Hacker's Secrets 4

home *** CD-ROM | disk | FTP | other *** search

/ Hacker's Secrets 4 / Hacker's Secrets 4.iso / privacy / eff / eff-309.txt < prev next >

Wrap

Text File | 1992-11-28 | 21KB | 457 lines

########## ########## ########## | COMPUTER SPIES ########## ########## ########## | by Mitchell Kapor #### #### #### | ######## ######## ######## |BUILDING BLOCKS AS STUMBLING BLOCKS ######## ######## ######## | A Commentary on the 15th NCSC #### #### #### | by Rebecca Mercuri ########## #### #### | ########## #### #### | THIS OLD DOS ===================================================================== EFFector Online November 9, 1992 Issue 3.09 A Publication of the Electronic Frontier Foundation ISSN 1062-9424 ===================================================================== Computer Spies by Mitchell Kapor Can a company lawfully eavesdrop on its employees' telephone calls? Not if they have an expectation of privacy. But, at least in most states, the employer can monitor conversations if it tells the workers that that is what it is going to do. That old legal issue surfaces in a new technological context in Silicon Valley, with disturbing consequences for your ability to defend key information assets. Take a look at how Borland International, a company that should know better after almost a decade on the leading edge of technology, may have hurt itself in a case involving an apparent theft of trade secrets. The allegations in the tangled legal affair are by now well known. On Sept. 1 Eugene Wang, a vice president of Borland's computer languages division, abruptly jumped ship to join competitor Symantec Corp. A pattern of suspicious behavior in Wang's final days suggested that perhaps he had traded Borland secrets along with his job. Borland had no proof, but it knew where to look. Borland executives opened Wang's MCI Mail account, where they found, they said, a number of messages that they believe prove Wang delivered Borland product plans, memos and other sensitive documents to Symantec. The evidence thus uncovered led to police searches of Wang's and Symantec Chief Executive Gordon Eubanks' homes and Symantec offices, to a pending criminal investigation of Wang and Eubanks and to a civil suit by Borland against Symantec. What has been scarcely addressed in newspaper coverage of these events is what this case means to the rapidly growing business of electronic mail. Let's back up and consider the law that protects electronic mail users, the federal Electronic Communications Privacy Act of 1986. The privacy act protects messages while in transmission on a public mail service such as MCI, as well as after messages are received and stored on that service. Borland and its attorneys, in a hurry to prove their suspicions about Wang, justified their intrusion into the mailbox as a property right: Borland was paying the bills for Wang's MCI account. "E-mail is like an in-box on someone's desk,' says Borland spokesman Steven Grady in defense of the search. "When they leave, it reverts to the corporation." Case closed? Not quite. Borland's metaphors fall apart when tested against the realities of electronic mail. Unlike in-boxes on an abandoned desk, E-mail requires a password, and it can be administered by a wholly separate communications company, like MCI. As it stands, in a criminal case Wang could challenge the legality of all the evidence collected on the basis of the messages found in his MCI account. He may also have grounds for a countersuit under the electronic privacy act and California law, which goes further in protecting individual privacy. It's easy to understand the anger Borland executives felt in discovering an apparent information hemorrhage. But the methods employed by Borland, which likes to flaunt its "barbarian" ways, may have been a little too barbarian by the standards of the federal statute. The one thing for sure is that all parties will be involved in a lengthy and expensive court battle to sort this out. The final result may be a draw between Borland and Symantec, and a new definition of privacy for the rest of corporate America. Borland could have strengthened its case against Wang if it had followed the recommendation of the Electronic Mail Association to announce its policies on electronic mail. As it was, a source says the Santa Cruz County District Attorney staff took potential violations of the electronic privacy act so seriously that they used a top computer-crime prosecutor from the San Francisco area to help write the search warrants. Despite Borland's hard-learned lessons, it continues to refuse to implement a formal E-mail privacy policy that declares just when electronic messages sent from company equipment are company property. Perhaps Borland is afraid that announcing such a policy would simply remind miscreants to erase incriminating E-mail files before they are found. If so, that's naive and shortsighted. Some companies may be reluctant to announce in advance that they are constantly snooping. So be it, but then they should refrain from scanning MCI in-boxes. Whatever they do, they have to