home *** CD-ROM | disk | FTP | other *** search
Text File | 2002-05-27 | 554.1 KB | 11,458 lines
[ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-= ========================================================================== = <=-[ HWA.hax0r.news ]-=> = ========================================================================== [=HWA'99=] Number 27 Volume 1 1999 July 31st 99 ========================================================================== [ 61:20:6B:69:64:20:63:6F:75: ] [ 6C:64:20:62:72:65:61:6B:20:74:68:69:73: ] [ 20:22:65:6E:63:72:79:70:74:69:6F:6E:22:! ] ========================================================================== New mirror site, Stefan did a *very* nice job on this check it out, http://www.alldas.de/hwaidx1.htm HWA.hax0r.news is sponsored by Cubesoft communications www.csoft.net and www.digitalgeeks.com thanks to p0lix for the digitalgeeks bandwidth and airportman for the Cubesoft bandwidth. Also shouts out to all our mirror sites! tnx guys. http://www.csoft.net/~hwa http://www.digitalgeeks.com/hwa HWA.hax0r.news Mirror Sites: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.alldas.de/hwaidx1.htm ** NEW ** http://www.csoft.net/~hwa/ http://www.digitalgeeks.com/hwa. http://members.tripod.com/~hwa_2k http://welcome.to/HWA.hax0r.news/ http://www.attrition.org/~modify/texts/zines/HWA/ http://archives.projectgamma.com/zines/hwa/. http://www.403-security.org/Htmls/hwa.hax0r.news.htm SYNOPSIS (READ THIS) -------------------- The purpose of this newsletter is to 'digest' current events of interest that affect the online underground and netizens in general. This includes coverage of general security issues, hacks, exploits, underground news and anything else I think is worthy of a look see. (remember i'm doing this for me, not you, the fact some people happen to get a kick/use out of it is of secondary importance). This list is NOT meant as a replacement for, nor to compete with, the likes of publications such as CuD or PHRACK or with news sites such as AntiOnline, the Hacker News Network (HNN) or mailing lists such as BUGTRAQ or ISN nor could any other 'digest' of this type do so. It *is* intended however, to compliment such material and provide a reference to those who follow the culture by keeping tabs on as many sources as possible and providing links to further info, its a labour of love and will be continued for as long as I feel like it, i'm not motivated by dollars or the illusion of fame, did you ever notice how the most famous/infamous hackers are the ones that get caught? there's a lot to be said for remaining just outside the circle... <g> @HWA =-----------------------------------------------------------------------= Welcome to HWA.hax0r.news ... #27 =-----------------------------------------------------------------------= We could use some more people joining the channel, its usually pretty quiet, we don't bite (usually) so if you're hanging out on irc stop by and idle a while and say hi... ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** *** *** *** please join to discuss or impart news on techno/phac scene *** *** stuff or just to hang out ... someone is usually around 24/7*** *** *** *** Note that the channel isn't there to entertain you its for *** *** you to talk to us and impart news, if you're looking for fun*** *** then do NOT join our channel try #weirdwigs or something... *** *** we're not #chatzone or #hack *** *** *** ******************************************************************* =-------------------------------------------------------------------------= Issue #27 =--------------------------------------------------------------------------= [ INDEX ] =--------------------------------------------------------------------------= Key Intros =--------------------------------------------------------------------------= 00.0 .. COPYRIGHTS ...................................................... 00.1 .. CONTACT INFORMATION & SNAIL MAIL DROP ETC ....................... 00.2 .. SOURCES ......................................................... 00.3 .. THIS IS WHO WE ARE .............................................. 00.4 .. WHAT'S IN A NAME? why `HWA.hax0r.news'?.......................... 00.5 .. THE HWA_FAQ V1.0 ................................................ =--------------------------------------------------------------------------= Key Content =--------------------------------------------------------------------------= 01.0 .. GREETS .......................................................... 01.1 .. Last minute stuff, rumours, newsbytes ........................... 01.2 .. Mailbag ......................................................... 02.0 .. From the Editor.................................................. 03.0 .. l0pht releases AntiSniff - Press release......................... 04.0 .. Pixar to remake TRON?............................................ 05.0 .. Meet the fed (zdtv:Defcon)....................................... 06.0 .. Poulsen at DefCon................................................ 07.0 .. Y2K Situation in Europe.......................................... 08.0 .. Applied Maximum Internet Security................................ 09.0 .. HPSBUX9907-100 CDE Leaves Current Directory in root PATH......... 10.0 .. Tiger vulnerability.............................................. 11.0 .. Tattooman (Ken Williams) climbs back in the ring................. 12.0 .. UPDATE ON THE PACKET STORM WEB SITE SITUATION.................... 13.0 .. Piracy is Big Business for Some ................................. 14.0 .. Mitnick sentencing postponed again............................... 15.0 .. Military Reserves to be Used for Cyber Defense .................. 16.0 .. Kodak's new PROM copy-killer?.................................... 17.0 .. Sandstorm Releases New Version of Phone Sweep ................... 18.0 .. Major FUD - US Under Attack by Russians.......................... 19.0 .. BO2K and SMS, Which One is Evil? ................................ 20.0 .. The Last True Hacker ............................................ 21.0 .. One Russian ISP Standing Up to FSB .............................. 22.0 .. Gameboy steals cars, makes free fone calls....................... 23.0 .. Mitnick Retains High Profile Lawyer For State Case .............. 24.0 .. Back Orifice for Macintosh? ..................................... 25.0 .. AOL Criminals Busted ............................................ 26.0 .. Press Does Not Know What to Say About BO2K ...................... 27.0 .. UCITA Moves Forward - Will Remove Vendor Liability............... 28.0 .. NSC Proposes FidNet - Infrastructure Protection or Surveillance Tool? 29.0 .. Local Cops Funded by IT Industry ................................ 30.0 .. Two Arrested for Corporate Espionage ............................ 31.0 .. Virus Infestations On the Rise .................................. 32.0 .. Granny Hacker from Heck visits Def Con parts 1 to 3.............. 33.0 .. FidNet Causing Massive Confusion ................................ 34.0 .. Lawmakers Want Drug Info Off the Net ............................ 35.0 .. Reno Wants Inet Crypto Banned ................................... 36.0 .. CCC Camp Happens Next Weekend ................................... 37.0 .. Computer Criminal Busted in UK .................................. 38.0 .. Researching an attack (KeyRoot) by Mnemonic....................... 39.0 .. Win98 Security Issues A KeyRoot/gH Advisory by Mnemonic........... 40.0 .. WLDoTrans.asp allows CC retrieval A gH Advisory by Mnemonic....... 41.0 .. bad CGI scripts allow web access A gH Advisory by Mnemonic........ 42.0 .. Can my firewall protect me? by Mnemonic........................... 43.0 .. How company specific programs can be used against the company by Mnemonic 44.0 .. Exploiting the netware bindery by Mnemonic........................ 45.0 .. Tax Break for Key Escrow Crypto .................................. 46.0 .. NSA Claims Israel Attacking US ................................... 47.0 .. Jail Time for Users of Crypto .................................... 48.0 .. Office97 Users Ripe for the Picking .............................. 49.0 .. China Sends Pirate to Jail ....................................... 50.0 .. MITNICK: FEDERAL GOVERNMENT MANIPULATED THE FACTS................. 51.0 .. ISPS ACCUSE CHINA OF INFOWAR...................................... 52.0 .. PETERSEN INTERVIEW: TRADING CYBERCRIME FOR CYBERPORN.............. 53.0 .. GHOSTS IN THE MACHINE............................................. 54.0 .. DATABASE PROTECTIONS OK-D......................................... 55.0 .. YET ANOTHER SITE SPITTING OUT PERSONAL INFO....................... 56.0 .. CALIFORNIA ADOPTS DIGITAL SIGNATURE LAW........................... 57.0 .. NEW AMMO AGAINST VIRUSES.......................................... 58.0 .. DOE SECRETARY ORDERS SECURITY BREAK............................... 59.0 .. EU MEMBERS NOT FOLLOWING DATA-PROTECTION RULES.................... 60.0 .. EXPERTS WARN ABOUT NEW Y2K-THREAT................................. 61.0 .. WILL YOUR CABLE MODEM CENSOR THE WEB?............................. 62.0 .. UNMASKING ANONYMOUS POSTERS....................................... 63.0 .. AOL Y2KFIX: A HOAX DISGUISED AS A HOAX?........................... 64.0 .. NO FBI SURVEILLANCE AFTER CRITICISMS.............................. 65.0 .. FEDS CRACK DOWN ON Y2K FRAUD...................................... 66.0 .. RED HAT DELIVERS LINUX E-COMMERCE SERVER.......................... 67.0 .. HACKING IN 1999 .................................................. 68.0 .. Y2k crash test for Windows and DOS................................ 69.0 .. CASSANDRA GOLD.................................................... 70.0 .. BELL CANADA Y2k TEST.............................................. 71.0 .. [RHSA-1999:025-01] Potential misuse of squid cachemgr.cgi ........ 72.0 .. [RHSA-1999:022-03] New Samba pacakges available (updated)......... 73.0 .. CERT« Advisory CA-99-10 Insecure Default Configuration on RaQ2 Servers 74.0 .. MS Security Bulletin: Patch Available for "Malformed Dialer Entry" Vulnerability 75.0 .. Senate asks for input into information infrastructure protection plan 76.0 .. FBI: beware outside Y2K workers................................... 77.0 .. HPSBUX9907-101 Security Vulnerability Software Distributor (SD)... 78.0 .. NSA spying on Americans? (who ya kidding??? of COURSE they are)... 79.0 .. AOL messaging policy might risk cable deals ...................... 80.0 .. Study calls for reserve virtual IT warfare unit................... 81.0 .. CERT IN-99-04: Similar Attacks Using Various RPC Services......... =--------------------------------------------------------------------------= AD.S .. Post your site ads or etc here, if you can offer something in return thats tres cool, if not we'll consider ur ad anyways so send it in. ads for other zines are ok too btw just mention us in yours, please remember to include links and an email contact. Corporate ads will be considered also and if your company wishes to donate to or participate in the upcoming Canc0n99 event send in your suggestions and ads now...n.b date and time may be pushed back join mailing list for up to date information....................................... Current dates: Aug19th-22nd Niagara Falls... ................. Ha.Ha .. Humour and puzzles ............................................ Hey You!........................................................ =------=........................................................ Send in humour for this section! I need a laugh and its hard to find good stuff... ;)........................................... SITE.1 .. Featured site, ................................................. H.W .. Hacked Websites ............................................... A.0 .. APPENDICES...................................................... A.1 .. PHACVW linx and references...................................... =--------------------------------------------------------------------------= @HWA'99 00.0 (C) COPYRIGHT, (K)OPYWRONG, COPYLEFT? V2.0 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ THE OPINIONS OF THE WRITERS DO NOT NECESSARILY REFLECT THE OPINIONS OF THE PUBLISHERS AND VICE VERSA IN FACT WE DUNNO WTF IS GONNA TAKE RESPONSIBILITY FOR THIS, I'M NOT DOING IT (LOTS OF ME EITHER'S RESOUND IN THE BACKGROUND) SO UHM JUST READ IT AND IF IT BUGS YOU WELL TFS (SEE FAQ). Important semi-legalese and license to redistribute: YOU MAY DISTRIBUTE THIS ZINE WITHOUT PERMISSION FROM MYSELF AND ARE GRANTED THE RIGHT TO QUOTE ME OR THE CONTENTS OF THE ZINE SO LONG AS Cruciphux AND/OR HWA.hax0r.news ARE MENTIONED IN YOUR WRITING. LINK'S ARE NOT NECESSARY OR EXPECTED BUT ARE APPRECIATED the current link is http://welcome.to/HWA.hax0r.news IT IS NOT MY INTENTION TO VIOLATE ANYONE'S COPYRIGHTS OR BREAK ANY NETIQUETTE IN ANY WAY IF YOU FEEL I'VE DONE THAT PLEASE EMAIL ME PRIVATELY current email cruciphux@dok.org THIS DOES NOT CONSTITUTE ANY LEGAL RIGHTS, IN THIS COUNTRY ALL WORKS ARE (C) AS SOON AS COMMITTED TO PAPER OR DISK, IF ORIGINAL THE LAYOUT AND COMMENTARIES ARE THEREFORE (C) WHICH MEANS: I RETAIN ALL RIGHTS, BUT I GIVE YOU THE RIGHT TO READ, QUOTE AND REDISTRIBUTE/MIRROR. - EoD Although this file and all future issues are now copyright, some of the content holds its own copyright and these are printed and respected. News is news so i'll print any and all news but will quote sources when the source is known, if its good enough for CNN its good enough for me. And i'm doing it for free on my own time so pfffft. :) No monies are made or sought through the distribution of this material. If you have a problem or concern email me and we'll discuss it. cruciphux@dok.org Cruciphux [C*:.] 00.1 CONTACT INFORMATION AND MAIL DROP ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Wahoo, we now have a mail-drop, if you are outside of the U.S.A or Canada / North America (hell even if you are inside ..) and wish to send printed matter like newspaper clippings a subscription to your cool foreign hacking zine or photos, small non-explosive packages or sensitive information etc etc well, now you can. (w00t) please no more inflatable sheep or plastic dog droppings, or fake vomit thanks. Send all goodies to: HWA NEWS P.O BOX 44118 370 MAIN ST. NORTH BRAMPTON, ONTARIO CANADA L6V 4H5 WANTED!: POSTCARDS! YESH! POSTCARDS, I COLLECT EM so I know a lot of you are ~~~~~~~ reading this from some interesting places, make my day and get a mention in the zine, send in a postcard, I realize that some places it is cost prohibitive but if you have the time and money be a cool dude / gal and send a poor guy a postcard preferably one that has some scenery from your place of residence for my collection, I collect stamps too so you kill two birds with one stone by being cool and mailing in a postcard, return address not necessary, just a "hey guys being cool in Bahrain, take it easy" will do ... ;-) thanx. Ideas for interesting 'stuff' to send in apart from news: - Photo copies of old system manual front pages (optionally signed by you) ;-) - Photos of yourself, your mom, sister, dog and or cat in a NON compromising position plz I don't want pr0n. <g> - Picture postcards - CD's 3.5" disks, Zip disks, 5.25" or 8" floppies, Qic40/80/100-250 tapes with hack/security related archives, logs, irc logs etc on em. - audio or video cassettes of yourself/others etc of interesting phone fun or social engineering examples or transcripts thereof. Stuff you can email: - Prank phone calls in .ram or .mp* format - Fone tones and security announcements from PBX's etc - fun shit you sampled off yer scanner (relevant stuff only like #2600 meeting activities) - reserved for one smiley face -> :-) <- - PHACV lists of files that you have or phac cd's you own (we have a burner, *g*) - burns of phac cds (email first to make sure we don't already have em) - Any and all telephone sounds/tones/beeps/trunk drops/line tests/etc in .ram etc format or .mp* If you still can't think of anything you're probably not that interesting a person after all so don't worry about it <BeG> Our current email: Submissions/zine gossip.....: hwa@press.usmc.net Private email to editor.....: cruciphux@dok.org Distribution/Website........: sas72@usa.net @HWA 00.2 Sources *** ~~~~~~~~~~~ Sources can be some, all, or none of the following (by no means complete nor listed in any degree of importance) Unless otherwise noted, like msgs from lists or news from other sites, articles and information is compiled and or sourced by Cruciphux no copyright claimed. News & I/O zine ................. <a href="http://www.antionline.com/">http://www.antionline.com/</a> Back Orifice/cDc..................<a href="http://www.cultdeadcow.com/">http://www.cultdeadcow.com/</a> News site (HNN) .....,............<a href="http://www.hackernews.com/">http://www.hackernews.com/</a> Help Net Security.................<a href="http://net-security.org/">http://net-security.org/</a> News,Advisories,++ .(lophtcrack)..<a href="http://www.l0pht.com/">http://www.l0pht.com/</a> NewsTrolls .(daily news ).........<a href="http://www.newstrolls.com/">http://www.newstrolls.com/</a> News + Exploit archive ...........<a href="http://www.rootshell.com/beta/news.html">http://www.rootshell.com/beta/news.html</a> CuD Computer Underground Digest...<a href="http://www.soci.niu.edu/~cudigest">http://www.soci.niu.edu/~cudigest</a> News site+........................<a href="http://www.zdnet.com/">http://www.zdnet.com/</a> News site+Security................<a href="http://www.gammaforce.org/">http://www.gammaforce.org/</a> News site+Security................<a href="http://www.projectgamma.com/">http://www.projectgamma.com/</a> News site+Security................<a href="http://securityhole.8m.com/">http://securityhole.8m.com/</a> News site+Security related site...<a href="http://www.403-security.org/">http://www.403-security.org/</a> News/Humour site+ ................<a href="http://www.innerpulse.com/>http://www.innerpulse.com</a> News/Techie news site.............<a href="http://www.slashdot.org/>http://www.slashdot.org</a> +Various mailing lists and some newsgroups, such as ... +other sites available on the HNN affiliates page, please see http://www.hackernews.com/affiliates.html as they seem to be popping up rather frequently ... http://www.the-project.org/ .. IRC list/admin archives http://www.anchordesk.com/ .. Jesse Berst's AnchorDesk alt.hackers.malicious alt.hackers alt.2600 BUGTRAQ ISN security mailing list ntbugtraq <+others> NEWS Agencies, News search engines etc: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.cnn.com/SEARCH/ <a href="http://www.cnn.com/SEARCH/">Link</a> http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0 <a href="http://www.foxnews.com/search/cgi-bin/search.cgi?query=hack&days=0&wires=0&startwire=0">Link</a> http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack <a href="http://www.news.com/Searching/Results/1,18,1,00.html?querystr=hack">Link</a> http://www.ottawacitizen.com/business/ <a href="http://www.ottawacitizen.com/business/">Link</a> http://search.yahoo.com.sg/search/news_sg?p=hack <a href="http://search.yahoo.com.sg/search/news_sg?p=hack">Link</a> http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack <a href="http://www.washingtonpost.com/cgi-bin/search?DB_NAME=WPlate&TOTAL_HITLIST=20&DEFAULT_OPERATOR=AND&headline=&WITHIN_FIELD_NAME=.lt.event_date&WITHIN_DAYS=0&description=hack">Link</a> http://www.zdnet.com/zdtv/cybercrime/ <a href="http://www.zdnet.com/zdtv/cybercrime/">Link</a> http://www.zdnet.com/zdtv/cybercrime/chaostheory/ (Kevin Poulsen's Column) <a href="http://www.zdnet.com/zdtv/cybercrime/chaostheory/">Link</a> NOTE: See appendices for details on other links. http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm <a href="http://news.bbc.co.uk/hi/english/sci/tech/newsid_254000/254236.stm">Link</a> http://freespeech.org/eua/ Electronic Underground Affiliation <a href="http://freespeech.org/eua/">Link</a> http://ech0.cjb.net ech0 Security <a href="http://ech0.cjb.net">Link</a> http://axon.jccc.net/hir/ Hackers Information Report <a href="http://axon.jccc.net/hir/">Link</a> http://net-security.org Net Security <a href="http://net-security.org">Link</a> http://www.403-security.org Daily news and security related site <a href="http://www.403-security.org">Link</a> Submissions/Hints/Tips/Etc ~~~~~~~~~~~~~~~~~~~~~~~~~~ All submissions that are `published' are printed with the credits you provide, if no response is received by a week or two it is assumed that you don't care wether the article/email is to be used in an issue or not and may be used at my discretion. Looking for: Good news sites that are not already listed here OR on the HNN affiliates page at http://www.hackernews.com/affiliates.html Magazines (complete or just the articles) of breaking sekurity or hacker activity in your region, this includes telephone phraud and any other technological use, abuse hole or cool thingy. ;-) cut em out and send it to the drop box. - Ed Mailing List Subscription Info (Far from complete) Feb 1999 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~~~~~~~ ~~~~~~~~ ISS Security mailing list faq : http://www.iss.net/iss/maillist.html THE MOST READ: BUGTRAQ - Subscription info ~~~~~~~~~~~~~~~~~~~~~~~~~~~ What is Bugtraq? Bugtraq is a full-disclosure UNIX security mailing list, (see the info file) started by Scott Chasin <chasin@crimelab.com>. To subscribe to bugtraq, send mail to listserv@netspace.org containing the message body subscribe bugtraq. I've been archiving this list on the web since late 1993. It is searchable with glimpse and archived on-the-fly with hypermail. Searchable Hypermail Index; http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html <a href="http://www.eecs.nwu.edu/~jmyers/bugtraq/index.html">Link</a> About the Bugtraq mailing list ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The following comes from Bugtraq's info file: This list is for *detailed* discussion of UNIX security holes: what they are, how to exploit, and what to do to fix them. This list is not intended to be about cracking systems or exploiting their vulnerabilities. It is about defining, recognizing, and preventing use of security holes and risks. Please refrain from posting one-line messages or messages that do not contain any substance that can relate to this list`s charter. I will allow certain informational posts regarding updates to security tools, documents, etc. But I will not tolerate any unnecessary or nonessential "noise" on this list. Please follow the below guidelines on what kind of information should be posted to the Bugtraq list: + Information on Unix related security holes/backdoors (past and present) + Exploit programs, scripts or detailed processes about the above + Patches, workarounds, fixes + Announcements, advisories or warnings + Ideas, future plans or current works dealing with Unix security + Information material regarding vendor contacts and procedures + Individual experiences in dealing with above vendors or security organizations + Incident advisories or informational reporting Any non-essential replies should not be directed to the list but to the originator of the message. Please do not "CC" the bugtraq reflector address if the response does not meet the above criteria. Remember: YOYOW. You own your own words. This means that you are responsible for the words that you post on this list and that reproduction of those words without your permission in any medium outside the distribution of this list may be challenged by you, the author. For questions or comments, please mail me: chasin@crimelab.com (Scott Chasin) Crypto-Gram ~~~~~~~~~~~ CRYPTO-GRAM is a free monthly newsletter providing summaries, analyses, insights, and commentaries on cryptography and computer security. To subscribe, visit http://www.counterpane.com/crypto-gram.html or send a blank message to crypto-gram-subscribe@chaparraltree.com.á To unsubscribe, visit http://www.counterpane.com/unsubform.html.á Back issues are available on http://www.counterpane.com. CRYPTO-GRAM is written by Bruce Schneier.á Schneier is president of Counterpane Systems, the author of "Applied Cryptography," and an inventor of the Blowfish, Twofish, and Yarrow algorithms.á He served on the board of the International Association for Cryptologic Research, EPIC, and VTW.á He is a frequent writer and lecturer on cryptography. CUD Computer Underground Digest ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This info directly from their latest ish: Computer underground Digestááá Suná 14 Feb, 1999áá Volume 11 : Issue 09 ááááá ááááááááááááááááááááá ISSNá 1004-042X áááááá Editor: Jim Thomas (cudigest@sun.soci.niu.edu) áááááá News Editor: Gordon Meyer (gmeyer@sun.soci.niu.edu) áááááá Archivist: Brendan Kehoe áááááá Poof Reader:áá Etaion Shrdlu, Jr. áááááá Shadow-Archivists: Dan Carosone / Paul Southworth ááááááááááááááááááááááááá Ralph Sims / Jyrki Kuoppala ááááááááááááááááááááááááá Ian Dickinson áááááá Cu Digest Homepage: http://www.soci.niu.edu/~cudigest [ISN] Security list ~~~~~~~~~~~~~~~~~~~ This is a low volume list with lots of informative articles, if I had my way i'd reproduce them ALL here, well almost all .... ;-) - Ed Subscribe: mail majordomo@repsec.com with "subscribe isn". @HWA 00.3 THIS IS WHO WE ARE ~~~~~~~~~~~~~~~~~~ Some HWA members and Legacy staff ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ cruciphux@dok.org.........: currently active/editorial darkshadez@ThePentagon.com: currently active/man in black fprophet@dok.org..........: currently active/IRC+ man in black sas72@usa.net ............. currently active/IRC+ distribution vexxation@usa.net ........: currently active/IRC+ proof reader/grrl in black dicentra...(email withheld): IRC+ grrl in black eentity ...( '' '' ): Currently active/IRC+ man in black Foreign Correspondants/affiliate members ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Qubik ............................: United Kingdom D----Y ...........................: USA/world media HWA members ......................: World Media Past Foreign Correspondants (currently inactive or presumed dead) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ N0Portz ..........................: Australia system error .....................: Indonesia Wile (wile coyote) ...............: Japan/the East Ruffneck ........................: Netherlands/Holland Please send in your sites for inclusion here if you haven't already also if you want your emails listed send me a note ... - Ed Spikeman's site is down as of this writing, if it comes back online it will be posted here. http://www.hackerlink.or.id/ ............ System Error's site (in Indonesian) ******************************************************************* *** /join #HWA.hax0r.news on EFnet the key is `zwen' *** ******************************************************************* :-p 1. We do NOT work for the government in any shape or form.Unless you count paying taxes ... in which case we work for the gov't in a BIG WAY. :-/ 2. MOSTLY Unchanged since issue #1, although issues are a digest of recent news events its a good idea to check out issue #1 at least and possibly also the Xmas issue for a good feel of what we're all about otherwise enjoy - Ed ... @HWA 00.4 Whats in a name? why HWA.hax0r.news?? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Well what does HWA stand for? never mind if you ever find out I may have to get those hax0rs from 'Hackers' or the Pretorians after you. In case you couldn't figure it out hax0r is "new skewl" and although it is laughed at, shunned, or even pidgeon holed with those 'dumb leet (l33t?) dewds' <see article in issue #4> this is the state of affairs. It ain't Stephen Levy's HACKERS anymore. BTW to all you up and comers, i'd highly recommend you get that book. Its almost like buying a clue. Anyway..on with the show .. - Editorial staff @HWA 00.5 HWA FAQ v1.0 Feb 13th 1999 (Abridged & slightly updated again) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Also released in issue #3. (revised) check that issue for the faq it won't be reprinted unless changed in a big way with the exception of the following excerpt from the FAQ, included to assist first time readers: Some of the stuff related to personal useage and use in this zine are listed below: Some are very useful, others attempt to deny the any possible attempts at eschewing obfuscation by obsucuring their actual definitions. @HWA - see EoA ;-) != - Mathematical notation "is not equal to" or "does not equal" ASC(247) "wavey equals" sign means "almost equal" to. If written an =/= (equals sign with a slash thru it) also means !=, =< is Equal to or less than and => is equal to or greater than (etc, this aint fucking grade school, cripes, don't believe I just typed all that..) AAM - Ask a minor (someone under age of adulthood, usually <16, <18 or <21) AOL - A great deal of people that got ripped off for net access by a huge clueless isp with sekurity that you can drive buses through, we're not talking Kung-Fu being none too good here, Buy-A-Kloo maybe at the least they could try leasing one?? *CC - 1 - Credit Card (as in phraud) 2 - .cc is COCOS (Keeling) ISLANDS butthey probably accept cc's CCC - Chaos Computer Club (Germany) *CON - Conference, a place hackers crackers and hax0rs among others go to swap ideas, get drunk, swap new mad inphoz, get drunk, swap gear, get drunk watch videos and seminars, get drunk, listen to speakers, and last but not least, get drunk. *CRACKER - 1 . Someone who cracks games, encryption or codes, in popular hacker speak he's the guy that breaks into systems and is often (but by no means always) a "script kiddie" see pheer 2 . An edible biscuit usually crappy tasting without a nice dip, I like jalapeno pepper dip or chives sour cream and onion, yum - Ed Ebonics - speaking like a rastafarian or hip dude of colour <sic> also wigger Vanilla Ice is a wigger, The Beastie Boys and rappers speak using ebonics, speaking in a dark tongue ... being ereet, see pheer EoC - End of Commentary EoA - End of Article or more commonly @HWA EoF - End of file EoD - End of diatribe (AOL'ers: look it up) FUD - Coined by Unknown and made famous by HNN <g> - "Fear uncertainty and doubt", usually in general media articles not high brow articles such as ours or other HNN affiliates ;) du0d - a small furry animal that scurries over keyboards causing people to type weird crap on irc, hence when someone says something stupid or off topic 'du0d wtf are you talkin about' may be used. *HACKER - Read Stephen Levy's HACKERS for the true definition, then see HAX0R *HAX0R - 1 - Cracker, hacker wannabe, in some cases a true hacker, this is difficult to define, I think it is best defined as pop culture's view on The Hacker ala movies such as well erhm "Hackers" and The Net etc... usually used by "real" hackers or crackers in a derogatory or slang humorous way, like 'hax0r me some coffee?' or can you hax0r some bread on the way to the table please?' 2 - A tool for cutting sheet metal. HHN - Maybe a bit confusing with HNN but we did spring to life around the same time too, HWA Hax0r News.... HHN is a part of HNN .. and HNN as a proper noun means the hackernews site proper. k? k. ;& HNN - Hacker News Network and its affiliates http://www.hackernews.com/affiliates.html J00 - "you"(as in j00 are OWN3D du0d) - see 0wn3d MFI/MOI- Missing on/from IRC NFC - Depends on context: No Further Comment or No Fucking Comment NFR - Network Flight Recorder (Do a websearch) see 0wn3d NFW - No fuckin'way *0WN3D - You are cracked and owned by an elite entity see pheer *OFCS - Oh for christ's sakes PHACV - And variations of same <coff> Phreaking, Hacking, Anarchy, Cracking, Carding (CC) Groups Virus, Warfare Alternates: H - hacking, hacktivist C - Cracking <software> C - Cracking <systems hacking> V - Virus W - Warfare <cyberwarfare usually as in Jihad> A - Anarchy (explosives etc, Jolly Roger's Cookbook etc) P - Phreaking, "telephone hacking" PHone fREAKs ... CT - Cyber Terrorism *PHEER - This is what you do when an ereet or elite person is in your presence see 0wn3d *RTFM - Read the fucking manual - not always applicable since some manuals are pure shit but if the answer you seek is indeed in the manual then you should have RTFM you dumb ass. TBC - To Be Continued also 2bc (usually followed by ellipses...) :^0 TBA - To Be Arranged/To Be Announced also 2ba TFS - Tough fucking shit. *w00t - 1 - Reserved for the uber ereet, noone can say this without severe repercussions from the underground masses. also "w00ten" <sic> 2 - Cruciphux and sAs72's second favourite word (they're both shit stirrers) *wtf - what the fuck, where the fuck, when the fuck etc .. *ZEN - The state you reach when you *think* you know everything (but really don't) usually shortly after reaching the ZEN like state something will break that you just 'fixed' or tweaked. @HWA -=- :. .: -=- 01.0 Greets!?!?! yeah greets! w0w huh. - Ed ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Thanks to all in the community for their support and interest but i'd like to see more reader input, help me out here, whats good, what sucks etc, not that I guarantee i'll take any notice mind you, but send in your thoughts anyway. * all the people who sent in cool emails and support FProphet Pyra TwstdPair _NeM_ D----Y Dicentra vexxation sAs72 Spikeman p0lix Ken Williams/tattooman of PacketStorm, hang in there Ken...:( & Kevin Mitnick (watch yer back) kewl sites: + http://www.securityportal.com/ NEW + http://www.securityfocus.com/ NEW + http://www.hackcanada.com/ + http://www.l0pht.com/ + http://www.2600.com/ + http://www.freekevin.com/ + http://www.genocide2600.com/ + http://www.packetstorm.harvard.edu/ ******* DOWN ********* SEE AA.A + http://www.hackernews.com/ (Went online same time we started issue 1!) + http://www.net-security.org/ + http://www.slashdot.org/ + http://www.freshmeat.net/ + http://www.403-security.org/ + http://ech0.cjb.net/ @HWA 01.1 Last minute stuff, rumours and newsbytes ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "What is popular isn't always right, and what is right isn't always popular..." - FProphet '99 +++ When was the last time you backed up your important data? ++ AGENT STEAL INTERVIEW Justin Petersen tells CNN he now plans to begin a new life online, free of crime, with an adult Web site. The interview airs on CNN Sunday and Monday at 8 p.m. ET and 10 p.m. PT. ++ INFOWARCON'99 by BHZ, Saturday 24th July 1999 on 10:26 pm CET Infowar (www.infowar.com) announced this year's security gathering - InfowarCon '99. It will be held in Washington from September 8th - 9th and: "Designed for corporations, infrastructure firms, and finance, military, intelligence and law enforcement organizations, InfowarCon '99 provides proven tactics for defending the enterprise and infrastructures". Thanks to myself for providing the info from my wired news feed and others from whatever sources, also to Spikeman for sending in past entries.... - Ed @HWA 01.2 MAILBAG - email and posts from the message board worthy of a read ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 02.0 From the editor. ~~~~~~~~~~~~~~~~ #include <stdio.h> #include <thoughts.h> #include <backup.h> main() { printf ("Read commented source!\n\n"); /* * Nothing much to say, I have a summer cold, (gak!) here's * issue #27... start reading. :) * * hwa@press.usmc.net * */ printf ("EoF.\n"); } Congrats, thanks, articles, news submissions and kudos to us at the main address: hwa@press.usmc.net complaints and all nastygrams and mai*lbombs can go to /dev/nul nukes, synfloods and papasmurfs to 127.0.0.1, private mail to cruciphux@dok.org danke. C*:. 