. Also, the system needs to be available 24/7. If it’s not, then that
reduces the system’s reliability, too. This system’s relevance will depend on its impregnability. In other words, no
student (or outside hacker) should be able to hack through it using any of the latest techniques.
The system administrators in charge of managing this system (hardware, database, etc.) should be reliable and
motivated to have good professional integrity. Since they have access to all the sensitive data, they shouldn’t disclose
it to any unauthorized people (such as friends or relatives studying at the high school, any unscrupulous admissions
staff, or even the media). Laws against any such disclosures can be a good motivation in this case; but professional
integrity is just as important.

Psychological Aspects of Security Engineering

Why do you need to understand the psychological aspects of security engineering? The biggest threat to your online
security is deception: malicious attacks that exploit psychology along with technology. We’ve all received phishing
e-mails warning of some “problem” with a checking, credit card, or PayPal account and urging us to “fix” it by logging
into a cleverly disguised site designed to capture our usernames, passwords, or account numbers for unlawful
purposes. Pretexting is another common way for private investigators or con artists to steal information, be it personal
or corporate. It involves phoning someone (the victim who has the information) under a false pretext and getting the
confidential information (usually by pretending to be someone authorized to have that information). There have been
so many instances where a developer or system administrator got a call from the “security administrator” and were
asked for password information supposedly for verification or security purposes. You’d think it wouldn’t work today,
but these instances are very common even now! It’s always best to ask for an e-mailed or written request for disclosure
of any confidential or sensitive information.
Companies use many countermeasures to combat phishing:
• Password Scramblers: A number of browser plug-ins encrypt your password to a strong,
domain-specific password by hashing it (using a secret key) and the domain name of the
web site being accessed. Even if you always use the same password, each web site you visit
will be provided with a different, unique password. Thus, if you mistakenly enter your Bank
of America password into a phishing site, the hacker gets an unusable variation of your real
password.

5
Chapter 1 ■ Understanding Security Concepts

• Client Certificates or Custom-Built Applications: Some banks provide their own laptops and
VPN access for using their custom applications to connect to their systems. They validate the
client’s use of their own hardware (e.g., through a media access control, or MAC address) and
also use VPN credentials to authenticate the user before letting him or her connect to their
systems. Some banks also provide client certificates to their users that are authenticated by
their servers; because they reside on client PCs, they can’t be accessed or used by hackers.
• Two-Phase Authentication: With this system, logon involves both a token password and
a saved password. Security tokens generate a password (either for one-time use or time
based) in response to a challenge sent by the system you want to access. For example, every
few seconds a security token can display a new eight-digit password that’s synchronized
with the central server. After you enter the token password, the system then prompts for
a saved password that you set up earlier. This makes it impossible for a hacker to use your
password, because the token password changes too quickly for a hacker to use it. Two-phase
authentication is still vulnerable to a real-time “man-in-the-middle” attack (see the
“Man-in-the-Middle Attack” sidebar for more detail).

MAN-IN-THE-MIDDLE ATTACK

A man-in-the-middle attack works by a hacker becoming an invisible relay (the “man in the middle”) between a
legitimate user and authenticator to capture information for illegal use. The hacker (or “phisherman”) captures the
user responses and relays them to the authenticator. He or she then relays any challenges from the authenticator
to the user, and any subsequent user responses to the authenticator. Because all responses pass through the
hacker, he is authenticated as a user instead of the real user, and hence is free to perform any illegal activities
while posing as a legitimate user!
For example, suppose a user wants to log in to his checking account and is enticed by a phishing scheme to
log into a phishing site instead. The phishing site simultaneously opens a logon session with the user’s bank.
When the bank sends a challenge; the phisherman relays this to the user, who uses his device to respond to it;
the phisherman relays this response to the bank, and is now authenticated to the bank as the user! After that,
of course, he can perform any illegal activities on that checking account, such as transferring all the money to his
own account.
Some banks counter this by using an authentication code based on last amount withdrawn, the payee account
number, or a transaction sequence number as a response, instead of a simple response.

• Trusted Computing: This approach involves installing a TPM (trusted platform module)
security chip on PC motherboards. TPM is a dedicated microprocessor that generates
cryptographic keys and uses them for encryption/decryption. Because localized hardware is
used for encryption, it is more secure than a software solution. To prevent any malicious code
from acquiring and using the keys, you need to ensure that the whole process of encryption/
decryption is done within TPM rather than TPM generating the keys and passing them to
external programs. Having such hardware transaction support integrated into the PC will
make it much more difficult for a hacker to break into the system. As an example, the recent
Heartbleed bug in OpenSSL would have been defeated by a TPM as the keys would not be
exposed in system memory and hence could not have been leaked.

6
 Chapter 1 ■ Understanding Security Concepts

• Strong Password Protocols: Steve Bellovin and Michael Merritt came up with a series of
protocols for encrypted key exchange, whereby a key exchange is combined with a shared
password in such a way that a man in the middle (phisherman) can’t guess the password.
Various other researchers came up with similar protocols, and this technology was a precursor
to the “secure” (HTTPS) protocol we use today. Since use of HTTPS is more convenient, it was
implemented widely instead of strong pass word protocol, which none of today’s browsers
implement.
• Two-Channel Authentication: This involves sending one-time access codes to users via a
separate channel or a device (such as their mobile phone). This access code is used as an
additional password, along with the regular user password. This authentication is similar to
two-phase authentication and is also vulnerable to real-time man-in-the-middle attack.

Introduction to Security Protocols

A security system consists of components such as users, companies, and servers, which communicate using a number
of channels including phones, satellite links, and networks, while also using physical devices such as laptops, portable
USB drives, and so forth. Security protocols are the rules governing these communications and are designed to
effectively counter malicious attacks.
Since it is practically impossible to design a protocol that will counter all kinds of threats (besides being
expensive), protocols are designed to counter only certain types of threats. For example, the Kerberos protocol that’s
used for authentication assumes that the user is connecting to the correct server (and not a phishing web site) while
entering a name and password.
Protocols are often evaluated by considering the possibility of occurrence of the threat they are designed to
counter, and their effectiveness in negating that threat.
Multiple protocols often have to work together in a large and complex system; hence, you need to take care
that the combination doesn’t open any vulnerabilities. I will introduce you to some commonly used protocols in the
following sections.

The Needham–Schroeder Symmetric Key Protocol

The Needham–Schroeder Symmetric Key Protocol establishes a session key between the requestor and authenticator
and uses that key throughout the session to make sure that the communication is secure. Let me use a quick example
to explain it.
A user needs to access a file from a secure file system. As a first step, the user requests a session key to the
authenticating server by providing her nonce (a random number or a serial number used to guarantee the freshness
of a message) and the name of the secure file system to which she needs access (step 1 in Figure 1-2). The server
provides a session key, encrypted using the key shared between the server and the user. The session key also contains
the user’s nonce, just to confirm it’s not a replay. Last, the server provides the user a copy of the session key encrypted
using the key shared between the server and the secure file system (step 2). The user forwards the key to the secure
file system, which can decrypt it using the key shared with the server, thus authenticating the session key (step 3). The
secure file system sends the user a nonce encrypted using the session key to show that it has the key (step 4). The user
performs a simple operation on the nonce, re-encrypts it, and sends it back, verifying that she is still alive and that she
holds the key. Thus, secure communication is established between the user and the secure file system.
The problem with this protocol is that the secure file system has to assume that the key it receives from
authenticating server (via the user) is fresh. This may not be true. Also, if a hacker gets hold of the user’s key, he could
use it to set up session keys with many other principals. Last, it’s not possible for a user to revoke a session key in case
she discovers impersonation or improper use through usage logs.
To summarize, the Needham–Schroeder protocol is vulnerable to replay attack, because it’s not possible to
determine if the session key is fresh or recent.

7
Chapter 1 ■ Understanding Security Concepts

Authenticating
Server

m n
ste ee

Us pro
sy tw

Se cryp er), s y (be

er vi d
by
ile be

en er v ke
r ve te e s tw

re in
e f ey

/ S ared r)

qu g
r r d u si o e e
ur k

sh r ve

es he
e s si n n n s
ec red

Se

ts r "
po g ke ec
es a
th sh

a s no
nd sh y e ur
d ds

s w are nc e f

es ce
an en

si o "
ith d k ryp ile
elf r s

nk
n
its erve

"n ey ted sys

ey
on (be us tem
S

ce tw in
",
se een
ss Us
ion e
ke r
g /
User forwards the encrypted session

y
key to secure file system
Secure file User
system

Secure file system sends user a “nonce’’

encrypted using the session key

Figure 1-2. Needham–Schroeder Symmetric Key Protocol

Kerberos
A derivative of the Needham–Schroeder protocol, Kerberos originated at MIT and is now used as a standard
authentication tool in Linux as well as Windows. Instead of a single trusted server, Kerberos uses two: an
authentication server that authenticates users to log in; and a ticket-granting server that provides tickets, allowing
access to various resources (e.g., files or secure processes). This provides more scalable access management.
What if a user needs to access a secure file system that uses Kerberos? First, the user logs on to the authentication
server using a password. The client software on the user’s PC fetches a ticket from this server that is encrypted
under the user’s password and that contains a session key (valid only for a predetermined duration like one hour or
one day). Assuming the user is authenticated, he now uses the session key to get access to secure file system that’s
controlled by the ticket-granting server.
Next, the user requests access to the secure file system from the ticket-granting server. If the access is permissible
(depending on user’s rights), a ticket is created containing a suitable key and provided to the user. The user also gets
a copy of the key encrypted under the session key. The user now verifies the ticket by sending a timestamp to the
secure file system, which confirms it’s alive by sending back the timestamp incremented by 1 (this shows it was able to
decrypt the ticket correctly and extract the key). After that, the user can communicate with the secure file system.
Kerberos fixes the vulnerability of Needham–Schroeder by replacing random nonces with timestamps.
Of course, there is now a new vulnerability based on timestamps, in which clocks on various clients and servers
might be desynchronized deliberately as part of a more complex attack.
Kerberos is widely used and is incorporated into the Windows Active Directory server as its authentication
mechanism. In practice, Kerberos is the most widely used security protocol, and other protocols only have a
historical importance. You will learn more about Kerberos in later chapters, as it is the primary authentication used
with Hadoop today.