confront the reality of the enormous power of digital media. In an age when a company's most valuable property may be intangible the source code for a software package, for example an E-mail account may amount to an unlocked door on a warehouse. The electronic privacy act's procedures may need streamlining, and the Borland case may be the ratchet that makes the adjustments. By the time Borland could have obtained court authorization to examine Wang's electronic mail, some of the messages might have been deleted by MCI's automated five-day cleanup function. New legislation requires fine- tuning in the light of the complexities of real world situations in order to be effective for the purposes for which it was originally designed. But the lesson here is that corporations must begin to adjust their own policies to fit the technologies they use. from Forbes Magazine November 9 1992 Mitch Ratcliffe, editor-at-large for MacWEEK, provided research assistance for this column. -==--==--==-<>-==--==--==- BUILDING BLOCKS TO SYSTEM SECURITY By Rebecca Mercuri (mercuri@gradient.cis.upenn.edu) A Report from the 15th National Computer Security Conference October 13 -16, Baltimore, Maryland. I attended the 15th National Computer Security Conference with the hope of coming away with some solutions for the security problems I had encountered over the past few years. I left with a longer list of problems, and the vague feeling that our industry has become remiss in providing us with answers that we can use, or has answers and is either incapable or unwilling to yield them publicly. Let me state clearly here that this comment does not reflect negatively on the conference organizers. They performed their task well, creating a superbly orchestrated event that covered a broad spectrum of topics. Indeed, "rookies" were liberally mixed on panels with esteemed "greybeards" and many women (sans beards) were in evidence as session chairs and presenters (although I was somewhat dismayed to note that females appeared to constitute less than 10% of the attendees, lower than in the computing community in general). The breadth and extent of the conference does not allow one reporter to describe it fully, so I offer these remarks merely as comment and commentary, perhaps to stimulate discussion. The conference had an international flavor. The keynote was by Roland Hueber (Directorate General of the Commission of the European Communities) and the closing plenary on International Harmonization serving as bookends. There were repeated calls for cooperation in developing global security standards, with the primary advantages of such appearing to be in commerce. In the wake of the cold war, there seems to be a spirit of openness in this regard. I offer the speculation that it may be foolhardy to enter into conformity of thought and solutions. Diversity, particularly in commerce, inspires creativity. Monopoly, or single-mindedness, often leaves one at risk of exploitation by a strong central power, or of attack by those who are close enough or who understand the system well enough to side-track it We may need "fault-tolerant" and "diversified" answers. It is useful to juxtapose thoughts about covert channels with those about encryption systems. For the uninitiated, covert channels are created when internal intermittent polling is performed in an effort to conceal illicit data collection activities. Bob Morris provided the statistic that 1/10 of a bit per second is enough to expose a key in approximately 1 month. This is at current processing rates, but one can extrapolate out the Silicon Valley curve and surmise that our current key encryption systems will be inadequate within the end of the century (if not now, perhaps). In the quest for security tools one encounters the debate on provability and formal top level specification. With respect to covert channels, Virgil Gligor referred to "formal top level specification as an unmitigated waste of time," saying that data structures and source may not map to the top level, there may not be enough relevant details provided, and excessive false illegal flows may occur. Earl Boebert stated that formal proving methods have worth in analysis of specifications, but have failed utterly in spec/code, code/object, and code/behavior correspondence. Still, formal methods have their supporters, most notably SRI, as indicated by John Rushby, one of their directors (who also publicly revealed that there had been a major successful break-in at the lab last month). Interestingly, the panel on Intrusion Detection was chaired by SRI's Teresa Lunt, who discussed the use of expert systems to encode vulnerabilities, attack methods and known suspicious behaviors. Steve Snapp expressed the divide and conquer approach, saying that there may be no single generalizable model of intrusion, and that static, incidence/existence, and data driven methods should all be used. The matter of viruses was explored throughout various sessions. The general consensus of opinion seemed to be that rigorous procedures and policies need to be implemented so that recovery