03.0 l0pht releases AntiSniff - Press release ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ For Immediate Release L0pht Heavy Industries Releases a Public Beta of Its Revolutionary New AntiSniff Network Security Software Boston, MA - July 22, 1999 - L0pht Heavy Industries, a world renowned computer security think tank, today announced the public beta release of its AntiSniff network security software, which can detect attackers surreptitiously monitoring a computer network. "AntiSniff is a whole new breed of network security tool, designed to detect the attack patterns used in compromising a computer network, instead of merely being reactive to already known vulnerabilities.", said Dr. Mudge, Chief Scientist at L0pht Heavy Industries. AntiSniff, which operates on both Windows NT and UNIX operating systems, will detect remote computers that are packet sniffing, that is, monitoring all network communications. In a recent survey, three-quarters of U.S. corporations, government agencies, financial institutions and universities reported suffering financial losses due to computer security breaches. Some of these attacks have become quite famous, such as the successfull attacks against the Senate & FBI webservers. Other attacks, however, don't get any media attention, and are far worse than the defacement of a web site. These attacks involve the invasion of government and corporate secrets, and personal privacy. Many of these attacks rely on packet sniffing to penetrate deep into a computer network. Network communication can be likened to large group of people standing together in a room and talking. When people talk to each other, others nearby have the ability to listen in. When computers communicate over networks, they normally only listen to communications destined to themselves. However, they also have the ability to enter promiscous mode, which allows them to listen to communications that are destined to other computers. When an attacker successfully compromises a computer, they install what is known as a packet sniffer, a tool that puts the computer into promiscuous mode, thus allowing them to monitor and record all network communications. The private information they gather, such as account names, passwords, credit cards, and even e-mail, is then used to compromise other computers. This is how, from one weak computer in a computer network, many computers, and the information they contain can be compromised. Until now, it has been impossible for network administrators to remotely detect if computers were listening in on all network communications. L0pht Heavy Industries' AntiSniff stops all this, by giving network administrators and information security professionals the ability to remotely detect computers that are packet sniffing, regardless of the operating system. Dr. Mudge explains, "AntiSniff works by running a number of non-intrusive tests, in a variety of fashions, which can determine whether or not a remote computer is listening in on all network communications. Now it is impossible for an attacker who is sniffing to hide." Current network security tools, such as network scanners, work by probing machines for software that contains bugs or software that's misconfigured. Intrusion Detection Systems (IDS), work by finding malicious signatures in network traffic. AntiSniff, on the other hand, is the first of it's kind. It remotely detects the passive act of eavesdropping on network communications. It will even detect packet sniffers installed by a rogue insider who may have legitimate administrative access to a machine, but still should not be monitoring all network traffic. The AntiSniff public beta is released for Windows NT, complete with a fully featured graphical interface, report generating tools, and alarm system. It is designed so that it can be used to quickly scan a network or scan continuously, triggering alarms when a "packet sniffing" machine is detected. The beta version has been made available free to all who would like to try it out. L0pht hopes to have the commercial release ready within a few weeks. Retail and site license pricing have not yet been determined. To further the research of the security community as a whole, as they have in previous products, L0pht will be releasing AntiSniff as a UNIX command-line tool, complete with full source code. For more information please contact AntiSniff@l0pht.com. The free beta download and full documentation are available at http://www.l0pht.com/antisniff/. About L0pht Heavy Industries L0pht Heavy Industries is a world renowned computer security think tank. Founded in 1992 as a computer research facility, the L0pht has grown into a leader in the field of computer security software. The L0pht's products include L0phtCrack, the industry standard NT password auditing tool. As a result of their innovative security research, the L0pht has released dozens of computer security advisories to the Internet community, warning of dangerous vulnerabilities in today's most widely used software. Many at the L0pht are considered top experts in the computer security field and have appeared on numerous network news programs and documentaries, as well as having testified about government computer security for the U.S. Senate. Visit the L0pht's web site at http://www.l0pht.com. All trademarks and registered trademarks are the property of their respective holders. @HWA 04.0 Pixar to remake TRON? ~~~~~~~~~~~~~~~~~~~~~ -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Pixar Studios to remake Disney's Tron? By Richard Barry, ZDNet (UK) July 23, 1999 4:13 PM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2301037,00.html?chkpt=hpqs014 It set the scene for a generation of hi-tech sci-fi movies and, arguably, inspired some of the best films of the genre. Tron, the legendary Disney movie loved by the thirty-something generation, is rumored to be in the re-make room with some very serious backers, including Steve Jobs. Jobs, on stage this week with the iBook, also has another day job, running Pixar Animation Studios (Nasdaq:PIXR), maker of "Toy Story" and "A Bug's Life." According to one source, Pixar may be working on a remake of the classic '80s sci-fi film. The source, who asked not to be identified, said Pixar is trying to decide whether to remake the original or create a sequel. It will begin work on the project once Toy Story II hits the theaters November 24. John Lasseter, Toy Story's director, will head the production. Lending fuel to the rumor, Lasseter has gone on record crediting Tron as the driving inspiration behind Toy Story. He saw the film while working as an animator on Mickey's Christmas Carol and had two best friends on the production team. "It [Tron] was the future. It was the potential I saw in computer animation," Lasseter said. A spokesperson for Pixar in Richmond, Calif., said she was not aware of any Tron projects, but if it were to happen, it would likely be led by Disney. Disney owns 50 percent of Pixar. The company did not return calls by press time. @HWA 05.0 Meet the fed (zdtv:Defcon) ~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.zdnet.com/zdtv/cybercrime/features/story/0,3700,2293749,00.html Phil Loranger, division chief for information assurance with the US Army, speaks out about Def Con Phil Loranger, the division chief for information assurance with the US Army, was interviewed by CyberCrime analyst Alex Wellen while at Def Con. Here are excerpts. Why come to Def Con? "This is an important conference to anybody [who] attends. It is a conference in which there is a lot of valuable and technical information exchanged. "There is an opportunity to meet some of the folks on the dark side, if you will, to see some of their thinking. "We've done this [for the] first time this year to put [on] a federal panel and get [a] frank and honest exchange. ... To get some feelings from what the industry considers to be some of the most elite people in the dark side of computer security, if you will. "We were invited to do a presentation and to participate in a panel." Do you use hackers to check out your systems, to verify your vulnerablities? "Hackers, by their very definition, are law breakers and criminals, and I don't see why they should be rewarded, especially using taxpayer dollars. "We have very talented people who have never broken the law and have struggled very hard through [their] academic years; and those are the folks we want to bring onto the payroll. "This is not to say that the people we are addressing here today at this conference are criminals. We are talking here in broad strokes saying that if you break into a system you're a criminal." How have you been received by attendees? "I have been experiencing a very cordial interchange among the people we've met. Meet the [Fed] panel was a less regulated environment, if you will. I think that it was not as rowdy as I had imagined, and I was pleased about that. "Isn't it wonderful that we're able to have conferences like this under our form of government that says it's OK to not agree with the people on the platform?" Will you return to Def Con next year? "I see us reacting to invitations to these if there are more, absolutely. "Where else can you come and have a member of the White House National Security Counsel, a member of the Office of the Secretary of Defense for Investigation, and a member of the military department stand there and interface with what I guess is considered ... we're considered to be their targets and so forth." @HWA 06.0 Poulsen at DefCon ~~~~~~~~~~~~~~~~~ My First Def Con On finding decadence and dialogue in the desert By Kevin Poulsen July 14, 1999 I'm wandering through the hall outside the main conference room at the Alexis Park Hotel, stepping gingerly over blue Ethernet cable while gripping a drink in one hand, a cigarette in the other. Las Vegas is a nexus of many vices, crammed into spurts of late-night binges and hangover mornings. Last weekend it became an oasis of decadence and dialogue in a desert turned to mud by a freak thunderstorm. It's the seventh annual Def Con, the computer underground convention: my first. Around me, a chaotic bazaar shows hackers of all shapes and sizes crowding around tables stacked with underground publication, T-shirts, and chunks of technology begging to be taken apart and reassembled. The younger attendees are drowning in caffeinated drinks-- primarily Jolt cola, which was apparently stocked by the hotel especially for this occasion. "How is publicly releasing a hacking tool different from giving out guns to children?" queries the voice behind the camera, aimed for a kill shot at my head. Earlier in the day, The Cult of the Dead Cow made a flashy standing-room-only presentation of Back Orifice 2000 -- a feature-packed but stealthy remote-control utility for Windows-- and it's fast becoming a symbol for the conference. I don't know how to answer a question comparing a computer program to a firearm, but when the voice rephrases, I offer my soundbite. "Secrecy only helps the bad guys." By my definition, everyone at Def Con is a good guy, except the handful of good gals. The thousands of hackers, security consultants, outlaws, and scenesters from around the world are laying bare their knowledge, and sometimes their flesh, to each other and to the roving (and steadily increasing) glass eyes of news organizations that they suspect just don't get it. Even the cops tend towards openness, good-naturedly accepting their "I Am the Fed" T-shirts when sharp-eyed hackers pick them from the crowd. The Primo Stuff The Dead Cow was the star of the show, but other highlights included the premiere of a nine-minute teaser for Freedom Downtime, 2600 editor Emmanuel Goldstein's work-in-progress about the legal travails of imprisoned hacker Kevin Mitnick. After seeing the trailer, Chaos Theory foresees Goldstein and his documentary appearing at Cannes. You heard it here first. Austin Hill, president of Zero Knowledge Systems Inc., described the workings of his company's much-anticipated Freedom Net, an elaborate system intended to cloak the online activities of privacy conscious netizens. Hill wins my Golden Aphorism award (which I just invented) for his answer to law enforcement's complaints that Internet anonymity makes their job harder: "Policing is only easy in a police state." Sessions at the conference covered public policy, tutorials on computer security and lock-picking, a plethora of technical discussions, and games, such as Hacker Jeopardy and a social engineering contest. At night, hackers raved on the conference dance floor and partied in the suites. And it's there, away from the rows of Linux boxes and laptops, and beyond the reach of the blue cables, that the excesses of the Def Con nightlife evoke a Hollywood party, circa 1985. Reclining next to the hot tub at a shindig in one of the more spacious suites-- a vice, once again, in each hand-- someone offers me a tiny Ziplock bag filled with white powder. The illusion is dispelled when I read the warning label affixed to the bag. The powder is 100 percent pure caffeine. Primo stuff at the hacker con. Editor's Note: Kevin Poulsen was a speaker at Def Con, and was on the team that won Hacker Jeopardy, which also included Jennifer Granick and Mark Lottor. @HWA 07.0 Y2K Situation in Europe ~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by BHZ, Friday 23rd July 1999 on 1:17 pm CET German Council of Trade and Industry published results of their testing about Y2K compliance in German companies. It looks like just 45 percent of companies are properly prepared for the new millennium. According to some IT professionals, year 2000 will be a year of bankruptcies. Western European countries are prepared for Y2K, but there is always something to work around. Read the story on NY Times. July 23, 1999 Europe Rides Bumpy Computer Road to Year 2000 By EDMUND L. ANDREWS HANOVER, Germany -- Perhaps fittingly, Germany's first real scare about Year 2000 computer crashes came on a Friday the 13th. It was March 1998, and most people here were greeting warnings about Year 2000 failures with a lack of interest. It seemed like a trivial problem, a matter of making sure that computer clocks would not misread the year 2000 as 1900. Then came the test at the Hanover city power company, organized by a confident data processing manager in the spirit of public education, with local media invited to watch. At first, everything seemed fine. But within a few minutes after "midnight," the computer began spewing out thousands of error messages. Then it froze up entirely, and the monitors went blank. Hanover did not go dark. But for a few minutes, it was impossible to monitor the electric grid or to trace equipment breakdowns. It took seven months to eradicate all the problems. "I really thought it would be fine," said Juergen Rehmer, the blue-jeans-clad manager who arranged the event. "We had made a lot of changes already, and I was quite certain that a full-system test wouldn't present any great difficulty." Rehmer's test was a watershed. It disrupted a widespread complacency about Year 2000 problems, and marked the first time that a German power company had issued a warning. At the time it occurred, the German government had yet to make its first assessment of the Year 2000 problem. Surveys by insurance companies showed that the vast majority of companies had not even begun to look at their systems. "The European view is that Anglo-American countries are in kind of an hysterical mold," said Peter Eibert, the Year 2000 coordinator at Ford Motor Co. of Europe, based in Cologne. Germany and many of Europe's most advanced countries are racing to make up for lost time. Corporations are pouring billions of dollars into reprogramming computers. Government agencies have set up hot lines. Industry associations hold countless conferences, often invoking the image of ticking time bomb. They are making headway. Most experts are increasingly confident that Europe is not likely to see catastrophic failures. A Year 2000 trial involving Europe's major banks went smoothly. Airlines and airports, which recognized the danger long ago, say they are ready. Nevertheless, many smaller companies and public institutions are running out of time. In a recent survey, the German Council of Trade and Industry found that only 45 percent of companies were properly prepared. Hermes, a German insurance company in Hamburg, estimates that 60 percent of German companies still hadn't started a comprehensive program by last fall. "We believe there will be a substantially higher rate of bankruptcies in the year 2000," said Walter Schmitt-Jamin, a managing director of Hermes. A doubling of the usual bankruptcy rate, slightly less than one percent of companies each year, is entirely possible, he added. The readiness varies considerably across Western Europe. In Britain, the Netherlands and much of Scandinavia, governments and corporations jumped on the problem two years ago. In Germany and France, government and business leaders were until recently more lackadaisical. Poorer countries like Italy, Spain and Portugal are struggling. The formerly Communist nations of Central Europe and Russia are much more seriously behind. LOT, the Polish national airline, announced recently that it will ground about 70 flights on New Year's Eve out of concern about Year 2000 breakdowns. The Russian government recently reported that only one-third of the country's banks were ready. Western European countries are well prepared in comparison. But they also have more to worry about. The 15 nations of the European Union, 11 of which have now adopted the euro as a single currency, is an increasingly unified economy linked by dense information networks. There is a boom in the construction of cross-border fiber-optic networks. Power companies buy and sell electricity over electronic trading systems. Car manufacturers order from suppliers over computer networks. Yet when car manufacturers sent the worldwide suppliers detailed Year 2000 questionnaires in early 1997, most of the responses provided little in the way of useful information. That became a source of growing anxiety here in Germany over the next year. Executives at General Motors' Opel subsidiary were startled to discover that industrial robots they bought in 1997 still had Year 2000 glitches. By August 1998, Opel had decided to start sending its own Year 2000 assessors on personal visits to key suppliers. "The key was to ask questions that indicated whether the suppliers knew what they were talking about," said Roger Aze, Opel's Year 2000 coordinator. "Do you have a person in charge of Y2K? Do you have a program and a schedule?" In the last several months, Opel started sending technical experts to its most critical suppliers -- the ones whose own assembly lines are linked directly by computer network to those of Opel and that deliver on a "just in time" basis. But Aze is still bracing for things outside their control: power disruptions or problems further down the supply chains. Power remains one of the biggest concerns. "The energy industry had overslept," Rehmer said bluntly. It wasn't until July 1998 -- four months after Hanover's surprising test failure -- that the German Association of Electric Utilities advised members to "Start now!" on Year 2000 preparation. Today, Year 2000 experts in Germany say severe disruptions are unlikely but cannot be ruled out. As a result, many big industrial manufacturers are scaling back production to insulate themselves for a shock of an abrupt power disruption. BASF AG, the chemical conglomerate based in Ludwigshafen, has decided to shut a number of its systems on New Year's Eve so it can get by on the electricity from its own on-site power plant. So many manufacturers are reducing their power consumption on New Year's Eve that the utility industry has begun to worry about disruptions caused by an abrupt plunge in demand. One of the key differences between European countries on Year 2000 issues is the degree to which governments became involved. In Britain, Prime Minister Tony Blair has built up a huge program to promote awareness and point companies toward solutions. Besides drumming up publicity, the government fielded several thousand "bug busters" to get out the word. The Netherlands started a similar program, known as the Dutch Millennium Platform, headed by Jan Timmer, the former chairman of Philips Electronics NV. Timmer irked business groups by exhorting them to act, but most now experts rank the Netherlands alongside the United States and Britain as among the best-prepared countries. By contrast, German leaders did not show much interest in the subject until a few months ago. The government issued a tepid report one year ago and a more thorough one this spring, and it only recently set up an Internet site devoted to the issue. Local governments have largely been quiet on the matter. In March, the German weekly news magazine Focus published a survey indicating that most German cities had not yet prepared themselves for problems. According to the survey, carried out with the German Conference of Cities, half the cities had yet to test their hospitals, and one-third had not tested their mass transit systems. The hospitals have had a rude awakening. Andreas Tecklenberg, director of a 260-bed hospital in the north German town of Eutin, was dismayed when only six out of 150 manufacturers gave him useful answers when he sent them queries about Year 2000 problems. Since then, he has started to get better information. At the moment, he estimates, about one-third of the hospital's systems are "green" or ready; about one-third are yellow, and one-third still red. "The devices will have to be watched," Tecklenberg said. "But fortunately, we can have people take over if equipment goes wrong." At the German Heart Center in Berlin, which specializes in heart surgery, administrators are avoiding elective surgery between Christmas and January 3. It has also imposed a ban on holidays for most of the medical and technical staff on New Year's Eve. "If you look at this from the American standpoint, we all started late here," acknowledged Marcus Werner, who coordinates the center's Year 2000 planning. Werner started his preparations in October and said he was now reasonably confident about the hospital's medical equipment. But like so many others, he worries about power. The hospital shares a back-up generator with the University of Berlin, but he is still worried about the software that will have to ration the relatively scarce electricity. "What it comes down to is things you basically have no control over," he said. @HWA 08.0 Applied Maximum Internet Security ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by BHZ, Friday 23rd July 1999 on 1:09 pm CET Applied Maximum Internet Security, 3 day computer security seminar will be held in Cardiff By The Sea (California) on August 16-18, 1999 and September 27-29, 1999. ex-underground based instructors will cover the topics from essentials of TCP/IP, over the usual hacking/cracking tools to attack strategies. The fee is $1,395 for 3 days. @HWA 09.0 HPSBUX9907-100 CDE Leaves Current Directory in root PATH ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To: BugTraq Subject: [support_feedback@us-support.external.hp.com: Security Bulletins Digest] Date: Tue Jul 20 1999 13:58:28 Author: Patrick Oonk Message-ID: <19990720135828.J6635@atro.pine.nl> ----- Forwarded message from HP Electronic Support Center <support_feedback@us-support.external.hp.com> ----- Date: Tue, 20 Jul 1999 04:45:18 -0700 (PDT) Subject: Security Bulletins Digest From: support_feedback@us-support.external.hp.com (HP Electronic Support Center ) To: security_info@us-support.external.hp.com Reply-To: support_feedback@us-support.external.hp.com Errors-To: support_errors@us-support.external.hp.com HP Support Information Digests =============================================================================== o HP Electronic Support Center World Wide Web Service --------------------------------------------------- If you subscribed through the HP Electronic Support Center and would like to be REMOVED from this mailing list, access the HP Electronic Support Center on the World Wide Web at: http://us-support.external.hp.com Login using your HP Electronic Support Center User ID and Password. Then select Support Information Digests. You may then unsubscribe from the appropriate digest. =============================================================================== Digest Name: Daily Security Bulletins Digest Created: Tue Jul 20 3:00:02 PDT 1999 Table of Contents: Document ID Title --------------- ----------- HPSBUX9907-100 CDE Leaves Current Directory in root PATH The documents are listed below. ------------------------------------------------------------------------------- Document ID: HPSBUX9907-100 Date Loaded: 19990719 Title: CDE Leaves Current Directory in root PATH ------------------------------------------------------------------------- **REVISED 01** HEWLETT-PACKARD COMPANY SECURITY BULLETIN: #00100, 07 July 1999 Last Revised: 19 July 1999 ------------------------------------------------------------------------- The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard Company will not be liable for any consequences to any customer resulting from customer's failure to fully implement instructions in this Security Bulletin as soon as possible. ------------------------------------------------------------------------- PROBLEM: The current directory is in the root user's PATH after logging in using CDE. PLATFORM: HP 9000 series 700/800 at HP-UX revision 10.X DAMAGE: Increase in privileges.. SOLUTION: Modify /usr/dt/bin/Xsession until a patch is available. AVAILABILITY: This advisory will be updated when patches are available. CHANGE SUMMARY: HTML to text conversion instructions for script added. ------------------------------------------------------------------------- I. A. Background - The PATH environemnt variable is constructed from several sources including dtsearchpath and scripts in /etc/dt/config/Xsession.d/ and /usr/dt/config/Xsession.d/. The resulting PATH contains the string "::" which will be interpreted as the current directory. The root user should not have the current directory in the PATH. B. Fixing the problem - Since the PATH environment variable can be affected by dtsearchpath and several scripts, the recommended solution is to clean up the root user's PATH after is has been created. **REVISED 01** Note: This file is in HTML format. If you are editing the text version from a mailing the line below: for (i=1; i<=n; i++) { must be changed. Replace the characters between the second "i" and the "=n" with the single "less than" character (ascii 0x3c). The line will then read: for (i=1; iX=n; i++) { where X stands for the "less than" character. In /usr/dt/bin/Xsession just before this: # ########################################################################### # # Startup section. Add this: ###################### Clean up $PATH for root ########################## if [ "$USER" = "root" ] then Log "Clean up PATH for root user" Log "Old PATH = $PATH" PATH=`echo $PATH | awk ' { # Remove elements from PATH that are # (a) "." # (b) "" # (c) blank # gsub (" ",":", $0) # Substitite ":" for each blank n = split ($0, path, ":") # Split into elements with ":" as delimiter first = 1 # To suppress leading ":" in new PATH for (i=1; i<=n; i++) { len = length(path[i]) dot = index(path[i], ".") dot_only = 0 if ((len == 1) && (dot==1)) { dot_only = 1 } # print element if it is not "" and not "." if (!(len==0) && !(dot_only==1)) { if(first != 1) { printf (":") # if not first element, print ":" in front } printf ("%s",path[i]) first = 0 } } } END { printf ("\n") }'` Log "New PATH = $PATH" fi ###################### End - Clean up $PATH for root #################### C. To subscribe to automatically receive future NEW HP Security Bulletins from the HP Electronic Support Center via electronic mail, do the following: Use your browser to get to the HP Electronic Support Center page at: http://us-support.external.hp.com (for US, Canada, Asia-Pacific, & Latin-America) http://europe-support.external.hp.com (for Europe) Login with your user ID and password (or register for one). Remember to save the User ID assigned to you, and your password. Once you are in the Main Menu: To -subscribe- to future HP Security Bulletins, click on "Support Information Digests". To -review- bulletins already released from the main Menu, click on the "Search Technical Knowledge Database." Near the bottom of the next page, click on "Browse the HP Security Bulletin Archive". Once in the archive there is another link to our current Security Patch Matrix. Updated daily, this matrix categorizes security patches by platform/OS release, and by bulletin topic. The security patch matrix is also available via anonymous ftp: us-ffs.external.hp.com ~ftp/export/patches/hp-ux_patch_matrix D. To report new security vulnerabilities, send email to security-alert@hp.com Please encrypt any exploit information using the security-alert PGP key, available from your local key server, or by sending a message with a -subject- (not body) of 'get key' (no quotes) to security-alert@hp.com. Permission is granted for copying and circulating this Bulletin to Hewlett-Packard (HP) customers (or the Internet community) for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to HP, and provided such reproduction and/or distribution is performed for non-commercial purposes. Any other use of this information is prohibited. HP is not liable for any misuse of this information by any third party. ________________________________________________________________________ -----End of Document ID: HPSBUX9907-100-------------------------------------- ----- End forwarded message ----- -- Patrick Oonk - PO1-6BONE - patrick@pine.nl - www.pine.nl/~patrick Pine Internet B.V. PGP key ID BE7497F1 Tel: +31-70-3111010 - Fax: +31-70-3111011 - http://www.pine.nl/ -- Pine Security Digest - http://security.pine.nl/ (Dutch) ---- Excuse of the day: Police are examining all internet packets in the search for a narco-net-traficer [ (application/pgp-signature) ] @HWA 10.0 Tiger vulnerability ~~~~~~~~~~~~~~~~~~~ To: BugTraq Subject: tiger vulnerability Date: Tue Jul 20 1999 09:37:39 Author: Ellen L Mitchell Message-ID: <199907201437.JAB12684@net.tamu.edu> -----BEGIN PGP SIGNED MESSAGE----- A vulnerability in one of the scripts used by the unix security tool Tiger has been discovered and a patch issued. Tiger is a public domain package developed and maintained by Texas A&M University, used for checking security problems on a Unix system. Due to lack of checking, a local user can craft a command in such a way that he may have the command executed with the privileges of the process running Tiger (usually root). While no known compromises have occurred due to this vulnerability, it is recommended that the patch be applied if you run tiger. Patches for tiger have been issued and are available at ftp://net.tamu.edu/pub/security/TAMU/ Thanks to Michel Miqueu and Philippe Bourgeois of CERT-IST for reporting the problem. Ellen - -- Ellen Mitchell Network Group Texas A&M University -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBN5SI2vjlKRxZFQKVAQGm2wQAqfJWT1nW5A3odbYWa+yvUYjRBkACBVac hslPIEtX8xVTOgrsHVK5ugT3lD0jz6jQc2DVkIhp89dS4st/+GrFu6ikcg2PaN1x a7YfqnpYxjRQuTEL9mVG67tyCvsxmOpzv/aTWwEd9AJofRbCUdWK1ruBe2P6Vd2s B/BdszrqfbI= =nyA0 -----END PGP SIGNATURE----- @HWA 11.0 Packet Storm Working on Corporate Sponsorship ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.hackernews.com/ contributed by xripclaw Ken Williams has posted a statement saying that Packet Storm Security is not dead. He is currently working on a deal with a corporate sponsor that will allow him to have a professionally maintained site with full staff of security experts, administrators, and web designers. We look forward to new developments. Tattooman http://frey.rapidnet.com/~tattooman/ 12.0 UPDATE ON THE PACKET STORM WEB SITE SITUATION --------------------------------------------- hey, i've been working very hard with numerous corporate entities to try to get the web site back up and online as soon as possible. everything is looking very good now, and i hope to have the site back up and better than ever RSN (Real Soon Now). hopefully, the site will be run and hosted by a professional security firm (to be named at the appropriate time), and the new site will be more professionally maintained by a full staff of security experts, administrators, and web designers. with a very substantial amount of corporate funding, the new Packet Storm Security will be a completely revamped site with more features, more updates, more bandwidth, more of everything. news and updates will be posted here as soon as i get confirmation of the new plans, and contracts are signed. -- Ken Williams, Sat Jul 24 16:34:45 EDT 1999 everything is looking very good and i hope to have great news to post in the next couple of days. -- Ken Williams, Mon Jul 26 22:12:07 EDT 1999 Contact Info ------------ tattooman@genocide2600.com jkw@rage.resentment.org jkwilli2@unity.ncsu.edu PGP Keys -------- Keys with ASCII Blocks, Fingerprints, and IDs http://www4.ncsu.edu/~jkwilli2/ Keys with ASCII Blocks, Fingerprints, IDs, and Certificates http://www.keyserver.net:11371/pks/lookup?template=netensearch%2Cnetennomatch%2Cnetenerror&search=jkwilli2&op=vindex&fingerprint=on&submit=Get+List @HWA 13.0 Piracy is Big Business for Some ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.hackernews.com/ contributed by PJ Churning out thousands of copies at a time for sale in the US and abroad, Southern California is now the home of the software counterfeiter. LA Times http://www.latimes.com/HOME/BUSINESS/UPDATES/lat_piracy990725.htm Who pays to arrest the pirates? Intel, Hewlett Packard, and others are funding public police forces. Evidently it is perfectly legal to grant local police departs hundreds of thousands of dollars so that they arrest the people you want them to. The police say there is no conflict of interest. LA Times http://www.latimes.com/HOME/BUSINESS/UPDATES/lat_piracy990726.htm LA Times http://www.latimes.com/HOME/BUSINESS/UPDATES/lat_piracy990725.htm Pirates of the High-Tech Age Southern California is now home to a sophisticated breed of criminals who, lured by high profits and low penalties, make and sell counterfeit computer software. By P.J. HUFFSTUTTER, TINI TRAN and DAVID REYES, Times Staff Writer Southern California is becoming the national base for counterfeiters who make bogus software that looks so good even computer experts can't tell the difference. Once a problem confined to Asia and Latin America, high-quality fake CD-ROMs made here are showing up for sale in foreign countries, on Internet sites and even in some retail stores like Fry's Electronics. Authorities have seized nearly $200 million in counterfeit software in dozens of cases in Southern California over the past three years. The disks are manufactured by a new breed of multicultural gangs who operate somewhat like legitimate software companies. Lured by high profits and low penalties, these criminals work cooperatively with each other, often "outsourcing" different aspects of the operation to business partners in order to save time and money. "The irony of all this is the counterfeiters are mimicking us," said Chris Chapin, manager of intellectual property enforcement for video game publisher Electronic Arts Inc. in Redwood City. "They are our worst business rivals." Feeding off the nation's growing number of PC-owners, the counterfeiters are supplying consumers with hot new products such as video games, tax programs and business tools. Software pirates can replicate, for as little as 50 cents, disks holding programs that computer companies price at hundreds of dollars. "Look, I can make more money off this than my lawyer can defending me," said one self-described pirate, nicknamed "hax3rz," who was selling illegal copies of top-selling video games on the Internet. "If they want it, I'll sell it." Southern California "is the capital for pirated [software] products in North America," said Nancy Anderson, senior attorney for Microsoft Corp.'s anti-piracy group. "Not Silicon Valley. Not New York. Not Texas. Not Washington. Here." High-tech piracy flourishes amid the anonymous industrial parks in the San Gabriel Valley cities of Walnut, Diamond Bar, City of Industry and Rowland Heights. Investigators have raided one business park in Walnut so many times that police have dubbed it "Pirates' Cove." But operations are also found elsewhere in the region. Earlier this year, in what industry experts describe as the nation's largest-ever software counterfeiting bust, Westminster police and the FBI arrested a dozen people and shut down an alleged piracy scheme with $60 million worth of fake Microsoft software sitting on a warehouse floor in the city of Paramount. Atul Sowmitra Dhurandhar, a 51-year-old native of India, and his wife were accused of money laundering and running the operation that for four years allegedly churned out counterfeit CD-ROMs from plants in three Southern California counties. They pleaded not guilty, and their trial begins in Los Angeles federal court this week. Like computer executives tapping personal contacts for deals, Dhurandhar allegedly used friends to create a business network: a convicted Chinese counterfeiter, who obtained a commercial CD-ROM replicator to copy the disks; a Mexican national, who is allegedly a Mexicali state judicial police officer, to smuggle product across the border; and another Mexican to hire illegal immigrants to run the CD replicator. But even as police break up the operations, the software industry still cannot get the public to support its plight. There is little widespread sympathy when a corporation such as Microsoft--which is worth more than $500 billion--complains that it loses hundreds of millions of dollars a year to piracy. The wealthy upper class traditionally is seen by the masses as the enemy, said Robert Kelly, professor of society and criminal justice at the City University of New York. In the past, it was oil barons and railroad tycoons. Today, notes Kelly, Microsoft head Bill Gates is the bad guy. "Fake software is not seen as a threat to the public good," said Alfred Blumstein, a public policy professor at Carnegie Mellon University. Despite software companies aggressively lobbying politicians and spending millions of dollars on anti-piracy advertising campaigns, the laws remain relatively soft on counterfeiters. The result: people who pirate millions of dollars' worth of software often receive only probation. "It's cheap, it's easy and there's almost no risk," said Sgt. Marcus Frank of the Westminster Police Department, who lead the Dhurandhar investigation. "If you were a criminal, wouldn't you do it?" The Key to Success: Networking Frank said the Dhurandhar investigation peaked last fall, when undercover officers staked out warehouses in Paramount, watching as a stream of truck drivers loaded pallets stacked high with fake Microsoft goods. The ringleaders had allegedly been shipping an estimated 15,000 fake Microsoft disks a month nationwide and overseas. By early February, police and the FBI had enough evidence to get a search warrant and raid the operation. Officers burst inside a warehouse one rainy afternoon and surprised six immigrant workers, who were busy printing counterfeit Microsoft user manuals. Here and at nearby facilities, investigators found top-of-the-line CD-ROM duplication equipment, high-speed printing presses and rows of bookbinding and shrink-wrapping machines. Piles of phony warranty cards spilled out of nearby crates. Sixty million dollars' worth of boxed, shiny silver compact disks, all sporting the Microsoft logo, towered over the officers. And tucked off in a corner, police say, was the investigative mother lode: files stuffed with Dhurandhar's business documents and checkbooks. The paperwork mapped out an elaborate counterfeiting network, according to police, and gave investigators leads on the scheme's money trail. Dhurandhar, his wife Mamta--who faces the same charges as her husband--and their attorneys have declined to discuss the case. Ten other suspects will join them at trial this week. Prosecutors say the Dhurandhar case is a textbook example of a modern software counterfeiting operation, where professional networking is the key to success. Someone knows someone with the machinery to copy the disks. Someone else knows of a print-shop owner willing to churn out bogus user manuals. Police say the players in the Southland's growing software piracy industry range from legitimate shop owners to street thugs to U.S.-based Asian gangs, such as the Wah Ching and Black Dragons, to savvy businessmen of all nationalities willing to run a wide-scale operation. Instead of a crime "family" with workers of one ethnicity answering to a boss, these software gangs operate as independent agents with no specific loyalties. Where traditional crime outfits work to improve the power and dominance of their family, these alliances of counterfeiters end when the job is done. "If you're a Crip, you're always a Crip," said Det. Jess Bembry, an expert in Asian organized crime with the Los Angeles Police Dept. These cases are different because "if it benefits them [financially], warring groups will stop fighting to make money together." Like computer executives sealing million-dollar agreements with a handshake, the ancient Chinese rite of guanxi (pronounced gwan-shee) is the unspoken social glue that defines interactions in some Asian societies. For legitimate businessmen throughout the world, guanxi means a person's social rapport is his key currency in the corporate world. It also is a philosophy that, say police, allows accused software counterfeiters such as the Dhurandhars to build a large manufacturing enterprise. Dhurandhar allegedly used several of his businesses, including a Long Beach print shop called Digital Colors, as fronts for the secret operation. Heavily tinted windows shielded the workers and gave no clue as to what was being manufactured inside. By day, the firm was a legitimate printing business, according to court documents. By night, it allegedly was a full-scale counterfeiting and assembly plant. Digital Colors, according to police investigators and the documents they seized, was one hub in a manufacturing labyrinth. Companies in the San Gabriel Valley handled the assembly work. Distributors in Los Angeles and Westminster hawked the goods, which included French, Portuguese and English versions of such bestsellers as Windows 95 and Windows 98, Microsoft's computer operating systems. In Long Beach, Digital Colors made the boxes, which were stored in Paramount warehouses, one of which housed a $1.5-million CD-ROM replicator that is as big as a high school classroom. Finished products allegedly were boxed, shrink-wrapped and sold to mid-level distributors. They, in turn, sold the fakes to other software distributors. Some products were loaded on trucks and hauled across the country, say police. Other goods were taken to Los Angeles International Airport, flown to Northern California and later shipped overseas. Ultimately, the disks allegedly were hawked at swap meets, over the Internet and at small retail shops in the U.S., Canada, Europe and South America. How much money the counterfeiters actually made still is unclear, said assistant U.S. attorney Stephen Larson, who is prosecuting the case. Court documents allege that the Dhurandhars used an elderly relative's bank account, and other accounts with Bank of America and Bank of Orange County, to launder at least $3.5 million in cash from sales of the fake software products. Profits allegedly were funneled into nearly $5 million worth of residential and commercial properties across Southern California, including a $2.7-million, Spanish-style home in Palos Verdes Estates perched above Lunada Bay, according to state property records and court documents. The Dhurandhars could step through their French doors and enjoy an expansive view of the ocean and Catalina Island. Federal and state authorities seized the properties and arrested the Dhurandhars in June at their home. Police say that Atul Dhurandhar was watering his lawn, and had $20,000 cash in his pocket, when they arrested him. A neighbor, when asked about the Dhurandhars, responded: "We never see them. They keep to themselves." Asian Economic Woes Intensify Piracy The piracy of intellectual property--whether software or music, film or pharmaceuticals--has flourished worldwide for decades. The rise of Southern California as a counterfeiting center is a more recent phenomenon. The other hotbed of software counterfeiting is Asia, where the threat of punishment is relatively low. In legitimate retail shops in Thailand last year, more than 80% of all computer software sold to consumers was pirated, according to the U.S. Trade Representative's office. Last year's Asian economic collapse intensified piracy. Asian police and U.S. federal investigators say formerly legitimate optical disc producers--the companies that manufacture CD-ROMs for software firms in Asia--are now moonlighting as software counterfeiters. Among the offerings in Asian black markets: Microsoft's business software package, Office 2000 Premium, which retails for nearly $8,700 in the United States. A week before Office 2000 debuted last month, shoppers who visited open-air markets in Hong Kong and Singapore picked up pirated versions for $20. Like their counterparts in the drug trade, software counterfeiters are well financed and mobile. When Hong Kong officials began cracking down on piracy in 1995, pirates relocated their manufacturing facilities to mainland China and nearby Macau, where there are fewer police agencies tracking copyright violators. Piracy also increased in Southern California. The U.S. Customs Department has tracked a steady increase in the value--and number--of high-tech counterfeit goods it seized this decade leaving the country. Although pirated movies and music get media attention, they made up only 2% of all compact disks customs seized in the U.S. last year. Kathlene Karg, director of anti-piracy operations for the Interactive Digital Software Association, said pirates are attracted to the U.S. market because they can charge more. "That's why they're starting to make and distribute their stuff in the U.S. The risk might be greater, but so are the potential profits," she said. The fakes made here are harder to detect. For one thing, say manufacturers, they look great. Counterfeits sold overseas rarely come in anything more elaborate than a plastic sleeve. Americans, however, prefer to buy nicely packaged goods, and pirates can charge more if consumers are convinced they're buying authentic--though drastically discounted--software. Fake versions of Office 2000, similar to those selling for $20 in Singapore, can be found on at least one Internet site for $175. The difference? A user's manual, a warranty card and a shrink-wrapped box. All fake, of course. "Nearly everything [counterfeit] of ours that we're seeing being made in Southern California is retail-ready," said Anne Murphy, an attorney with Microsoft's anti-counterfeiting team. "That's a big threat to our business because people think they're buying the real thing." In fact, high-grade counterfeits are starting to show up in mainstream stores such as Fry's Electronics, industry sources say. The San Jose Police Department's high-tech crime unit in the past year has investigated several such cases. Police officers said that small batches of bogus goods, sold to the chain through independent distributors, had been discovered in inventory at various Fry's stores. Officials at San Jose-based Fry's declined to comment. Investigators won't say whether some consumers had bought fakes. Noting that investigations are ongoing, police also refused to identify the stores that carried the goods, or to disclose what kind of software was counterfeited. Even if the people who made the bogus product are caught, the consequences could be minor. But the downside for consumers could be serious. Counterfeit software could be a copy of an early--and flawed--version of the real thing. It could include viruses that could destroy a person's computer data. And manufacturers refuse to fix fake goods. Federal penalties for counterfeiting are relatively low. If convicted, a person can be sent to prison for up to five years for software counterfeiting. But most software pirates avoid serious punishment and usually serve less than three years, according to officials at the U.S. Attorney's office. Though a federal statute--the Digital Millennium Copyright Act--enacted late last year allows for more serious financial penalties and jail terms, the law remains relatively untested. To date, federal and local prosecutors have focused largely on those accused of running major counterfeiting operations and laundering money, such as the Dhurandhars. Federal money laundering charges have a much stronger legal bite--a minimum of 10 years in prison--than counterfeiting, said Assistant U.S. Attorney Larson, who is chief of the department's organized crime strike force in Los Angeles. "It takes me longer to build a case than the time they end up spending in jail," grumbled Det. Jess Bembry, an expert in Asian crime with the Los Angeles County Sheriff Department. "It's ridiculous." Few consumers sympathize when Microsoft or other large software firms complain about counterfeiters. The Redmond, Wash.