8
 Chapter 1 ■ Understanding Security Concepts

Burrows–Abadi–Needham Logic
Burrows–Abadi–Needham (BAN) logic provides framework for defining and analyzing sensitive information. The
underlying principle is that a message is authentic if it meets three criteria: it is encrypted with a relevant key, it’s from
a trusted source, and it is also fresh (that is, generated during the current run of the protocol). The verification steps
followed typically are to
1. Check if origin is trusted,
2. Check if encryption key is valid, and
3. Check timestamp to make sure it’s been generated recently.
Variants of BAN logic are used by some banks (e.g., the COPAC system used by Visa International). BAN logic is a
very extensive protocol due to its multistep verification process; but that’s also the precise reason it’s not very popular.
It is complex to implement and also vulnerable to timestamp manipulation (just like Kerberos).
Consider a practical implementation of BAN logic. Suppose Mindy buys an expensive purse from a web retailer
and authorizes a payment of $400 to the retailer through her credit card. Mindy’s credit card company must be able
to verify and prove that the request really came from Mindy, if she should later disavow sending it. The credit card
company also wants to know that the request is entirely Mindy's, that it has not been altered along the way.
In addition, the company must be able to verify the encryption key (the three-digit security code from the credit card)
Mindy entered. Last, the company wants to be sure that the message is new—not a reuse of a previous message.
So, looking at the requirements, you can conclude that the credit card company needs to implement BAN logic.
Now, having reviewed the protocols and ways they can be used to counter malicious attacks, do you think using a
strong security protocol (to secure a program) is enough to overcome any “flaws” in software (that can leave programs
open to security attacks)? Or is it like using an expensive lock to secure the front door of a house while leaving the
windows open? To answer that, you will first need to know what the flaws are or how they can cause security issues.

Securing a Program
Before you can secure a program, you need to understand what factors make a program insecure. To start with, using
security protocols only guards the door, or access to the program. Once the program starts executing, it needs to have
robust logic that will provide access to the necessary resources only, and not provide any way for malicious attacks
to modify system resources or gain control of the system. So, is this how a program can be free of flaws? Well, I will
discuss that briefly, but first let me define some important terms that will help you understand flaws and how to
counter them.
Let’s start with the term program. A program is any executable code. Even operating systems or database systems
are programs. I consider a program to be secure if it exactly (and only) does what it is supposed to do—nothing else!
An assessment of security may also be decided based on program’s conformity to specifications—the code is secure
if it meets security requirements. Why is this important? Because when a program is executing, it has capability to
modify your environment, and you have to make sure it only modifies what you want it to.
So, you need to consider the factors that will prevent a program from meeting the security requirements. These
factors can potentially be termed flaws in your program. A flaw can either be fault or a failure.
A fault is an anomaly introduced in a system due to human error. A fault can be introduced at the design stage
due to the designer misinterpreting an analyst’s requirements, or at the implementation stage by a programmer not
understanding the designer’s intent and coding incorrectly. A single error can generate many faults. To summarize, a
fault is a logical issue or contradiction noticed by the designers or developers of the system after it is developed.
A failure is a deviation from required functionality for a system. A failure can be discovered during any phase of
the software development life cycle (SDLC), such as testing or operation. A single fault may result in multiple failures
(e.g., a design fault that causes a program to exit if no input is entered). If the functional requirements document
contains faults, a failure would indicate that the system is not performing as required (even though it may be
performing as specified). Thus, a failure is an apparent effect of a fault: an issue visible to the user(s).

9
Chapter 1 ■ Understanding Security Concepts

Fortunately, not every fault results in a failure. For example, if the faulty part of the code is never executed or the
faulty part of logic is never entered, then the fault will never cause the code to fail—although you can never be sure
when a failure will expose that fault!
Broadly, the flaws can be categorized as:
• Non-malicious (buffer overruns, validation errors etc.) and
• Malicious (virus/worm attacks, malware etc.).
In the next sections, take a closer look at these flaws, the kinds of security breaches they may produce, and how to
devise a strategy to better secure your software to protect against such breaches.

Non-Malicious Flaws
Non-malicious flaws result from unintentional, inadvertent human errors. Most of these flaws only result in program
malfunctions. A few categories, however, have caused many security breaches in the recent past.

Buffer Overflows
A buffer (or array or string) is an allotted amount of memory (or RAM) where data is held temporarily for processing.
If the program data written to a buffer exceeds a buffer’s previously defined maximum size, that program data
essentially overflows the buffer area. Some compilers detect the buffer overrun and stop the program, while others
simply presume the overrun to be additional instructions and continue execution. If execution continues, the
program data may overwrite system data (because all program and data elements share the memory space with the
operating system and other code during execution). A hacker may spot the overrun and insert code in the system
space to gain control of the operating system with higher privileges.1
Several programming techniques are used to protect from buffer overruns, such as
• Forced checks for buffer overrun;
• Separation of system stack areas and user code areas;
• Making memory pages either writable or executable, but not both; and
• Monitors to alert if system stack is overwritten.

Incomplete Mediation
Incomplete mediation occurs when a program accepts user data without validation or verification. Programs are
expected to check if the user data is within a specified range or that it follows a predefined format. When that is not
done, then a hacker can manipulate the data for unlawful purposes. For example, if a web store doesn’t mediate user
data, a hacker may turn off any client JavaScript (used for validation) or just write a script to interact with the web
server (instead of using a web browser) and send arbitrary (unmediated) values to the server to manipulate a sale. In
some cases vulnerabilities of this nature are due to failure to check default configuration on components; a web server
that by default enables shell escape for XML data is a good example.
Another example of incomplete mediation is SQL Injection, where an attacker is able to insert (and submit)
a database SQL command (instead of or along with a parameter value) that is executed by a web application,
manipulating the back-end database. A SQL injection attack can occur when a web application accepts user-supplied

1
Please refer to the IEEE paper “Beyond Stack Smashing: Recent Advances in Exploiting Buffer Overruns” by Jonathan Pincus
and Brandon Baker for more details on these kind of attacks. A PDF of the article is available at http://classes.soe.ucsc.edu/
cmps223/Spring09/Pincus%2004.pdf.

10
 Chapter 1 ■ Understanding Security Concepts

input data without thorough validation. The cleverly formatted user data tricks the application into executing
unintended commands or modifying permissions to sensitive data. A hacker can get access to sensitive information
such as Social Security numbers, credit card numbers, or other financial data.
An example of SQL injection would be a web application that accepts the login name as input data and displays
all the information for a user, but doesn’t validate the input. Suppose the web application uses the following query:

"SELECT * FROM logins WHERE name ='" + LoginName + "';"

A malicious user can use a LoginName value of “' or '1'='1” which will result in the web application returning
login information for all the users (with passwords) to the malicious user.
If user input is validated against a set of defined rules for length, type, and syntax, SQL injection can be prevented.
Also, it is important to ensure that user permissions (for database access) should be limited to least possible privileges
(within the concerned database only), and system administrator accounts, like sa, should never be used for web
applications. Stored procedures that are not used should be removed, as they are easy targets for data manipulation.
Two key steps should be taken as a defense:
• Server-based mediation must be performed. All client input needs to be validated by the
program (located on the server) before it is processed.
• Client input needs to be checked for range validity (e.g., month is between January and
December) as well as allowed size (number of characters for text data or value for numbers for
numeric data, etc.).

Time-of-Check to Time-of-Use Errors

Time-of-Check to Time-of-Use errors occur when a system’s state (or user-controlled data) changes between the check
for authorization for a particular task and execution of that task. That is, there is lack of synchronization or serialization
between the authorization and execution of tasks. For example, a user may request modification rights to an innocuous
log file and, between the check for authorization (for this operation) and the actual granting of modification rights, may
switch the log file for a critical system file (for example, /etc/password for Linux operating system).
There are several ways to counter these errors:
• Make a copy of the requested user data (for a request) to the system area, making
modifications impossible.
• Lock the request data until the requested action is complete.
• Perform checksum (using validation routine) on the requested data to detect modification.

Malicious Flaws
Malicious flaws produce unanticipated or undesired effects in programs and are the result of code deliberately
designed to cause damage (corruption of data, system crash, etc.). Malicious flaws are caused by viruses, worms,
rabbits, Trojan horses, trap doors, and malware:
• A virus is a self-replicating program that can modify uninfected programs by attaching a
copy of its malicious code to them. The infected programs turn into viruses themselves and
replicate further to infect the whole system. A transient virus depends on its host program
(the executable program of which it is part) and runs when its host executes, spreading itself
and performing the malicious activities for which it was designed. A resident virus resides in
a system’s memory and can execute as a stand-alone program, even after its host program
completes execution.
• A worm, unlike the virus that uses other programs as mediums to spread itself, is a stand-
alone program that replicates through a network.

11
Chapter 1 ■ Understanding Security Concepts

• A rabbit is a virus or worm that self-replicates without limit and exhausts a computing
resource. For example, a rabbit might replicate itself to a disk unlimited times and fill up the
disk.
• A Trojan horse is code with a hidden malicious purpose in addition to its primary purpose.
• A logic trigger is malicious code that executes when a particular condition occurs (e.g., when
a file is accessed). A time trigger is a logic trigger with a specific time or date as its activating
condition.
• A trap door is a secret entry point into a program that can allow someone to bypass normal
authentication and gain access. Trap doors have always been used by programmers for
legitimate purposes such as troubleshooting, debugging, or testing programs; but they
become threats when unscrupulous programmers use them to gain unauthorized access
or perform malicious activities. Malware can install malicious programs or trap doors on
Internet-connected computers. Once installed, trap doors can open an Internet port and
enable anonymous, malicious data collection, promote products (adware), or perform any
other destructive tasks as designed by their creator.
How do we prevent infections from malicious code?
• Install only commercial software acquired from reliable, well-known vendors.
• Track the versions and vulnerabilities of all installed open source components, and maintain
an open source component-security patching strategy.
• Carefully check all default configurations for any installed software; do not assume the
defaults are set for secure operation.
• Test any new software in isolation.
• Open only “safe” attachments from known sources. Also, avoid opening attachments from
known sources that contain a strange or peculiar message.
• Maintain a recoverable system image on a daily or weekly basis (as required).
• Make and retain backup copies of executable system files as well as important personal data
that might contain “infectable” code.
• Use antivirus programs and schedule daily or weekly scans as appropriate. Don’t forget to
update the virus definition files, as a lot of new viruses get created each day!