is possible to some level following contamination or invasion. In the talks I attended, no clear method for handling the recovery from a "new" virus (that can not be eradicated with existing software) was offered. This was not consoling to someone who had just last week left a client's law office with the admonishment "don't use any of the text files that you've created in the last 6 months until I can find out what the new virus strain is that appears to have adhered to some unknown quantity of them." Here too, the standardization on certain operating systems and environments (such as Microsoft Windows(TM)), and uniform acceptance of specific tools (such as the legal community's reliance on Word Perfect(TM)) encourages the proliferation of attacks that could potentially disable large sectors of the user base. Losses seem to be tied heavily to the bottom line. In banking, it may not be advantageous to implement a $10M or more security system that still does not assure total impenetrability when insurance coverage can be obtained at a cost of $1M (even if this price only remains low until there is a hit). In health care, as described in Deborah Hamilton's award-winning paper, the bottom line may indeed be one or more people's lives. As true with drug approvals, it is easy to see that holding back an inadequately tested computer system may cost more lives than providing it while make improvements and corrections. How does one weigh security, reliability and verifiability issues when there is a crying need for access to the developing technology? We are faced with a moral dilemma without a governing body to set policies. The area of privacy was eloquently addressed by Attorney Christine Axsmith who said that our reasonable expectations of privacy, as expressed by the 4th Amendment, protect people, not just places. But she went on to say that with regard to the computer industry, the Privacy Act and other legislation efforts still suffer from a lack of court rulings necessary to define their interpretations. Will our efforts to improve security undermine privacy? Curt Symes (from IBM) stated that "we'll all be using smart cards in the future, for a higher level of authentication." Does this mean that I will eventually be required to be bioidentified (DNA, fingerprint, retinal scan, voiceprint) in order to obtain access to my own data and research? A chilling thought. In conclusion, to paraphrase Peter Neumann, perhaps the conference theme "Information Systems Security: Building Blocks to the Future" should be read not as "building-blocks" (the small bricks), but as "building BLOCKS" or obstacles to our future as security professionals. There is a sense of urgency now -- many of us need more than a foundation of toy blocks, requiring true solutions which appear to not be forthcoming. What we don't want are systems and design structures that are so cumbersome as to impede computational progress. Discussion may be fruitful, but let us put our noses to the grindstone and provide functional tools and answers, rather than guidelines and assertions. While some are working in this direction, many others are needed. NCSC '92 -- Comment and Commentary Copyright (c) 1992 by Rebecca Mercuri. All Rights Reserved. Reposting and/or reprint not granted without prior written permission from the author. Address questions, response and corrections to: mercuri@gradient.cis.upenn.edu -==--==--==-<>-==--==--==- THIS OLD DOS Hi, I'm Bob Wheeler Dealer, and welcome to This Old DOS. Last week you may remember we renovated the Charles Babbage Family computer. We upgraded their antique CPM to the IBM operating system known as MS DOS. And this week on This Old DOS, we're continuing our renovation by installing a brand new operating system, supposed to be real easy to use, called Windows. And boy am I excited. So let's go around back and see how Norm is doing with it. Bob: Hi Norm; how's it going? Norm: Oh, hi Bob. Well as you can see I'm about to install Windows on our old machine. Bob: No glass in these Windows, huh Norm? Ha ha. Norm: Ha ha. That's right, just a handful of floppy disks. This is an attempt at making an IBM PC work *a little bit more* like an Apple Macintosh. Instead of typing commands, you just move a lot of little pictures around on a screen. Bob: I can't wait. Sounds simple enough; let's take a whack at it. Norm: Well, ok, the first thing we do is install these disks. Pop them in the computer and follow the uh directions on the screen. Here you try (sound of hard drive grinding). That's it. Bob: Simple enough. Norm: Ok, Bob, now the machine wants to know if you want to modify your config.sys or change your autoexec.bat to automatically load when the machines boots up. What do you want to do? Bob: What's a config.sys? I don't anything about this stuff. Norm: Never mind, it's ok Bob, I'll take care of it. There. Now to be really state of the art, we've got to upgrade our microprocessor (sound of sawing). That's the computer chip inside inside so that these Windows will work fast enough. Otherwise, you know, you might as well go out and get a cup of