-based behemoth is the world's most valuable corporation and has continually exceeded Wall Street's profit expectations. Last week, Microsoft said its fiscal fourth-quarter profits jumped 62%, with earnings for the period climbing to a record $2.2 billion. Microsoft has fought piracy since 1976, when Bill Gates wrote his now-famous "Homebrew" open letter to computer hobbyists. The missive chastised computer users and called them "thieves" for not paying to use the operating software, known as BASIC. Some critics say that software firms fuel piracy by charging too much for their products, but the companies argue that the prices are set to recoup costs of developing and marketing new programs and make a profit. "Counterfeiting is stealing. We don't benefit by it. We don't cause it," said Murphy, the corporate attorney for Microsoft. There are three categories of software piracy. "Warez" is the Internet underground community where users gather at little-known online trading posts to swap files. In license infringement piracy, an individual or organization loads a software program onto multiple computers and doesn't pay the manufacturer for each installation. Finally, there is counterfeiting--the practice of taking a program, burning a copy of it onto a disk and selling the CD-ROM for a profit. American willingness to buy counterfeit disks terrifies software firms, which have not convinced the public that downloading a $300 business computer program is as unethical as stealing a $300 leather coat. In fact, the lack of public outrage has so emboldened the criminal sector that consumers sometimes shop for counterfeit brands. Take, for example, the Players, a Malaysian crime syndicate known for making fake console video games. Their products, which are sold throughout Asia and on the Internet, sport a small "Players" logo on the jewel case. This logo also is burned on the game disk itself--often in place of the icon for Sony Corp., the legitimate game publisher. "When it comes to money, morality gets put aside," said Frank of the Westminster Police Department. "Welcome to the new age of international relations." _ _ _ Times staff writer Rone Tempest in Hong Kong contributed to this report. LA Times http://www.latimes.com/HOME/BUSINESS/UPDATES/lat_piracy990726.htm Tech Firms Pay Police Agencies to Fight Cyber Crime Law enforcement: Intel funds sheriff's unit that chases computer pirates. Some fear conflict of interest. By P.J. HUFFSTUTTER, Times Staff Writer Gander through the headquarters of the Sacramento County Sheriff Department's high-tech team and see what cops call the "ideal model" for fighting cyber crime in an age of shrinking budgets. Fluorescent lights cast a jaundiced pall over the worn office cubicles, the frayed fabric pinned in spots with tacks. On each desk sits a computer, confiscated from a crime scene and still sporting an evidence tag. Windbreakers with the team logo are a luxury. Then there are the things visitors don't see. Like the $10,000 body wire Intel Corp. bought for the unit to use in undercover stings. Or the corporate jet Hewlett-Packard Co. used to fly officers to Silicon Valley, and the tens of thousands of dollars the computer firm spent for the team's travel expenses--flights, hotels, meals--when a recent case took officers out of town. Tired of being ripped off by high-tech criminals, some of America's most powerful computer companies are fighting back with a relatively simple approach: Subsidize the local police. From inside pilferage and brazen heists to Internet piracy and industrial espionage, digital crime in the United States cost computer hardware and software companies about $3 billion last year. Authorities, who concede they are barely making a dent in the problem, insist they don't have the staff, resources or public support to tackle the overwhelming number of complaints. But the computer companies do. Corporate largess ranges from a $100,000 annual grant from Intel that pays for police salaries in Oregon to Motorola Corp. and several other major PC firms donating $10,000 each to an annual fund to help underwrite the Austin (Texas) Police Department's cyber team. This controversial practice has divided the law enforcement community between those who embrace the help and those who insist it is a means of buying justice. It also underscores a nationwide dilemma: How can local police departments protect the high-tech sector--and the jobs and tax revenue it provides--if there isn't enough money to handle such cases? While investigating the Hewlett-Packard case, members of the Sacramento Valley Hi-Tech task force traveled nationwide, at company expense, to serve search warrants, arrest suspects and confiscate evidence. Before federal criminal charges were filed, however, Hewlett-Packard filed a civil fraud suit against a company in San Diego believed to be tied to the $500-million scheme. Hewlett-Packard used evidence gathered, in part, in the officers' travels to resolve its suit and ultimately obtain a stipulated judgment in its favor for $900,000. "When companies are directly paying for travel, investigations or salaries, I think that's a very dangerous line that quickly crosses into a conflict of interest," said former FBI Agent Joe Chiaramonte, president of the San Jose chapter of the High Technology Crime Investigation Assn., a trade group. But police Sgt. Tom Robinson, who heads up the Hillsboro, Ore., computer unit, sees it differently: "Frankly, any department that's not [accepting such grants] is missing the boat." Advocates such as Robinson insist the money represents the key to winning the war on cyber crime, and is a small investment for the multinational companies. "If you're inferring that we're paid off, that's not right," said Sacramento County Sheriff's Sgt. Michael Tsuchida. "I'll eat your dinner, sleep in your hotel and still arrest you if you're breaking the law." 'We All Realized We Needed Each Other' Traditionally, many corporations have shied away from revealing too much to law enforcement to avoid drawing public attention to internal troubles. But as computer piracy grows, companies today are much more willing to seek help from police agencies. Catching such criminals has long been the bailiwick of federal prosecutors, as tech-savvy criminals rarely stay within the neat confines of city limits when committing fraud on the Internet or stealing computer components. But federal law prevents prosecutors and the FBI from taking corporate contributions to pay for salaries or travel expenses, and limits the use of evidence collected by private investigators. State laws, however, have created a much broader gray area for local police. As a result, some local agencies rely on corporate handouts. When losses mounted from armed robberies at computer chip plants in Austin in the early '90s, the city's high-tech companies decided to finance a private nonprofit group to train officers to deal with the problem. Through the Austin Metro High Tech Foundation, firms including IBM and Dell Computer Corp. annually donate up to $10,000 each for investigators' training, travel and equipment. In return, businesses--including Applied Micro Devices, National Instruments and Motorola Corp.--say they expect law enforcement to treat computer crime as seriously as drugs and gang violence. Because Texas law restricts direct corporate contributions to particular police units, the funds are managed and distributed through the Austin Community Foundation, a nonprofit entity. "[The companies] can tell us what equipment we can or can't buy, but they can't tell us what to do with the cases," said Police Sgt. Robert Pulliam, who runs the department's five-person computer crime team. "We all realized we needed each other." This circle of financial interdependence has evolved slowly, from a long-standing tradition of police getting information from private investigators hired by the corporations. Companies typically approach police when they have enough evidence to back up a search warrant, said Los Angeles County Deputy Dist. Atty. William Clark, who prosecutes many trademark cases. Law enforcement then assembles the case. The corporate investigators often serve as experts, helping to identify fake products or explain the workings of stolen technology. Microsoft is the most aggressive technology firm when battling thieves, police say. In Hong Kong, the company runs its own stings, setting up fake storefronts as a means of gathering evidence, sources say. In the United States, Microsoft employs a security force of more than 200 people, some of them former law enforcement officers, who investigate cases and package the evidence, which they hand over to authorities for prosecution. "As a matter of policy, we don't pay law enforcement to do their jobs," said Anne Murphy, a corporate attorney with Microsoft's anti-counterfeiting group. "In certain cases, Microsoft has provided financial support for operating expenses for investigations." In 1997, the software giant approached the Los Angeles County Sheriff's Department and offered to help pay for a sting operation. The price? About $200,000 to purchase printing equipment from suspected software counterfeiters, and give officers the tools needed to create an undercover print shop. The department declined. "It's not about the money. It's about how the public perceives the money and how it's being used," said Det. Jess Bembry, who worked for the department's Asian Organized Crime unit at the time. "When defense attorneys start screaming, all anyone cares about is avoiding the perception of impropriety." The rich scent of wet soil and warm grass wafts across Hillsboro, a bedroom community of Portland, Ore., that has traded its agricultural roots for a future in high-tech manufacturing. This town of 68,000 more than doubles in population during weekdays, as workers flood into the catacomb of industrial facilities that have sprung up throughout the city's rolling hills. As Oregon's largest private employer, Intel's influence is pervasive. In blue-collar Hillsboro, it is difficult to distinguish the line between corporate philanthropy and corporate influence. At the Hillsboro Chamber of Commerce, a small plaque that reads "Intel Room" is affixed outside the door of the center's main meeting room--in honor of the company paying to furnish the small space. Though the town represents Oregon's largest high-tech hub, city managers have set aside only 2.7% of the Hillsboro Police Department's annual $9.2-million budget for its seven-person computer crime team. There's no need to commit more, city officials say, because Intel catches the shortfall: $100,000 a year, which pays the salary of one of the police officers and some expenses, according to a 1996 city memorandum of understanding obtained by The Times. Additionally, Intel purchased one officer's car, and helped pay for the team's offices, computer workstations, telephones and fax machines. Of all 231 cases Hillsboro's high-tech team has tackled between 1995 and April 30 of this year, about 41% involve Intel in some way. As of April, about one-fifth of the nearly $210 million the unit recovered is tied to Intel complaints. Police say the grant, which is permitted by Oregon state law, has not swayed their focus. Investigators attribute the case ratio to black-market demand for fake Intel computer chips and the company's size. "This may not be the ideal way for us to do business, but at least we're trying to do something about these crimes," said Police Sgt. Robinson, whose team includes members of the FBI and the U.S. attorney's office. "Without us, the criminals run rampant and impact everyone--the companies and the community," he said. Intel executives insist that their "nontraditional approach" of working with police is legitimate and harmless. It is, they say, merely part of a companywide philosophy to invest in the communities where employees live and work--not a means of gaining police protection. "It'd be dead wrong to criticize the police unless we could make a contribution," said Chuck Mulloy, a corporate spokesman for Intel. Other cities are modeling their efforts after Hillsboro. Chandler, Ariz., which has several Intel manufacturing and assembly centers, plans to pattern its own nascent computer team after Hillsboro. Such partnerships can hurt the police if companies stop paying, say critics. That's a concern in Hillsboro, where city officials admit there are no guarantees that the Intel grant won't disappear. "The police don't want to hear this, but if we lose the Intel grant, we'll default on the high-tech crime unit," said David Lawrence, Hillsboro's assistant city manager. "We'll have to go back to what we had before, which wasn't much." Inside a bland concrete warehouse on the edge of Sacramento's city limits, the Sacramento Valley Hi-Tech unit is the quintessential modern police model for fighting computer crime. The task force was created in 1995 and draws officers from 16 enforcement agencies. The team's diverse membership--officers from different jurisdictions who possess varied skills--is the key to its strength. "These guys have the best reputation among law enforcement," said L.A. County Sheriff's Det. Bembry. "They do amazing things with very few financial resources." Each agency pays for its officers' salaries, equipment and vehicle. But the departments don't feed into the team's general operating budget, which is zero, said Sgt. Tsuchida, who runs the unit. By comparison, the department's narcotics team receives at least $55,000 a year for similar costs. "We serve at least 50 search warrants a year," Tsuchida said. "We couldn't get the $150 a person to get the training to make sure everyone does it the same way. That's a safety concern." The financial slack is often covered by local technology companies, which contribute seized assets and occasionally kick in for travel and other expenses, Tsuchida said. "If the companies don't pay, we can't investigate" some out-of-town cases, said Sacramento County Sheriff's Lt. Jan Hoganson, who commands the unit. "We can't afford it." Cost was a factor in the recent Hewlett-Packard software theft case, which investigators say has links extending from the Central Valley to Southern California, the Pacific Northwest and Central America. Bill Conley, president of US Computer Corp. in Redmond, Wash., is one of several people Sacramento's unit arrested in conjunction with the case. The charges, of possessing stolen H-P goods, were later dropped, but Conley insists the case was tainted. "It was the Hewlett-Packard people--not the Redmond police, not the Sacramento cops--who led the whole thing, who took employees off and threatened to take them to jail," said Conley, 41. Police, prosecutors and Hewlett-Packard officials scoff at Conley's claim, and cite other types of white-collar crimes, such as insurance fraud, which routinely relies on the private sector for enforcement help. And Sacramento's Hoganson insists his team's focus is unbiased, they say, noting that of the 285 cases the team investigated in 1998, only 16 were tied to companies that are members of the unit's steering committee. But the California Supreme Court takes the issue seriously. In a 1996 trade secrets case, the court upheld the disqualification of a Santa Cruz County district attorney because the office had accepted more than $13,000 from a Scotts Valley software company, Borland International. The money was used to hire a computer expert to determine whether a former executive had taken proprietary information to a rival firm, Symantec Corp. Police and prosecutors say the Hewlett-Packard case is different because the corporation's involvement did not influence their decision to file criminal charges. "I don't see [it] as a conflict, because you're giving law enforcement the money--not the district attorney's office," said Robert Morgester, a deputy attorney general for the state attorney general's office who helped create and fund the Sacramento team. California legislators are trying to offset the money pinch, by rolling out a $1.3-million state grant to be divided among three task forces: Sacramento, San Jose and Los Angeles/Orange County. In addition, the governor's office has set aside an additional $1 million for the same purpose. Investigators say that although the grant helps, it's still not enough. "That money is already spent on training, hiring new people and getting my guys new computers," Tsuchida said. "We're not breaking any laws now, so why should we change what we're doing?" Copyright Los Angeles Times. 14.0 Mitnick sentencing postponed again... ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.zdnet.com/zdnn/filters/bursts/0,3422,2302198,00.html Monday; Jul26th 10:46a Mitnick sentencing postponed again The sentencing of convicted hacker Kevin Mitnick was postponed for a second time today. The government is asking for Mitnick to be responsible for restitution on the order of $1.5 million, while the defense is asking for payments on the order of $5,000, based on his projected earnings potential during his supervised release. He will not be able to use a computer during that three year-period. More details to follow. --ZDNN staff @HWA 15.0 Military Reserves to be Used for Cyber Defense ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Sarge The Reserve Component Employment Study 2005, commissioned by Defense Secretary William Cohen, has concluded that Reserve units are probably the best choice to help secure military systems. The study says that members of a this new unit could work remotely and should be recruited from high-tech sectors of the civilian population. (Hmmmm, maybe I should reenlist?) Federal Computer Week http://www.fcw.com:80/pubs/fcw/1999/0726/fcw-newsreserve-07-26-99.html JULY 26, 1999 Study calls for reserve virtual IT warfare unit BY DANIEL VERTON (dan_verton@fcw.com) A year-long study completed last week by a senior panel of Defense Department officials recommended an unprecedented expansion in the role the reserves play in national defense, including the formation of a virtual cyberdefense unit to protect the nation's critical infrastructure. The study, Reserve Component Employment Study 2005, was initiated in April 1998 at the request of Defense Secretary William Cohen and concluded that the reserves are "particularly well-suited to homeland defense missions." In addition, the study called for the formation of a "joint [reserve component] virtual information operations organization" and tasked various senior-level DOD organizations to complete a "proof of concept" study for creating the unit by June 30, 2000. The new reserve cyberdefense unit "would consist of individuals with information technology skills who could perform their duties from dispersed locations rather than working as a single consolidated unit at a specific training center," the report said. To accomplish their mission of protecting various critical infrastructure nodes, the unit would communicate from existing reserve centers and other DOD facilities across the country that have access to the Secret Internet Protocol Routing Network. To form the new unit, the study recommended looking for reserve members in regions of the country where high concentrations of IT skill already exist. In addition, the study suggested that the reserves consider recruiting high-tech-savvy people from the civilian sector, requiring them to join the reserves for a specific number of years in exchange for high-tech training provided by DOD. Establishing a "virtual organization" also would go a long way toward solving the department's problem of retaining personnel with critical IT skills and may allow DOD to reduce its reliance on external contractor support, the report said. "A 'virtual organization' [also] could support the Joint Task Force [for] Computer Network Defense," the report said. Cohen established the JTF-CND in December 1998 to monitor and take defensive actions against hackers and other unauthorized users who try to penetrate DOD networks. Rick Forno, a security officer for Network Solutions Inc. and the former senior security analyst at the House of Representatives' Information Resources Security Office, said the report's recommendation to use the reserves for cyber defense "is a great idea" and represents one of DOD's more innovative initiatives. "I'm thrilled that DOD is looking to go outside the box on the Info-Protect/InfoCorps idea in the reserve components," said Forno, who proposed a similar idea to DOD a year ago. However, "it comes down to endorsement and support from senior leadership [whether or not] they let this organization function as intended," he said. Anthony M. Valletta, vice president of C3I systems for SRA Federal Systems and former acting assistant secretary of Defense for command, control, communications and intelligence, said the concept of using the reserves in this manner is one that the intelligence community has proven works. "When we did this with the intelligence community, it worked extremely well," Valletta said. "We have a lot of expertise in the reserves that we need to take advantage of." The main challenge facing the reserve cyberdefense corps idea, according to Valletta, is training and equipping the reserves to carry out the mission. "We have to keep up with the technology, and the reserves have to have the latest capabilities," Valletta said. "That is a major change of philosophy in terms of equipping the reserves." However, the idea of establishing a JTF for Homeland Defense also is an idea that some groups, particularly civil liberties organizations, may question. "The main issue is the Posse Comitatus Act and the limits on military activity within the U.S.," said Mark Lowenthal, former deputy assistant secretary of State for intelligence and now a member of Valletta's C3I consulting team at SRA. "If it is limited to what are clearly DOD facilities, then there should be no problem," he said. "If it steps over that line, then there are some legal issues that have to be addressed." Other recommendations contained in the report include using the reserves as part of a Joint Task Force headquarters for Homeland Defense, which would work with the Federal Emergency Management Agency and other civil authorities to coordinate responses to attacks involving nuclear, chemical and biological weapons, and increasing the use of smart card technology to reduce delays in processing reserve members for active-duty assignments. @HWA 16.0 Kodak's new PROM copy-killer? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ Kodak Introduces CD-PROM, Claims to Thwart Pirates contributed by WareZ dud3 Kodak has introduced a new CD technology it calls CD-PROM or CD-Programable Read Only Memory. It combines the standard CD with a small section of CDR that will contain specific information about the machine the software is registered to. Kodack claims this will stop piracy in its tracks. (It might stop the warez dudes from trading the latest version of Duke Nuke 'Em but it will do nothing to stop the professionals.) Express News http://www.expressnews.com/pantheon/news-bus/sheron-tech/2504rkodak_7-25nz.shtml Kodak develops anti-hacker CD Format is computer-specific, aims to foil non-customers By Don Sheron EXPRES-NEWS SCIENCE/TECHNOLOGY WRITER Software pirates have a new technological hurdle ahead of them. Kodak has developed a way to make CD programs more secure from hackers and unlicensed users. It's a customized CD called the CD-PROM (Compact Disc-Programmable ROM). This includes the standard write-once feature of commercial software, but the CD-PROM also includes a recordable feature that identifies a particular computer to the CD. "There's a lot of enthusiasm for this technology," said Bruce Ha, senior research associate at the Eastman Kodak Co. of Rochester, N.Y. "It's a format that people have been talking about for the past 10 years now." The new hybrid technology allows software manufacturers to produce low-cost CD-ROMs with the ability to add CD-R (recordable) information. CD-PROM works like a normal CD software product, but using the software requires start-up information specific to the licensed consumer. For instance, many software CDs require a registration code to unlock some or all of the program's features. To get the registration code, consumers can register their software online with the software manufacturer. To thwart Internet hackers, the CD-PROM will match the registration code with the licensed software, thus keeping hackers from using an illegal copy of the software. Similarly, a CD-PROM is designed to work on software shipped with a specific computer. The CD-PROM can be set up to read only the BIOS information on the computer with which it was shipped. The BIOS (basic input/output system) loads and executes the computer's operating system, such as Windows 98. "So (Microsoft) Office or any other program that comes bundled with that computer cannot be shared by anyone else," Ha said. But making a CD-PROM has been difficult. A normal CD contains data embedded into "pits" that are pressed into the platter. The platter is then covered by an aluminum reflective layer and a protective plastic coating. On a CD-R, a single groove is pressed into the platter instead of pits. An organic dye is added for recording new information onto the platter. A reflective layer of gold or silver covers the dye, and then the CD gets a protective coating. Some manufacturers have tried to add both pits and grooves onto a CD. But they have had problems with the disc being read properly. This can occur when the ROM reader switches to the recordable writer, or because the speed of the laser light reading the CD changes when it goes through different materials on the platter. To get around this, Kodak decided to use a single, continuous groove pressed into the platter. The master disc is designed to make the CD reader think that the groove actually contains a series of pits. Kodak is using the CD-PROM for its Picture CD product. Ha says no failures have been noticed after beta testing 20,000 discs in photo labs. Saturday, Jul 24,1999 @HWA 17.0 Sandstorm Releases New Version of Phone Sweep ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Brian Sandstorm Enterprises has released a new version of its $998 war dialing program called 'Phone Sweep' It does have at least one cool feature, auto recognition of over 200 remote systems. Ummm, thanks but I'd rather have the free, non-hardware copy protected, Tone Loc. Excite News http://news.excite.com/news/bw/990721/ma-sandstorm PhoneSweep http://www.sandstorm.net/phonesweep/ Tone Loc - toneloc.zip http://www.l0pht.com/~oblivion/blkcrwl/telecom/toneloc.zip Tone Loc Utilities http://www.l0pht.com/~oblivion/blkcrwl/telecom/toneutil.zip Sandstorm Enterprises Announces Single Call Detect -- Advanced Telephone Scanning Technology to be Incorporated Into New Release of PhoneSweep Updated 10:45 AM ET July 21, 1999 Most Significant Development in Wardialing Since the Movie "War Games" CAMBRIDGE, Mass. (BUSINESS WIRE) - Sandstorm Enterprises Inc., an information security tools company, has released an enhanced version of its PhoneSweep telephone scanner, incorporating "Single Call Detect" to dramatically speed scans. Additional features in PhoneSweep release 1.1 include an increase in the number of target systems recognized, to more than 200, and enhancements to the tool's brute force testing mode. PhoneSweep is intended for use by security professionals to audit corporate telephone systems for vulnerabilities, such as undocumented modems tied to internal networks. PhoneSweep works like a computer criminal's "war dialer," and Sandstorm has found an enthusiastic market for PhoneSweep among security professionals who had been using such "hackerware" for lack of a commercially-developed and supported alternative. "A surprising number of corporations, and even Federal agencies, have been using hacker tools like ToneLoc to carry out their telephone scans," said Dr. Ross Stapleton-Gray, Sandstorm's Vice President for Government Relations. "There's a certain irony -- and recklessness -- in relying upon unsupported, undocumented software to secure mission- or national security-critical networks." Single Call Detect allows PhoneSweep to determine if a telephone is answered with a voice, a second dial tone, a fax machine, or a data modem with a single call. The determination is made in less than five seconds, speeding the scanning process. "Dialing numbers and waiting for the modems to synchronize or time out, while simple, is neither efficient nor particularly effective," said James Van Bokkelen, Sandstorm's president. "Single Call Detect allows PhoneSweep to skip rapidly from number to number, ending a call as soon as a voice, busy or second dial tone is detected, and completing the average scan in less than half the time." The speed and accuracy afforded by Single Call Detect also reduces any inconvenience to organizations being scanned, as PhoneSweep promptly releases connections upon encountering a live or recorded voice. In developing PhoneSweep, Sandstorm worked with security expert Peter Shipley, who has scanned several million phone lines in the San Francisco Bay area. Shipley's research has shown unsecured "back doors" at hundreds of sites -- including government and commercial systems -- that allowed full control to any caller without first asking for a username and password. Sandstorm has used Shipley's results to train its recognition engine, and Shipley has used PhoneSweep's recognition system to categorize and tabulate the results of his project. Originally released last October, PhoneSweep is in use by both security departments and independent auditors at hundreds of sites in North America and overseas. PhoneSweep customers include both large and small companies, Federal and state governments and the military. PhoneSweep customers with current support contracts will all receive automatic upgrades to release 1.1. PhoneSweep Basic ($980) supports a single modem and up to 800 phone numbers per scanning profile. PhoneSweep Plus ($2800) supports four modems for simultaneous scanning, and 10,000 number profiles. PhoneSweep Plus8 ($5600) supports eight modems with 10,000 number profiles. Sandstorm Enterprises will be exhibiting at the 8th USENIX Security Symposium, August 23-26 in Washington D.C. PhoneSweep(TM) and Single Call Detect (TM) are trademarks of Sandstorm Enterprises Inc. Further details on PhoneSweep and "Single Call Detect" are available on the product Web site, at http://www.phonesweep.com Contact: Sandstorm Enterprises Inc. In Boston, MA Dick Guilmette, (617) 426-5056 dickg@sandstorm.net or In Washington, DC Dr. Ross Stapleton-Gray, (703) 685-5197 rsgray@sandstorm.net @HWA 18.0 Major FUD - US Under Attack by Russians ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by dis-crete This article is so filled with FUD (Fear Uncertainty and Doubt) and so many unconfirmable statements it makes me ill. The few facts that are present are old and the rest is there to scare the hell out of you. I'd still like to talk to the guy who claims his print job was redirected. He won't answer my emails. The London Times http://www.the-times.co.uk/news/pages/sti/99/07/25/stifgnusa03003.html?999 The Australian http://www.theaustralian.com.au/world/4161044.htm -=- The London Times http://www.the-times.co.uk/news/pages/sti/99/07/25/stifgnusa03003.html?999 Cyber assault: Clinton wants an extra $600m to combat threats such as Moonlight Maze Russian hackers steal US weapons secrets by Matthew Campbell Washington AMERICAN officials believe Russia may have stolen some of the nation's most sensitive military secrets, including weapons guidance systems and naval intelligence codes, in a concerted espionage offensive that investigators have called operation Moonlight Maze. The intelligence heist, that could cause damage to America in excess of that caused by Chinese espionage in nuclear laboratories, involved computer hacking over the past six months. This was so sophisticated and well co-ordinated that security experts trying to build ramparts against further incursions believe America may be losing the world's first "cyber war". Investigators suspect Russia is behind the series of "hits" against American computer systems since January. In one case, a technician trying to track a computer intruder watched in amazement as a secret document from a naval facility was "hijacked" to Moscow from under his nose. American experts have long warned of a "digital Pearl Harbor" in which an enemy exploits America's reliance on computer technology to steal secrets or spread chaos as effectively as any attack using missiles and bombs. In a secret briefing on Moonlight Maze, John Hamre, the deputy defence secretary, told a congressional committee: "We are in the middle of a cyber war." Besides military computer systems, private research and development institutes have been plundered in the same operation. Such institutes are reluctant to discuss losses, which experts claim may amount to hundreds of millions of dollars. "We're no longer dealing with a world of disgruntled teenagers," said a White House official, referring to previous cases of computer hacking in which pranksters have been found responsible for incursions. "It is impossible to overstate the seriousness of this problem. The president is very concerned about it." The offensive began early this year, when a startling new method of hacking into American computer systems was detected. A military computer server near San Antonio, Texas, was "probed" for several days by hackers who had entered the system through an overseas site on the internet. Dozens of infiltrations ensued at other military facilities and even at the Pentagon in Washington. When research laboratories also reported incursions using the internet technique, officials realised that a "cyber invasion" was under way. "There were deliberate and highly co-ordinated attacks occurring in our defence department systems that appeared to be coming from one country," said Curt Weldon, chairman of a congressional committee for military research and development. "Such a thing has never happened before. It's very real and very alarming." Even top secret military installations whose expertise is intelligence security have been breached. At the Space and Naval Warfare Systems Command (Spawar), a unit in San Diego, California, that specialises in safeguarding naval intelligence codes, Ron Broersma, an engineer, was alerted to the problem when a computer print job took an unusually long time. To his amazement, monitoring tools showed that the file had been removed from the printing queue and transmitted to an internet server in Moscow before being sent back to San Diego. "It turned out to be a real tough problem for us," he told a private computer seminar last month. It is not clear precisely what information was contained in the stolen document. Beyond its role in naval intelligence, Spawar is also responsible for providing electronic security systems for the Marine Corps and federal agencies. It is suspected that several other intrusions had gone undetected. Oleg Kalugin, a former head of Soviet counterintelligence now resident in Maryland, said such facilities were prime targets for Russian intelligence. He said the Federal Agency for Government Communications and Information, a former KGB unit that specialises in electronic eavesdropping, was certain to be exploiting the internet for spying on America. "That's what they're good at," he said. America's high-precision technologies, including weapons guidance systems, are of particular interest to a country such as Russia where economic woes have prompted crippling cutbacks in funding for military research. "Russia is quite good at producing technology but can't afford to finance the research," said Kalugin. "It's easier to steal it." The computer assaults have given fresh impetus to measures ordered by Clinton more than a year ago to protect the country's electronic infrastructure. Alerted to the threat of Moonlight Maze, the president has called for an extra $600m to help fund a variety of initiatives, including an infrastructure protection centre in the FBI to gauge the vulnerability of computer systems to attack. He has ordered the military to develop its own information warfare capabilities to respond to such attacks. But Weldon, describing dependence on computer systems as "the Achilles heel of developed nations", said this is not enough. He is advocating the creation of a unit in the Pentagon under a senior commander to oversee the defence of computer systems. According to other experts, America has been so preoccupied with beating the Y2K (year 2000) or millennium bug - a programming problem that could paralyse computers on the first stroke of the new year - that its military, scientific and commercial communities have neglected the overall security of their computer systems. At the same time, the huge number of systems being overhauled to make them Y2K-compliant has heightened the risk of infiltration. Alarmed by the theft of military documents whisked to Russia, American officials argue that the country should brace itself for other, equally disturbing forms of information warfare that, in theory, could bring the country to its knees. China, Libya and Iraq are developing information warfare capabilities and, according to one White House official, "we see well-funded terrorist groups that also have such capabilities". A series of war games conducted by experts last year revealed that the world's greatest superpower could be at the mercy of a handful of determined computer hackers paralysing airports, markets and military systems with a few taps on a computer laptop. Suspicions that Russia is responsible are based partly on the involvement of Moscow-based internet servers in some attacks. But experts caution that evidence of a Russian hand in the operation may not signal a Kremlin connection. "It could turn out to be Russian organised crime," said one expert. "And they could be acting as a front for the intelligence community." Ironically, the Russians are pressing for an international treaty to freeze information warfare. "We cannot permit the emergence of a fundamentally new area of international confrontation," Sergei Ivanov, the former Russian foreign minister, wrote in a letter to Kofi Annan, the United Nations secretary-general in October. Subsequently, Russia's relations with America have reached their lowest ebb since the cold war because of Nato's intervention in Yugoslavia. Relations with China have also suffered. An offensive in cyberspace may be their one way of retaliating without getting into a shooting war. The Australian http://www.theaustralian.com.au/world/4161044.htm US losing cyber war to Russian hackers From MATTHEW CAMPBELL of The Sunday Times in Washington 26jul99 US officials believe Russia may have stolen some of Washington's most sensitive military secrets, including weapons guidance systems and naval intelligence codes, in an espionage offensive that investigators have called Operation Moonlight Maze. The intelligence action, whose damage to the US could exceed that caused by Chinese espionage in nuclear laboratories, involved computer hacking in the past six months. The operations were so sophisticated that security experts trying to build defences against further incursions believe the US may be losing the world's first cyber war. Investigators suspect Russia is behind the series of hits against US computer systems since January. In one case, a US technician trying to track a computer intruder watched in amazement as a secret document from a naval facility was hijacked to Moscow from under his nose. In a secret briefing on Moonlight Maze, deputy Defence Secretary John Hamre told a congressional committee: "We are in the middle of a cyber war." Besides military computer systems, private research and development institutes have been plundered, US officials say. Such institutes are reluctant to discuss losses, which experts claim amount to hundreds of millions of dollars. "It is impossible to overstate the seriousness of this problem. The President is very concerned about it," a White House official said. The offensive began early this year, when a startling new method of hacking into US computer systems was detected. A military computer server near San Antonio, Texas, was infiltrated for several days by hackers who had entered the system, through an overseas site on the Internet. Dozens of security violations ensued at other military facilities, and even at the Pentagon, the US military headquarters in Washington. When research laboratories also reported Internet incursions, officials realised a cyber invasion was under way. "There were deliberate and highly co-ordinated attacks occurring in our defence department systems that appeared to be coming from one country," said Curt Weldon, chairman of the congressional committee for military research and development. "Such a thing has never happened before. It's very real and very alarming." Even top-secret military installations, whose expertise is intelligence security, have been breached. At the Space and Naval Warfare Systems Command in San Diego, California, which specialises in safeguarding naval intelligence codes, engineer Ron Broersma was alerted to the operation when a computer print-out took an unusually long time. To his amazement, monitoring checks showed the top-secret file had been removed from the printing queue and transmitted to an Internet server in Moscow before being sent back to San Diego. Alerted to the threat of Moonlight Maze, President Bill Clinton has called for an extra $US600 million ($923 million) to fund a variety of security initiatives, including an infrastructure protection centre in the FBI to gauge the vulnerability of computer systems. The White House has ordered the US military to develop its own information warfare capabilities. US officials warn other forms of electronic attack could potentially bring the country's military to its knees. China, Libya and Iraq are developing information warfare capabilities. And one White House official says: "We see well-funded terrorist groups that also have such capabilities." @HWA 19.0 BO2K and SMS, Which One is Evil? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by maierj We missed this last Friday but Jim Louderback, over at ZD Net has some interesting comments regarding SMS and BO2K. Last week cDc challenged MS to recall SMS. cDc says that SMS has the same feature set as BO2K, and since BO2K is being classified as a Virus/Trojan then SMS must be one to. Jim asks the question just what is a virus anyway? ZD Net http://www.zdnet.com/zdnn/stories/comment/0,5859,2300632,00.html -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Virus identity beginning to blur By Jim Louderback, ZDTV July 23, 1999 10:49 AM PT URL: http://www.zdnet.com/zdnn/stories/comment/0,5859,2300632,00.html So what is, or what is not a virus? That question took an interesting turn last week. The kind folks over at Cult of the Dead Cow launched a counter-attack at Microsoft. Their new Back Orifice product, which allows remote monitoring and administration of computers over a LAN or the Internet, has come under fire from many quarters. Because after a surreptitious install it is virtually undetectable by the end user, many are calling it a Trojan Horse. But a Trojan Horse is actually a program that calls itself one thing, but turns out to be something else. Unless a hacker or cracker developed a seemingly benign program that secretly installed Back Orifice's Server, it's just a program that does some powerful and possibly nasty things. But Microsoft and others have been bashing Back Orifice. Symantec included Back Orifice server detection in their Anti-Virus product. And up on Microsoft's security site, they're calling Back Orifice 'malicious' -- primarily because it "Includes stealth behavior that has no purpose other than to make it difficult to detect." But apparently that old stone and glass-house adage applies here. Microsoft's own Systems Management Server (a.k.a. SMS) happens to have features surprisingly 'malicious' -- just like Back Orifice. SMS, in fact, does let you remotely control a user's PC without the client being aware of it. Apparently Microsoft included this feature at the request of their customers. It should come as no surprise that some Microsoft actions could be characterized as malicious. Actually it's refreshing to have them finally admit it. And I got a good chuckle when the Cult of the Dead Cow issued a press release challenging Microsoft to recall SMS. And it's folly to assume that Symantec would scan for SMS in Norton AntiVirus, along with Back Orifice. But it still raises the question of what is a virus. That feature is a useful tool when respected software vendor Microsoft sells it for many hundreds of dollars. But when a company calling themselves, "the most influential group of hackers in the world" includes that same feature, and gives it away for free, suddenly it's a virus. But that's not all. It seems that many PC vendors have been shipping an ActiveX control that unknowingly opens up a user's system to rape and pillage. The HP version of the control allows an e-mail to automatically download a program locally, install it and run it. The SystemWizard Launch ActiveX control can be executed from an Outlook or Outlook Express client. According to Pharlap CEO Richard Smith, similar versions of this control are shipped on many major computer systems (but not all of them -- my IBM ThinkPad is safe). For more information on this topic, head over to www.tiac.net/users/smiths/acctroj/index.htm. So is the SystemWizard Launch ActiveX control a virus? Well it certainly has some elements of a Trojan horse. It sits on your PC, looking benign, until someone executes it in the right way. And it can severely compromise your security -- this is a perfect way to deliver Back Orifice or SMS, for instance. Should Symantec's Norton Anti-Virus scan for this control as well? Or should you just turn ActiveX off in your browser? I'm not sure I have an answer, but these lines are going to continue to blur. And as we connect more and more devices up the Internet, including phones, appliances and set-top boxes, "malicious" programs will have even more fertile ground to spread. And man, I'd hate to have my freezer infected with a virus. @HWA 20.0 The Last True Hacker ~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by found on slashdot So what exactly is a 'hacker'. Do the ethical hackers in the IBM ads count? Is Richard Stallman, as Steven Levy called him, the last true hacker? What about Linus Torvalds? Boston Globe http://www.boston.com/dailyglobe2/206/business/Scientists_and_hackers+.shtml ECONOMIC PRINCIPALS Scientists and hackers By David Warsh, Globe Staff, 07/25/99 If the essence of politics is to be found in the shifting meaning of words, then few words carry a more interesting charge these days than ''hacker.'' For example, as one of a series of recent ads, IBM Corp. has been parading a photograph of employee Nick Simicich, ''Ethical Hacker.'' Flowing-bearded, fish-shirted, felt-hatted, granny-glassed, Simicich is described as a ''paid professional paranoid.'' His job: to determine whether software systems are susceptible to hackers. His distinction: He protected the electrical power infrastructure in the United States from ''cyber-jackers bent on misdirecting electricity with bogus information.'' So much for the limits of the current definition of hacker: the principled tester-of-limits vs. the high-tech saboteur. But if you listen carefully to the leading innovators in computer systems, you realize that the applicability of the term is expanding rapidly. Consider the story of how Linus Torvalds, and not Richard Stallman of the Massachusetts Institute of Technology, came to pose the chief threat to the world's first centibillionaire, Bill Gates. Stallman would seem to be the hacker par excellence - ''the last true hacker,'' as author Steven Levy called him in his famous book. Even though it was Harvard College that he entered in 1970, it was down the street at MIT that Stallman found his spiritual home. There he imbibed deeply the peculiar sensibility that is one of MIT's enduring contributions to computer culture. He rendered a small jewel of a hack of one sort a few years ago when he posted an official-looking sign on the spot that serves as the Wellesley terminus of the shuttle bus that has connected Wellesley College and MIT since the mid-1960s. Barbedall Square, it read. At the MIT end of the line, of course, is Kendall Square. (It helps to say them out loud.) Such is the world of an MIT hacker: high-spirited, clever, accomplished, and, just possibly, but not necessarily, oriented to the occasional countercultural prank. According to Stallman, the use of ''hacker'' to mean ''security breaker'' is mass media confusion. Hackers themselves, he says, use the word to mean ''Someone who loves to program and enjoys being clever at it.'' Stallman's significance goes far beyond a few practical jokes, however. It was in 1981 that a little start-up company known as Symbolics Inc. hired away most of the staff of MIT's Artificial Intelligence Lab and set them to work writing proprietary software. At about the same time, Digital Equipment introduced its new VAX computers, with brand-new proprietary operating systems. The community of pioneering software sharers that had grown out of the Model Railroad Club at MIT suddenly collapsed. So Stallman did a historic thing. Instead of joining the proprietary world, he set out to make a free, shareable operating system that would work on any computer and run any program. There would be none of the nondisclosure agreements that characterized the nascent software industry. Stallman dubbed his ambitious project the GNU system. But first there would have to be tools. His first big achievement was EMACS, a compiler and text editor that rendered possible more ambitious programming. Other programs followed. All were freely made available to others under the ''copyleft'' license Stallman and his friends devised to keep the underlying source code open - that is, to protect the right of other users to know and modify the basic code. Stallman's Waterloo was the operating system's ''kernel,'' the core part of the operating system where memory is allocated among all the other programs: scheduling, signalling, device input/output, and so on. When Stallman turned his shoulder to the task in 1990, the dogma among computer scientists in cutting-edge American universities such as MIT was that something called a ''microkernel'' would be required to make a truly portable system. A microkernel would be a kind of coded general theory of all computer architectures; it would be required before such a system could run on any hardware. Cut to Helsinki in 1991. A young Finnish graduate student named Linus Torvalds, comfortably outside the circuits of grant-supported American computer science research, decided to try an alternative approach - a ''monolithic kernel,'' simpler, but far faster and already relatively well-understood. ''I am a pragmatic person,'' Torvalds has written. '' ... I didn't have to aim for such a lofty goal. I was interested in portability between real world systems, not theoretical systems.'' So Torvalds read up on the systems in use, in search of common denominators between them. Once he had a design for a certain task - for memory management, say - that would be on the most popular chips, he put it out to an extensive list of correspondent hackers to see how it could be improved. At first it was written to suit just one architecture: the Intel 386. Gradually a kernel emerged that could control the most popular microprocessors - the 68K, the Sparc, the Alpha and the Power PC. Torvalds then combined his kernel with a good bit of the GNU programs Stallman and his friends had written, and presto! The operating system that has become known as Linux - similar in spirit to AT&T's Unix system but not based on it - was ready to be distributed and more or less continually improved. And because it had been written - hacked - by an impassioned graduate student in Finland and a relentless code warrior in Cambridge and a few hundred collaborators for their individual satisfaction and shared use, it was available to others for free. And in the last 10 years the project originally envisaged by Stallman and Torvalds and a handful of others has grown into a credible threat to Windows NT - the Microsoft operating system with its secret proprietary source code on which rests Bill Gates' most basic hopes for the 21st century. ''Linux today has millions of users, thousand of developers, and a growing market,'' Torvalds has written in ''Open Sources: Voices from the Open Source Revolution,'' the O'Reilly & Associates anthology from which this account is drawn. ''I'd like to say I knew this would happen, that it's all part of the plan for world domination. ''But honestly this has all taken me a bit by surprise. I was much more aware of the transition from one Linux user to one hundred Linux users than the transition from one hundred to one million.'' And the point? Simply that the neatly barbered and quietly circumspect Torvalds is every bit as much a hacker as Stallman - a fact the flamboyant Stallman readily concedes. So what is a hacker, after all? Eric Raymond offers this definition in the third edition of his New Hacker's Dictionary: ''A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary.'' Torvalds' success suggests that even that definition may be too narrow. Remember, it was only 150 years ago that thinkers and wordsmiths of all sorts were trying to agree on a term that could apply equally to all the different sorts of intellectuals who had emerged from the precincts of philosophy and natural history. It seemed clear these new professionals shared an ethic. Their methods and goals were unfamiliar and, quite possibly unique. They even admitted women to their ranks! In the England of the 1830s, it took a decade before the term ''scientist'' emerged and won common acceptance. This story ran on page G01 of the Boston Globe on 07/25/99. ⌐ Copyright 1999 Globe Newspaper Company. @HWA 21.0 One Russian ISP Standing Up to FSB ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Arik ISP Bayard-Slavia Communications is refusing to go along with SORM-2 (System of Efficient Research Measures 2). In a supposed effort to reveal tax evaders and other criminals SORM-2 gives Russia's Federal Security Service (FSB) the right to look into private e-mail without a warrant. SORM-2 calls for ISPs to install special listening equipment to keep its ISP license. Bayard-Slavia is the only ISP we have heard of that is refusing to go along with these provisions. Information Week http://www.techweb.com/wire/story/TWB19990726S0003 Russian ISP Refuses To Spy On Customers (07/26/99, 6:35 a.m. ET) By Marina Moudrak, Data Communications At least one Russian ISP is refusing to go along with a directive that lets the government spy on customers -- and it's paying the price. The directive is known as System of Efficient ResearchMeasures 2 (SORM 2), and it gives Russia's Federal Security Service (FSB) the right to look into private e-mail without a warrant, under the pretense of sniffing out tax dodgers and corruption. It also calls for ISPs to pay for surveillance equipment in their servers and a link to FSB headquarters in Moscow. But ISP Bayard-Slavia Communications is refusing to go along with SORM-2, and now the government is taking action. According to Bayard-Slavia director general Nail Murzakhanov, the FSB tried to shut down the ISP by withdrawing its license and challenging its right to frequencies used for its satellite connection to Moscow. Eventually, it found a way to freeze the ISP's bank account so it couldn't pay for the satellite connection at all. "We will never help the FSB implement illegal shadowing," Murzakhanov said. "We're the first ISP to struggle against illegal information collection. Unfortunately, we're also likely to become the first to be destroyed because of insubordination." @HWA 22.0 GameBoy Steals Cars and Makes Free Calls ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by doc A GameBoy, GameBoy Pocket, or GameBoy Color has software available with the ability to turn your GameBoy into a RedBox (Toll Fraud Device) This software has been around for a while. These GUI based applications allow you use you GameBoy to make free long distance calls, crack answering machine passwords, and just use it as a tone dialer. Well the new GameBoy Color has an interesting feature, an IR port. As mentioned on HNN and elsewhere a few months ago there are vehicles that use IR as a locking mechanism. With currently available software you can now teach your GameBoy various IR codes including those to unlock vehicles. Wondering how you get these programs into your GameBoy? Well, Nintendo recently lost the court case against the person making and selling GameBoy ROMS which makes it real easy to transfer files around. Another example of how it is not the tool that is malicious but the user. Ratb0y's Homepage http://homepages.go.com/~ratb0y/gameboy.htm @HWA 23.0 Mitnick Retains High Profile Lawyer For State Case ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Ryan Kevin Mitnick's sentencing for the Federal charges he has already pleaded guilty to was delayed again yesterday. In the meantime Kevin has retained well known defense attorney Tony Serra, to handle his state charges. This is a expose that does a decent job of giving a broad over view of the legal side of the Kevin Mitnick case. Cal Law - Tony Serra Profile http://www.callaw.com/weekly/feata726.html Wired- Sentencing Delayed http://www.wired.com/news/news/politics/story/20953.html -=- The Hacker and the Toker With the L.A. district attorney's office on his case, Kevin Mitnick hopes Tony Serra will help him beat the rap By Paul Elias , Omar Figueroa and Carolyn Hagin Tony Serra doesn't use a computer. He has never surfed the Net. On the whole, he'd rather sit in front of the fire with some 19th century American literature and enough marijuana to stone an elephant. The famous San Francisco defense lawyer is your basic hash-smoking Luddite. "My wife has a computer," he says. "She's on it every night. I can't get her off the fucking thing." It's no surprise then, that Serra has never defended anyone accused of a computer crime. He hasn't even come close in his 37-year legal career. "I do dope and murder, man," he says. "That's all I've done my entire life." As in defending the likes of Proposition 215, Black Panther Huey Newton and Ellie Nesler, the woman convicted of gunning down her child's molester. Serra once offered to defend Ted Kaczynski -- the king of the Luddites -- by invoking Kaczynski's anti-technology views. The Unabomber readily accepted the offer but a judge wouldn't allow it. But all of that was before Kevin Mitnick, the most revered martyr of hackerdom, placed a collect call to Serra's office last month looking for pro bono representation. Mitnick is the most notorious member of an emerging class of cybercriminals. Over the last decade, he has faced three federal prosecutions for hacking into other people's computers and related charges, and is now facing a case in state court. Luckily for Mitnick -- and for Serra -- the hacker's call was fielded by one of two bright acolytes who work in Serra's office, housed on a pier along the San Francisco waterfront. The two young lawyers then fiercely lobbied Serra to take the case, a single count of computer hacking that's being prosecuted by L.A. District Attorney Gil Garcetti's office. The charge was actually filed seven years ago, but Mitnick has yet to be arraigned. "Tony wasn't very excited about it at first," recalls Omar Figueroa, the 28-year-old lawyer who talked to Mitnick first. But when Figueroa and colleague Carolyn Hagin, 27, explained to Serra that the case was bigger than a mere fraud case -- that it came complete with a big counterculture community that knows how to get good press and involved a new civil rights frontier -- Serra relented. But with one proviso: Figueroa and Hagin would have to do all of the pretrial work, then give Serra a crash course in technology on the eve of trial. It's an arrangement that suits everybody just fine. "I've always had an interest in cybercrime," says Hagin. "It's part of our generation." Now even the 64-year-old Serra, who knows far more about Tibetan prayer flags and Native American rituals than he does about HTML and encryption, says he's looking forward to going to trial. "I view this as a political case," he says. Indeed, political cases are Serra's specialty, and he is the poet laureate of defense attorneys who successfully cast their clients as victims of oppressive government forces. "Political case" is also code for "good ink." Serra said the same thing about the Mendocino County murder trial of Eugene "Bear" Lincoln, a Native American who was accused of killing a white deputy sheriff during a shoot-out on a reservation in 1995. Press coverage was extensive and mostly favorable as Serra successfully turned the tables on Mendocino County prosecutors and sheriffs -- and the entire power structure of the area -- by arguing that Native Americans had suffered centuries worth of abuse and discrimination. An all-white jury acquitted Lincoln in 1997, believing he acted in self-defense. Word of Serra's victory circulated through the state's jails and prisons. Mitnick, along with much of the inmate population, was impressed by Serra's work on that case, and it reportedly prompted him to call Serra as his own case neared trial. Kevin Mitnick may not hold a college degree, but he is certainly no Luddite. Long before the Internet became a household staple and years before Yahoo and bandwidth emerged as commonplace jargon, the self-taught Mitnick was a cyberspace juvenile delinquent. At 17, Mitnick spent three months in L.A.'s Juvenile Detention Center for destroying Pacific Bell computer data. Two years later, in 1983, University of Southern California campus police arrested Mitnick while he was sitting at a computer in the school's terminal room, attempting to break into a Pentagon computer. He spent six months in a California Youth Authority prison after that arrest. But his two brief stints behind bars as a teen-ager seemed only to embolden him as an adult. Instead of using his computer skills for gainful employment, Mitnick couldn't shake his compulsion to hack. All of the myriad profiles of Mitnick available online paint him as the quintessential computer geek motivated not by money but by the ability to access highly sensitive information for the hell of it. He just couldn't resist the siren song of forbidden access. In 1987, he was arrested and convicted by a state court of stealing software from a software company and sentenced to 36 months of probation. Two years later, he pleaded guilty in federal court to breaking into a Digital Equipment Corp. computer, after which Los Angeles U.S. District Judge Mariana Pfaelzer sentenced him to a year in a prison and six months of therapy to combat his computer "addiction." In 1992, while Mitnick was working at the Tel Tec Detective Agency, the FBI -- suspecting that he was illegally using a commercial database system -- launched yet another investigation into his activities. Pfaelzer soon issued an arrest warrant for Mitnick, who was charged with one count of hacking and one count of violating the terms of his 1989 probation. But when federal authorities showed up to arrest him, Mitnick had vanished, and a two-year, high-tech cat-and-mouse game with his pursuers began. He ultimately made the FBI's most-wanted list. At one point, in late 1992, investigators from the California Department of Motor Vehicles almost caught Mitnick. Someone using a valid law enforcement requestor code called the DMV and requested that a photo of a police informer be faxed to a number in Studio City. The number turned out to be a Kinko's copy center, and Mitnick was seen leaving the store with the fax. But Mitnick spotted the investigators, dropped the fax and outran them. Federal authorities finally arrested Mitnick in February 1995 in Raleigh, N.C., after an extensive manhunt, which had been fueled by front-page coverage in The New York Times . He quickly agreed to plead guilty to violating his probation and to a new hacking charge filed by federal prosecutors in Raleigh and was sentenced to 22 months in prison. He was soon transferred to the Federal Detention Center in Los Angeles, where he faced 25 more counts of hacking and illegal copying of information during digital break-ins of companies, including Sun Microsystems Inc. In March of this year, he cut a plea bargain with federal prosecutors that requires him to serve an additional year in federal custody. In theory, he could move into a halfway house as early as next month to finish out his sentence. Though he pleaded guilty to the high-tech crimes against Sun and others, Mitnick claims he didn't share the information with anybody. Prosecutors and the victimized companies claim that $150 million worth of their research and development has been ruined. The government, though, is asking the court to order Mitnick to pay a more modest $1.5 million in restitution. But Mitnick's court-appointed lawyers, led by Donald Randolph of Santa Monica's Randolph & Levanas, contend that Mitnick caused little, if any, actual damage. They're arguing for a $5,000 fine. Pfaelzer has scheduled a hearing on the subject for July 26. Bespectacled and pudgy, Mitnick now uses his abundant nervous energy to review the case against him. He spends most of his waking hours poring over court documents and constantly calling his attorneys to discuss his case. "He reviews his case in detail," says Hagin, of Serra's office. "He's an extremely intelligent guy." Once Mitnick settles his federal affairs, he still has to contend with the L.A. DA's single charge of computer fraud for allegedly duping the DMV to fax him the informer's photo. It is that charge that may prevent him from getting into a halfway house to serve out the rest of his federal sentence. No bail in the state case, no halfway house. In fact, Mitnick fears prosecutors will try to have him moved from the federal jail to the dreaded county jail. "We've been waiting to prosecute him for five years," says L.A. Deputy District Attorney Larry Diamond, who brushes off criticism that the state charge and the $1 million bail amount to overkill. "Because he wants to finish his [federal] sentence in a halfway house," an unsympathetic Diamond retorts, "Kevin wants special treatment." In fact, argues Diamond, Mitnick has been receiving special treatment since Pfaelzer first put him on probation in 1989 for hacking. The 25-year veteran of the DA's office is unimpressed with just about every aspect of Mitnick's case. He dismisses Mitnick as "just another case" and Serra as "just another defense attorney." As for his view of Pfaelzer: "She's coddled 'poor Kevin' from day one." Diamond also rejects the argument that the bail is excessive -- the bail schedule calls for $25,000 -- saying Mitnick has been a "notorious fugitive." But Diamond reserves his harshest criticism for the federal prosecutors on the Mitnick case. "The real story here," he growls during a telephone interview from his Van Nuys office, "is how the U.S. attorney gave this case away." To begin with, Diamond believes Mitnick shouldn't even be appearing in front of Pfaelzer, but rather in a federal court in North Carolina because that's where he was arrested back in 1995. Not only was he charged with violating his probation but he was indicted by a Raleigh grand jury on 25 fresh charges of hacking, wire fraud and theft of intellectual property. Mitnick cut a quick plea deal with Raleigh prosecutors so he could be transferred back to L.A. to face yet another set of hacking charges. The Southern California case was also disposed of with a plea deal, which Mitnick entered in March. "It's bizarre," Diamond says of the federal proceedings. "Completely bizarre." L.A. Assistant U.S. Attorney David Schindler, who handled Mitnick's latest federal case, has heard it all before. In fact, he's getting blasted from both sides of the Mitnick issue. Critics such as Diamond say he's gone too soft on Mitnick. Meanwhile, a growing number of young computer nerds protest that Mitnick is a political prisoner who has done little -- if anything -- illegal, and is relentlessly being pursued by different sets of prosecutors. Even if he did all the things that he has done, the theory goes, he's already received the harshest punishment ever for hacking. Pro-Mitnick protesters are pleading their case on numerous Web sites. But Schindler, who has been locking up hackers since 1991, says Mitnick got the same prison sentence he would have received had he gone to trial. "What we gave away [with the plea bargain] was the right to argue for an upward departure" in Mitnick's sentence, says Schindler, referring to a prosecutor's ability to seek a longer prison term than the one called for in federal sentencing guidelines. Schindler concedes that Mitnick's sentence is the longest that he has seen during the years he's been prosecuting hackers. Kevin Poulsen, another infamous hacker that Schindler prosecuted, received a 51-month sentence. He was also ordered to pay about $100,000 in restitution. When all is said and done, Mitnick will have been sentenced to 68 months in federal custody, may yet do state time, and may also be ordered to pay several times the restitution Poulsen did. And as for Diamond's forum-shopping charge, Schindler says, "Mitnick begged us to transfer him to L.A." That J. Tony Serra has taken Kevin Mitnick's case goes to show how ubiquitous this Internet thing has become. The Digital Age has truly affected all segments of society if it has touched an aging radical lawyer like Serra, who has his marijuana prescribed by a doctor and who's known for driving rusting junkers around town, only to abandon them on the street the minute they finally give out on him. His association with Mitnick will certainly make him and his associates extremely simpatico with all of hackerdom. That crowd is facing increased government scrutiny as the Department of Justice continues to dedicate more money each year to fighting cybercrime. "This was our first case relating to computers," says Santa Monica defense attorney Gregory Vinson, who is assisting Randolph with Mitnick's federal case. "It's an area we are going to develop more." U.S. Attorney General Janet Reno has asked Congress to give the Justice Department's computer crimes and intellectual property division an additional $120 million to fight cybercrime next year. Other agencies -- federal and local -- are beefing up their cybercrime forces as well. "If someone would have told me two years ago that I would be prosecuting Internet fraud, I seriously would have laughed in their face," Jay Perlman, deputy chief of the Securities and Exchange Commission Office of Internet Enforcement, said recently at a cybercrime symposium in Virginia. In the wake of several Mitnick-inspired hack jobs on government Web sites in the past year, a federal multi-agency task force has been formed in Dallas specifically to fight hackers. The task force has issued 16 warrants in 12 jurisdictions, but has yet to charge anyone with a crime. "So far, cybercrime has mostly been a federal effort," says Jennifer Granick, a San Francisco criminal defense attorney who is carving out a nice niche for herself as a computer crime specialist. "But the locals are getting increasingly involved, too." By 2005, it's predicted that one billion people worldwide will be on the Internet, and prosecutors expect the number of cybercrime cases will rise accordingly. A closer look makes it clear that Serra and Mitnick have more in common than not. Both stand out as countercultural icons for their peers. Serra is a hero to every hippie who went to law school, while Mitnick appeals to disaffected youths who are known as hackers, crackers and high-tech poseurs. Both have inspired the creation of Hollywood movies. James Woods played a Serra-like character in 1989's True Believer while Mitnick's life goes on the big screen next month in Takedown , which chronicles the manhunt for him. So it's not a stretch to imagine Serra representing more hackers and others accused of computer crimes down the line. But first, he's got to learn how to use a computer -- or at least speak the language. "I don't even know any of the terminology," he says. "I'm organic, man." Tony Serra He hasn't even spoken with Mitnick yet. Instead, it's been Figueroa and Hagin who have been answering Mitnick's daily telephone calls. Truth is, this is really their case. Sure, Serra will handle the trial and all the big hearings such as a motion to dismiss. And it will be Serra pushing the David versus Goliath angle and garnering all of the press. But it's Figueroa and Hagin who will do the heavy lifting, such as wheedling discovery out of Diamond and handling Mitnick's bail appeal. That's the way it works in Serra's office, and the two young lawyers are appreciative. Both have been attorneys for less than a year and probably would not have landed work on such a high-profile case -- albeit for expenses only -- if not for Serra. He says he'll give them a chance to examine witnesses if Mitnick's case gets to trial. Both appear ready. Serra always seems to have smart neophyte lawyers in orbit around his office. Figueroa graduated from Stanford Law School while Hagin is a product of the University of San Francisco School of Law. Both gained invaluable experience as clerks to Serra when they rented a house in Ukiah during the Bear Lincoln trial, during which they wrote many of the case's motions. They also appear smart enough to ignore Serra's complaints of high-technology ignorance. "Tony pretends to be mystified by computers," says Figueroa. "But he's not. He'll be ready for trial." Paul Elias is a reporter at The Recorder ,a San Francisco affiliate of California Law Week . Wired- Sentencing Delayed http://www.wired.com/news/news/politics/story/20953.html More Delays for Mitnick by Douglas Thomas 3:00 a.m. 27.Jul.99.PDT The sentencing hearing for convicted cracker Kevin Mitnick was postponed for a fourth time Monday and rescheduled for 9 August. US District Judge Marianne Pfaelzer issued a continuance because of scheduling conflicts, according to a court clerk. Mitnick pleaded guilty on 26 March to five counts of a 25-count federal indictment and two related counts from a Northern California indictment. His plea agreement resulted in a 54-month prison sentence, making Mitnick eligible to be released into a halfway house pending Pfaelzer's approval and permission from the State of California. A pattern of delays has plagued the case from its onset. What remains to be determined in Mitnick's sentencing is the judgment for restitution which Pfaelzer has made clear she will issue. The government contends that Mitnick should be forced to repay US$1.5 million dollars in damages to the victim companies. In the pre-sentence investigation report, Mitnick's attorneys said their client is unable to pay anywhere near that amount and should only be required to repay about $5,000. Mitnick had already spent more than four years behind bars at the Los Angeles Metropolitan Detention Center. At the original hearing in March, sentencing was delayed until 14 June. That hearing was again continued to 12 July, when attorneys were unable to reach an agreement about the terms of restitution. The judge was unprepared to rule, due to a last minute filing by the government to which the defense was unprepared to respond. Mitnick Fans Await Denouement by Douglas Thomas 3:00 p.m. 13.Jul.99.PDT LOS ANGELES -- Kevin Mitnick's allies rallied here Monday, as the cracker's expected prison term is still up in the air. Mitnick's sentencing hearing was attended by a number of computer hackers, fresh from Las Vegas where they had attended the annual DefCon hacker meeting. Defense attorney Donald Randolph spoke to a gathering of a dozen or so hackers in the hallway. "It was nice to see some friendly faces," he said, and thanked them for their continued support. That support was much needed after US District Judge Marianne Pfaelzer had been particularly tough on both attorneys Monday, comparing them to bickering kids. She went so far as to call the government's motion to sanction attorney Randolph for the release of several letters from victim companies "childish." The current sentencing proceedings mark the climax to what has been a years-long campaign in the hacker community. Hackers have focused their attention on the case, launching Web sites like kevinmitnick.com, protests reaching as far as Moscow, and Web site defacements to draw attention to what they see as Mitnick's unjust prosecution and a violation of his Constitutional and civil rights. Kevinmitnick.com tracks media coverage of the case, and offers information, commentary, and online versions of most of the court filings. Other activists have printed "Free Kevin" bumper stickers and T-shirts, and some have proposed relatively mainstream money-making ventures to help contribute to Mitnick's legal defense fund. While the activists continually grouse over media coverage of the Mitnick case, citing inaccurate or misinformed accounts, they have also learned the importance of working to provide the press with accurate information. Particularly infuriating to hackers are claims that Mitnick has been accused or convicted of stealing credit card information (he hasn't), that he has appeared on either the America's Most Wanted TV program or on the FBI's "Ten Most Wanted List" (neither is true), or that he has threatened national security by breaking into NORAD (also not true). The importance of these media reports and mis-characterizations were driven home last week when a municipal court judge in Van Nuys, CA set Mitnick's bail for his upcoming state case at $1 million dollars, based primarily on media coverage of Mitnick's hacking exploits. Judge Pfaelzer barred Mitnick from the hearing, and wondered "when do newspaper stories count as evidence in a court of law?" Many hackers have challenged the court's decisions, ranging from the denial of a bail hearing to a four-year pre-trial incarceration. They charge that the court has repeatedly denied requests for access to court information considered vital to Mitnick's defense. Although the government's goal has been to "send a message" to hackers about the severity of these crimes and to demonstrate their willingness to prosecute them, hackers appear to be receiving a different message. One hacker said Monday that the court is doing little to deter him, and instead is, in effect, telling him "be more careful, don't get caught." Another hacker, Kerry Zero, said the government's agenda in this case is to set a foundation which "makes it easier to prosecute hackers in the future." Not surprisingly, many supporters painted Mitnick as the victim in the case. They said that the financial damages being claimed are overstated, and that no adequate explanation has been offered for why Mitnick was held for so long without a trial or bail. "All this talk about protecting the victim -- Kevin is the victim in this case," said one hacker, who asked not to be identified. After the hearing, three hackers, Teklord, Bonq, and Sig9, all expressed deeper concerns about the case. For Teklord, the result was one of dismay. "I'm confused about the government," he said. "The system is supposed to protect people and it's failing us." Bonq expressed a similar confusion. "I don't know who to trust." And after watching the hearing, Sig9 said he had "lost a lot of respect for the system." For many hackers, the Mitnick case has been a civics lesson in how the system works. Biff Macki, a hacker who has followed the Mitnick case for some time thinks the lesson is pretty clear-cut. "If the government wants you, they'll get you, no matter what," he said. The problem, he says, is in the system itself. "[The US government has] millions of dollars to spend and it is impossible to organize an adequate defense on 15 minutes of collect calls a day from federal prison." @HWA 24.0 Back Orifice for Macintosh? ~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Nick SecureMac.com has a story about TakeDown Suite 2.5, a backdoor program similar to the original Back Orifice. Once installed the application allows someone to remotely administer the machine. This is similar functionality to Back Orifice, which only works under windows. TakeDown Suite operates by installing an invisible extension into the system folder, when the machine next reboots it is vulnerable. Now where is that idiot that said Macs where secure? Secure Mac http://www.securemac.com/ 25.0 AOL Criminals Busted ~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Lamer After sending out bogus emails to AOL customers asking for credit card numbers two teenagers where able to get 900 people to cough them up. With about a 2% return rate on the emails they sent out the pair started to use the credit card numbers. They bought computer equipment that they later sold on eBay and sold the numbers in chat rooms. The Department of Justice and FBI, both worked on the case but would not reveal how the two had been caught. (I am glad the author did not call these two 'hackers') APB Online http://www.apbonline.com/911/1999/07/23/netcredit0723_01.html AOL USERS DUPED BY TEENS, COPS SAY Hundreds Sent Credit Card Numbers in Response to E-Mails July 23, 1999 By Valerie Kalfrin SACRAMENTO, Calif. (APBNews.com) -- Two teenagers who police say illegally accessed America Online and wrote e-mails pretending to represent the company duped about 900 people into giving them their credit card numbers, authorities said today. Dino Dagdagan, 18, of Carson and a 17-year-old home-schooled Sacramento student are charged with felony possession of access to credit accounts and other crimes. The two allegedly sent out thousands of e-mails to America Online customers, claiming there was a problem with their accounts and asking the subscribers to visit a Web site to correct matters, officials said. Fake Web site But the Web site, too, was a fake, set up to glean the unsuspecting customers' credit card numbers, said Sgt. Rick Gibson, a spokesman for the Sacramento County Sheriff's Department. "People should call the company and make sure it's a true communication and a real Web site," Gibson told APBNews.com today. "Out of every 10,000 e-mails they sent out, about 200 customers would give them information." The 17-year-old allegedly traded or sold the numbers in Internet chat rooms while Dagdagan allegedly used the credit card accounts to buy computer equipment, which he then sold via the online auction site eBay, Gibson said. Task force tracks down suspects Customers alerted police to the scam about a month ago when they noticed purchases on their credit card bills that they had not made, police said. A Northern California multi-agency task force, including computer-crimes experts from the Department of Justice and FBI, helped track down the youths, Gibson noted, although he would not go into specifics. "We have ways of doing things," he said. The juvenile, who was released to his parents' custody last week, is accused of obtaining the illegal access to the Sterling, Va.