Securing a Distributed System

So far, we have examined potential threats to a program’s security, but remember—a distributed system is also a
program. Not only are all the threats and resolutions discussed in the previous section applicable to distributed
systems, but the special nature of these programs makes them vulnerable in other ways as well. That leads to a need to
have multilevel security for distributed systems.
When I think about a secure distributed system, ERP (enterprise resource) systems such as SAP or PeopleSoft
come to mind. Also, relational database systems such as Oracle, Microsoft SQL Server, or Sybase are good examples
of secure systems. All these systems are equipped with multiple layers of security and have been functional for a
long time. Subsequently, they have seen a number of malicious attacks on stored data and have devised effective
countermeasures. To better understand what makes these systems safe, I will discuss how Microsoft SQL Server
secures sensitive employee salary data.

12
 Chapter 1 ■ Understanding Security Concepts

For a secure distributed system, data is hidden behind multiple layers of defenses (Figure 1-3). There are levels
such as authentication (using login name/password), authorization (roles with set of permissions), encryption
(scrambling data using keys), and so on. For SQL Server, the first layer is a user authentication layer. Second is an
authorization check to ensure that the user has necessary authorization for accessing a database through database
role(s). Specifically, any connection to a SQL Server is authenticated by the server against the stored credentials.
If the authentication is successful, the server passes the connection through. When connected, the client inherits
authorization assigned to connected login by the system administrator. That authorization includes access to any of
the system or user databases with assigned roles (for each database). That is, a user can only access the databases
he is authorized to access—and is only assigned tables with assigned permissions. At the database level, security is
further compartmentalized into table- and column-level security. When necessary, views are designed to further
segregate data and provide a more detailed level of security. Database roles are used to group security settings for a
group of tables.

SQL Server Access to Customer data

Authentication – (except salary details)
Client login/password using roles
tries to
access
Data
DB2 Customer
Name Location Salary
John Doe Chicago 10,000
Jane Doe Elgin 5,000
DB1 Mike Dey Itasca 3,000
Al Gore Boston 20,000
Jay Leno Frisco 15,000
…………………………………
SQL Server Authorizes access
to database DB1 only DB3

Figure 1-3. SQL Server secures data with multiple levels of security

In Figure 1-3, the user who was authenticated and allowed to connect has been authorized to view employee data
in database DB1, except for the salary data (since he doesn’t belong to role HR and only users from Human Resources
have the HR role allocated to them). Access to sensitive data can thus be easily limited using roles in SQL Server.
Although the figure doesn’t illustrate them, more layers of security are possible, as you’ll learn in the next few sections.

Authentication
The first layer of security is authentication. SQL Server uses a login/password pair for authentication against stored
credential metadata. You can also use integrated security with Windows, and you can use a Windows login to
connect to SQL Server (assuming the system administrator has provided access to that login). Last, a certificate or
pair of asymmetric keys can be used for authentication. Useful features such as password policy enforcement (strong
password), date validity for a login, ability to block a login, and so forth are provided for added convenience.

13
Chapter 1 ■ Understanding Security Concepts

Authorization
The second layer is authorization. It is implemented by creating users corresponding to logins in the first layer
within various databases (on a server) as required. If a user doesn’t exist within a database, he or she doesn’t have
access to it.
Within a database, there are various objects such as tables (which hold the data), views (definitions for filtered
database access that may spread over a number of tables), stored procedures (scripts using the database scripting
language), and triggers (scripts that execute when an event occurs, such as an update of a column for a table or
inserting of a row of data for a table), and a user may have either read, modify, or execute permissions for these
objects. Also, in case of tables or views, it is possible to give partial data access (to some columns only) to users. This
provides flexibility and a very high level of granularity while configuring access.

Encryption
The third security layer is encryption. SQL Server provides two ways to encrypt your data: symmetric keys/certificates
and Transparent Database Encryption (TDE). Both these methods encrypt data “at rest” while it’s stored within a
database. SQL Server also has the capability to encrypt data in transit from client to server, by configuring corresponding
public and private certificates on the server and client to use an encrypted connection. Take a closer look:
• Encryption using symmetric keys/certificate: A symmetric key is a sequence of binary or
hexadecimal characters that’s used along with an encryption algorithm to encrypt the data.
The server and client must use the same key for encryption as well as decryption. To enhance
the security further, a certificate containing a public and private key pair can be required. The
client application must have this pair available for decryption. The real advantage of using
certificates and symmetric keys for encryption is the granularity it provides. For example,
you can encrypt only a single column from a single table (Figure 1-4)—no need to encrypt
the whole table or database (as with TDE). Encryption and decryption are CPU-intensive
operations and take up valuable processing resources. That also makes retrieval of encrypted
data slower as compared to unencrypted data. Last, encrypted data needs more storage. Thus
it makes sense to use this option if only a small part of your database contains sensitive data.

Create Create Create

Database Certificate (in Symmetric key
Master key in user database) (using the
user database certificate for
encryption)
Database that needs
to be encrypted All in the same user database

Decryption is performed by opening the symmetric key (that Encrypt column(s)

uses certificate for decryption) and since only authorized for any tables (using
users have access to the certificate, access to encrypted data the symmetric key)
is restricted

Figure 1-4. Creating column-level encryption using symmetric keys and certificates

14
Other documents randomly have
different content
24. © 15Mar55; MP5841.
25. © 18Mar55; MP5842.
26. © 22Mar55; MP5843.
27. © 25Mar55; MP6011.
28. © 29Mar55; MP6012.
29. © 1Apr55; MP6013.
30. © 5Apr55; MP6014.
31. © 8Apr55; MP6015.
32. © 12Apr55; MP6016.
33. © 15Apr55; MP6017.
34. © 19Apr55; MP6018.
35. © 22Apr55; MP6019.
36. © 26Apr55; MP6020.
37. © 29Apr55; MP6021.
38. © 3May55; MP6022.
39. © 6May55; MP6027.
40. © 10May55; MP6028.
41. © 13May55; MP6134.
42. © 17May55; MP6135.
43. © 20May55; MP6136.
44. © 24May55; MP6137.
45. © 27May55; MP6138.
46. © 31May55; MP6139.
47. © 3Jun55; MP6140.
48. © 7Jun55; MP6141.
49. © 10Jun55; MP6142.
50. © 14Jun55; MP6143.
51. © 17Jun55; MP6144.
52. © 21Jun55; MP6174.
53. © 24Jun55; MP6304.
54. © 28Jun55; MP6305.
55. © 1Jul55; MP6306.
56. © 4Jul55; MP6307.
57. © 8Jul55; MP6308.
58. © 12Jul55; MP6309.
59. © 15Jul55; MP6310.
60. © 19Jul55; MP6311.
61. © 22Jul55; MP6312.
62. © 26Jul55; MP6313.
63. © 28Jul55; MP6434.
64. © 2Aug55; MP6435.
65. © 4Aug55; MP6436.
66. © 9Aug55; MP6437.
67. © 11Aug55; MP6438.
68. © 15Aug55; MP6439.
69. © 19Aug55; MP6440.
70. © 22Aug55; MP6441.
71. © 26Aug55; MP6442.
72. © 30Aug55; MP6502.
73. © 2Sep55; MP6503.
74. © 6Sep55; MP6504.
75. © 9Sep55; MP6505.
76. © 13Sep55; MP6506.
77. © 16Sep55; MP6507.
78. © 20Sep55; MP6508.
79. © 23Sep55; MP6570.
80. © 27Sep55; MP6603.
81. © 30Sep55; MP6604.
82. © 4Oct55; MP6605.
83. © 7Oct55; MP6606.
84. © 11Oct55; MP6607.
85. © 14Oct55; MP6608.
86. © 18Oct55; MP6609.
87. © 21Oct55; MP6610.
88. © 25Oct55; MP6613.
89. © 28Oct55; MP6614.
90. © 1Nov55; MP6615.
91. © 4Nov55; MP6616.
92. © 8Nov55; MP6704.
93. © 11Nov55; MP6705.
94. © 15Nov55; MP6706.
95. © 18Nov55; MP6707.
96. © 22Nov55; MP6708.
97. © 25Nov55; MP6709.
98. © 29Nov55; MP6710.
99. © 2Dec55; MP6711.
100. © 6Dec55; MP6815.
101. © 9Dec55; MP6905.
102. © 13Dec55; MP6816.
103. © 16Dec55; MP6817.
104. © 20Dec55; MP6818.
Volume 39.
1. © 23Dec55; MP6819.
2. © 27Dec55; MP6820.
3. © 30Dec55; MP6821.
4. © 3Jan56; MP6822.
5. © 6Jan56; MP6932.
6. © 10Jan56; MP6933.
7. © 13Jan56; MP6934.
8. © 16Jan56; MP6935.
9. © 20Jan56; MP6936.
10. © 24Jan56; MP6937.
11. © 27Jan56; MP6938.
12. © 31Jan56; MP6939.
13. © 2Feb56; MP6927.
14. © 7Feb56; MP6928.
15. © 10Feb56; MP6929.
16. © 14Feb56; MP6930.
17. © 17Feb56; MP6976.
18. © 21Feb56; MP6975.
19. © 23Feb56; MP6974.
20. © 28Feb56; MP6973.
21. © 2Mar56; MP7024.
22. © 6Mar56; MP7021.
23. © 9Mar56; MP7022.
24. © 13Mar56; MP7023.
25. © 16Mar56; MP7027.
26. © 20Mar56; MP7026.
 27. © 23Mar56; MP7025.
28. © 26Mar56; MP7184.
29. © 30Mar56; MP7185.
30. © 2Apr56; MP7186.
31. © 5Apr56; MP7187.
32. © 9Apr56; MP7188.
33. © 13Apr56; MP7293.
34. © 17Apr56; MP7294.
35. © 20Apr56; MP7292.
36. © 24Apr56; MP7257.