coffee while the screen draws pretty pictures, heh heh. So let me get one of these uh 486 chips. We've got a crane here. Hey fellas.. fellas! You wanna load that puppy here inta place? Careful! (sound of machinery) Don't bend the pins! There, all snapped in. Bob: All right, now we're ready to open Windows, right? Norm: Not on your life, Bob. While we're at it we're building an extention onto the memory board for those fat, greedy programs that gobble the stuff up. I'll just hammer a few of these 4 megabyte chips into place (bang bang). There, now we've got 16 megabytes on board. Narly, man! Bob: All right, let her rip, Norm. Norm: Not so fast, Bob! Those big Windows programs need lots and lots of storage space. Charles talked to his banker and decided to spring for that 200 megabyte beauty there. Hand me that..uh Bob: You mean this thing here? (groaning and grunting) Norm: Yeah, that's the hard drive. Ah, thanks. And they want to do multimedia.. you know sound, graphics, computer games... the latest -- so we'll add on a new super VGA monitor.. Bob: Something else? Norm: A CD ROM drive.. Bob: Something else? More stuff? Norm: Yeah, we have a sound board and special speakers if you want that great sound. Bob: This .. this isn't so simple anymore! Norm: Well, we're just about ready to go. That's about it. Bob: All right now, with all this preparation Norm, this had better be great. Norm: Well, I hope so, let's (sound of drive grinding) load up Word Perfect, Lotus 1.-2-3, Excel, and FileMaker Pro and watch her rip! (beep.. crash). Oh-oh. Bob: What happened? What happened? Norm: Well, it looks like a system crash. Bob: Oh no! Norm: Don't worry! We can fix this thing. We can fix it. Bob: What do we do now, give up? Norm: No, Never! We drop everything and start over. That's the American Way. You keep changing stuff until you find what's wrong. Bob: Now, how long is this gonna take? I haven't got all weeks to..? Norm: Don't worry! We'll I'll have this thing running like top, Bob. In the mean time you can go back in my shop there and use my Mac. Bob: All right, you keep working at it Norm. We're out of time folks. Join us tomorrow for the start of our new 50-part series: "How to install and maintain a Local Area Network." Until then, bye bye for This Old DOS! (c) Copyright National Public Radio (R) 1992. The segment by NPR's Ira Plato was originally broadcast on National Public Radio's "Talk of the Nation" on September 11, 1992 and is used with permission of National Public Radio. Any unauthorized duplication is prohibited. -==--==--==-<>-==--==--==- MEMBERSHIP IN THE ELECTRONIC FRONTIER FOUNDATION If you support our goals and our work, you can show that support by becoming a member now. Members receive our bi-weekly electronic newsletter, EFFector Online, the @eff.org newsletter and special releases and other notices on our activities. But because we believe that support should be freely given, you can receive these things even if you do not elect to become a member. Our memberships are $20.00 per year for students, $40.00 per year for regular members. You may, of course, donate more if you wish. Our privacy policy: The Electronic Frontier Foundation will never, under any circumstances, sell any part of its membership list. We will, from time to time, share this list with other non-profit organizations whose work we determine to be in line with our goals. If you do not grant explicit permission, we assume that you do not wish your membership disclosed to any group for any reason. ---------------- EFF MEMBERSHIP FORM --------------- Mail to: The Electronic Frontier Foundation, Inc. 155 Second St. #39 Cambridge, MA 02141 I wish to become a member of the EFF I enclose:$__________ $20.00 (student or low income membership) $40.00 (regular membership) $100.00(Corporate or company membership. This allows any organization to become a member of EFF. It allows such an organization, if it wishes to designate up to five individuals within the organization as members.) I enclose an additional donation of $ Name: Organization: Address: City or Town: State: Zip: Phone:( ) (optional) FAX:( ) (optional) Email address: I enclose a check [ ] . Please charge my membership in the amount of $ to my Mastercard [ ] Visa [ ] American Express [ ] Number: Expiration date: Signature: Date: I hereby grant permission to the EFF to share my name with other non-profit groups from time to time as it deems appropriate [ ] . Initials: Your membership/donation is fully tax deductible. ===================================================================== EFFector Online is published by The Electronic Frontier Foundation 155 Second Street, Cambridge MA 02141 Phone: +1 617 864 0665 FAX: +1 617 864 0866 Internet Address: eff@eff.org Reproduction of this publication in electronic media is encouraged. Signed articles do not necessarily represent the view of the EFF. To reproduce signed articles individually, please contact the authors for their express permission. ===================================================================== This newsletter is printed on 100% recycled electrons.