-based Internet service provider, officials said. Dagdagan, who is free on $10,000 bond, also faces possession of stolen property and an additional computer-crimes charge. He's due to be arraigned July 28 in a Lynwood court. America Online's corporate headquarters did not return a phone call seeking comment today. @HWA 26.0 Press Does Not Know What to Say About BO2K ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Weld Pond The number of articles that are showering accolades onto BO2K is amazing. Ok, maybe they aren't all that positive, but at least neutral and not claiming it is a trojan/virus. Some people still aren't getting the full picture but at least this is progress. InformationWeek http://www.informationweek.com/745/45iujl.htm InternetView: Pariah's Software Has Value By Jason Levitt xcept for its peculiar name and seemingly sinister authors, Back Orifice 2000, the recently released remote administration software for the Windows and Windows 2000 platforms, might be considered a contender in any comparative product review. Instead, it's a pariah, demonized because it's been misused by some Internet villains, and ignored because its authors don't appear to have day jobs. Yet this software is deserving of closer attention, if only because it's high-quality programming released as free software under the GNU Public License. Sure, there's reason enough not to trust the software--the employees of the virtual vendor that created it, the Cult of the Dead Cow, won't reveal their real names. Nevertheless, BO2k doesn't look so bad stacked up against mainstream commercial competitors such as Symantec's pcAnywhere, Compaq's Carbon Copy, and Artisoft's CoSession Remote. Am I advocating the use of dangerous software on your LAN? Absolutely not. But I don't think BO2k should be dismissed because the authors have a political agenda. Even Jason Garms, Microsoft's lead product manager for Windows NT security, concedes BO2k does "little different from what legitimate remote-control software can do." So what is Microsoft's objection? According to Garms, it's that BO2k is "designed to be stealthy and evade detection by the user." This is a reasonable objection, and it's the primary reason it's difficult to take the software seriously as an end-user product. Such software is easy to abuse, especially when it's free and comes with complete source code. The Cult's "Minister of Propaganda," who goes by the name "Deth Vegetable," is the first to admit the cult is no fan of Microsoft, and, in fact, one reason for BO2k's existence is to convince Microsoft to "finally implement a security model in their Windows operating system." I would prefer Microsoft engineer a new operating system (see Internet Zone), but revamping the Windows security model to create a secure system would be nearly as much effort. Even open-source pundit Eric Raymond agrees that "BO2k exposes the fact that the so-called `security' of Windows is a bad joke." It's easy to see that free software that can control PCs remotely will be abused. But BO2k will ultimately help more than hinder, by revealing the inadequacies of the Windows security model and providing useful source code for developers. @HWA 27.0 UCITA Moves Forward - Will Remove Vendor Liability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Evil Wench The National Conference of Commissioners on Uniform State Laws (NCCUSL) is likely to endorse the Uniform Computer Information Transactions Act (UCITA). This isn't a federal law but a law that will be passed around to all the states to enact individually making it even harder to defeat. The proposal will allow software manufacturers to sell software that is broken with no liability, even if they knew it didn't work. It gives vendors the right to disable software remotely without prior authorization from the customer. It would prevent reverse engineering and place a gag order on anyone who said anything bad about a product. ComputerWorld http://www.computerworld.com/home/print.nsf/all/990726B6A6 InfoWorld- UCITA Summary http://www.infoworld.com/cgi-bin/displayStory.pl?/features/990531ucita_home.htm -=- UCITA is going to hurt you if you don't watch out By Dan Gillmor 07/26/99 All IT managers have their share of horror stories in dealing with software and the companies that sell it -- buggy products, slow response by vendors and so on. But if some proposed legislation becomes law around the U.S., your worries may just be starting. By the time you read this, the National Conference of Commissioners on Uniform State Laws (NCCUSL) is likely to have endorsed the Uniform Computer Information Transactions Act (UCITA). This legislation is high on the software industry's wish list, because it would tilt the balance of power to vendors -- and away from users. Even if the mounting opposition somehow persuades the commissioners to back off, recent history shows that the software industry won't give up. This issue isn't going away, no matter what happens at the commissioners meeting this week in Denver. A variety of reputable consumer and professional organizations oppose this proposal -- among them, the Federal Trade Commission, the Association for Computing Machinery, the Association for Information Management and Consumers Union. Here are some of their objections: o Sellers could legally disclaim any obligation to sell products that work. They would be legally immune even if they knew about defects before the sale and deliberately failed to disclose the defects, no matter how serious. o In the event of a dispute, a vendor could disable a customer's software remotely, even if that totally disrupted the customer's business. The seller would have a unilateral right to decide that the customer was violating the terms of the contract; a buyer would have to take the vendor to court in response. o Reverse engineering, used by security experts to examine software, could be prohibited, increasing the risk that buggy products and viruses would go undetected. o A vendor could prohibit a user from publicly commenting on the quality or performance of a product. In other words, if it didn't work, you couldn't tell your colleagues at other companies or vice versa. UCITA is itself a backup plan. The industry's original strategy was to get a rewrite of the Uniform Commercial Code, the system designed to ensure uniform laws dealing with commerce. But when the American Law Institute -- the NCCUSL's co-drafter of Uniform Commercial Code proposals -- listened to the opponents and backed away from the idea, the software companies persuaded the NCCUSL to push ahead with UCITA anyway. (For more history and information, check out a detailed account at www.infoworld.com/ucita at the Web site of Computerworld's sister publication Infoworld.) If the commissioners endorse UCITA, the proposed law would move into state legislatures around the nation this year. Whatever happens, the industry's relentless pursuit of this legislation should be a wake-up call to other IT people. Get ready to fight this legislation in your statehouses. Whether it's UCITA or something else, the software barons won't stop pushing against your rights. Stay on your guard, or you'll regret it. -=- InfoWorld- UCITA Summary http://www.infoworld.com/cgi-bin/displayStory.pl?/features/990531ucita_home.htm May 31, 1999 UCITA: Summary information UCITA and the issues that revolve around it are extremely complex. It raises many thorny problems of which the wisest of the wise would have trouble striking a fair balance, and its potential consequences in the electronic-commerce world of the future is surely any mortal's prediction. Yet the process by which it could become the law of the land is obscure, convoluted, and highly legalistic, making it difficult for everyone who has a stake in what it says to have input into its development. The purpose of this page is to provide some background and resources for those who want to understand UCITA better and for those who want to find a way to have their voice heard. I obviously have my own point of view on the act and what I think it means for InfoWorld readers -- as I've said, I've gone from being naively optimistic about the chances for the law helping software customers to deeply concerned that it will only make things worse, and you can certainly learn why I feel that way here. But there's more than enough sources of information for you to make up your own mind and to decide what you want to do about it. This site includes: a brief explanation of what UCITA is and how the process works a background piece from Ed Foster on why he thinks UCITA is important to software customers links to InfoWorld stories and columns on UCITA and Article 2B a list of the top dozen issues opponents of UCITA are concerned about There are also a number of other Web sites that can provide you with all the details on the numerous issues involved in the 2B draft. The de facto clearinghouse for legal briefs and position papers from all sides in the process is the "Guide to the Proposed Law on Software Transactions" provided by Carol A. Kunze at http://www.2bguide.com/. This guide also provides further background on the UCC, reports that have appeared in the press about 2B and links to the current draft. Two recent papers posted there which do a good job of summarizing the opposing views on UCITA are the NCCUSL leadership's defense of the move from 2B to UCITA at http://www.2bguide.com/docs/nuaa.html and a rebuttal by law professor Jean Braucher at http://www.2bguide.com/docs/0499jb.html. Many sites about Article 2B have not yet been updated to reflect the change to UCITA. Two Web sites that have a great deal of background information on consumer-related issues in the draft (few of which have changed to any substantial degree) are Ralph Nader's Consumer Project on Technology site at http://www.cptech.org/ucc/ and the site of "Bad Software" author and attorney Cem Kaner at http://www.badsoftware.com. What you can do With the July meeting where UCITA will be up for approval by the NCCUSL commissioners fast approaching, readers must act quickly if they are to influence the outcome. One simple thing you can is to sign our e-mail petition, which reads as follows: "In light of the concerns previously expressed over proposed UCC Article 2B by a variety of interest groups, and the lack of time such groups have had to study and respond to its new reincarnation as a uniform act, the undersigned urge the National Conference of Commissioners on Uniform State Laws to not approve the Uniform Computer Information Transactions Act at this time." If you agree, "sign" the petition by sending an e-mail to us at ucita@infoworld.com with any additional comments you'd like to make and your name, title, company, city, and state. The results will be presented to the NCCUSL commissioners in Denver to help demonstrate to them that the concern about UCITA is widespread. An even more effective step is to write directly to the NCCUSL commissioners who represent your state. The Society for Information Management has urged its membership to do this, and InfoWorld readers could make a big difference by adding their voices to that of SIM's members. To get the list of commissioners for your state, along with a draft letter you can customize, visit SIM's site at http://www.simnet.org/public/programs/issues/ucccode.html. It's not too early to make sure your state legislators and the governor also are aware of your concerns about UCITA. While we won't know until the end of July whether UCITA will be approved for distribution to the state legislatures, that's where the fight will move next if the commissioners OK it. Even if they reject UCITA, there is a possibility that "rogue" versions of the law will be introduced in some states in any case. So the more aware those in your state's government are of the controversial nature of UCITA, the better. @HWA 28.0 NSC Proposes FidNet - Infrastructure Protection or Surveillance Tool? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Weld Pond A draft prepared by the National Security Council last month, calls for a sophisticated software system to monitor activities on nonmilitary Government networks and a separate system to track networks used in crucial industries like banking, telecommunications and transportation. This system is to be called FidNet or the Federal Intrusion Detection Network. The effort is intended to alert law enforcement officials to attacks against the nation's Infrastructure. Opponents are saying that this could become a building block for a surveillance infrastructure with great potential for misuse. NY Times http://www.nytimes.com/library/tech/99/07/biztech/articles/28compute.html July 28, 1999 U.S. Drafting Plan for Computer Monitoring System By JOHN MARKOFF The Clinton Administration has developed a plan for an extensive computer monitoring system, overseen by the Federal Bureau of Investigation, to protect the nation's crucial data networks from intruders. The plan, an outgrowth of the Administration's anti-terrorism program, has already raised concerns from civil liberties groups. A draft prepared by officials at the National Security Council last month, which was provided to The New York Times by a civil liberties group, calls for a sophisticated software system to monitor activities on nonmilitary Government networks and a separate system to track networks used in crucial industries like banking, telecommunications and transportation. The effort, whose details are still being debated within the Administration, is intended to alert law enforcement officials to attacks that might cripple Government operations or the nation's economy. But because of the increasing power of the nation's computers and their emerging role as a backbone of the country's commerce, politics and culture, critics of the proposed system say it could become a building block for a surveillance infrastructure with great potential for misuse. They also argue that such a network of monitoring programs could itself be open to security breaches, giving intruders or unauthorized users a vast window into Government and corporate computer systems. Government officials said the changing nature of military threats in the information age had altered the nature of national security concerns and created a new sense of urgency to protect the nation's information infrastructure. "Our concern about an organized cyberattack has escalated dramatically," Jeffrey Hunker, the National Security Council's director of information protection, who is overseeing the plan, said Tuesday. "We do know of a number of hostile foreign governments that are developing sophisticated and well-organized offensive cyber attack capabilities, and we have good reason to believe that terrorists may be developing similar capabilities." As part of the plan, networks of thousands of software monitoring programs would constantly track computer activities looking for indications of computer network intrusions and other illegal acts. The plan calls for the creation of a Federal Intrusion Detection Network, or Fidnet, and specifies that the data it collects will be gathered at the National Infrastructure Protection Center, an interagency task force housed at the Federal Bureau of Investigation. Such a system, to be put fully in place by 2003, is meant to permit Government security experts to track "patterns of patterns" of information and respond in a coordinated manner against intruders and terrorists. The plan focuses on monitoring data flowing over Government and national computer networks. That means the systems would potentially have access to computer-to-computer communications like electronic mail and other documents, computer programs and remote log-ins. But an increasing percentage of network traffic, like banking and financial information, is routinely encrypted and would not be visible to the monitor software. Government officials argue that they are not interested in eavesdropping, but rather are looking for patterns of behavior that suggest illegal activity. Over the last three years, the Pentagon has begun to string together entire network surveillance systems using filters that report data to a central site, much as a burglar alarm might be reported at the local police station. Officials said such a system might have protected against intrusions recently reported in computers at the Bureau of Labor Statistics, which produces information like the consumer price index that can affect the performance of the stock market. The draft of the plan, which has been circulated widely within the executive branch, has generated concern among some officials over its privacy implications. Several officials involved in the debate over the plan said that the situation was "fluid" and that many aspects were still not final. The report is vague on several crucial points, including the kinds of data to be collected and the specific Federal and corporate computer networks to be monitored. The report also lacks details about the ways information collected in non-Governmental agencies would be maintained and under what conditions it would be made available to law enforcement personnel. Government officials said that the National Security Council was conducting a legal and technical review of the plan and that a final version is to be released in September, subject to President Clinton's approval. The plan was created in response to a Presidential directive in May 1998 requiring the Executive Branch to review the vulnerabilities of the Federal Government's computer systems in order to become a "model of information and security." In a cover letter to the draft Clinton writes: "A concerted attack on the computers of any one of our key economic sectors or Governmental agencies could have catastrophic effects." But the plan strikes at the heart of a growing controversy over how to protect the nation's computer systems while also protecting civil liberties -- particularly since it would put a new and powerful tool into the hands of the F.B.I. Increasingly, data flowing over the Internet is becoming a vital tool for law enforcement, and civil liberties experts said law enforcement agencies would be under great temptation to expand the use of the information in pursuit of suspected criminals. The draft of the plan "clearly recognizes the civil liberties implications," said James X. Dempsey, staff counsel for the Center for Democracy and Technology, a Washington civil liberties group, "But it brushes them away." The draft states that because Government employees, like those of many private companies, must consent to the monitoring of their computer activities, "the collection of certain data identified as anomalous activity or a suspicious event would not be considered a privacy issue." Dempsey conceded the legal validity of the point, but said there was tremendous potential for abuse. "My main concern is that Fidnet is an ill-defined monitoring system of potentially broad sweep," he said. "It seems to place monitoring and surveillance at the center of the Government's response to a problem that is not well suited to such measures." The Federal Government is making a concerted effort to insure that civil liberties and privacy rights are not violated by the plan, Hunker said. He said that data gathered from non-Government computer networks will be collected separately from the F.B.I.-controlled monitoring system at a separate location within a General Services Administration building. He said that was done to keep non-Government data at arm's length from law enforcement. The plan also has drawn concern from civil libertarians because it blends civilian and military functions in protecting the nation's computer networks. The draft notes that there is already a Department of Defense "contingent" working at the F.B.I.'s infrastructure protection center to integrate intelligence, counterintelligence and law enforcement efforts in protecting Pentagon computers. "The fight over this could make the fight over encryption look like nothing," said Mary Culnan, a professor at Georgetown University who served on a Presidential commission whose work led to the May 1998 directive on infrastructure protection. "The conceptual problem is that there are people running this program who don't understand how citizens feel about privacy in cyberspace." The Government has been discussing the proposal widely with a number of industry security committees and associations in recent months. Several industry executives said there is still reluctance on the part of industry to directly share information on computer intrusions with law enforcement. "They want to control the decision making process," said Mark Rasch, vice president and general counsel of Global Integrity, a company in Reston, Va., coordinating computer security for the financial services industries. One potential problem in carrying out the Government's plan is that intrusion-detection software technology is still immature, industry executives said. "The commercial intrusion detection systems are not ready for prime time," said Peter Neumann, a computer scientist at SRI International in Menlo Park, Calif., and a pioneer in the field of intrusion detection systems. Current systems tend to generate false alarms and thus require many skilled operators. But a significant portion of the $1.4 billion the Clinton Administration has requested for computer security for fiscal year 2000 is intended to be spent on research, and Government officials said they were hopeful that the planned effort would be able to rely on automated detection technologies and on artificial intelligence capabilities. For several years computer security specialists have used software variously known as packet filters, or "sniffers," as monitoring devices to track computer intruders. Like telephone wiretaps, such tools can be used to reconstruct the activities of a computer user as if a videotape were made of his computer display. At the same time, however, the software tools are routinely misused by illicit computer network users in stealing information such as passwords or other data. Commercial vendors are beginning to sell monitoring tools that combine packet filtering with more sophisticated and automated intrusion detection software that tries to detect abuse by looking for behavior patterns or certain sequences of commands. @HWA 28.0 Feds Get Gov Employees to Sign Away Rights ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Evil Wench Intelligence Authorization Act has been passed by the Senate, this new bill will give federal law enforcement new powers to search government computers belonging to individuals who have access to classified information. The bill requires employees who need access to classified information to sign a waiver allowing law enforcement officials to "access information stored in computers used in the performance of government duties." (They can't take your rights away but now they can get you to sign them away.) Federal Computer Week http://www.fcw.com/pubs/fcw/1999/0719/web-intell-7-23-99.html JULY 23, 1999 . . . 15:05 EDT Intelligence bill grants feds new computer security powers BY DANIEL VERTON (dan_verton@fcw.com) The Senate this week voted unanimously to pass the fiscal 2000 Intelligence Authorization Act, which would provide federal law enforcement officials new authority to search government computers belonging to individuals who have access to classified information. The new computer security provision comes in the wake of reports of espionage by China at the nation's nuclear laboratories and was part of a larger effort by the Senate Select Committee on Intelligence to improve government counterintelligence procedures. According to Sen. Richard C. Shelby (R-Ala.), chairman of the Senate Select Committee on Intelligence, the bill requires employees who need access to classified information to sign a waiver allowing law enforcement officials to "access information stored in computers used in the performance of government duties." The provision is aimed specifically at enhancing the FBI's ability to investigate cases of possible espionage sooner rather than later. The thorny issue of granting access to government computers for the purposes of investigating wrongdoing came into the limelight last month when officials at the Defense Threat Reduction Agency allegedly attempted to access the computer belonging to a senior technology trade advisor as he testified before Congress [FCW, July 19, 1999]. "This provision is intended to avoid the problems we have seen with the FBI's reluctance to access 'government' computers without a warrant in the course of an espionage investigation," Shelby said. "There should be no question that investigative agencies may search the computer of an individual with access to classified information." @HWA 29.0 Local Cops Funded by IT Industry ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Arik Pulling from the LA Times article that we linked to on Monday, the UK Register runs a story on how local US Police departments are legally accepting large grants from IT firms in exchange for going after pirates. Companies such as Intel and Hewlett-Packard offer cash and other perks to local law enforcement agencies while they work on cases beneficial to the corporation. Local Police agencies see nothing wrong with this. (Why hire private detectives when you can just hire the local police force.) The UK Register http://www.theregister.co.uk/990727-000017.html Posted 27/07/99 3:57pm by Tim Richardson US police funded by IT giants Hi-tech companies are paying out thousands of dollars to hard-up police departments in the US to help combat computer-related crime. According to a report in the LA Times, Intel regularly slips police departments in Oregon $100,000 a year to help pay the wages of a few law enforcement professionals. It's also more than happy to part with $10,000 to kit out the odd sheriff's department with a wire-tap or two. Then there's Hewlett-Packard which is more than happy to let police officers use its corporate jet if it helps catch a computer villain. Snag is, some people think this is an abuse of the system. They claim these firms are "buying justice" in their bid to crackdown on computer crime which reportedly cost the US $3 billion last year. But one outspoken officer told the LA Times that such allegations were way out of line. "If you're inferring that we're paid off, that's not right," Sgt Michael Tsuchida of the Sacramento County Sheriff's Office told the LA Times. "I'll eat your dinner, sleep in your hotel and still arrest you if you're breaking the law," he said. It's nice to know that the judgement of the boys in blue is not swayed by a few greenbacks. In a way, the hacks at The Register are no different. They swan off on fancy all-expenses-paid press trips, get taken out to swanky restaurants -- and still manage to dish the dirt about their hosts. The Register -- eating the hand that feeds IT. « @HWA 30.0 Two Arrested for Corporate Espionage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by operand Interactive Connections, now known as Screaming Media, has had two former employees arrested on Tuesday on charges they allegedly broke into its computer system and stole secret business plans. If convicted, they face a possible maximum prison term of five years. They allegedly copied various proprietary files and software belonging to Interactive Connections. It is unknown what they then did with the information. Wired http://www.wired.com/news/news/politics/story/20966.html Turkey-Day Crackers Arrested Reuters 2:10 p.m. 27.Jul.99.PDT Two former employees of Interactive Connections, now known as Screaming Media, were arrested on Tuesday on charges they allegedly broke into its computer system and stole secret business plans. Ira Lee, 29, and Zissis Trabaris, 31, who had worked as software developers at the company, were each charged in federal court in Manhattan with one count of unlawful and unauthorized computer intrusion. If convicted, they face a possible maximum prison term of five years. Interactive Connections provides news filtering and distribution services, mostly for Web sites. Its clients include America Online and Sun Microsystems, federal prosecutors said. According to the complaint, the alleged crime occurred after the defendants' employment at Interactive Connections ended and shortly after The Wall Street Journal ran a favorable article about the company. The newspaper reported that the company was backed by James Robinson, former chief executive of American Express Co. The defendants allegedly entered Interactive's computer system from Lee's home computer on 25 November, the night before Thanksgiving. They allegedly stayed on the system for about four hours into Thanksgiving morning and copied various proprietary files and software belonging to Interactive and then transferred the information to various computers that the two men controlled, the complaint charged. Copyright 1999 Reuters Limited. @HWA 31.0 Virus Infestations On the Rise ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by TurTleX Computer virus infection rates have doubled since 1998 and quadrupled since 1997 according to a report released by ICSA. The survey was based on responses from tech departments at 300 U.S. corporations and government agencies. Newsweek http://www.newsweek.com/nw-srv/tnw/today/cs/cs02mo_1.htm ICSA http://www.icsa.net/ -=- Newsweek http://www.newsweek.com/nw-srv/tnw/today/cs/cs02mo_1.htm TUESDAY, July 27, 1999 Stopping the Spread Are computer viruses becoming an epidemic? A recent survey conducted by ICSA.net, a company that provides computer security information to corporations, reports that computer virus infection rates have doubled since 1998 and quadrupled since 1997. Based on responses from tech departments at 300 U.S. corporations and government agencies, the survey also finds a comparable increase in costs. "The cost of having viruses, given the frequency of when you get them and what happens after you get them, is more than doubling every year," Peter Tippett, chairman of ICSA.net, told Newsweek.com. "We can't conclude that anything has happened that will prevent things from becoming twice as bad next year," he adds. One reason for the rise in infections are rates of transmission, which have dramatically increased in the past several years. Between 1980 and 1995 computer viruses were transmitted primarily via floppy disks, usually taking a year or more to become prevalent. By 1995, macro virusesùwhich primarily live in MS Word or Excel documents and spread via file sharingùhad decreased that time to a few months. The most recent generation, dubbed "'Net-enabled" or "communications-enabled" viruses, use the Internet or e-mail to replicate, and can reach epidemic proportions within days. These new viruses could represent the greatest threat thus far. The solution, Tippett says, is to use anti-virus programs and tools correctly. The survey reported that 83 percent of the companies surveyed had anti-virus software on 90 percent of their computers, but often failed to use it properly. For example, 40 percent of those companies used "periodic scanning" on desktopsùscanning for viruses once a day, for example, or every time the system restartsùinstead of enabling anti-virus programs' full-time background scanning functions. Doing the latter, Tippett advises, increases the chance of discovering the virus before it spreads unknowingly to the next victim. Other advice: protect servers, gateways anddesktops, and update anti-virus programs often. ù Laura Fording @HWA 32.0 Granny Hacker from Heck visits Def Con parts 1 to 3 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From AntiOnline http://www.antionline.com/cgi-bin/News?type=antionline&date=07-12-1999&story=CMDC1.news Granny Hacker From Heck Visits Def Con Thursday, July 15, 1999 at 16:29:59 by Carolyn Meinel - Writing For AntiOnline July 1, 1999. A staffer from Loompanics calls to say that the Def Con convention staff has ordered them to not sell my "The Happy Hacker: A Guide to Mostly Harmless Hacking" (http://happyhacker.org/buyhh.html) at their upcoming computer criminal soiree. This means war! How can I best stick it to the Def Con d00dz? Oho, their web site (http://www.defcon.org) is advertising a Bastard Operator from Hell (BOFH) (http://www.rangsoc.demon.co.uk/bofh_last.htm) contest. A true BOFH should run a computer with all sorts of tantalizing services. Build something that looks like an eight year old could break in. Then the attacker runs exploit after exploit against the box. And every attack mysteriously SCREWS UP!!! Muhahaha. By offering a prize for the best victim computer, the Def Con guys hops to get better targets for the hackers playing Capture the Flag. Amarillo, TX, July 6 and 7, I'm out there with Happy Hacker Wargame director Vincent Larsen and wargame admin Jon to put together our BOFH entry: Fangz. Ah, yes, Fangz, an Intel box running Red Hat Linux (at least that's what any port scanner would tell you, snicker). It runs ftp, pop3, smtp, a DNS server, telnet with a guest account with no password, guest access to vi and a C compiler; and a Lithium Quake server with back doors in place. Ahem, every service is working according to the RFCs, but not quite running the way hackers would expect:):) OK, let's get this straight. All I did was provide the hardware and use the Hacker Wargame to test various iterations of Vincent and Jon's Process Based Security (http://www.sage-inc.com) modifications to Red Hat Linux. Red Hat is a hacker's paradise. A clean install of the latest version has over 200 ways to break into it. Vincent and Jon's version of Red Hat, however, would make the BOFH himself proud. That's why I decided against entering a FreeBSD or OpenBSD system. They have pretty good security, too. But they don't TORMENT hackers the way Process Based Security does. At sunrise Friday morning, July 9, I caught a ride on the Happy Hacker Godfather's King Air business jet, along with him and Jon. Also there was this giant Texan on board. I asked him, "You look like a bodyguard. You look like you could pick up someone by the neck and hold him out at arm's length." "I'm an interior decorator. That's my story and I'm sticking with it." Nine AM we are on site at the Alexis Park hotel. We stagger along with Fangz, a monitor, laptop, my favorite Ethernet hub, my crummy backup Ethernet hub, lots of spare 10BASE-T cabling, tools, and duct tape just in case I need to tape anyone to the wall. A Def Con "goon" (security guard) helps us out by taking us to the head of the registration line. Who should be handling, um, exceptional cases such as ourselves but Pete Shipley. As his mouth drops with surprise to see us Happy Hacksters out in force, he fails to flash his copyrighted vampire fangs. Now these are very important, copyrighted vampire fangz, er, I mean, fangs. Shipley's lawyer actually sent several letters to the publisher of my Happy Hacker book claiming that Shipley had gotten a copyright on wearing vampire fangs, so the guy on the cover of my book wearing fangs owed Shipley royalties. Or something like this. Anyhow, the publisher, being a hacker himself (Dr. Mark Ludwig), decided to have a little fun with Shipley. In the second edition he blotted out Shipley's fanged features with a green blob reading "hey man get my face off this cover." Anyhow, I think Mark using Shipley's copyrighted fangs on my book cover is why Shipley can't wear fangs any more. That must be what got Shipley to being such a major enemy of mine. After all, my lady BOFH personality ought to win the adulation of hackers everywhere. LART, LART, who has the LART?;^) (http://www.winternet.com/~eric/sysadmin/lart.1m.html) Shipley swears it isn't because I hacked him at Def Con 3 in front of dozens of witnesses (see Granny Hacker from Heck). Oh, yes, if you are a reporter, contact me and I'll give you phone numbers for two of those witnesses. Well, that fangless Shipley just about ruined my day. What next, would Cult of the Dead Cow's (http://cultdeadcow.com) Deth Vegetable trash can his Mr. T bust and prance on stage in a business suit? We got Fangz set up pretty quickly. All I did was some physical stuff. Meanwhile, Jon changed the gateway, DNS server and IP address himself because there are some interesting twists to Fangz. Then he spent the next few hours waiting for the Capture the Flag/BOFH contest to start by changing a few more things on Fangz, like the process control tables for the "mv" and "cat" commands. Oh, you say you never heard of Red Hat Linux "process control tables"? Muhahaha. Then... Priest pays me a visit. Priest. He's a tall middle aged guy whose trademark is the loud Hawaiian shirts and shorts he wears at every Def Con. At Def Con 5 he won his "I am the Fed" T-shirt by showing off an FBI badge. Of course I believe everything I see. "Carolyn," he gestures to me. He sidles up close and whispers, "I left the agency a few weeks ago. An Internet startup in California offered me a chance to get rich. I have a nondisclosure agreement for you. Interested?" Of course I like to get rich, too. I sincerely believe that Internet startups like to offer FBI agents tons of money. "Sure." Meanwhile the Capture the Flag/BOFH game has finally gotten started. Less than 100 of the 3,600 Def Con attendees have signed up to play the game. What? Less than one hundred? I ask several players. They all say there are perhaps only 200 people at Def Con who actually know how to break into computers. The rest? Feds, narcs, groupies, and fakes. And BOFHs:):) Suddenly people start shouting. I turn to see a man prancing on top of a table next to the Penguin Palace booth. He is naked except for an extremely tiny g-string. It's a good thing his genitals are tiny enough to fit into it. Then he pulls on his jeans and leads a parade of drooling teenagers out of the room. A tiny waisted bleached blonde with braless boobs in a spaghetti string shirt prances over to some Capture the Flag players. Not only is each boob the size of her head, they are powered by antigravity devices. From time to time she pulls up her shirt and sticks her naked boobs into the faces of the players. They keep on shooing her off -- "We're trying to hack, dammit!" (to be continued: groupies get drunk and laid; Feds, narcs and Cult of the Dead Cow urge code kiddies to hack more government Web sites so Congress will boost the Information Warfare budget from $1 billion to $1.4 billion; fangz LARTs hackers; Michael Schiffman beefs up his muscles with a bicycle pump; Shipley remains fangless; Priest attempts an entrapment scheme; and Granny Operator from Heck gets into trouble.) Granny Hacker Visits Defcon - Part 2 Wednesday, July 21, 1999 at 0:49:12 by Carolyn Meinel - Writing For AntiOnline LetÆs see, where was I. Oh, yes, the lady with the giant breasts powered by antigravity machines is trying to distract people playing the Capture the Flag game against the Bastard Operator from Hell contestants. All the BOFHers are unscathed so far. IÆm standing next to my box, every now and then checking to make sure at least a half dozen people have spawned shells in the guest ac count. I want Fangz to get a real workout! And who should sidle over but Priest, the giant guy in the buzz cut sandy hair and loud Hawaiian shirt who says he is ôno longer with the agency.