MOVING DAY. Chevrolet Motor Division. Made by Jam Handy

Organization. 74 ft., color, 35mm. Eastman color. © Chevrolet
Motor Division of General Motors Corp.; 23Mar56; MU6055.
MOVING-IN-DAY; NO. 10-60. Procter & Gamble Co. Made by
Tatham-Laird. 1 min., sd., b&w, 16mm. © Procter & Gamble Co.;
19Jan59 (in notice: 1958); MP9399.
THE MOVING OUT OF MINNIE. SEE Death Valley Days, no. 426.
MOVING THROUGH SPACE. Universal Pictures Co. 1 reel, sd.,
b&w, 35mm. (Variety View) A Universal International picture. ©
Universal Pictures Co., Inc.; 12Apr54; LP3711.
MOVING TO LARGER QUARTERS. American Radiator and
Standard Sanitary Corp. [1952] Produced by Jam Handy
Organization. 3 reels, b&w, 35mm. © The Jam Handy
Organization, Inc.; 2Apr52; MU5382.
MOZART AND HIS MUSIC. Coronet Instructional Films. 12 min.,
sd., b&w, 16mm. © Coronet Instructional Films; 22Apr54;
MP4662.
MUCH ADO ABOUT NUTTING. Warner Bros. Cartoons, 1953. 7
min., sd., color, 35mm. (Looney Tune Cartoon) Technicolor. ©
The Vitaphone Corp.; 1Jun53 (in notice: 1952); MP3573.
MUCHO MOUSE. Metro-Goldwyn-Mayer. Released by Loew’s. 7
min., sd., color, 35mm. (Tom and Jerry Cartoon) CinemaScope.
Perspecta Sound. Technicolor. © Loew’s Incorporated; 31Dec56;
LP8912.
MUDDY KASOFF STORY. SEE The Lawless Years.
THE MUDLARK. Twentieth Century-Fox Film Corp., 1951. 99
min., sd., b&w, 35mm. Based on the novel of the same title by
Theodore Bonnet. © Twentieth Century-Fox Film Corp.;
11Jan51; LP689.
LA MUERTE ENAMORADA. (Death in Love) Producciones
Yazbek, Mexico. Released by Clasa-Mohme; in the U. S. by
Importadora. 83 min., sd., b&w, 35mm. Appl. author:
Producciones Luis Manrique, S. de R. L. © Importadora, Inc.;
1Jan51; LP11129.
THE MUGGER. Barbizon Productions, presented by Helprin-
Crown. Released by United Artists Corp. 74 min., sd., b&w,
35mm. Based on the novel by Ed McBain. © Barbizon
Productions Corp. (in notice: Barbizon Productions, Inc.);
5Nov58; LP12530.
LA MUJER DE LAS CAMELLIAS. (The Woman of the Camelias)
Argentina Sona Film, Argentina. Released by Clasa-Mohme; in
the U. S. by Importadora. 77 min., sd., b&w, 35mm. Appl. author:
Zulema G. de Amadori. © Importadora, Inc.; 15Aug53; LP11333.
LA MUJER DEL OTRO. (The Other Man’s Wife) Films de America,
Mexico. Released in the U. S. by Importadora. 96 min., sd., b&w,
35mm. Based on an original plot by Octavio Luis Alba. Appl.
author: Producciones Jose Elvira, S. de R. L. © Importadora,
Inc.; 15May48; LP11629.
MUJER O FIERA. Producciones Cub-Mex, Mexico. Released in the
U. S. by Importadora. 99 min., sd., b&w, 16mm. Based on the
original work of Felix B. Caignet. Appl. author: Producciones
Delmar, S.A. © Importadora, Inc.; 15Dec54; LP11336.
LA MUJER QUE SE VENDIO. (The Woman Who Sold Herself)
Producciones Delmar, Mexico. Released by Clasa-Mohme; in the
U. S. by Importadora. 75 min., sd., b&w, 35mm. A Producciones
 Cub-Mex Film. Adapted from a radio serial by Felix B. Caignet.
© Importadora, Inc.; 15Jul54; LP11014.
LAS MUJERES DE MI GENERAL. Producciones Rodriguez Hnos.,
Mexico. Released by Clasa-Mohme. 103 min., sd., b&w, 35mm.
Based on La Soldera, by Joselita Rodriguez and Celestino
Gorostiza. © Importadora, Inc.; 1Jul51; LP10836.
LAS MUJERES DE MI GENERAL. (The General’s Women)
Producciones Rodriguez Hermanos, Mexico. Released in the U.
S. by Importadora. 103 min., sd., b&w, 35mm. Appl. author:
Producciones Continenta. © Importadora, Inc.; 1Jul51; LP11834.
A MULE FOR SANTA FE. SEE Schlitz Playhouse of Stars.
MULE TRAIN. Gene Autry Productions. Released by Columbia
Pictures Corp., 1950. 70 min., sd., b&w, 35mm. © Gene Autry
Productions; 22Feb50; LP2918.
MULETOWN GOLD STRIKE. SEE Zane Grey Theatre, no. 9430.
MULISH CAR. Delco-Remy Division. Made by Campbell-Ewald
Co. 90 sec. (High Adventure Series) Appl. author: Campbell-
Ewald Co., employer for hire of E. W. Birnbryer, author of script.
© Campbell-Ewald Co.; 28Mar58; MU6465.
THE MULLINAIRES. Mullins Manufacturing Corp. Made by Jam
Handy Organization. 10 min., b&w, 35mm. © Jam Handy
Organization, Inc.; 18Feb54; MU5614.
MULTIPLE SCREENING. Communication Materials Center under
the auspices of the Commonwealth of Pennsylvania, 1950. 9
min., sd., b&w, 16mm. © Pennsylvania State Dept. of Health;
21Dec50; MP1406.
MULTIPLICATION IS EASY. Coronet, 1949. 11 min., sd., b&w,
16mm. © David A. Smart; 23Sep49; MP5063.
MULTIPLY ONE BOY. SEE Restless Gun.
THE MUMBYS. SEE All Star Theatre, no. 117.
THE MUMMY’S SECRET. Adrian Weiss Productions, 1952. 3 reels,
sd., b&w, 16mm. Based on the Craig Kennedy stories created by
 Arthur B. Reeve. © Adrian Weiss Productions; 19Nov52;
LP2104.
MUMPS THE WORD. SEE The Dennis Day Show, no. 136.
LE MURA DI MALAPAGA. SEE The Walls of Malapaga.
MURAL MAKING. International Film Bureau. Made by Crawley
Films. 6 min., sd., color, 16mm. (Creative Hands, no. 11)
Eastman color. © International Film Bureau, Inc.; 18Jun56 (in
notice: 1955); MP7911.
MURDER AT HOME. Lindsley Parsons Productions, 1952. 3 reels,
sd., b&w, 16mm. © Lindsley Parsons Productions, Inc.; 12Nov52;
LP2066.
MURDER AT SHINGLESTRAND. SEE Hidden Homicide.
MURDER AT THE MANSION. SEE Richard Diamond, Private
Detective, no. 6813.
MURDER BY CONTRACT. Columbia Pictures Corp. 81 min., sd.,
b&w, 35mm. © Columbia Pictures Corp.; 1Oct58; LP12201.
MURDER BY MESSENGER. SEE Big Town, no. 56.
MURDER BY PROXY. SEE Blackout.
MURDER BY RADIATION. SEE Jet Jackson, The Flying
Commando, no. 1.
MURDER FOR SALE. SEE Mr. and Mrs. North, no. N215.
MURDER FOR THE MILLION. SEE Murder Reported.
MURDER IN LANGTRY. SEE Judge Roy Bean.
MURDER IN PARADISE. SEE Schlitz Playhouse of Stars.
MURDER IN RHYME. SEE Man Against Crime, Oct. 8, 1952.
MURDER IN SHORT PANTS. SEE Mr. and Mrs. North, no. 23.
MURDER IN THE ROUGH. SEE Man Against Crime, Nov. 8,
1953.
MURDER IN THE STUDIO. SEE Man Against Crime, Jan. 21,
1953.
MURDER IS MY BEAT. Allied Artists Pictures Corp. 70 min., sd.,
b&w, 35mm. © Allied Artists Pictures Corp.; 27Feb55; LP4517.
MURDER IS PERMANENT. SEE Colonel March of Scotland Yard.
MURDER ME TWICE. SEE Hitchcock Presents.
MURDER MOUNTAIN. SEE Man Against Crime, Dec. 6, 1953.
MURDER ON A MILLION. Adrian Weiss Productions, 1953. 3
reels, sd., b&w, 16mm. Based on the Craig Kennedy stories
created by Arthur B. Reeve. © Adrian Weiss Productions;
10Mar53 (in notice: 1952); LP2397.
MURDER ON STAGE NINE. Adrian Weiss Productions, 1951. 2
reels, sd., b&w, 16mm. Based on the Craig Kennedy stories by
Arthur B. Reeve. © Adrian Weiss Productions; 3Jul51; LP1025.
MURDER ON THE MAIN DECK. SEE The Great Adventures of
Captain Kidd, no. 6.
MURDER ON THE MIDWAY. SEE

Mr. and Mrs. North, no. 38.

Peter Gunn.