ö Out of the corner of his mouth he mutters to me, ôDis has been committing too many felonies. If Dis doesnÆt watch out, he will go to jail.ö Dis. ThatÆs one of the two or three hundred handles Brian Martin uses, but who knows, lots of other hackers may use it, too. Or maybe Priest just keeps on confusing Dis with Mitnick or someone like that. I mutter right back, ôItÆs not clear to me that Dis is committing any felonies.ö Hoo, boy, now this is getting interesting. First Priest hints that he can make me rich, then he appeals to my presumed desire for revenge. Lots of people assume that since I am Brian MartinÆs number one obsession (as seen at http://attrition.org), that I must hate him. Au contraire! Today is honesty day, no more kidding around. Martin is my public relations man, working overtime year after year to make sure everyone has heard of and buys my book, The Happy Hacker. By publicizing his fictional accounts of how I hacked 303.org and sekurity.org and let us NOT FORGET the New York Times, Martin has persuaded countless teenagers that I am a brilliant evil genius granny. Oh, while we are on the topic of honesty, Priest just emailed me to advise that he just might sue me for the first installment of Granny Hacker from Heck Goes to Def Con. LetÆs see, what are his exact words, ôI have to talk to my lawyer about a lawsuit...I at no time represented my self as an FBI agent nor did I ever display a 'badge' at Defcon 5 to get a Fed t-shirt. Further, at no time did I aproach you with an offer of employment or a commentary on what my orgainzation was doing.ö Hmmm, another man from an alternate universe. I think his alternate universe is at http://www.exo.com, phone them up and they will give you a truly amazing shell account from which you can entertain yourself with the file permissions of the other users. LetÆs see if I have this straight. Priest, a fictional entity who ran Def Con 7, and who has variously claimed to be an FBI agent and involved in a get rich quick Internet startup scheme, is trying to figure out how to sue the Granny Hacker from Heck for a humorous article that has lots of witnesses. If you have any leads on this manÆs true identity, or want to add to reports of who this man has claimed to be from time to time, please contact me at 505-281-9675. ôDonÆt pay attention to the man behind the curtain...ö Now, back to our regularly scheduled programming, Friday July 9. Jon takes a turn guarding Fangz, our Bastard Operator From Hell contestant. I go to the main ballroom to catch the first round of ôSpot the Fed.ö I pass a room out of which rock music booms. There are fog machines, spotlights waving about. I notice more young women than I had ever before seen at a Def Con, mostly beautiful, dancing with hackers in that party room. More gorgeous women lounge in the hallway, awkwardly flirting and beckoning. Are they hoping to marry the next Bill Gates? They certainly donÆt have the look of Las Vegas prostitutes, not even the lady with the antigravity boobs. ThereÆs intelligence in those eyes. I briefly think of Tracy Baldwin, a new FBI agent, who came to Albuquerque for her first assignment out of Quantico. BaldwinÆs young, beautiful, tense like a coiled spring. Some of these women in the hallway remind me of her. Oh, yes, last November I gave Baldwin a hard time when she tried to convince me she might arrest me if I didnÆt take a lie detector test about whether I hacked the New York Times. So now she gets to put up with being in a Granny Hacker story. In the ballroom, Priest is on stage with a microphone. He booms out, ôTo win your æI spotted the FedÆ T-shirt, you have to identify someone who carries a badge and has the power to arrest. Informers donÆt count. You know how you spot an informer, donÆt you? HeÆs someone who was raided and got back out on the street within 24 hours.ö That made me think. A story in Forbes magazine last January had reported that the FBI had raided Brian Martin -- yet had not arrested him. According to an employee of the Internet Service Provider Martin uses (Inficad), not long thereafter ôWe were served a subpoena by the Fed's to perform certain actions on the attrition box co-located at our facility. As we do with all law enforcement matters we complied, and they performed what was required and permitted under the subpoena.ö Many in that room know about MartinÆs FBI raid. Some in that room remember Priest claiming to be a Fed. Why would a Fed, even an ex-Fed (if Priest was telling me the truth) be trying to publicly finger Martin as a supposed informant? All in good fun, IÆm sure. A young man sitting next to me leans over. ôWho is this Priest guy? He seems to be running Def Con.ö I dunno, maybe being a ficticious character is his profession. ### Near midnight I am hovering over a laptop and hear a voice booming, ôYou. WeÆre closing down for the night. Out. Now.ö I look up and see a knot of hackers scurrying for the nearest exit, behind them Priest playing the role of Nazi SS man. He swivels, points with outstretched arm at the next nearest group. ôYou. Out. Now.ö He strides to another group. ôYou. Out. Now.ö I am amazed. ArenÆt hackers supposed to be anti-authoritarian? IsnÆt herding hackers like herding cats? Not here. Oops, IÆm wrong. A departing group breaks up and scatters rather than making it to the exit. Priest catches on within seconds. He points them out one by one: ôI told you, out. Now.ö When he has cleared the room of all but those of use playing the hacker war game, he comes over to us, now relaxed. I gesture at Fangz. ôI donÆt want to leave until everyone else is out of the room. I worry about physical sabotage of my Bastard Operator from Hell entry.ö ôNo problem.ö He lets me be the last non-staff person out. ### Saturday morning. July 10, 1999. IÆm waiting by the pool for the con to reopen. A swarthy fellow speaks. ôCarolyn, IÆm a friend of Zyklon.ö ôCan you tell me just why, when he hacked the White House Web site, he called me a crack whore?ö ôIÆll ask. By the way, I have your Happy Hacker book. Loved it.ö I canÆt resist plugging my book. Buy out the latest printing, folks, and maybe IÆll shut up. Maybe not:) ### The hacking game is in full swing. A dumpy little fellow comes over to me. ôHi, remember I called you on the phone? IÆm a reporter from Rolling Stone. Can you tell me why so many hackers hate you so much? They wonÆt ever tell me why, they just say æCarolyn sucks.Æö ôThey donÆt all hate me, just some noisy ones. Why donÆt you talk to these young people?ö I introduce him to a group of teenage boys who have clustered around me to get hints about my entry in the game: ôFangz.ö Stuff like I tell them to use the pasv command to make its ftp server work. Sorry, Fangz is a little primitive, but the fewer features on its services, the harder it is to hack. Hey, give us credit, itÆs RFC compliant and at least we donÆt force players to use tftp, or cut and paste stuff through a terminal emulation program! The teens crowd around the reporter. ôTell people most hackers are good guys! We donÆt commit crime! We make the Internet a better place!ö they chorus. A tall, thin young man in skinhead garb and haircut walks up and hands me a flyer. It is about the new Web site, ôNetcriminals.org.ö It has a fake dossier on me, along with fake dossiers for several other people. Skinhead asks, ôDo you know who I am?ö I shake my head. He gives a tight grin. ôNetmask.ö Netmask. It is the first time we have met in real life, yet over the years he has occasionally sent me demented, obscene, yet humorous emails. Some people might say he must be my kind of guy, but ask my fellow choir memebers at St. Luke, IÆm just a sweet old lady. Anyhow, Netmask and I had spoken once on the phone, or perhaps I should say, had spoken once that he had admitted to being Netmask. His erotic fantasies remind me of the man, or group, that has done major damage to almost every Internet Service Provider I had ever used: GALF. NetmaskÆs Web site -- 303.org -- features pictures of his 303 gang mowing down aspen trees with machine guns, dancing around a table covered with exotic guns, firebombing a car, and at one time it included instructions that presumably were meant as a humorous parody on instructions on how to molest children (under cocksoldier.com, hosted on the same box). They live near the Columbine school district near Denver. Netmask runs the kind of gang that could make reporters go nuts for a chance to interview him. I can see the headline, ôGoth gun and bomb nut hackers run rampant in Columbine school district.ö But I will resist the temptation to write lurid stuff about them, just check out http://www.303.org for yourself, if it is still up. Just before Def Con, Netmask had emailed me, ôYou up for a little hacker death match with me on friday? (at con)ö I replied, ôSure on death match, if you'll talk with me afterward. My aim might be off, I'm used to beating up outlaw horses with well-aimed kicks, the half ton class opponent is kinda exhilarating. Haven't sparred with a human in a long time. Dunno why humans are afraid of me :):)ö I was just kidding, I swear! I just give wild horses ôlove tapsö when they attack me, is all. Hacker Death Match. That consists of putting on bulky foam rubber ôsumo suitsö and trying to knock each other down or out of the ring. Netmask had emailed back, ôIm gonna pass on this actually.... Keeps me out of the media.. and keeps you less in the media..ö Just now I am wearing karate shoes. ItÆs my Deadly Granny outfit. Make muggers quake in their boots when they see me. Netmask is staring at them. The karate shoes, I mean. His martial art is kick boxing. He looks up. We stare at each other awhile. Then I lean forward within six inches of his face and whisper, ôThe reason I respect you, is you arenÆt a crybaby like the others.ö He ducks and rushes off. ### Two PM. I had gotten press credentials earlier that day from an elderly oriental man so I could get into the front row with a tape recorder to cover the Cult of the Dead Cow. They are about to introduce their new program to enable people to break into computers: Back Orifice 2000. Priest gets up on stage to announce their imminent arrival. A voice shouts out, ôThere have been a lot of naked people here. IsnÆt that against the law?ö Priest laughs. ôThis is Las Vegas.ö Another voice shouts, ôWhat happens to the people who are running around naked?ö Priest points at him. ôThey get laid!ö The audience roars with laughter. Priest continues, ôWe have a treat for you tonight, live rock music.ö Priest leaves the stage to cheers. The lights dim, then go out. From big speakers on stage come sounds of a storm, mooing of cows and an adult voice ordering a kid over and over again to put the cows in the barn. The mooing gradually grows ominous, then ridiculously loud. Rock music breaks out as two spotlights shine on each side of the stage. They project the logo of the Cult of the Dead Cow -- a cow skull in black against a white cross. The logos rotate. In the center of the stage a video projects themes of cattle interspersed with intimidating images from Nazi and Maoist social realistic art. Then, to cheers, the Cult of the Dead Cow gang enters from right stage, hurling glowing disks out to the audience. Nineteen of the twenty cult members prance, slouch and/or stagger up on stage. In front of them, their master of ceremonies leaps about in a ratty white fur coat, synthetic fur chaps, a belt made of handcuffs, doing a sick parody of a Pentecostal preacher, grabbing his crotch, making obscene jokes, and leading the audience in chants of (him)ôDead!ö (audience) ôCow! (him) ôKiss! (audience) ôAss!ö The rising lights reveal a parody of church vestments, banners with a Christian cross with the dead cow symbol in the center hanging on each side of the stage. He raises both hands over his head, palms toward the audience. ôEvery eight year old can hack shit! Hacking to save the world! Just donÆt get fucking busted! And use a fucking spell checker!ö Long cheering and laughter come from the crowd. ôAnd now, the man who wrote Back Orifice 2000 -- Dildog!ö Dildog describes the features as if it is merely a ôremote administration toolö as he calls it, raising snickers from the crowd. He uses LCD projectors from both a ôclientö (attacker) and ôserverö (victim) computer to show how BO2000 hides itself. When he shows the option to disable the victim mouse and keyboard and allow the attackerÆs mouse and keyboard to control the victim, the crowd cheers. They end the show with a man in red lace tights, shorts and red pasties held on with duct tape (who looks like a near terminal AIDS victim) shimmying across the stage while Deth Vegetable -- a gigantic sumo-style man in shorts -- smashes computers and a monitor with an electric guitar, the Master of Ceremonies waving his hands and screaming as he fires roman candles from a tube he clenches with his thighs against his crotch. Afterwards I go back to the press room to check for schedule changes. Somehow I have the premonition that Brian MartinÆs talk ôfakes walk among usö may be rescheduled. David Akin of the Canadian publication ôNational Postö approaches me as I am leaving and asks ôWhy do so many hackers hate you? They wonÆt tell me anything specific. Basically they just say æCarolyn sucks.Æö Just then a disheveled man in an Attrition.org black T-shirt strides up yelling, ôGet out of here. Only press are allowed here.ö ôI have a press pass.ö I show it to him. ôYou arenÆt a legitimate reporter! Get out of here.ö ôHow many FUCKing hundreds of magazine articles do I have to write before you admit I am a reporter?ö Oops, I said a bad word. IÆm mortified. ôWeÆll consider you a reporter when you write real information!ö ôReal information! Your Attrition.org site is full of libel!ö Just then the woman in charge of the press room, followed by several reporters, comes out and yells at me, ôThe conference staff says you are not a reporter. Give back your press pass. Now.ö Akin turns to them, ôYou canÆt do this! You canÆt pull a reporterÆs credentials just because you donÆt like what he or she writes!ö Somehow Priest materializes. ôCome with me, I have some information for you.ö We go into a deserted room. Chairs are stacked high. I canÆt believe I am actually thinking this, but the first thing that comes to mind is that this will make a great scene for the ôGranny Hacker Sticks it to the FBIö movie. Priest breaks the spell. ôThe press room incident. It never happened.ö ôWhat?ö ôWe are explaining it to the reporters. They understand it was no big deal. You will never speak of this incident again.ö ôNo way.ö Puzzlement flashes across his face. He must be realizing that his nondisclosure agreement ploy has failed. ôIf you talk to a reporter about this, I will throw you out of the con. You *will* tell them it never happened.ö ôOne problem. I donÆt lie.ö I begin to tremble. ôI ... have ... my ... integrity.ö Priest rubs his chin. I glare at him. He takes a deep breath. Time for a different ploy. ôYou donÆt have to worry about Attrition.org. We have discredited them with the media. Brian Martin is on his way out.ö I look at him, head tilted, puzzled. ôA few months ago Brian Martin tried to get me fired.ö ôUh, huh.ö ôWe were talking on Internet Relay Chat. On condition of confidentiality. He sent a transcript of the conversation to my boss. Got me in major trouble.ö ôAll he did was violate confidentiality? Sheesh, he didnÆt alter the transcript?ö ôHe altered the transcript. Fortunately I had my version burned into a CD-ROM. Also, two others had eavesdropped on our chat and burned their transcripts to CD-ROM, too. Ours all agreed.ö I nodded. Yeah, right. How come there are always so many fantastic stories revolving around Brian Martin and Attrition.org? We ought to nominate attrition.org for a Hugo award at the next World Science Fiction Convention. Or is Priest the one who deserves the Hugo? Priest continues. ôI want Martin behind bars. You know he was busted for the New York Times hack. Then immediately released. HeÆs now an unpaid informant.ö I let out a long breath. If Priest is telling the truth -- a BIG assumption -- Martin is now too valuable for the agency to expend. ôIÆve heard that Martin is ops (moderator) on three Global Hell IRC channels. So was he the one who got Zyklon busted for the White House hack?ö Priest shrugs. ôIs he informing on Global Hell?ö He throws up his hands. ôWe have so much on our plates we canÆt even pay attention to Global Hell.ö ôBut they claim to be the ones hacking so many of those government Web sites.ö ôYou have no idea of what we are contending with.ö Internet startup. Get rich. Yeah, right, I hate it when people forget to stick to their stories. I reply, ôI have a problem with your informant. I had to shut down our Happy Hacker IRC server when Martin got on it. It is my opinion that he may have been encouraging kids to commit crime. I am not operating a breeding ground for crime. IÆm not going to bring Happy Hacker IRC back up until I get a more reliable group of moderators.ö ôContributing to the delinquency of minors is a crime. Bring your IRC server back up and we can get Martin behind bars.ö ôHow?ö ôYour network is located in Texas. Under Texas state law, even though Martin and any kid he involves in crime are both out of state, if discussions about committing a crime happened on a computer within Texas, thatÆs conspiracy. TheyÆll extradite both parties.ö ôI canÆt do that. I will not expend some teenager to put Martin behind bars. I will not bring up our IRC server until I can make sure we can keep the criminals off.ö And, I thought, not until we can keep FBI agent provocateurs out. ôSo, am I going to have to kick you out of the conference?ö ôMy publisher would be overjoyed. Great publicity. Believe it or not, two independent groups have approached me about doing a movie. Getting kicked out would be a GREAT dramatic device.ö Oh, man, I can almost taste the Granny Hacker from Heck movie! ôBut what do you want?ö ôI want to stay. I want to see if Fangz can win the Bastard Operator from Hell contest. But even if it does, I presume the conference organizers will come up with an excuse to deny us the prize.ö ôYes, but at least you will know you won.ö When I return to the game, I see someone at the console of Fangz. ôExcuse me, thatÆs my computer. The rules say you have to hack it remotely, not from console.ö ôI was just checking to see whether it was broken.ö He goes back to messing with the console of the computer next to Fangz, his entry in the Bastard Operator from Hell contest. A fat man with disheveled black hair and ragged beard and sloppy clothes joins him. The disheveled man slides a CD-ROM into the drive. They are violating the rules by changing their operating system. Again. A little later I see Priest walking by. I run over and hail him. ôExcuse me, what is your real name?ö He pauses in mid stride, looking so off balance I wonder if he might fall. His mouth flaps open and shut. Finally he sputters, ôYou must be kidding.ö ôI thought it was worth a try.ö He falls back into his fast stride and disappears into the crowd. Poor Priest, he doesnÆt realize yet that he has just persuaded an investigative reporter, yes, the Granny Reporter from Heck, to learn everything she can about him, stuff like his .bash_history (real hackers use tcsh) and maybe even his real name. ### To be continued: JonÆs lightning reflexes keep Joltcan.c exploit from DOSing Fangz; Michael Schiffman beefs up his muscles with a bicycle pump; fat guy who keeps on changing the operating system for his BOFH entry howls with rage about how mean and nasty Fangz is when people try to break in (recorded in real-audio, to be available from this web site); Granny Hacker from Heck gets into trouble, but a giant Texan interior decorator rescues her. Granny Hacker Visits Def Con - Part 3 Thursday, July 22, 1999 at 0:01:12 by Carolyn Meinel - Writing For AntiOnline Saturday, July 10, 1999. After dinner, I return to take a turn guarding Fangz. Jon points to a stain on the linen covering the table where Fangz sits. ôSomeone tried to kill it by pouring a can of Jolt at the keyboard. Also, the power has been turned off four times since you left. They are getting ugly.ö He laughs. ôI let someone reboot into single user mode as root. He changed the root password to æcrackwhore.Æ He was pissed when he rebooted and couldnÆt get into root over the network.ö Oh, yes, I knew what that was all about. He had set it up so root from console couldnÆt write to the password file. We both snicker. Then I grow sober thinking of the hazards of people frequently turning off our power. The operating system we use can sometimes be destroyed if the power goes off while a file is being written to the disk. Kernel panic! Some hackers gather around me talking about the latest Web site hacks. They say the Defcon.org site is down because someone defaced it with parodies of the Antionline and Happy Hacker web sites. I didnÆt do it! Honest! Um, John, what about you? They have an even better story about why MartinÆs Attrition.org site is down for Def Con. Somehow the title of the index.html page changed to ôTemple of Hate.ö ThatÆs what AntionlineÆs John Vranesevich and I like to call it. Then, mysteriously, just after it sprouted the ôTemple of Hateö slogan, Attrition.org went down. (Later Martin explained that his webmaster had changed the name on purpose, that it wasnÆt hacked, honest! And, just by coincidence, a hard drive failed right after the ôTemple of Hateö headline went up. Just by coincidence, as soon as they got Attrition.org up again, they decided to change the headline to ôWe are the people our parents warned us about.ö I didnÆt do it! I swear! Repeat after me, ôHacking Web sites is childish.ö Besides, why would I hack my own publicist?) At fifteen minutes before 10 PM, Priest comes in to shut down the room. ôYou. Out. Now.ö Hackers meekly file to the doors. I go to my hotel room at the Hard Rock hotel across the street, and change into a short red velvet dress and black tights. This is for the formal ôBlack and Whiteö ball, then sashay back to the Alexis hotel. IÆm glamorous granny now, honest! In the lobby, two of the Trumpbour brothers greet me. They thank me for bringing our Happy Hacker Wargame team and some computers to their Summercon hacker gathering a month previously. ôDef Con has a bad atmosphere. We like to keep our con pleasant.ö I thank them for keeping alive the ideal of true hacking. Folks, if you go to just one hacker con next year, try Summer Con. It's run by real hackers, people who use their real names, not a bunch of fictitious characters such as Priest. Speak of the devil, Priest walks by just now dressed like a priest. I flash him my winningest smile, but he acts like he doesnÆt see me. I begin walking through the lobby toward the Def Con ballroom. A voice behind me yells, ôCarolyn! Why did you tell the FBI that I hacked the New York Times?ö I turn and see a man so muscular that he looks like a bicycle pump has inflated him. By contrast, his narrow head sits on a skinny neck. He is wearing a tank top that shows off his tattoos. His muscles quiver with what I suspect might be rage. Behind and beside him is a crowd of kids that look like they average fourteen years of age. They goggle at us like spectators at a bull fight. I scan the group. I donÆt recognize any of them. ôExcuse me, but I donÆt believe we have met.ö Mr. Steroids says, ôWe have met. Several times. Think.ö I scratch my head, rub my chin. I simply canÆt think of having ever met anyone who gives the impression of being seriously pumped on steroids. I study his face. Steroids shouldnÆt change that too much. Still doesnÆt ring a bell. ôGive me a hint.ö ôYou know me. You told the FBI I hacked the New York Times.ö I wonder if the FBI had tried to force him to become an informant. Did some agents do to him exactly what they did to me, claiming to have evidence that they really didnÆt have? When they came after me for supposedly hacking the New York Times, I had told them to, um ôfwordö themselves. Seriously, I am against computer crime and am happy to help the FBI catch criminals. But I refuse to be an undercover informant and I oppose the use of undercover informants. OK, time for major soapbox speech here. IMNSHO, our taxpayer money should not fund the FBI to run around encouraging computer crime all in the name of some undercover operation. But, then, maybe IÆm just paranoid. Maybe the FBI doesn't run Def Con. Maybe it is mere coincidence that Jeff Moss, who bills himself as the man who owns the Def Con conferences, is a full-time employee of Secure Computing, Inc. To be exact, the registration for Defcon.org reads: DEF CON (DEFCON-DOM) 2709 E. Madison Seattle, WA 98112 Domain Name: DEFCON.ORG Administrative Contact, Technical Contact, Zone Contact: Moss, Jeff (JM27) jm@DEFCON.ORG 206-626-2526 (FAX) 206-453-9567 Billing Contact: Moss, Jeff (JM27) jm@DEFCON.ORG 206-626-2526 (FAX) 206-453-9567 Maybe it is coincidence that the Secure Computing web site claims that it ôis the market share leader in providing network perimeter security to the U.S. Federal government.ö (http://www.securecomputing.com/C_Bg_Hist_FRS.html) Maybe the whole Priest thing is just a guy having mostly harmless Vogon fun by being a fictitious FBI agent. IÆm wondering if the FBI really had told Mr. Steroids I had provided evidence against him. Is this how their Quantico academy teaches FBI agents to nullify recalcitrant reporters? Run around questioning, raiding and arresting people and telling them I provided the evidence? For once IÆm dead serious here. Besides Mr. Steroids, Pete Shipley and his dis.org gangmates Ph0n-E and Cyber say the FBI has questioned them at length about allegations the FBI claimed I had made against them. Do you know what it feels like to have weird looking guys trembling with anger accusing me of getting them in trouble with the FBI? But then again, maybe the FBI isnÆt doing anything of the sort and all these guys are just making up these stories. Anyhow, youÆre tired of my rant, so letÆs get back to the story. Serious mode off. Humor mode on. Steroids reaches into his jeans pocket and pulls out a battered wallet. ôOK, IÆll give you a hint. Look at this.ö He shows me his driverÆs license, trembling in his hand. It says ôMichael Schiffman.ö His buddies draw closer, menacing. Er, as menacing as a gaggle of 13 through 15 year olds can get. Darn, IÆm not wearing my karate shoes. They are staring at my 38 D bosom instead. I put on my best politician smile. ôMichael Schiffman, nice to meet you!ö Now I know who he is, a man better known as ôRouteö or ôDaemon9.ö He got mad at me long ago when I told my Happy Hacker mailing list that I opposed his hacker ezine, ôPhrack.ö In my opinion, he encourages people to commit senseless digital vandalism. ôWhy did you tell the FBI that Modify and I hacked the New York Times?ö I thought fast. I could remember telling the FBIÆs Tracy Baldwin that it was my opinion that there was only a 2% chance that Michael Schiffman could have been part of Hacking for Girliez. I had thought that was my way of debunking the idea he was involved. I figure it wonÆt do any good to tell him about the 2% bit, heÆs too mad to grasp nuances just now. I reply, ôThe FBI told me that *I* hacked the New York Times.ö Schiffman puffs out a breath. He looks like an impatient school teacher waiting for a slow student to get the right answer. OK, a psychotic teacher with steroid poisoning. HeÆs shaking. ôWhy did you tell them we did it?ö ôModify hack the New York Times? Now thatÆs ridiculous. Why would I say that to the FBI? He couldnÆt hack his way out of a paper bag.ö Schiffman and company begin shouting, ôModify can so hack,ö ôCrack whore,ö and other brilliant intellectual observations. I brilliantly retort, ôI donÆt have to listen to this.ö Would they jump me? Was I about to be mobbed by children while not wearing karate shoes? I figure I am safer acting like they could not be any threat than by taking a martial arts defensive stance. I turn on my heel and walk away.. I enter the main ballroom at midnight -- time for Hacker Jeopardy to start. This is a takeoff on the TV quiz show, ôJeopardy.ö To get to the empty seats on the far side of the ballroom, I walk around the back. In the middle of the back row I see a familiar face: Modify and three others are standing on their chairs. Are they trying to be noticed? As I pass them, Modify hands me a business card reading ôAttrition.org -- We donÆt play well with others.ö Oh, yes, isnÆt that a line from the movie ôHackersö? Does this mean they are trying to get a movie deal, too, something like ôHow Attrition.org Stuck it to Priest (whoever the heck he is)ö? The guy standing on the chair next to Modify hisses at me, ôYouÆd better watch out.ö I stop to look over the guy who hissed at me. Yes, it must be Brian Martin. It has to be. He is standing next to Modify, his bosom buddy. But Martin, once buff, showing off his muscles with a tight T-shirt at previous Def Cons, has wasted away. HeÆs downright skinny now. Some two inches of his hairline has balded. The man is only 25 or 26, I think. Are those wrinkles on that sagging, emaciated face? Is that a stoop to his shoulders? The pressure of being my publicist, dealing with that non-hack of his attrition.org web site, and PriestÆs attempts to brand him a narc and discredit him with journalists must be wearing him down. Priest tromps up on stage. ôIs there anyone who needs to do anything before the game starts?ö A transvestite prances up to Priest, clad in a tiny sheath evening dress. Someone throws the girlie a condom. S/He lifts his/her skirt to reveal a red sequined jock strap that appears to be rather full, and inserts the condom in it. S/He wriggles off stage, a pied piper leading a gaggle of boys out of the ballroom. ### Sunday morning some dazed-looking guys are lounging by the pool. One is the fellow who is managing the entry in the Bastard Operator from Hell contest that sits to the right of Fangz. I walk over and give him a cheery hello. He and his comrades start howling, ôYour computer is stupid. ItÆs broken. It sucks.ö I ask, ôWhy?ö ôBecause itÆs yours.ö ôBecause the C compiler is broken.ö I say, ôOther people have compiled programs on it. Why canÆt you?ö ôBecause they fixed the compiler.ö I say, ôThatÆs called hacking.ö ### Later that morning, there is great cheering as the Ghetto Hackers break into one computer, then another, then get ôhalf a hackö on a third. At 1 PM the game is called to a close. Ghetto Hackers have won the ôCapture the Flagö part of the contest. Of the remaining nine computers, the winner in the Bastard Operator from Hell is, in theory, to be awarded to whomever had been running the most services. That, I hope, means Fangz. I notice a crowd gathering. Priest is there. I ask him, ôIs it OK to take down our equipment now?ö He nods. Jon and I began taking the system apart, unplugging the Ethernet hub, power, etc. A kid from the Penguin Palace booth comes over and begins interviewing me on tape. ôCarolyn, your box finished the game without being rooted. Does this mean youÆre elite?ö ôNo, it just means Fangz didnÆt get rooted.ö The fat, disheveled guy with the box next to Fangz begins shouting, ôYou didnÆt get rooted because the hackers here are no good. They didnÆt root my box and it had plenty of holes.ö I reply, ôYou mean the Ghetto Hackers are no good? ThatÆs not a fair comparison, you kept on changing your operating system from console.ö ôI cheated? I had FreeBSD on it for twelve hours! People did so have plenty of time to try to break in!ö ôAre you saying the Ghetto Hackers are no good?ö He rubs his chin, thinking this one over. As I watch him, I suddenly realize who he is. Bluto, from the Popeye cartoons. Aha, I have pierced yet another hacker identity. Finally Bluto looks me in the eye and yells, ôYou cheated! Your box broke the rules! You have to be able to remotely administer it! ThatÆs the rules of the game!ö I look bewildered. ôWait, I distinctly heard them say you are *allowed* to administer it remotely, and forbidden to administer it from the console. They didnÆt say we were *required* to do remote administration.ö I realize a crowd has gathered. Shipley is among them. Bad sign. A skyscraper of a man looms to my right. ItÆs the giant Texan interior decorator. He holds a keyboard menacingly in his right hand, staring down Bluto. Good sign. Bluto yells again, ôCan you remotely administer this box? Answer me now!ö ôWell, um, er, it doesnÆt have secure shell, we have to telnet in to do anything.ö IÆm embarrassed. ôProve it! Create an account now!ö ôBut we just took the system down...ö ôProve it! Prove it!ö Priest looms behind Bluto. HeÆs staring into my eyes. ôThatÆs it, Carolyn. We just used up our last chit at this hotel. Last night some fucking idiot tried to steal their golf cart. One more incident and they close down the con. You. Out. Now.ö I can hardly hear Priest for the shouting of Bluto, who is leaning awfully close and waving his arms. I make out strangled sounds like ônon RFC services ... broken C libraries...ö The Penguin Palace kid is still tape recording. The giant Texan interior decorator is still leaning over the table wielding FangzÆ keyboard like a weapon, in the face of Bluto. I hear a voice shouting, ôItÆs not fair, she isnÆt causing the disruption.ö Priest hisses at the kid with the recorder, ôIf you publish it, IÆll sue you.ö Then he stares at me. ôYou. Out. Now.ö I get this sinking feeling. ôDoes this mean otherwise you will strap us into chairs to listen to your Vogon poetry?ö A guy in a Def Con Goon shirt hisses, ôResistance is futile.ö PriestÆs eyes glaze over as he recites, ôOr I will rend thee in the #dc-stuff channel, see if I donÆt!ö My mind comes up with a ôdonÆt panicö scenario. ôActually I quite like your poetry.ö PriestÆs mouth flaps open and shut. ôYou do? Tell me more.ö ôEr, ... interesting rhythmic devices...ö The giant Texan interior decorator springs to my defense. ôCounterpoints ... the surrealism of the underlying metaphor...ö A dreamy smile softens the lumpy surface of PriestÆs face. ôSo what youÆre saying is I write poetry because underneath my mean callous heartless exterior I really just want to be loved?ö ôYes, yes!ö the giant Texan interior decorator and I urge him. ôNo, well, youÆre both completely wrong, I just write poetry to throw my mean callous heartless exterior into sharp relief. You. Out. Now.ö As we exit the hotel, walking by the pool, Priest trots up and tries to draw me aside. ôWe need to speak privately.ö I think for a minute. Maybe he has reconsidered. Maybe he just wants me to sign that nondisclosure agreement after all and make me rich. Or could it be, shudder, more Vogon poetry? I gesture at Jon and the giant Texan interior decorator. ôWe can speak with them here.ö ôNo, this is private.ö ôThen we canÆt talk.