MURDER PREFERRED. Adrian Weiss Productions, 1951. 25 min.,

sd., b&w, 16mm. Based on the Craig Kennedy stories by Arthur
B. Reeve. © Adrian Weiss Productions; 13Dec51; LP1372.
MURDER REPORTED. Fortress Film Productions, Eng. Released
in the U. S. by Columbia Pictures Corp. 6 reels, sd., b&w, 35mm.
Based on the novel Murder for the Million, by Robert Chapman.
© Fortress Film Productions, Ltd.; 1Dec56; LP9000.
MURDER WARRANT. SEE Gunsmoke.
MURDER WITH HI FI. SEE The Adventures of the Falcon.
MURDER WITHOUT CRIME. Associated British Picture Corp.,
London. Released in the U.S., 1951. 75 min., sd., b&w, 35mm.
Based on the play of the same title by J. Lee Thompson. ©
Stratford Pictures Corp.; 2Apr51; LP832.
MURDER WITHOUT TEARS. Allied Artists Productions. Released
by Monogram Pictures Corp. 64 min., sd., b&w, 35mm. Based on
the original story, “Double Jeopardy,” by Jo Pagano. ©
Monogram Pictures Corp.; 14Jun53; LP2702.
THE MURDERED BLONDE CASE. SEE The Line-Up.
MURDERS IN THE RUE MORGUE. SEE Phantom of the Rue
Morgue.
MURIETTA. SEE The Californians, no. 470-35.
THE MURPHY ROBBERY CASE. SEE The Line-Up, no. 41.
MURPHY VS. BUCCERONI. SEE Famous Fights, no. 17.
MUSCATEL. SEE Science Pictures, no. 46.
MUSCLE BEACH TOM. Metro-Goldwyn-Mayer. Released by
Loew’s. 7 min., sd., color, 35mm. (Tom and Jerry Cartoon)
CinemaScope. Technicolor. © Loew’s Incorporated; 28Jun56;
LP6922.
A MUSCLE FOR HARVEY. SEE The Brothers, no. 26.
MUSCLE POWER FOR PLANES. Allison Division of General
Motors Corp. Made by Jam Handy Organization. 398 ft., color,
16mm. Kodachrome. © Jam Handy Organization, Inc.; 18Jan56;
MU6012.
MUSCLE TUSSLE. Warner Bros. Cartoons, 1953. 7 min., sd., color,
35mm. (Merrie Melodies Cartoon) Technicolor. © The
Vitaphone Corp.; 2May53 (in notice: 1952); MP3478.
MUSCLE TUSSLE. Warner Bros. Cartoons. 7 min., sd., color,
35mm. (Merrie Melodies Cartoon) Technicolor. © Vitaphone
Corp.; 15Nov52; MP5309.
MUSCLE UP A LITTLE CLOSER. Columbia Pictures Corp. 2 reels,
sd., b&w, 35mm. © Columbia Pictures Corp.; 28Feb57 (in notice:
1956); LP8423.
MUSCLEMAN SHOW. SEE December Bride, no. 111.
MUSEUM AND MUMMY. Interstate Bakeries Corp. Made by
Walter Lantz Productions. 20 sec., sd., b&w, 16mm. © Walter
 Lantz Productions, Inc.; 15Jan59 (in notice: 1958); LP13716.
MUSIC. SEE Renaissance on TV, no. 7.
MUSIC BOX REVUE. SEE Our Miss Brooks.
MUSIC BY MARTIN. Universal International, 1951. 15 min., sd.,
b&w, 35mm. © Universal Pictures Co., Inc.; 28Feb51 (in notice:
1950); LP835.
MUSIC: CAREER OR HOBBY? Coronet Instructional Films. 11
min., sd., b&w, 16mm. Appl. author: Frank S. Endicott. © John
Smart; 9Sep53; MP3929.
MUSIC CIRCUS. Paramount Pictures Corp., 1951. 10 min., sd.,
b&w, 35mm. (Pacemaker Series) © Paramount Pictures Corp.;
2Feb51; LP777.
MUSIC FOR EVERYONE. AMI. Made by Video Films. 22 min.,
color, 16mm. Appl. author: William R. Witherell, Jr. © AMI,
Inc.; 18Jul56; MU6133.
MUSIC IN THE NIGHT. SEE Alcoa-Goodyear Theatre, no. 8128.
MUSIC LESSON. SEE Leave It to Beaver.
MUSIC OF MANHATTAN. Twentieth Century Fox Film Corp.,
1950. 9 min., sd., b&w, 35mm. (Movietone Specialty Series) ©
Twentieth Century-Fox Film Corp.; 28Apr50; MP345.
MUSIC ON THE DOUBLE. Universal Pictures Co., 1953. 2 reels,
sd., b&w, 35mm. A Universal International picture. © Universal
Pictures Co., Inc.; 8May53; LP2571.
MUSIC PUBLISHING RACKET. SEE Confidential File.
MUSIC TO DIE BY. SEE Mickey Spillane.
MUSIC WITH THE HORMEL GIRLS. Geo. A. Hormel & Co. [1953]
6 motion pictures (30 min. each), sd., b&w, 35mm. © Geo. A.
Hormel & Co.; 20Apr53.

1. MU5551.
2. MU5550.
3. MU5549.
 4. MU5548.
5. MU5547.
6. MU5546.

MUSICAL GEMS, BERLIN SYMPHONY ORCHESTRA. SEE

Beethoven’s First Symphony [and] Chopin’s Waltz.
MUSICAL MADNESS. SEE Little Roquefort in Musical Madness.
MUSICAL MEMORIES. Vitaphone Corp., 1951. A Warner Bros.
short subject. 10 min., sd., b&w, 35mm. (Hit Parade of the Gay
Nineties Series) © The Vitaphone Corp.; 24Aug51; MP1574.
THE MUSICAL VERSION. SEE The George Burns and Gracie
Allen Show, no. 162.
MUSIK FÜR KINDER. Neue Kulturfilmgesellschaft, Germany. 13
min., sd., b&w, 35mm. Based on Schoolwork, by Carl Orff. ©
Neue Kulturfilmgesellschaft; 25Dec55; MP6985.
MUSIQUIZ. Loew’s, 1952. 9 min., sd., b&w, 35mm. (Pete Smith
Specialty. What’s Your I. Q.?) A Metro-Goldwyn-Mayer picture.
© Loew’s Incorporated; 7Feb52 (in notice: 1951); MP2098.
MUSKY FISHING. SEE Hamm’s Beer Commercials, no. H-503-SC.
MUSSOLINI. Edwin Ware Hullinger. Made by Hullinger
Productions. Approx. 29 min., sd., b&w, 35mm. © Edwin Ware
Hullinger; 8Sep59; MP9684.
MUSSOLINI. Edwin Ware Hullinger. 26 min., sd., b&w, 35mm.
Appl. states part of footage prev. pub. as news reel material. NM:
additions & revisions. © Edwin Ware Hullinger; 29Oct57;
MU6397.
MUSSOLINI. SEE The Twentieth Century.
MUSTANG. Eronel Productions. Released by United Artists Corp.
73 min., sd., b&w, 35mm. From the book Capture of the Golden
Stallion, by Rutherford Montgomery. © Eronel Productions,
Inc.; 4Feb59; LP13246.
MUSTY MUSKETEERS. Columbia Pictures Corp. 2 reels, sd., b&w,
35mm. © Columbia Pictures Corp.; 13May54 (in notice: 1953);
 LP3913.
MUTE EVIDENCE. SEE Man with a Camera.
MUTE JUSTICE. SEE Big Town, no. 80.
MUTINY. King Bros. Productions. Released by United Artists,
1952. 77 min., sd., color, 35mm. Based on a story by Hollister
Noble. © King Bros. Productions, Inc.; 27Feb52 (in notice: 1951);
LP1531.
MUTINY ON THE ADVENTURE GALLEY. SEE The Great
Adventure of Captain Kidd, no. 5.
MUTINY ON THE BUNNY. (Bugs Bunny Special) Warner Bros.
Cartoons, Inc., 1948. 7 min., sd., color, 35mm. © The Vitaphone
Corp.; 31Dec48; MP5119.
MUTINY UNMASKED. SEE The Great Adventures of Captain
Kidd, no. 8.
MUTTS ABOUT RACING. Metro-Goldwyn-Mayer. Released by
Loew’s. 7 min., sd., Technicolor, 35mm. (Droopy Cartoon)
CinemaScope. Perspecta sound. © Loew’s, Inc.; 31Dec57;
LP9787.
MUZZLE TOUGH. Warner Bros. Cartoons. 7 min., sd., color,
35mm. (Merrie Melodies Cartoon) Technicolor. © Vitaphone
Corp.; 24Jun54 (in notice: 1953); MP6344.
MY ADORABLE SAVAGE. SEE Mi Adorado Salvaje.
MY BABY BOY. Revue Productions. Approx. 27 min., sd., b&w,
16mm. © Revue Productions, Inc.; 29Apr56; LP7595.
MY BLUE HEAVEN. Twentieth Century-Fox Film Corp., 1950. 96
min., sd., color, 35mm. © Twentieth Century-Fox Film Corp.;
23Aug50; LP418.
MY BROTHER DOWN THERE. SEE Running Target.
MY BROTHER JOE. SEE Medic.
MY BROTHER RICHARD. SEE Alfred Hitchcock Presents.
MY BROTHER’S GIRL. SEE Leave It to Beaver.
MY BROTHER’S KEEPER. SEE 26 Men.
MY CHILD’S KEEPER. SEE Medic.
MY CHURCH. Broadman Films. 10 min., sd., color, 16mm. Appl.
author: Earl Waldrup. © Broadman Films; 1Jul54; MP9605.
MY COUSIN RACHEL. Twentieth Century-Fox Film Corp., 1952.
98 min., sd., b&w, 35mm. Based on the novel of the same title by
Daphne Du Maurier. © Twentieth Century-Fox Film Corp.;
24Dec52; LP2426.
MY DAUGHTER JOY. London Film Productions, Ltd. Released in
the U. S., 1950. 8 reels, sd., b&w, 35mm. Based on the novel
“David Golder” by Irene Nemirovsky. © London Film
Productions, Inc.; 16Jun50; LP150. Pub. in London, 1Jan50.
MY DAUGHTER JOY. SEE Operation X.
MY DAUGHTER’S HUSBAND. SEE Your All Star Theatre, no. 24.
MY ECSTASY. Gustav Machaty Productions. Released by Pix
Distributing Corp., 1950. 68 min., sd., b&w, 35mm. Released in
1949 under the title “My Life.” Adapted from the film “Extase”
produced in Czechoslovakia in 1933 by Elekta Film Slavia. ©
Gustav Machaty Productions; 1Feb50 (in notice: 1948); LP26.
MY FAIR DEADLY. SEE Mickey Spillane.
MY FAIR VOCAL COACH. SEE The Danny Thomas Show, no. 101.
MY FATHER, THE FOOL. SEE The Westinghouse-Desilu
Playhouse, no. 3.
MY FATHER’S WORLD. Broadman Films. 12 min., sd., color,
16mm. Eastman color. Appl. author: Earl Waldrup. © Broadman
Films; 1Jan57 (in notice: 1956); MP7913.
MY FAVORITE GIRL. (Sing and Be Happy Series) Universal
Pictures Co., Inc., 1949. 10 min., sd., b&w, 35mm. © Universal
Pictures Co., Inc.; 29Nov49; MP4994.
MY FAVORITE HUSBAND. Columbia Broadcasting System. 3
reels each, sd., b&w, 16mm. © Columbia Broadcasting System,
Inc.

1. Sixth Wedding Anniversary. © 7Oct55; LP5753.

 2. The Maid. © 29Sep55; LP5752.
3. Liz Expresses Herself. © 10Nov55; LP5785.
4. The Bank Robbery. © 13Oct55; LP5751.
5. Exercise. © 20Oct55; LP5750.
6. The Tea Room. © 27Oct55; LP5749.
7. Lucky Day. © 3Nov55; LP5784.
8. The Statue. © 2Dec55; LP5783.
9. Jury Duty. © 18Nov55; LP5786.
10. The Painting. © 25Nov55; LP5787.
11. The Child. © 8Dec55; LP5832.
12. The Astrologer. © 22Dec55; LP5833.
13. The Parking Ticket. © 14Dec55; LP5834.

MY FAVORITE SPY. Paramount Pictures Corp., 1951. 93 min., sd.,

b&w, 35mm. © Paramount Pictures Corp.; 25Dec51; LP1379.
MY FOOLISH HEART. Samuel Goldwyn Productions, Inc., 1949.
98 min., sd., b&w, 35mm. Based on “Uncle Wiggily in
Connecticut,” a story by J. D. Salinger. © Samuel Goldwyn
Productions, Inc.; 24Dec49; LP2773.
MY FORBIDDEN PAST. RKO Radio Pictures, 1950. 70 min., sd.,
b&w, 35mm. Based on the novel, “Carriage Entrance,” by Polan
Banks. © RKO Radio Pictures, Inc.; 31Dec50; LP1056.
MY FRIEND HARRY. SEE The Danny Thomas Show, no. 112.
MY FRIEND IRMA GOES WEST. Wallis-Hazen, Inc. Released by
Paramount Pictures Corp., 1950. 10 reels, sd., b&w, 35mm. ©
Wallis-Hazen, Inc.; 18May50; LP109.
MY FRIEND, SUPERMAN. SEE Adventures of Superman.
MY FRIENDS, THE BIRDS. Revue Productions. Approx. 27 min.,
sd., b&w, 16mm. © Revue Productions, Inc.; 4Nov56; LP7659.
MY GUN IS QUICK. Victor Saville Productions. Released by
United Artists Corp. 88 min., sd., b&w, 35mm. Based on the
 novel of the same title by Mickey Spillane. © Parklane Pictures,
Inc.; 30Jul57; LP8994.
MY HEART GOES CRAZY. Wesley Ruggles Productions, London.
Released by International Film Corp. and distributed in the U. S.
by United Artists Corp. 70 min., sd., color, 35mm. Technicolor.
Released in England in 1946 under the title, “London Town.” ©
International Film Corp.; 12Jun53; LP2895.
MY HORSE AJAX. SEE Fury.
MY HUSBAND. SEE Mi Marido.
MY INFALLIBLE UNCLE. SEE The Errol Flynn Theatre.
MY KINGDOM FOR A WOMAN. SEE Abdullah’s Harem.
MY LIBERTY BELL. SEE Crossroads.
MY LIFE. Gustav Machaty Productions. Released by Pix
Distributing Corp., 1949. 66 min., sd., b&w, 35mm. Released in
1950 under the title “My Ecstasy.” Adopted from the film
“Extase” produced in Czechoslovakia in 1933 by Elekta Film
Slavia. © Pix Distributing Corp.; 21Oct49; LP2847.
MY LIFE. SEE Border Patrol.
MY LITTLE DUCKAROO. Warner Bros. Cartoons. 7 min., sd.,
color, 35mm. (Merrie Melodies Cartoon) Technicolor. ©
Vitaphone Corp.; 27Nov54; LP5769.
MY LITTLE GIRL. SEE Heinz Studio 57.
MY MAN AND I. Loew’s, 1952. 98 min., sd., b&w, 35mm. A Metro-
Goldwyn-Mayer picture. © Loew’s Inc.; 14Aug52; LP1915.
MY MAN GODFREY. Universal Pictures Co. 92 min., sd., color,
35mm. A Universal International picture. CinemaScope.
Eastman color. Based on the novel by Eric Hatch. © Universal
Pictures Co., Inc.; 11Oct57; LP9151.
MY NAME IS MARY BROWN. ILGWU Training Institute. 14 min.,
sd., color, 16mm. Appl. author: David Gingold. © Northeast
Dept., International Ladies’ Garment Workers’ Union; 23Mar55;
LP5189.
MY NAME IS SALLY ROBERTS. SEE Celebrity Playhouse, no. 15.
MY OLD MAN. SEE Under My Skin.
MY OUTLAW BROTHER. Benedict Bogeaus Productions.
Released by Eagle Lion Classics, 1951. 82 min., sd., b&w, 35mm.
Formerly entitled, “My Brother, the Outlaw.” Based on the novel,
“South of the Rio Grande,” by Max Brand [pseud. of Frederick
Faust] © Benedict Bogeaus Pictures, Inc.; 15Mar51; LP801.
MY PAL GUS. Twentieth Century-Fox Film Corp., 1952. 83 min.,
sd., b&w, 35mm. © Twentieth Century-Fox Film Corp.; 13Nov52;
LP2245.
MY REMINISCENCES AS A COWBOY. SEE Cowboy.
MY SAINTED AUNT. SEE City Detective.
MY SISTER EILEEN. Columbia Pictures Corp. 108 min., sd., color,
35mm. CinemaScope. Technicolor. Based on the play by Joseph
Fields and Jerome Chodorov. © Columbia Pictures Corp.;
1Sep55; LP5266.
MY SISTER SUSAN. SEE Jane Wyman Theater.
MY SIX CONVICTS. Stanley Kramer Co. Released by Columbia
Pictures Corp., 1952. 104 min., sd., b&w, 35mm. Based on the
book of the same title by Donald Powell Wilson. © Stanley
Kramer Co., Inc.; 10Mar52; LP1601.
MY SOLDIER. SEE December Bride, no. 6.
MY SON AND HEIR. SEE Mickey Spillane.
MY SON IS A STRANGER. SEE The Line-Up.
MY SON IS GONE. Revue Productions in association with MCA
TV. Approx. 27 min., sd., b&w, 16mm. © Revue Productions,
Inc.; 9Sep55; LP6863.
MY SON JOHN. Paramount Pictures Corp., 1952. 122 min., sd.,
b&w, 35mm. © Paramount Pictures Corp.; 1Apr52; LP1726.
MY SON’S DAD. March of Time. Released by Young Men’s
Christian Associations, 1953. 27 min., sd., b&w, 16mm. ©
 National Board of Young Men’s Christian Associations; 9Jan53;
LP2629.
MY TRUE LOVE. SEE No Room for the Groom.
MY TRUE STORY. Columbia Pictures Corp., 1951. 67 min., sd.,
b&w, 35mm. © Columbia Pictures Corp.; 1Mar51; LP749.
MY TWO HANDS. SEE The Loretta Young Show, no. 4014-15.
MY VERY GOOD FRIEND ALBERT. SEE Medic.
MY WEDDING NIGHT. SEE Mi Noche de Bodas.
MY WIFE’S BEST FRIEND. Twentieth Century-Fox Film Corp.,
1952. 87 min., sd., b&w, 35mm. © Twentieth Century-Fox Film
Corp.; 18Sep52; LP2060.
MY WIFE’S FAMILY. Associated British Picture Corp., London.
Released by Associated British-Pathe. 76 min., sd., Eastman
color, 35mm. A Forth Film production. Based on the play by Fred
Duprez. © Associated British-Pathe, Ltd.; 13Nov56; LP9917.
MY WORLD DIES SCREAMING. Omecc. Released by Howco
International. 84 min., sd., b&w, 35mm. © Omecc, Inc.;
20Aug58; LP14208.
MYRA AND THE MONEY MAN. Hecuba Corp. 27 min., sd., b&w,
16mm. © Hecuba Corp.; 11Nov54; LP4124.
THE MYSTERIANS. RKO Teleradio Pictures. 89 min., sd., color,
35mm. © RKO Teleradio Pictures, Inc.; 30Apr59 (in notice:
1958); LP14642.
MYSTERIES OF NATURE. Moody Bible Institute of Chicago.
Made by Moody Institute of Science. 28 min., sd., b&w, 16mm.
(Sermons from Science) Includes portions from the motion
pictures God of Creation, Dust or Destiny, and The Prior Claim,
with a special TV introduction. © Moody Bible Institute of
Chicago; 2Jun56; MP7451.
THE MYSTERIOUS CARGO. SEE Schlitz Playhouse of Stars.
THE MYSTERIOUS COWBOY. Terrytoons. Released by Twentieth
Century-Fox Film Corp., 1952. 7 min., sd., color, 35mm.
(Terrytoon Cartoon) © Terrytoons, Inc.; 4Jul52; LP2061.
THE MYSTERIOUS CUBE. SEE Adventures of Superman.
THE MYSTERIOUS FATIMA. March of Time, 1952. 15 min., sd.,
b&w, 16mm. (Ballets de France, no. 16) © Time, Inc.; 9Sep52;
MP2765.
MYSTERIOUS ISLAND. Columbia Pictures Corp., 1951. 2 reels
each, sd., b&w, 35mm. © Columbia Pictures Corp.

1. Lost in Space. © 23Aug51; LP1126.

2. Sinister Savages. © 30Aug51; LP1148.
3. Savage Justice. © 6Sep51; LP1184.
4. Wild Man at Large. © 13Sep51; LP1158.
5. Trail of the Mystery Man. © 20Sep51; LP1185.
6. The Pirates Attack. © 27Sep51; LP1186.
7. Menace of the Mercurians. © 4Oct51; LP1235.
8. Between Two Fires! © 11Oct51; LP1218.
9. Shrine of the Silver Bird. © 18Oct51; LP1234.
10. Fighting Fury! © 25Oct51; LP1237.
11. Desperate Chances. © 1Nov51; LP1295.
12. Mystery of the Mine. © 8Nov51; LP1296.
13. Jungle Deadfall. © 15Nov51; LP1297.
14. Men from Tomorrow. © 22Nov51; LP1315.
15. The Last of Mysterious Island. © 28Nov51; MP1845.

MYSTERY AT THE BURLESQUE. Monogram Pictures Corp.,

1950. 58 min., sd., b&w, 35mm. © Monogram Pictures Corp.;
16Apr50; LP301.
THE MYSTERY BULLET. Adrian Weiss Productions, 1953. 3 reels,
sd., b&w, 16mm. Based on the Craig Kennedy stories created by
Arthur B. Reeve. © Adrian Weiss Productions; 17Feb53 (in
notice: 1952); LP2332.
MYSTERY HORSE. SEE Sky King, no. 24.
MYSTERY IN THE BACKYARD. Moody Bible Institute of Chicago.
Made by Moody Institute of Science. 13 min., sd., color, 16mm.
Eastman color. © Moody Bible Institute of Chicago; 7Dec56;
MP7816.
MYSTERY IN WAX. SEE Adventures of Superman.
MYSTERY IS MY BUSINESS. SEE The Adventures of Ellery
Queen.
MYSTERY MAN OF THE JUNGLE. SEE Adventures of Captain
Africa, no. 1.
MYSTERY MOUNTAIN. SEE Adventures of Champion.
THE MYSTERY OF CASPER HAUSER. SEE Telephone Time.
THE MYSTERY OF MINNIE. SEE TV Reader’s Digest.
THE MYSTERY OF MURDER. SEE Schlitz Playhouse of Stars.
THE MYSTERY OF SUICIDE GULCH. SEE Death Valley Days, no.
410.
MYSTERY OF THE BLACK JUNGLE. Venturini-Cosmopolitan
Films, Rome. Released in the U. S. by Republic Pictures Corp. 9
reels, sd., b&w, 35mm. Based on the novel by Salgari. © Republic
Pictures Corp.; 3Jan54; LP7037.
MYSTERY OF THE BROKEN STATUES. SEE Adventures of
Superman.
MYSTERY OF THE DOWNS. (You Can’t Escape) Associated
British Pictures Corp., London. Released by Associated British-
Pathe. 77 min., sd., b&w, 35mm. A Forth Films production.
Based on the novel She Died Young, by Alan Kennington. ©
Associated British-Pathe, Ltd.; 18Jan56; LP12507.
MYSTERY OF THE FOREST. SEE Jet Jackson, The Flying
Commando, no. 23.
THE MYSTERY OF THREE CLOCKS. Moody Bible Institute of
Chicago. Made by Moody Institute of Science. 28 min., sd., b&w,
16mm. (Sermons from Science) © Moody Bible Institute of
Chicago; 15Sep55; MP7484.
MYSTERY OF THREE CLOCKS. Moody Bible Institute of Chicago.
Made by Moody Institute of Science. 28 min., sd., b&w, 16mm.
(Sermons from Science) Produced in cooperation with the Kresge
Foundation. A television adaptation of the motion picture of the
same title. © Moody Bible Institute of Chicago; 2Jun56;
MP7252.
THE MYSTERY OF TIME. Educational Film Division, Moody
Institute of Science. 41 min., sd., color, 16mm. © Moody
Institute of Science; 15Dec57; MP8923.
THE MYSTERY PLANE. SEE Perils of the Wilderness, no. 2.
THE MYSTERY PLANE FLIES AGAIN. SEE Perils of the
Wilderness, no. 14.
MYSTERY SNIPER. SEE State Trooper. The Sniper.
MYSTERY STREET. Loew’s Inc., 1950. An MGM picture. 93 min.,
sd., b&w, 35mm. © Loew’s Inc.; 16May50; LP111.
MYSTERY SUBMARINE. Universal International, 1950. 78 min.,
sd., b&w, 35mm. © Universal Pictures Co., Inc.; 16Nov50;
LP536.
 N
NAAMAN THE LEPER. Moody Bible Institute of Chicago. Made by
Moody Institute of Science. 13 min., sd., color, 16mm.
Kodachrome. © Moody Bible Institute; 1Jan55 (in notice: 1954);
MP6807.
NAILED DOWN. SEE Fireside Theatre.
NAKED ALIBI. Universal Pictures Co. 86 min., sd., b&w, 35mm. A
Universal International picture. © Universal Pictures Co., Inc.;
20Jul54; LP3943.
NAKED DAWN. Universal Pictures Co. 82 min., sd., color, 35mm.
A Universal International picture. Technicolor. © Universal
Pictures Co., Inc.; 24Jun55 (in notice: 1954); LP5186.
NAKED EARTH. Foray Films. Released by Twentieth Century-Fox
Film Corp. 10 reels, sd., b&w, 35mm. CinemaScope. © Twentieth
Century-Fox Film Corp.; 19Jun58 (in notice: 1957); LP11684.
NAKED GUN. Associated Film Releasing Corp. 69 min., sd., b&w,
35mm. © Associated Film Releasing Corp.; 12Nov56; LP9249.
THE NAKED HILLS. LaSalle Productions. Released by Allied
Artists Pictures Corp. 73 min., sd., color, 35mm. © LaSalle
Productions, Inc.; 31May56 (in notice: 1955); LP6509.
NAKED IN THE SUN. Empire Studios. Released by Allied Artists
Pictures Corp. 79 min., sd., color, 35mm. Eastman color. Based
on the novel The Warrior, by Frank G. Slaughter. © Allied Artists
Pictures Corp.; 6Oct57 (in notice: 1956); LP9250.
THE NAKED JUNGLE. Paramount Pictures Corp. 95 min., sd.,
color, 35mm. Technicolor. Based on a story by Carl Stephenson.
© Paramount Pictures Corp.; 1Mar54 (in notice: 1953); LP3973.
THE NAKED MAJA. Titanus. Released by United Artists Corp. 111
min., sd., Technicolor, 35mm. Technirama. © Titanus, S. P. A.;
16Apr59 (in notice: 1958); LP13247.
NAKED PARADISE. Sunset Productions. Released by American
International Pictures. 68 min., sd., color, 35mm. Pathecolor. ©
Sunset Productions; 7Jan57; LP7779.
NAKED SEA. Theatre Productions. Released by RKO Radio
Pictures. 70 min., sd., color, 35mm. © Theatre Productions, Inc.;
31Dec54; LP5543.
THE NAKED SPUR. Metro-Goldwyn-Mayer. Released by Loew’s,
1953. 91 min., sd., color, 35mm. © Loew’s Incorporated; 6Jan53
(in notice: 1952); LP2297.
THE NAKED STREET. Fame Pictures. Released by United Artists
Corp. 84 min., sd., b&w, 35mm. Based on a story by Leo Katcher.
© Fame Pictures, Inc.; 9Sep55; LP5694.
NAME YOU CAN BUILD ON. Truscon Steel Division. Made by
Wilding Picture Productions. 29 min., sd., color, 16mm. ©
Truscon Steel Division, Republic Steel Corp.; 30Jul57; MP8572.
THE NAMELESS. SEE Wire Service.
THE NAME’S BUCHANAN. SEE Buchanan Rides Alone.
NANCY GOES TO RIO. Loew’s Inc., 1950. An MGM picture. 99
min., sd., color, 35mm. © Loew’s Inc.; 31Jan50 (in notice: 1949);
LP2824.
NANCY HANKS. TV-Radio Workshop, 1952. 3 reels, sd., b&w,
35mm. Second in a series of films depicting the life of Abraham
Lincoln. Appl. title: Mr. Lincoln: Nancy Hanks. © TV-Radio
Workshop; 30Nov52; LP2303.
NANCY MARLBOROUGH STORY. SEE The Millionaire.
NANCY WELLINGTON STORY. SEE The Millionaire.
NAPLES. SEE The Count of Monte Cristo.
NAPOLEON BUNNY-PART. Warner Bros. Cartoons. 7 min., sd.,
color, 35mm. (Merrie Melodies Cartoon. Bugs Bunny Special)
Technicolor. © Vitaphone Corp.; 16Jun56; MP8317.
THE NAPOLEONIC ERA. Coronet Instructional Films. 15 min.,
sd., b&w, 16mm. © Coronet Instructional Films, a division of
Esquire, Inc.; 7Jun57; MP8578.
NAPOLEON’S RETURN FROM ELBA. SEE You Are There.
NARCOSIS. California Dept. of Justice, Bureau of Narcotic
Enforcement. 35 min. © State of California, Dept. of Justice,
Bureau of Narcotic Enforcement; 11Oct54; MU5780.
NARCOTIC EVILS. F. Thomas Mueller. 25 min., si., color, 8mm.
Kodachrome. © F. Thomas Mueller; 4Mar55; MU5852.
NARCOTICS. SEE Confidential File.
NARRAGANSETT BAY. Chevrolet Motor Division, General Motors
Corp. [1952] Produced by Jam Handy Organization. 3 min.,
color, 35mm. © Chevrolet Division, General Motors Corp.;
22Apr52; MU5426.
NARROW ESCAPE. Flying A Pictures, 1953. 3 reels, sd., b&w,
16mm. © Flying A Pictures, Inc.; 16Mar53 (in notice: 1952);
LP2409.
THE NARROW MARGIN. RKO Radio Pictures, 1952. 71 min., sd.,
b&w, 35mm. Based on a story by Martin Goldsmith and Jack
Leonard. © RKO Radio Pictures, Inc.; 5Apr52; LP1720.
NASSAU HOLIDAY. Columbia Pictures Corp. 1 reel, sd., b&w,
35mm. (World of Sports) © Columbia Pictures Corp.; 24May56;
MP7499.
NASTY KNIGHT. SEE Tom Terrific.
NAT “KING” COLE AND JOE ADAMS’ ORCHESTRA. Universal,
1952. 15 min., sd., b&w, 35mm. © Universal Pictures Co., Inc.;
18Feb52 (in notice: 1951); LP1499.
NAT ‘KING’ COLE AND RUSS MORGAN’S ORCHESTRA.
Universal Pictures Co. 2 reels, sd., b&w, 35mm. A Universal
International picture. A three-dimensional film. © Universal
Pictures Co., Inc.; 29Oct53; LP3147.
NAT “KING” COLE AND THE KING COLE TRIO
TELESCRIPTIONS. Snader Telescriptions Corp., 1951. 18 min.,
sd., b&w, 16mm. © Snader Telescriptions Corp.; 1Apr51 (in
notice: 1950); MP1174.
NAT “KING” COLE AND THE KING COLE TRIO
TELESCRIPTIONS. Snader Telescriptions Corp., 1951. 17 min.,
sd., b&w, 16mm. © Snader Telescriptions Corp.; 19Feb51;
MP1390.
NAT KING COLE MUSICAL STORY. Universal Pictures Co. 2
reels, sd., color, 35mm. A Universal International picture.
CinemaScope. Technicolor. © Universal Pictures Co., Inc.;
2Dec55; LP5754.
NATCHEZ TRACE. SEE The Adventures of Jim Bowie, no. 3.
NATE CHAMPION. SEE Stories of the Century.
THE NATION CALLED DENVER. March of Time, 1950. 2 reels,
sd., b&w, 16mm. © Time, Inc.; 15Dec50; MP2108.
A NATION DECIDES. March of Time, Oct. 1952. 29 min., sd.,
b&w, 16mm. © Time, Inc.; 22Oct52; MP3213.
A NATION IS FIFTY. RKO-Pathe. 1952. 16 min., sd., b&w, 35mm.
© RKO Pathe, Inc.; 24Apr52; MP2667.
A NATION OF ATHLETES. Paramount Pictures Corp. 1 reel, sd.,
b&w, 35mm. (Grantland Rice Sportlight) © Paramount Pictures
Corp.; 18Nov55; MP6590.
THE NATION TO DEFEND. Coronet, 1952. 1 reel, sd., b&w,
16mm. (Are You Ready for Service? No. 8) © David A. Smart;
7Jan52; MP2055.
NATIONAL HONEYMOON. SEE Your All Star Theatre, no. 3.
THE NATIONAL PARK RANGERS. Wayne Mitchell. 18 min., sd.,
color, 16mm. Kodachrome. An Alpine production produced with
the cooperation of the Rangers of Sequoia National Park. ©
Wayne Mitchell; 1Oct53; MU5591.
NATIONAL PARK TOUR—YELLOWSTONE. SEE Sightseeing with
the Swayzes Through Vacationland America, no. 7.
THE NATIONAL POST-TRONIC. National Cash Register Co. Made
by Jam Handy Organization. 31 min., sd., color, 16mm.
Kodachrome. © National Cash Register Co.; 16Apr57; MU6322.
NATIONAL SECURITY VS. INDIVIDUAL RIGHTS. Jefferson
Productions. Released by McGraw-Hill Book Co. 27 min., sd.,
b&w, 16mm. (Problems of Democracy) From the CBS television
program See It Now. © Jefferson Productions, Inc.; 27Jul55;
MP6524.
NATIONALISM. Encyclopaedia Britannica Films, 1952. 20 min.,
sd., b&w, 16mm. (American Democracy Series) © Encyclopaedia
Britannica Films, Inc.; 9Oct52; MP3242.
NATIONAL’S ANIMATED FILM COMMERCIAL. Emil Mogul Co.
[1953] 20 sec., sd., b&w, 16mm. Appl. author: Myron Mahler. ©
Emil Mogul Co., Inc.; 13May53; MU5555.
A NATION’S MEAT. Pat Dowling Pictures for Swift & Company,
1950. 26 min., sd., color, 16mm. © Swift & Company; 1Mar50;
MP5.
THE NATION’S MENTAL HEALTH. SEE The March of Time, v.
17, no. 3.
NATIVE SON. Argentina Sono Film S.A.C.I., Buenos Aires, 1951.
Released by Classic Pictures. 91 min., sd., b&w, 35mm. Based on
the novel of the same title by Richard Wright. © Walter Gould;
8Mar51; LP1023.
NATURE GIRL AND THE SLAVER. ARCA-Cinematografica and
ARCA-Filmproduktion. Released by United Producers Releasing
Organization. 70 min., sd., Eastman color, 35mm. From the book
by Anne Day-Helveg. © United Producers Organization;
10Nov59; LP14934.
THE NATURE OF COLOR. Coronet Instructional Films. 10 min.,
sd., color, 16mm. Eastman color. Revised version. © Coronet
Instructional Films; 2Jan57; MP8099.
THE NATURE OF CORROSION: ANODE AND CATHODE
PROCESSES. SEE Corrosion in Action.
THE NATURE OF HEAT. Coronet Instructional Films. 11 min., sd.,
b&w, 16mm. Appl. author: Marvin Camras. © John Smart;
29Sep53; MP3925.
NATURE OF LEARNING. International Business Machines Corp.
1190 ft., b&w, 16mm. © International Business Machines Corp.;
5Jun59; MU6753.
NATURE OF TEACHING. International Business Machines Corp.
1170 ft., b&w, 16mm. © International Business Machines Corp.;
5Jun59; MU6754.
NATURE STUDY. SEE The People’s Choice, no. 7.
NATURE’S ENGINEERS. SEE Fury.
NATURE’S HALF ACRE. Walt Disney Productions. Released by
RKO Radio Pictures, 1951. 33 min., sd., color, 35mm. (Truelife
Adventure Series) Technicolor. © Walt Disney Productions;
11May51; MP3556.
NATURE’S PLAN. Conservation Foundation in association with
the New York Zoological Society. Released by Encyclopaedia
Britannica Films. 14 min., sd., color, 16mm. (The Living Water
Series, no. 1) Kodachrome. © The New York Zoological Society;
16Mar53 (in notice: 1952); MP3748.
NATURE’S SHOWCASE. RKO-Pathe. 8 min., sd., b&w, 35mm.
(Screenliner) © RKO-Pathe, Inc.; 8Feb55; MP5806.
NATURE’S STRANGEST CREATURES. Walt Disney Productions.
Released by Buena Vista Film Distribution Co. 1 reel, sd.,
Technicolor, 35mm. © Walt Disney Productions; 28Jan59;
LP13493.
NATURE’S TECHNIQUES. SEE John Kieran’s Kaleidoscope, no.
44.
NAUGHTY BUT NICE. Broadway Roadshow Productions, 1952. 10
min., sd., b&w, 35mm. © Broadway Roadshow Productions
(Harry A. Farros); 15Jan52; MP2580.
NAUGHTY MERMAIDS. Twentieth Century-Fox Film Corp. 1 reel,
sd., color, 35mm. CinemaScope. © Twentieth Century-Fox Film
Corp.; 22Jul55; MP6466.
THE NAUGHTY TWENTIES. Vitaphone Corp., 1951. A Warner
Bros. short subject. 10 min., sd., b&w, 35mm. (Hit Parade of the
 Gay Nineties Series) © The Vitaphone Corp.; 14Sep51 (in notice:
1950); MP1602.
NAVAJO. B-F Productions. Released by Lippert, 1951. 70 min., sd.,
b&w, 35mm. © B-F Productions; 7Dec51; LP1494.
NAVAJO CANYON COUNTRY. Avalon Daggett Productions. 13
min., sd., color, 16mm. Kodachrome. © Avalon Daggett; 1Aug54;
MP5055.
THE NAVIGATOR. SEE Alcoa Presents.
NAVY ALL-AMERICAN. Columbia Pictures Corp. 1 reel, sd., b&w,
35mm. (World of Sports) © Columbia Pictures Corp.; 15Mar56;
MP7497.
NAVY BOUND. Monogram Pictures Corp., 1951. 60 min., sd., b&w,
35mm. Based on the story of the same title by Talbert Josselyn.
© Monogram Pictures Corp.; 4Mar51; LP849.
NAVY CORPSMAN. SEE Navy Log.
THE NAVY HOLDS—1942. SEE Crusade in the Pacific, no. 6.
NAVY LOG. CBS Television Film Sales. 3 reels each, sd., b&w,
16mm. © CBS Television Film Sales, Inc.

After You, Ludwig. © 13Mar57; LP12280.

The Amateurs. © 5Dec57; LP11176.
American U-Boat 111. © 23Jan58; LP11164.
Assignment BRT. © 10Apr57; LP12345.
The Ballad of the Big E. © 12Jun57; LP12326.
The Beachcomber. © 14Apr56; LP6646.
The Beachpounders. © 19Dec57; LP11171.
The Big A. © 17Oct56; LP12322.
The Big White Albatross. © 26Dec57; LP1172.
The Bishop of the Bayfield. © 17Dec55; LP6222.
Blood Alley. © 13Feb58; LP11161.
Welcome to our website – the ideal destination for book lovers and
knowledge seekers. With a mission to inspire endlessly, we offer a
vast collection of books, ranging from classic literary works to
specialized publications, self-development books, and children's
literature. Each book is a new journey of discovery, expanding
knowledge and enriching the soul of the reade

Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.

Let us accompany you on the journey of exploring knowledge and

personal growth!

ebookultra.com