ö Jon, the giant Texan interior decorator and I pile into our rental car which the Happy Hacker Godfather has managed to materialize. Shipley is leaning into the window to snap one last picture of me. His lips part in a snarl. No fangs. I flash him a smile. Postscript: Just as I had anticipated, Priest rescheduled Brian MartinÆs ôFakes Walk Among USö talk. To be exact, he rescheduled it to dev/null (ôdevice nullö for you non-Unix wizards). Martin refused to take the affront passively. He gathered a handful of people by the pool side to recount his stories about AntionlineÆs John Vranesevich and me. He may win this yearÆs Hugo yet. Want to find out why fictitious characters variously claiming to be with the FBI or a hot Internet startup recite Vogon poetry at me? See http://happyhacker.org for our ômostly harmlessö instructions on how to break into computers. Happy hacking, and watch out for us grannies from heck! Oh, I almost forgot. Buy my book, The Happy Hacker: A Guide to Mostly Harmless Computer Hacking. Resistance is futile. Granny Hacker vs. "Bluto" via RealAudio: The Granny Hacker From Heck and "Bluto" go head to head by the pool: http://www.antionline.com/RealMedia/CarolynvsBluto.ram Granny Hacker From Heck Book Plug: Does your local bookstore say they have to special order The Happy Hacker? You don't want to wait several weeks to get it through Amazon.com? You can get the book fast for only $35. For US customers, this will include Priority 2nd day delivery. Send your check of money order for $34.95 (this includes shipping and handling) made out to Happy Hacker, 4 Fawn Rd., Cedar Crest NM 87008. @HWA 33.0 FidNet Causing Massive Confusion ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Space Rogue There seems to be a lot of confusion around this new plan, proposal, draft or whatever it is regarding FidNet. This new Federal Intrusion Detection Network is designed to protect the nation's infrastructure from cyber attack. HNN has only been able to find parts of the document and have not read all 170 pages of it but from what we have found this network would actually be run by the GSA and not the FBI, it would only monitor government owned systems, and there is a provision for privacy concerns. This document is not finalized nor has it been officially released, until then this plan needs to be closely watched. (At least the government is doing something other than executing stupid search warrants.) Center For Democracy & Technology - Contains Transcripts of Parts of the Report http://www.cdt.org/policy/terrorism/fidnet/ ZD Net http://www.zdnet.com/zdnn/stories/news/0,4586,2304083,00.html MSNBC http://www.msnbc.com/news/294532.asp ZDNet; -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- U.S. backs off private monitoring By Maria Seminerio and Margaret Kane, ZDNN July 28, 1999 2:26 PM PT URL: With criticism rolling in from all quarters, U.S. government officials on Wednesday backed away from a controversial plan to monitor private-sector networks for hacking activity. The proposed Federal Intrusion Detection Network (FIDNET) plan, details of which were revealed by the New York Times Wednesday, has been in the works for at least a year, a National Security Council spokesman told ZDNN. The proposal for the government to monitor critical systems for security breaches arose out of concerns about the growing vulnerability of government computer networks and sensitive private-sector networks to hackers, the spokesman said. (The NSC advises the president on national security issues.) But in spite of indications in a government document on the plan obtained by the Center for Democracy and Technology -- which indicates that private networks would also be watched -- the NSC spokesman denied that there is any plan for the surveillance of private online data. The document outlining details of the plan says the FIDNET monitoring system would cover "critical government and ultimately private-sector information." Information gathered about network security breaches within one of the plan's three "pillars" -- the Department of Defense computer network, other federal networks and private sector networks -- "would also be shared with the other two pillars," according to the document. The document coalesces with comments made by Jeffrey Hunker, senior director for critical infrastructure at the National Security Council, at the Black Hat Security Conference in Las Vegas earlier this month. "We depend on systems that were never meant to protect data from an organized threat," he told ZDNN. "The truth of the matter is that you all [the industry] own the systems that are going to be the target. It is not the federal government systems." However, in an interview with ZDNN, Jim Dempsey, senior staff counsel at CDT, said: "We feel the government should spend its resources closing the security holes that exist, rather than to watch people trying to break in," Jim Dempsey, senior staff counsel at CDT, said in an interview. In spite of assurances from government officials that any monitoring would be largely automated, somewhere down the line a person would have to step into the process, Dempsey said -- and this is where such a system could be abused. The government document detailing the plan acknowledges that "trained, experienced analysts" will have to step in to determine the nature of any suspected security breaches. Looking for 'anomalous activities' But the NSC spokesman said the government does not plan to monitor private networks or read e-mail messages, but rather to "look for anomalous activities" such as evidence of denial of service attacks on military and other government networks. This was little comfort to civil libertarians and other high-tech industry watchers, who blasted the plan as an Orwellian attack on privacy. "I think this is a very frightening proposal," said Barry Steinhardt, associate director of the American Civil Liberties Union, in an interview. "The FBI has abused its power in the past to spy on political dissenters. This type of system is ripe for abuse," Steinhardt said. "I think the threats (of network vulnerability) are completely overblown," said David Sobel, general counsel at the Electronic Privacy Information Center, in an interview. The perceived security threat is leading to "a Cold War mentality" that threatens ordinary citizens' privacy, Sobel said. "The most serious concern about this is that it could move us closer to a surveillance society," said Ed Black, president of the Computer and Communications Industry Association, in an interview. "It's critical that if they do this, they should not retain any of the information that is gathered." ZDNN's Robert Lemos contributed to this report. -=- MSNBC U.S. backs off private monitoring Under attack for its æCold War mentality,Æ the U.S. denies it plans to monitor private networks By Maria Seminerio and Margaret Kane ZDNN July 28 ù With criticism rolling in from all quarters, U.S. government officials on Wednesday backed away from a controversial plan to monitor private-sector networks for hacking activity THE PROPOSED FEDERAL INTRUSION Detection Network (FIDNET) plan has been in the works for at least a year, a National Security Council spokesman told ZDNN. The proposal for the government to monitor critical systems for security breaches arose out of concerns about the growing vulnerability of government computer networks and sensitive private-sector networks to hackers, the spokesman said. (The NSC advises the president on national security issues.) But in spite of indications in a government document on the plan obtained by the Center for Democracy and Technology ù which indicates that private networks would also be watched ù the NSC spokesman denied that there is any plan for the surveillance of private online data. The document outlining details of the plan says the FIDNET monitoring system would cover ôcritical government and ultimately private-sector information.ö Information gathered about network security breaches within one of the planÆs three ôpillarsö ù the Department of Defense computer network, other federal networks and private sector networks ù ôwould also be shared with the other two pillars,ö according to the document. ôWe feel the government should spend its resources closing the security holes that exist, rather than to watch people trying to break in,ö Jim Dempsey, senior staff counsel at CDT, said in an interview. In spite of assurances from government officials that any monitoring would be largely automated, somewhere down the line a person would have to step into the process, Dempsey said ù and this is where such a system could be abused. The government document detailing the plan acknowledges that ôtrained, experienced analystsö will have to step in to determine the nature of any suspected security breaches. But the NSC spokesman said the government does not plan to monitor private networks or read e-mail messages, but rather to ôlook for anomalous activitiesö such as evidence of denial of service attacks on military and other government networks. This was little comfort to civil libertarians and other high-tech industry watchers, who blasted the plan as an Orwellian attack on privacy. ôI think this is a very frightening proposal,ö said Barry Steinhardt, associate director of the American Civil Liberties Union, in an interview. ôThe FBI has abused its power in the past to spy on political dissenters. This type of system is ripe for abuse,ö Steinhardt said. ôI think the threats (of network vulnerability) are completely overblown,ö said David Sobel, general counsel at the Electronic Privacy Information Center, in an interview. The perceived security threat is leading to ôa Cold War mentalityö that threatens ordinary citizensÆ privacy, Sobel said. ôThe most serious concern about this is that it could move us closer to a surveillance society,ö said Ed Black, president of the Computer and Communications Industry Association, in an interview. ôItÆs critical that if they do this, they should not retain any of the information that is gathered.ö @HWA 34.0 Lawmakers Want Drug Info Off the Net ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by St0n3r First it was bomb making information; now it is drug making information. The dominoes are falling. Sen. Orrin Hatch, R-Utah, is sponsoring a large anti-methamphetamine bill, one section of which may ban this type of information from the Internet. Nando Times Better grab the information now while you still can. Textfiles.com - via Attrition.org http://www.attrition.org/~modify/texts/mirrors/textfiles.com/drugs/ Secrets of Methamphetamine Manufacture; Including Recipes for Mda, Ecstacy, and Other Psychedelic Amphetamines - Via Amazon.com http://www.amazon.com/exec/obidos/ASIN/1559501448/thehackernewsnet The Construction and Operation of Clandestine Drug Laboratories - via Amazon.com http://www.amazon.com/exec/obidos/ASIN/1559501081 @HWA 35.0 Reno Wants Inet Crypto Banned ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Arik Janet Reno, Attorney General for the United States, has called for an outright ban on the distribution of cryptography on the internet. She made statements to this effect in a letter she sent last May to German Federal Secretary of Justice Herta Daeubler-Gmelin. The attorney general's comments take her recent congressional testimony against the Security and Freedom through Encryption (SAFE) Act, H.R. 850, one step farther. Telepolis- German http://www.heise.de/tp/deutsch/inhalt/te/5117/1.html Newsbytes http://www.newsbytes.com/pubNews/99/134030.html JYA.com http://jya.com/reno-ban.htm Newsbytes; Reno Calls For Ban Of Encryption Products On The Net By Staff, Newsbytes WASHINGTON, DC, U.S.A., 28 Jul 1999, 5:16 PM CST Attorney General Janet Reno, long-known for her opposition to the export of strong encryption products, has called for an outright ban of the distribution of such software via the Internet, according to a German publication. The German magazine Telepolis printed what it said was a letter Reno sent last May to German Federal Secretary of Justice Herta Daeubler- Gmelin. The letter calls for the addressing of "risks posed by electronic distribution of encryption software." "Although the Wassenaar Nations have now reached agreement to control the distribution of mass market encryption software of certain cryptographic strength," Reno wrote, "some Wassenaar Nations continue not to control encryption software that is distributed over the Internet, either because the software is in the `public domain' or because those nations do not control distribution of intangible items." "While I recognize that this issue is controversial, unless we address this situation, use of the Internet to distribute encryption products will render Wassenaar's controls immaterial," Reno concluded in the letter. The 1996 Wassenaar Arrangement restricts the export of high-tech equipment that can be used for military purposes to countries of proliferation concern, like Iran, Iraq and Libya. Reno's letter came as a "thank you" to Daeubler-Gmelin's and Germany's efforts to "achieve a fair resolution on encryption products" at a Wassenaar plenary session last December. (Note: Translation of the letter provided by NY Architects, http://jya.com ) Reno's proposal, if enacted eventually, would mean the end of Internet-enabled distribution of all software products using encryption, including highly popular Web browsers from companies like America Online's Netscape and Microsoft. Any communications products using encryption would also be banned from Internet distribution. The attorney general's comments take her recent congressional testimony against the Security and Freedom through Encryption (SAFE) Act, H.R. 850, one step farther. SAFE's intent is to allow the widespread availability of strong encryption for export. Specifically, the bill would relax the White House's controls on encryption export policy, and would make strong encryption products available in the US mass market available for export. H.R. 850 would also extend the relaxation of policies to other encryption-related computer products. In testimony earlier this month before the House Armed Services Committee, Reno restated an earlier claim that while encryption provides many important benefits to society, "the good of society requires narrow exceptions to this normal expectation of privacy." Reno also predicted crime prevention would become much more difficult if the bill is passed, because the process to unscramble encrypted messages without the recovery key would be very complex. "That, to me, is an unacceptable result, and we must not allow it to happen," Reno added. Reno also asked for support and funding of a centralized technical resource - "a `Technical Support Center,'" as Reno called it - within the Federal Bureau of Investigation (FBI). Such a center would support federal, state and local law enforcement in developing tools and techniques to respond to public threats caused by terrorists and criminals who use encryption. Reported By Newsbytes.com, http://www.newsbytes.com . 17:16 CST -=- JYA.com http://jya.com/reno-ban.htm 27 July 1999. Thanks to CS-H and Telepolis. Translation by JYA with Systran. Source: http://www.heise.de/tp/deutsch/inhalt/te/5117/1.html TELEPOLIS, 27 July 1999 The USA urges ban of encryption products on the Internet Janet Reno pressures Herta DΣubler-Gmelin By Christiane Schulzki-Haddouti The Federal Cabinet ended the smoldering uncertainties in the German encryption policy at the beginning of June with publication of five key points. However, the encryption debate is not ended. In the next year a further Wassenaar round of negotiations will be on the table. The US is already trying now to persuade changes in positions. For the US the liberal export politics of the Europeans is a thorn in the eye. It therefore tries to close the last gaps. At the end of May US Attorney General Janet Reno requested in a letter (below) that Federal Secretary of Justice Herta DΣubler-Gmelin control distribution of coding software which is becoming common "over the Internet." In addition it also positions "Public Domain" products. Reno's view is that the "use of the Internet to distribute encryption products will render Wassenaar's controls immaterial." At the end of year 2000 the Wassenaar agreement is to be negotiated; it regulates among other things the export of encyption products. Until then the USA wants with the 33 Wassenaar member states to develop a broad consent. It is strange that the letter was addressed to the Federal Department of Justice and not to the Federal Ministry for Economic Affairs, which, together with the Federal Ministry of the Interior, is responsible for encryption policy. The Americans probably well-know that the responsibilities are distributed within the German Federal Government. Therefore it is to be accepted that they figure a discussion with the Ministry of Justice has a larger chance of success. The Federal Department of Justice did not want to confirm to Telepolis the existence of the letter. From the outside the ministry it means, however, it already has given several letters of the same request. It is now working on a letter in reply. However, it is not well-known whether the answer to Reno's unjustified demand is to fail. Arne Brand of the virtual local association of the SPD is annoyed about the "concealment policy" of the Federal Government: "a cover broad I nevertheless only over a thing out, if I do not have an own point of view, but me the line of others to attach would like". Encryption export policy as politico-economic instrument Also, Hubertus Soquat, adviser in the Federal Ministry for Economic Affairs, did not want to confirm the existence of the letter; he nevertheless referred Telepolis to the basis of the encyryption benchmark figures adopted by the cabinet as clearly a position: "possibly the demand" the American placed into that the area to adjust in the future also encryption products in the "Public Domain" category to counter German encryption policy, which is based on the free availability of encryption products. The free availability covers the range from development up to use by the user. The Federal Government cannot therefore meet "possible American demands." Soquat is convinced of the fact that "encryption export policy is being handled as a politico-economic instrument of the USA, at least." Thomas Roessler, spokesperson of the "Foerdervereins information technology and society " (FITUG), sees the Reno letter as an attempt to keep "electronic interception capabilities of American and allied authorities in force for as long as possible." He says that such export control would have absurd consequences: "A computer journal, which contains a supplement CD-ROM on free cryptographic software, might not be sold at the kiosk anymore, or only by license to certain foreign customers. Also the publication of free cryptographic software for general access over the Internet would no longer be easily possible." Besides, says Roessler, already the 1998 results of negotiation would contradict which cryptographic mass market software to export control, the actual purpose of the Wassenaar agreement. This consists of contributing "to regional and international security and stability as transparency and larger responsibility with the transfer by conventional weapons and dual-use goods and - technologies promoted and thereby destabilizing accumulations of such - goods and weapons are prevented." Besides "bona fide" civilian transactions are not to be obstructed. Roessler: "Today, the use of strong cryptography is the best course of action, it interacts with the controlled transactions obviously in bona fide civil transactions. The conception that an internationally destabilizing imbalance of military strength can be caused by free or mass market available encryption software, is "absurd." Reno's letter has to do nothing with the avowed goals of the Wassennaar agreement, "however, but with the attempt to keep in force the electronic surveillance capabilities of American and allied authorities," says Roessler. Based on information of the "Electronics Frontiers Australia " (EFA) the export of "Public Domain" crypto software is already now forbidden in Australia, the USA, New Zealand, France and Russia, since these states do not use "the general software note" of the Wassenaar agreement. A reason is not well-known the EFA. Ingo Ruhmann of the "forum computer scientist inside for peace and social responsibility " (FifF) regards the attempt of Reno to subject encyption systems of stronger control as "thoughtless handling of essential fundamental rights of democratic states." Already it is now foreseen that the "general software note" will play a central role in the Wassenaar preliminaries. An avowed goal of the USA is to prevent the download of encryption programs over the Internet. Also the treatment of "Public Domain" encryption software will be a topic. Still there are arguments about the definition of the term "Public of Domain." The Wassenaar agreement describes it as software which was made available "without restrictions on its further distribution." From a legal view it designates, however, goods, which are free from copyright rights. Critically: According to the wording it is sufficient to exclude a further spread on CD or without documentation so that a software no more than is not regarded "into the public domain." Is looked for now a definition for a product, which is everyone accessible and freely available. Source: http://www.heise.de/tp/deutsch/inhalt/te/5117/2.html Federal Secretary of Justice Herta DΣubler-Gmelin at the end of May Dear Minister DΣubler-Gmelin: I wish to thank you and your Government for your efforts to achieve a fair resolution regarding multilateral export controls on encryption products at the recent Wassenaar plenary session on December 2-3, 1998. While no Nation, including the United States, was completely satisfied, I think we made significant progress toward a regime that can support the interests of national security and public safety in the face of the challenges posed by the increasing use of encryption internationally. Given the divergent cryptography policies that the Wassenaar Nations have supported in the past, and the continuing controversy that cryptography policy continues to generate, that 33 Nations managed to find common ground augurs well for our future ability to find solutions that satisfy the divergent needs of privacy, electronic commerce, national security, and public safety. Much work remains to be done. In particular, I believe we must soon address the risks posed by electronic distribution of encryption software. Although the Wassenaar Nations have now reached agreement to control the distribution of mass market encryption software of certain cryptographic strength, some Wassenaar Nations continue not to control encryption software that is distributed over the Internet, either because the software is in the "public domain" or because those Nations do not control distribution of intangible items. While I recognize that this issue is controversial, unless we address this situation, use of the Internet to distribute encryption products will render Wassenaar's controls immaterial. I look forward to our continuing discussions on these and other issues. And again, thank you for your past and future considerations of these issues. Sincerely, Janet Reno Source is the editors at JYA @HWA 36.0 CCC Camp Happens Next Weekend ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by TurTleX and tacscan In an open field next to a lake near Altlandsberg, outside Berlin, Germany several thousand people are expected to gather under tents with their computers. The Chaos Computer Club Camp will be taking place next weekend. Along with things like a 34MBit Internet link, discussions on cryptography and the Linux Death Match one of the scheduled events may be underwater lock picking. Industry Standard http://www.thestandard.net/articles/display/0,1449,5672,00.html?home.tf Computer World http://www.computerworld.com/home/news.nsf/all/9907272hackhol HNN Cons Page http://www.hackernews.com/cons/cons.html Industry Standard; July 27, 1999 Chaos Club Takes Hackers on Holiday By Mary Lisbeth D'Amico MUNICH û Hackers looking to get away from it all and at the same time hone their skills, will set up tents in a field near Berlin next week as part of a three-day event sponsored by Germany's premier hacker group, the Chaos Computer Club. "Nerds, hackers and phreaks from around the world," as the club calls them, are gathering Aug. 6 through 8 in Altlandsberg, near Berlin, where they will split their time between partying, swimming in a nearby lake and engaging in contests that test their hacking prowess. The club will provide electricity and Ethernet access in every tent. A special network will be set up so users can practice and hook up to the Net. Although press is allowed, journalists must be on their best behavior, the club says. Reporters must pay like everyone else, must wear a badge clearly identifying themselves, may not take pictures and may only quote those who consent to be interviewed. Pre-registration is already closed for the event, according to the club Web site, but those that show up with 150 marks (US$82) can try their luck. The grounds can comfortably fit between 1,500 and 2,000 people. Business visitors û defined by a club publication as anyone who is "rich or working for a company or government that wants you at the camp because there is a lot to learn or you have a certain commercial interest," are asked to pay 1,500 marks (US$820). Spaces remain for this type of participant. The camp will be divided into theme villages û including lock picking, cryptography and re-engineering û where participants can choose the topic that most interests them. A typical event will be the Linux Deathmatch, a real-time hacking competition in which teams of one to three players will try to hack one another. Participants can also propose their own topics to the event's sponsors. One group has also announced a "Hack the NT" contest, and the lock-pickers' project is even eyeing "underwater lock picking in the lake nearby." Mary Lisbeth D'Amico writes for the IDG News Service -=- Computer World http://www.computerworld.com/home/news.nsf/all/9907272hackhol 37.0 Computer Criminal Busted in UK ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by tacscan A UK man has been arrested and released on bail for allegedly breaking into the computers of the CurrantBun.Com Web site. The arrest was conducted by members of the Computer Crime Unit based at New Scotland Yard. CurrantBun.com is the portal of Britain's most popular newspaper, The Sun. After the break-in the personal information of over 50 people was distributed via the internet. The Register http://www.theregister.co.uk/990726-000006.html Posted 26/07/99 1:57pm by Tim Richardson Man arrested over alleged hacking offence A 19-year-old man has been arrested in connection with the alleged hacking of a Web site owned by a Wapping-based business premises. The man -- who has not been named by police -- was arrested last Wednesday and released without charge. He was bailed to appear at Holborn Police Station in October pending further investigations. It is understood the arrest was part of a special operation conducted by the Computer Crime Unit based at New Scotland Yard. Last month the CurrantBun.Com Web site was hacked and the personal details of 50 people were published on the Net. CurrantBun.com is the portal of Britain's most popular newspaper The Sun which is based at Wapping, London. David Habanec claimed responsibility for the alleged break-in at CurrantBun.com. At the time he made no secret that he was responsible and went out of his way to court publicity over the alleged intrusion. He even published details of how he carried out the breach of security. In an exclusive interview with The Register Habanec said he did it to gain notoriety among the Internet community. He also alleged it was part of a revenge attack against Cheshire-based ISP Telinco, the company that provides the network for CurrantBun.Com. « @HWA 38.0 Researching an attack (KeyRoot) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.pure-security.net/ ____ ______ __ ___ _____ ____ __________ / / / ___/ \ \/ / / \ / \ ____ /___ ___/ / /__ / /__ \ / / <> / / __ \ / \ / / / ___/ / __/ / / / _/ \ / / __ \ / / / \ / /__ / / / /\ \ \____/ \ / \ \ /__/\__\ \_____/ /__/ \_/ \__\ \____/ \__\ http://www.weownyourlives.forever RESEARCHING AN ATTACK by Mnemonic xkyller@hotmail.com 7/27/99 =-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-==-=-=-= KeyRoot KeyRoot KeyRoot KeyRoot KeyRoot KeyRoot =-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-==-=-=-= Contents: 01 - Intro 02 - Web browsing 03 - Port scanning 04 - Determing the method of penetration 05 - Making the attack 06 - Ok that's it =-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-==-=-=-= Shouts to GRiDMAN for suggesting the topic to me =-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-==-=-=-= 01 - Intro I don't know why it wasn't obvious for me to write about it earlier. Although I'm sure the major audience that will continue reading after the intro are script kiddies, I thought about it for a while and decided to go ahead with releasing it. This white paper is geared towards people who want to single out a system and make an organized attack. Rather than attacking a random system you found to be exploitable to a certain security flaw. I hope I can be of some help to new security professionals or other hacker-type people or anyone else who breaks into systems. When you plan on breaking into someone else's system just plan on paying the consequences if you get caught. If you don't want to get caught take the necessary precautions. You still might get caught. =-=-=-=-=-=-=-=-=-= 02 - Web browsing After you know what system you're attacking you have to get some general information about the system like what platform are they running, what applications, things like that. A lot of times you can do this just by looking through their site. As you look through the take note of what it's running like if it says what operating system, what web server, firewall, administrative tools, or CGI scripts and remember what versions are being used either. The difference between version 1.0 and 3.0 can be the difference between a possible attack and no attack. FTP or telnet banners could also reveal information about the system. =-=-=-=-=-=-=-=-=-= 03 - Port scanning Port scanning is always a good idea whether you know anything at all about the system or not. The results of a port scan can in many cases show you what operating system is being run. For example a Unix machine wouldn't be running NetBIOS and an NT machine wouldn't be running mountd. In addition to this, what Internet applications are being run provides different ways you can break in. Like if you know that the system is Linux and is running qpop or nlock or some other exploit-able program then there's a possibility that you can penetrate the system that way. You should keep a temporary log of all port scanning that you do so that you can use the information when you actually make your attack. Here is an example of a very short port scan: KeyRoot Port Scanner (KeyScan) v1.0 by Mnemonic Scanning ip address 127.0.0.1 on ports 21, 23, 56 Scan started 3/6/2020 1:08 am 127.0.0.1 21 23 Scan completed 3/6/2020 1:10 am KeyRoot owns you I just scanned three ports on my local machine. Two of these ports were open (21 and 23). I can pretty much assume that I am running FTP and telnet. Other types of scans can determine what applications are being run on specific ports. =-=-=-=-=-=-=-=-=-= 04 - Determining the method of penetration Now you should know just about everything you need in order to make an attack. When you know what the system is running you basically know what it's vulnerable to. You can run some publicly-available exploit, write your own exploit, or use publicly-known attacks to penetrate the system. In many instances a system may be running programs that are exploitable only when you have an account on the system. If that's the case you're going to need to get a shell some how like guessing someone's password or something like that. Rooting the system means you have complete control over it. You have administrator rights. =-=-=-=-=-=-=-=-=-= 05 - Making the attack Ok so now you know how to attack the system go do it. In most cases when you're attacking a someone you need to be running the same platform as they are. This isn't the case with null connections or with platform-to- anotherplatform exploits. =-=-=-=-=-=-=-=-=-= 06 - Ok that's it Ummmm... yeah... peace to all my bro's in on EFNet. NtWaK0 and MostHateD and everyone else. =-=-=-=-=-=-=-=-=-= KeyRoot: living your life for you =-=-=-=-=-=-=-=-=-= 07 - KeyScan.c -----cut----- /* KeyScan.c by Mnemonic is just a very simple port scanner ____ ______ __ ___ _____ ____ __________ / / / ___/ \ \/ / / \ / \ ____ /___ ___/ / /__ / /__ \ / / <> / / __ \ / \ / / / ___/ / __/ / / / _/ \ / / __ \ / / / \ / /__ / / / /\ \ \____/ \ / \ \ /__/\__\ \_____/ /__/ \_/ \__\ \____/ \__\ For Linux/FreeBSD */ #include <netdb.h> #include <netinet/in.h> #include <stdio.h> #include <string.h> #include <sys/socket.h> #include <sys/types.h> #define p0rt putaportnumberherethatyouwanttocheck int x, s; char *str = "KeyScan v1.0 by Mnemonic"; struct sockaddr_in addr, spoofedaddr; struct hostent *host; int openthesock(int sock, char *target, int port) { struct sockaddr_in blah; struct hostent *he; bzero((char *)&blah, sizeof(blah)); blah.sin_family=AF_INET; blah.sin_addr.s_addr=inet_addr(target); blah.sin_port=htons(port); if ((he = gethostbyname(target)) != NULL) { bcopy(he->h_addr, (char *)&blah.sin_addr, he->h_length); } else { if ((blah.sin_addr.s_addr = inet_addr(server)) < 0) { perror("gethostbyname()"); return(-3); } } if (connect(sock,(struct sockaddr *)&blah,16)==-1) { close(sock); return(-4); } return; } void main(int argc, char *argv[]) { printf("\n\nKeyRoot Port Scanner (KeyScan) v1.0 by Mnemonic\n\n"); printf("Scanning ip address ", target, " on port ", p0rt); printf("\n\nScan started about five seconds ago hehehehe"); printf("\n\n", target); if ((s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) { printf("\n\nScan completed\n\n"); printf("KeyRoot owns you"); exit(-1); } openthesock(s, argv[1], p0rt); printf("\n ", p0rt); printf("\n\nScan completed\n\n"); send(s,str,strlen(str)); usleep(100000); close(s); printf("KeyRoot owns you"); } -----cut----- @HWA 39.0 Win98 Security Issues A KeyRoot/gH Advisory ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From www.pure-security.net ***************************************** / \ / \ / Mnemonic Presents \ / Win98 Security Issues \ / A KeyRoot/gH Advisory \ / \ / \ ***************************************** ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Win98 Security Issues 7/16/99 Mnemonic and gH www.pure-security.net xkyller@hotmail.com KeyRoot Information Security ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Contents 1 - Abstract 2 - Root 3 - TCP/IP 4 - Encryption 5 - Permissions 6 - Conclusion ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1 - Abstract As much as I like Win98 it is totally insecure. Programs in the root directory can allow remote web access. This could mean to browse your system files with possibly read and write permissions, upload and download files, remotely execute code, and whatever else you can think of. If your system has important files on it then you could be in trouble. The Access Controls in Win98 are misleading and can allow an attacker to access your hard drive with read/write permissions unpassworded. Also there is no encryption scheme between the network components so basically anyone can sniff your passwords and whatever else you type, and improper permissions allow trojan horses to carry out instructions with no restrictions. All of these security issues have the potential of giving an attacker remote administration over your Win98 system. The possibilities that come with that are endless. This advisory goes over several security problems in the Win98 operating system. I think youÆll be interested reading it. Have fun! ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2 - Root In Windows we have what is called the root directory. This is C:\WINDOWS. Files in the root directory can carry out system-wide processes that may be compromising to the security of the system. Explorer.exe has been exploited in past versions to allow remote access to Win95/98 over the web. In fact any program in the root directory has the potential of being exploited. Sometimes programs are written without security in mind or maybe the programmers look over parts of the code and don't realize there's a problem. There could be a buffer overflow or a poorly written function that allows remote browsing of databases. If you store medical or other personal information like credit card numbers, addresses, or company documents then this is obviously a concern. Nobody wants to wake up one morning and see that their fifteen-page paper that was suppose to be released tomorrow has been downloaded by a teen hacker. Windows 98 fails to incorporate security necessary to prevent these types of attacks. The only thing I can recommend at this time is that you download a free commercial firewall that's been released by a respectable company other than Microsoft. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 3 - TCP/IP Many of today's Windows '98 users want to share files with other computers on their existing network. One of the easiest ways to do this is using the TCP/IP protocol. All the user has to do is go to settings in the start menu, control panel and when Explorer opens up, click on the network icon. When the network config folder opens there will be a list of what network components have been installed. Just one click on TCP/IP and then Add.. File and print sharing.. OK and it's done. The thing most people don't realize when setting up shares is that they don't stop to think or don't realize that people other than the intended people can also access these shares and without a password. They assume that the password will be the same as their Windows logon password. Well they assumed wrong. Windows '98 provides poor configuration for networks which leaves them succeptible to attack to anyone on the Internet or on the network. For example if I were on a network and new the ip address of the computer running shares I would open an MSDOS window and: C:\>net use p: \\targetip\ipc$ The command completed successfully. C:\>net view \\targetip Shared resources at \\targetip Share name Type Used as Comment ------------------------------------------------------------------------------- ADMIN$ Disk Remote Admin C$ Disk C Drive D$ Disk D Drive IPC$ IPC Remote IPC NETLOGON Disk Logon server share HPLaser4 Printer HP LaserJet 4si The command completed successfully. Basically what I just did was create a null connection with the IPC$ share and view what shares were on the network. Now I can map to any of these shares like C$ and browse them with read/write permissions. What this means is that I can take a look at any file on the system. The access control features of Windows 98 are poorly set up and make misconfiguration of NetBIOS easy. To learn more about NetBIOS check out The NT Wardoc by Rhino9. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 4 - Encryption You would think that in cooperation with the network components of Windows 98 that there would be some sort of encryption between host and client but there's not. If you do in fact have a password set on your shares any attacker who is sniffing the network can see you typing in your username and password in cleartext. Win98 provides no prevention of this. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 5 - Permissions In the Windows environment there are no permissions on files by default. The potential of what someone might do with access to all of the files that are a part of the Windows 98 operating system is risky. They could also download a program which may be a virus or a trojan horse that executes instructions without any restrictions. This can't be good for anyone. Your Windows 98 computer is at risk of being compromised because Microsoft didnÆt pay attention and didnÆt do a clean job. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 6 - Conclusion Although Win98 provides excellent point-and-click features it is far beyond not being secure. Since the update from Win 95 to Win 98 Microsoft has failed to improve the system as far as security is concerned. There is absolutely no protection at all. If thatÆs what youÆre looking for in an operating system Windows is not the way to go. Switch to Unix or something. Basically thatÆs all you can do. Microsoft continues to downplay the security concerns of Windows 98 as I write this. I donÆt think anyoneÆs addressed all of these issues in one informative advisory before so I decided to. I hope youÆve enjoyed this advisory! Keep tabs on gH and me and KeyRoot. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Brought to you by KeyRoot and gLobaL heLL. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @HWA 40.0 WLDoTrans.asp allows CC retrieval A gH Advisory by Mnemonic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From www.pure-security.net ***************************************** / \ / \ / Mnemonic Presents \ / WLDoTrans.asp allows CC retrieval \ / A gH Advisory \ / \ / \ ***************************************** ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ WLDoTrans.asp allows CC retrieval 7/14/99 Mnemonic and gH www.pure-security.net xkyller@hotmail.com KeyRoot Information Security ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1 - Abstract Although there is client authentication and usually encryption between client and server, WLDoTrans.asp shows credit card information as clear text in hidden form fields. This can be retrieved by anyone local to the machine by viewing the page's source. If an attacker gets hold of the credit information they can buy things with your card. I hope you like the advisory. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2 - What is WLDoTrans.asp? WLDoTrans.asp is a secript used in a lot of online shopping. Basically it checks to see if the info a user enters in an ordering form is valid. It allows a users to purchase something like a hat or a t-shirt or anything else in the online market. When the user enters the information it gets encrypted before going to the server so that no one can intercept it and read it. This is suppose to allow for secure online shopping. However, as you will see, things aren't always secure as the little "you are in a secure area" boxes tell us. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 3 - Description Although ordering forms usually encrypt the information before sending it off to the server it's not secure. Once the info reaches WLDoTrans.asp it gets decrypted in order to check and see if it's valid. When WLDoTrans.asp loads and you view the source you can see in clear text the credit information you entered. This includes the card type, the full credit card number, the expiration date, and the full name on the card. The line with the credit card should look like <INPUT TYPE="HIDDEN" NAME="CARDNUM" VALUE="cardnumber"> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 4 - Impact Although the script is not accessible to anyone remotely, any time you step away from the computer there's nothing keeping someone from walking up to it and doing as they please. Even after you log out of an online shopping area, an attacker can press the "back" buttonin your web browser until they reach WLDoTrans.asp. All they have to do is view the source of the page and boom there it is. With your credit card number, type, and full name they can order anything they want to anywhere. It doesn't even have to be to them. They could decide to put you in debt and buy a plane. An attacker could easily run your credit card out and give you bad credit. You probably wouldn't even notice anything until you receive a bill for $800,000 or until someone says "sorry, this card is no good". ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 5 - What to do about it The most obvious way to fix the problem is to encrypt the hidden form fields (HFFs) which contain the credit card information. This is very easy and affordable and allows WLDoTrans.asp to function normally. Well encryption requires decryption on the server side and encryption on the web page side. Basically this would allow you to encrypt the hidden values before they're submitted to WLDoTrans.asp. When WLDoTrans.asp loads it is imperative that it displays only the encrypted values or risk retrieval of the credit card information. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Brought to you by KeyRoot and gLobaL heLL. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @HWA 41.0 bad CGI scripts allow web access A gH Advisory by Mnemonic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From www.pure-security.net ***************************************** / \ / \ / Mnemonic Presents \ / bad CGI scripts allow web access \ / A gH Advisory \ / \ / \ ***************************************** ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ bad CGI scripts allow web access 7/14/99 Mnemonic and gH www.pure-security.net xkyller@hotmail.com KeyRoot Information Security ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1 - Abstract Many CGI scripts today accept hidden values that aren't correct. When an attacker enters a value other than what is expected the script behaves weird and sometimes will allow the retrieval of passwords, credit card information, or system browsing. Basically that's it. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2 - Description More than half of all websites today are dependent on some sort of CGI script. This could be to admin a system over the www, edit something, login, or make a payment. Many of these scripts are written by an inexperienced programmer or one who is unconcerned about the security of the site. Their reliance on faulty programs is a big security problem. What happens most of the time is that a user inputs something to the script and the script doesn't check to see if the value is an acceptible value. For example, here's a form from a system I was checking out a little while ago: <FORM METHOD=POST ACTION="http://www.server.com/cgi-bin/faultyscript"> <INPUT NAME="member" TYPE=hidden VALUE=""> <INPUT NAME="membername" TYPE=hidden VALUE="myaccount"> <INPUT NAME="authentication" TYPE=hidden VALUE="abMBIV9v/bcdo"> <INPUT NAME="passwd" TYPE=hidden VALUE=""> <INPUT NAME="fulladdress" TYPE=hidden VALUE="http://www.server.com/blahblah"> <INPUT NAME="subdirectory" TYPE=hidden VALUE=""> <INPUT NAME="email" TYPE=hidden VALUE=""> <INPUT NAME="diskspace" TYPE=hidden VALUE=""> <INPUT NAME="extras" TYPE=hidden VALUE=""> <INPUT NAME="timestamp" TYPE=hidden VALUE="907100341"> <INPUT NAME="extlist" TYPE=hidden VALUE=""> <INPUT NAME="blah" TYPE=hidden VALUE="The name of the faulty script"> <INPUT NAME="filename" TYPE=hidden VALUE="index.html"> ... <INPUT TYPE="submit" NAME="operation" VALUE="Save and Continue Editing"> ... With this example, the form came with my account. However, when I simply change the hidden form named "membername" from the value of my account name to the value of any other account name including the root and webmaster accounts. When the page was loaded with the value "webmaster" replacing my account all I did was click save and a new page loaded with the webmaster account's password smack dab in the middle. This kind of attack can work on any system running a CGI script. All that has to happen is a kid willing to take two or three minutes out of his boring life and think. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 3 - Impact All this goes to show is that CGI scripts sometimes do weird things when they receive an input that they don't recognize. This could mean retrieval of account passwords, credit card information, or browsing the system and opening files. The impact of this problem is pretty deep. If an attacker can get the webmaster's password they have total control over that site. The attacker can open, alter, and delete files. They can delete or add users, change the content of the main webpage, and basically do anything to the system. If the attacker gets credit card information they can buy anything on someone else's credit card information and your system could be held responsible. Also if the attacker can browse the system's files they can retrieve the passwd file or some other file that can lead to root access. Basically it's not a good idea to have vulnerable CGI scripts at all. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 4 - What to do about it There only thing you can really do about this is to go back and look over the source to all of your CGI scripts and make sure there are checks in all of the right places. There can't be any place where an attacker can enter false data and have the script accept it. If you're at all worried that someone might try to exploit you then it's a good idea and it's easy. Take a few minutes during lunch while you're drinking a Cherry Pepsi and eating a Philly Sub to make corrections. Well that's it for this advisory. I hope you've enjoyed reading it as much as I enjoyed writing it. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Brought to you by KeyRoot and gLobaL heLL. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @HWA 42.0 Can my firewall protect me? by Mnemonic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From www.pure-security.net Can my firewall protect me? by Mnemonic 7/7/99 KeyRoot Everytime I look through a computer magazine or search the Internet, I see an advertisement for a firewall. "Your solution to hackers" many of them boast. By calling a product a firewall, vendors fool a lot of companies into buying something they don't know what it does, or something that won't help them at all. A firewall is software that filters incoming and outgoing connections to a system. It also monitors all server requests and the activity of the system's users on the Internet. Although a company may feel safe running a firewall, they're still at a high risk of being attacked. The firewall may very well protect against Denial of Service (DoS) attacks, and basic attempts at gaining root, or supervisor, access on the system, many firewalls actually increase the risk of attack rather than adding protection. If a firewall is improperly setup, it may allow remote access to even the most stupid of hackers. Additionally, the firewall may have its own problems without the help of an under-practiced administrator. It may contain a buffer overflow, for example, in the source code. Or it may have some other problem which allows remote execution of files. The problem is today's security standards are no higher than a sign that says "back off" on a fence post. When a hacker knows that a system is running a firewall, they quickly check around to see what kind of firewall in order to exploit it. He doesn't get worried and try the next system that looks vulnerable. I know this from my own experience. A few days ago, I broke into a system, with permission of course, that boasted no kid could break into it. It was running NT 4.0, IIS 4.0, Remote Access, some Cisco Router, and MIP 2.0. The system was actually vulnerable to several publicly-available exploits that led to admin-level access. The firewall did nothing to prevent the attacks. If you would like to protect your system, the best way is to keep up on all of the latest attacks and how to protect yourself against each one individually. This method is much more affective than buying something that could actually weaken your security instead of providing a shield. If you'd like to get in touch with me I'm Mnemonic and I'm usually an op in #Legions on EFNet. Go check out RootFest or something. @HWA 43.0 How company specific programs can be used against the company by Mnemonic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From www.pure-security.net -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- How company-specific programs can be used against the company 6/30/99 Mnemonic xkyller@hotmail.com -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- So you're sitting at your computer, drinking a Pepsi, reading your new magazine, whatever, and you decided to read this paper because it sounded cool. Well.. it is. No no, I mean it is but that's not the point. There are so many companies out there that depend on the Internet to do business. Whether their business is marketing, communication, or video games, the company's systems are in use by people who aren't always on-site. Many times a programmer will be hired to create programs that are made to carry out purposes that are specific to the needs of the company. This opens up a big security risk. If the program is configured incorrectly, or used in a way other than it was designed for, the program could behave iradically and give the user supervisor access. The purpose of this paper is to show how an attacker would exploit one of these programs, not how to eliminate the risk. However, in knowing the means of penetration, you should be able to design programs that will adamantly protect against tcp/ip based intrusions. Read over this paper carefully, and learn a thing or two. If you have any suggestions or comments feel free to contact me. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Contents: 1) Who's at risk? 2) Why it is a problem 3) How the programs are exploited 4) Why anyone would want to attack a company 5) Conclusion -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 1 - Who's at risk? There are a lot of companies out there and a lot of different work fields. It's hard to narrow it down to only a handful that are at risk, because everyone is at risk. Everyone that uses the Internet on a day-to-day basis that is. Any company that does online banking or that deals with any type of exchange of information or requires off-site use of their systems is at risk. For example, Booking Inc. might be set up in Saint Mary, Maryland and have an employee named Bob in Miami, Florida. Suppose Bob needs to access Booking's server to update the information about an airline that was suppose to arrive in a few weeks. Bob needs to replace it with information on another airline that will be arriving in its place, but he's nowhere near Booking Inc.'s location. The solution is to provide Bob with an easy way to do his job from where he is: the Internet. Booking Inc. hires a programmer to write them a software suite that will allow Bob to connect to Booking's system and update certain things in a certain way. This is the way most companies today think, but it's not a good way of thinking. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 2 - Why it is a problem The problem with this solution is that someone not employed by the company can use the same means of access as Bob to access the company's database. This isn't a good idea because from there, the attacker can flaunt around as if he were a part of your company. He could make transactions in the company's name, change schedules, or any number of things that would cost the company anywhere from nothing to thousands of dollars. No company can afford to leave their information that open. Access to the database doesn't mean just looking around. It means the ability to change things and go unnoticed. Many times a user will alter something that may pass without question until that something is called on. Then it really has an impact on the company. Too many companies don't realize there is a problem until it is too late, so I'm telling you now. If your company runs its own software there's a good chance that it is vulnerable to attack. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 3 - How the programs are exploited Since each program is different, there are obviously more ways to exploit the programs than I can mention here. Although, I will go over one of the most common methods of program exploitation. It is called a buffer overflow. A buffer is an area shared by software that can be called upon to recount things. It temporarily saves necessary data. This is where a program is designed to accept data, assign it a value, and store that value, that data, in a buffer. A buffer can only hold a certain amount of data. When a program receives an amount of data that is more than the buffer can handle, the program will not function properly. This is called a buffer overflow. The program will give the attacker privileges equivalent to that of its owner. For example, the program may be "owned" by the supervisor. That is, it can perform tasks with supervisor-equivalent privileges. Let's suppose that the software Booking Inc. has given Bob is called Doober, and that the host side of Doober has these lines: char flightnm[168] printf("Change flight number to?\n", flightnm); strcpy(flightnm); The problem is that flightnm can only hold data up to 168 bytes and doesn't check to see if the input will fit in the buffer. If Doober is owned by the supervisor, then an attacker could exploit Doober with a program that would input a string greater than 168 bytes. This would easily give the attacker supervisor rights. Here's another example: char buffer1[1024]; char buffer2[1024] ... memset(buffer1, 1, sizeof(buffer1)); memset(buffer2, 2, sizeof(buffer2)); ... memcpy(buffer2, buffer1, sizeof(buffer2)); If, however, you want to fix the problem, you can just add a line to make sure the input fits: ... memcpy(buffer2, buffer1, sizeof(buffer2)); if ((buffer2 != 1024) && (buffer2 > 1024) && (buffer1 != 1024) && (buffer1 > 1024)) { printf("That was too big\n"); exit(1); } -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- 5 - Conclusion If your system is running company-specific software, I more than believe that you're vulnerable to attack. I advise review the source code to all programs, and defining the type of access that the program has to the system. Bob from Booking Inc. may need to update airline information, but not the method of payment the airline's customers are using. So play it safe and all that jazz. If you have any comments or suggestions or if shx.c for SunOS doesn't compile right (I've used shx.c for BSD don't e-mail me about that), I'm Mnemonic at xkyller@hotmail.com. Peace out. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- Legions of the Underground http://www.legions.org Keen Veracity http://www.underzine.com KeyRoot -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- @HWA 44.0 Exploiting the netware bindery by Mnemonic ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From www.pure-security.net ***************************************** / \ / \ / Mnemonic Presents \ / Exploiting the NetWare Bindery \ / A KeyRoot Advisory \ / \ / \ ***************************************** ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Exploiting The NetWare Bindery 7/4/99 Mnemonic and KeyRoot Information Security we'll get a webpage to go here xkyller@hotmail.com ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ For those of you who follow my stuff in Keen Veracity, some of the material in this advisory is repeated material from previous releases. This advisory should be accurate for versions of NetWare up to and including NetWare 3.x ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1 - Abstract For a long time, NetWare has been doing very poorly in the security field. Even with the many tools released by various people to bring to light NetWare's weaknesses, Novell continues to ignore the existance of its problems until the details of an attack have been released to the public. As a wannabe admin and a repetitive Pepsi drinker, I think it is necessary for me to release my research on NetWare security. The problem now is that the NetWare bindery is openly accessible to any NetWare user. This means to my password, your password, and that idiot in the office next to you's password. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 2 - The NetWare Bindery NetWare's bindery is basically memory sectioned off for use of NetWare proccesses. It's a database where NetWare keeps information about the network resources and users that many function groups use to store and retrieve information. Each file server on a network system has its own bindery, and thus its own group of known objects. The NetWare bindery can best be compared to the Force. It binds the galaxy together. Yeah.. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 3 - Description There are actually two things I want to discuss here. The first is getting the password for someone else's account, and the other is getting the password for the account you're on. They're two seperate things. Now check it out: NetWare represents each shared application, printer, or a logged-in user as an object in the bindery. Each object has identifying characteristics, known as properties. Properties are dependant on objects which have these attributes: OBJECT ID OBJECT NAME OBJECT TYPE OBJECT FLAG OBJECT SECURITY PROPERTIES FLAG These are the properties attributes: OBJECT ID PROPERTY NAME PROPERTY FLAGS PROPERTY SECURITY VALUES FLAG The property name is a character string of up to 16 characters, including the null terminator. Propery names have the same restrictions on the use of characters as object names. The property flags are stored as a one-byte field. They indicate whether the property is static or dynamic, and whether it is an item or a set. Sets are lists of object IDs which are interpreted by NetWare. Item properties are unformatted binary fields stored in 128-byte segments which are interpreted by applications or NetWare APIs. Any user can retrieve the 128-byte segment which represents an object's password, and then convert this binary string into clear text. The user first calls GetObjectData() to get the name of the object. This function uses ScanBinderyObject() to populate a structure of type OBJECT. There are two ways of identifying objects. You can use the OBJECT ID or the OBJECT NAME and OBJECT TYPE. The last element is a dummy with all fields cleared to 0. Here the user calls GetUserAndApplicationData() to retrieve the password. For example: ... GLOBAL int GetUserAndAppInfo(char *argv[], int nMaxArgs, OBJECT *pObject) { strcpy(aop->obj.szObjectName, argv[nMaxArgs - 2])' aop->obj.wObjectType = OT_APPLICATION; strcpy(aop->szPassword, argv[nMaxArgs - 1]); fread(&szPassword, sizeof(int), 1, inpf); printf("\nThe password for that account is ", szPassword, "\n"); } The second thing I want to discuss is the retrieval of the password for the account that you're on. To do this we use functions in the Connection Services. So we can call GetConnectionNumber() to get the number that the file server has assigned to this workstation's connection. Then we call GetConnInfo() to get the name of the user among other information including the password. Take a look: ... void GetMyAccountPassword(char *argv[], int nMaxArgs, OBJECT *pObject) { FS_CONNECTION_INFO *pFSConnInfo; pFSConnInfo = GetConnInfo(GetConnectionNumber()); if (pFSConnInfo == NULL) return -1; /* this is where the user info is now */ *pObject = pFSConnInfo->fsLoggedObject.obj; free9pFSConnInfo); strcpy(aop->obj.szObjectName, argv[nMaxArgs - 2]); aop->obj.wObjectType = OT_APPLICATION; strcpy(aop->szPassword, argv[nMaxArgs -1]); fread(&szPassword, sizeof(int), 1, inpf); printf("\nThe password for the account you're on is ", szPassword, "\n"); } ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 4 - Impact Wow. I shouldn't even have to go over this section. If your network is running NetWare and you have private data of any sort on the network, your data is succeptible to the will of the attacker. The severity of this attack is only as big as the system that is affected. A hacker may decide to get the password to the supervisor account if the supervisor is logged in. If that happens, the hacker will have complete control of every computer on the NetWare network. The hacker may decide to change or delete your data, or nothing at all. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 5 - What to do about it There is actually nothing that any of us can do about this right now. We can't deny people access to the NetWare bindery or monitor their queries of it. The best thing to do right now is to switch to something more secure until the problem is fixed in a later version of NetWare. It would be wise to presume that it works on all versions of NetWare. ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Legions Interactive http://www.legions.org Keen Veracity http://www.underzine.com RootFest 2K http://www.rootfest.org ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ @HWA 45.0 Tax Break for Key Escrow Crypto ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Code Kid H.R. 2617, a bill sponsored by Porter Goss (R-Florida), seeks to amend the Internal Revenue Code of 1986 to allow a tax credit for development costs of encryption products with plain text capability without the user's knowledge. This will give companies a great monetary incentive to create weak crypto. (It will also allow people to find out what publicly traded companies took advantage of this tax break, so you will know which products to avoid.) The Federal Register http://thomas.loc.gov/cgi-bin/query/D?r106:1:./temp/~r106TNpQz3:e0: <link expired, couldn't locate a follow up...> Wired http://www.wired.com/news/news/politics/story/21014.html A Tax Break for Snoopable Code by Declan McCullagh 3:00 a.m. 30.Jul.99.PDT WASHINGTON -- If anyone in Washington qualifies as an ardent foe of encryption, it's congressman Porter Goss (R-Florida). Two years ago, the chairman of the House Intelligence committee tried to make it a crime to distribute privacy-protecting software, such as PGP or recent versions of Netscape Navigator and Internet Explorer. The plan failed, but Goss didn't give up. On Wednesday, he and the panel's ranking Democrat introduced a bill to jump-start the US market for encryption products with backdoors that would support government surveillance. The "Tax Relief for Responsible Encryption Act" gives companies a 15 percent tax break on the costs of developing government-snoopable encryption products. Such products might support key recovery -- in which a copy of the secret key needed to unlock scrambled data is placed within reach of law enforcement -- or "other techniques." "This legislation offers a way out of the stalemate between those who view commerce and national security as an 'either-or' proposition," Goss said in a statement. Goss and 22 other House members also sent a letter to President Clinton asking him to organize a "summit" of industry executives and government officials to extract an agreement on encryption regulation. "It has become evident that your leadership on this issue is vital to resolve the equally legitimate interests of law enforcement, national security, privacy, and industry.... We believe that without your personal involvement on this issue now, our national security and public safety will suffer serious and needless consequences," the legislators said. Law enforcement groups and their allies in the Clinton administration have long pressed for snoopable encryption products, complaining that a parade of undesirables -- such as pedophiles, drug smugglers, and money launderers -- might use crypto to communicate in secret. But the idea of the government subsidizing potential privacy invasions doesn't appear to be wildly popular. "I think the government's role is to protect the individual liberties of its citizens -- they should be giving companies incentives to strengthen encryption," said Jennifer DePalma, a graduate fellow at the Institute for Humane Studies at George Mason University in Arlington, Virginia. "They should let the free market continue to put an emphasis on protecting people's privacy," she said. For its part, the House Permanent Select Committee on Intelligence is insisting that it's pushing a voluntary approach. The committee members have abandoned their hope for a ban on unapproved encryption software, a source said. The administration has pushed for a key recovery scheme, whereby law enforcement would gain access to "plaintext," or unencrypted, information. But the market has rejected such options. "Mandatory recoverability is a nonstarter," a committee staff member said. "Law enforcement doesn't need us to mandate access to plaintext domestically." "The congressman does not want to mandate recovery of encryption products. He wants to encourage products that have societal benefits," a spokesman for Goss said. The committee last week said in a report that a bill to roll back some export restrictions on encryption products would harm children while protecting "criminals and international thugs." "Child pornographers could distribute their filth unimpeded," the report said. "Pedophiles could secretly entice the children of America into their clutches. Drug traffickers will make their plans ... without the slightest concern that they will be detected. Terrorists and spies can cause unspeakable damage without even the possibility of being stopped before it is too late." Rep. Julian C. Dixon (D-California) is cosponsoring the measure, HR 2616. @HWA 46.0 NSA Claims Israel Attacking US ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Turtlex Evidently there are not enough government computer security agencies. The NSA's new National Security Incident Response Center issued a warning last week regarding attacks originating from a machine inside Israel. The 'attacks' appeared to be numerous port scans of government and military computers. (Love the acronym NS-IRC, hehehe.) The Washington Times http://www.washtimes.com/news/news3.html White House says IPI system not aimed at U.S. By Ben Barber THE WASHINGTON TIMES White House spokesman David Leavy on Thursday adamantly denied a new International Public Information (IPI) system would be directed at American audiences. IPI is a secret Clinton administration program to control public information disseminated by the departments of State and Defense and intelligence agencies. It is meant to "influence foreign audiences in a way favorable to the achievement of U.S. foreign-policy objectives," according to a draft IPI charter obtained by The Washington Times. But critics claim that IPI will be used for domestic propaganda. White House says information system not aimed at U.S. By Ben Barber THE WASHINGTON TIMES <cont'd> White House spokesman David Leavy on Thursday adamantly denied a new International Public Information (IPI) system would be directed at American audiences. IPI is a secret Clinton administration program to control public information disseminated by the departments of State and Defense and intelligence agencies. It is meant to "influence foreign audiences in a way favorable to the achievement of U.S. foreign-policy objectives," according to a draft IPI charter obtained by The Washington Times. But critics claim that IPI will be used for domestic propaganda. -- Continued from Front Page -- "That is totally inaccurate," Mr. Leavy said. "The IPI initiative is designed to better organize the government and the instruments we have to support our public diplomacy, military activities and economic engagement overseas. There is no impact on the domestic press." Mr. Leavy said that U.S. information officials at home and abroad serve different functions. "There are officers who work with the media in the United States and officers who support the U.S. policy overseas. They are totally separate. They are totally different functions," Mr. Leavy said. But a former deputy chief of the U.S. Information Agency (USIA) under three presidents said he fears the IPI plan would mean U.S. propaganda aimed at foreigners would be used to influence American elections. Gene Kopp, who served under Presidents Nixon, Ford and Bush, said the elections of President Kennedy and President Carter were directly influenced by leaks of USIA foreign public-opinion polls showing a decline in U.S. prestige abroad. "I am concerned this could happen again under the IPI plan," said Mr. Kopp, currently a Washington lawyer. "The administration is transferring all assets, except broadcasting, to State, where they will not be separated in any way. It will be very difficult to separate what is disseminated in the United States and overseas." He said that the opportunity for abusing the system will be great. "The temptation to spin this stuff in a partisan way will be very strong -- probably irresistible," he said. "The other ominous feature is that this includes the intelligence agencies. They are in the business of misinformation. God only knows where that goes." New allegations emerged Thursday that the Clinton administration has been trying to control how American news organizations cover foreign affairs, at least since the Bosnia peacekeeping mission in 1996. According to a former government official, who insisted on anonymity, the White House created a Strategic Planning Directorate, which used the State Department and USIA to pressure American reporters into favorable coverage of the U.S. troop deployment in Bosnia-Herzegovina. It came into being just prior to the 1996 presidential election. "I heard them talk about it in conference telephone calls --how they had to control the media out there, the bureau chiefs, because if the Republicans picked this up [the Clinton administration] would be exposed as having no foreign policy," said the former government official. Shortly after President Clinton won re-election in 1996, the administration announced that U.S. troops would not be home by Christmas, as promised. Today, nearly three years later, some 7,000 U.S. troops remain in Bosnia. "The U.S. public wanted to know how long American troops had to be there," said the ex-official. "The Clinton people said 'only one year,' and [that] they would be home in December, after the election. But everyone knew the only way to keep the warring sides apart was robust international and American presence." This former official said this was widely discussed. "In the conference calls, they openly discussed how they had to prevent American journalists from discussing this," he said. The source said that USIA officials and National Security Adviser Samuel R. Berger tried to convince American editors not to publish accounts by their reporters who wrote that Bosnia was unsafe for Americans, that Muslim extremists were a threat, and that the warring sides would never be pacified. Ivo Daalder, who was a staffer on the National Security Council at the time, said discussions had no ulterior motives. Mr. Daalder, who is now at the Brookings Institution, said the talks among the USIA, National Security Council and other agencies "had the sole purpose of making sure they share information among them, and when the U.S. government speaks to the outside world, it does so in a coordinated manner." Mr. Daalder said "there was no deliberate campaign designed to put out false information prior to the 1996 presidential election." He said that USIA did increase staffing and efforts to convince American reporters in Bosnia of the administration's perspective in September, prior to the Bosnian elections. @HWA 47.0 Jail Time for Users of Crypto ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Code Kid The Electronic Communications Bill, proposed in Britain, could send users of encryption products to jail for up to two years. Basically if you send encrypted mail to someone who is being investigated by the police the police can ask you for your keys. If you refuse you could get up to two years in jail. Tip off the person who received the encrypted message and get five years. CNN http://www.cnn.com/TECH/computing/9907/29/ukencrypt.idg/index.html Use encryption, go to jail? July 29, 1999 Web posted at: 11:11 a.m. EDT (1511 GMT) by Douglas F. Gray LONDON (IDG) -- Encryption users could face up to two years in prison for refusing to hand over the keys to their code, according to Britain's proposed Electronic Communications Bill. The bill is causing concern among privacy advocates and opposition parties, who say the bill gives law enforcement wide-reaching power over private Internet communications. Most aggravating, the bill calls for a possible two years in prison for anyone refusing to turn over the encryption key or the message in plain text to law-enforcement officials. It also calls for a five-year prison term for tipping off senders that they are being investigated, according to Caspar Bowden, director of the London-based Foundation for Information Policy Research. Even discussing an investigation in public, such as complaining about alleged abuses of law enforcement to the media, may also be punishable by imprisonment, said Bowden. "Let's say that someone under investigation sends me a message with encryption that can only be decrypted by the receiver. The authorities come to me and tell me that they are investigating someone, but won't tell me who, so they ask for all my private keys," Bowden said. Refusing this request from the authorities could get him two years in prison, said Bowden. In such a case, the authorities would have all of Bowden's private keys, enabling law enforcement to read all encrypted correspondence that was sent to him. Bowden would then have no choice, he said, because by informing anyone of this, and asking them to change their key, he would break the "tipping off" clause of the bill and in turn and face five years imprisonment. "I can't complain to the newspaper, otherwise it's five years in jail. All I can do is go to a secret tribunal," Bowden said. He's not joking: The tribunal is five judges, only two have to participate, and only one has to lay the groundwork, he added. Bowden feels that the entire bill needs to be re-examined by the U.K.'s Department of Trade and Industry. "We would like to see the Electronic Communication Bill be about e-commerce, which is what they said; the law-enforcement section doesn't even belong in it," he added. There is also another method of hiding messages, called steganography. It's not really clear to commentators such as Bowden whether or not steganography is covered by the bill. With steganography, users can "sprinkle an encrypted message" into a photographic format, such as JPEG, or a music format such as MP3, both of which are very popular online. In actuality, the message does not necessarily need to be encrypted, just concealed within the file, according to Bowden. Although the bill does not mention technologies such as steganography, Bowden speculated that the authorities could enforce regulations in those cases by proving that there was a reason to search, such as the existence of a steganography program on the suspect's computer. Douglas F. Gray writes for the IDG News Service. @HWA 48.0 Office97 Users Ripe for the Picking ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Space Rogue A hole in the Jet 3.51 driver (ODBCJT32.DLL) leaves users vulnerable to attack. Such an attack would leave the system in such a state that the attacker could execute shell commands and give full control over your machine to the bad guy. Microsoft has verified the problem and is working on a security bulletin, in the mean time they recommend users upgrade to Jet 4.0. MSNBC http://www.msnbc.com/news/295385.asp Hole opens Office 97 users to hijack Vulnerability in popular Microsoft suite could allow malicious coder to take control of computers without victim knowing By Mark Stevenson MSNBC July 30 ù A vulnerability in Microsoft Office 97 can allow malicious code contained in an Excel 97 worksheet hidden in a Web page or sent in e-mail to take control of online computers without the victimsÆ being aware, Microsoft confirmed Thursday evening THE VULNERABILITY IS CONTAINED in the Jet 3.51 driver (ODBCJT32.DLL) that was shipped with the popular Office 97 software suite. (Microsoft is a partner in MSNBC.) Juan Carlos G. Cuartango, a Spanish Web developer who has discovered other important security holes, reported the problem to the NTBugTraq mailing list Thursday afternoon. Later Thursday, the Microsoft Security Team confirmed the bug in a posting to the same list. ôIf you open a malicious Excel worksheet implementing this vulnerability it will send shell commands to your operating system (Windows NT, 95 and 98 are all affected) that can: (infect) you (with) a virus, delete your disks, read your files,ö Cuartango said in his posting to the list. ôà(T)he worksheet will get full control over your machine.ö The Microsoft posting said the company is preparing to release a security bulletin dealing with the vulnerability. Shortly before 5 a.m. ET Friday, the bulletin had not appeared on the Microsoft Office Update site or the Microsoft security site. ôWeÆve verified that this vulnerability in Jet 3.51 does exist, and urge all customers who are using Jet 3.51 to upgrade to Jet 4.0,ö the Microsoft mail to NtBugTraq said. ôThis vulnerability should be taken seriously. Office 97 users in particular should consider immediately upgrading their database driver to Jet 4.0, as Jet 3.51 is installed by default in Office 97. Office 2000 users do not need to upgrade, as Office 2000 installs Jet 4.0 by default.ö An Excel worksheet that contains code to take advantage of the vulnerability could be hidden in a frame on a Web page or sent in an e-mail. As long as the worksheet contained no macros, there would be no indication to the user who visited the Web page or opened the e-mail that any code had been executed, Cuartango reported. If the file is sent in e-mail, the recipient must be on-line to be affected, Cuartango said. He recommended not opening documents you are not expecting to receive and going off-line before opening e-mail. If the worksheet were instead sent as an attachment to e-mail, the recipient could avoid ill effects by not opening the attachment. @HWA 49.0 China Sends Pirate to Jail ~~~~~~~~~~~~~~~~~~~~~~~~~~ From HNN http://www.hackernews.com/ contributed by Code Kid In what is believed to be the first jail sentence for piracy in China, a man has been sentenced to four years in jail and fined US $2,400. The name of the company or the software was not mentioned. Wired http://www.wired.com/news/news/politics/story/21003.html China Jails a Software Pirate Reuters 2:45 p.m. 29.Jul.99.PDT BEIJING -- China has sentenced a man to four years in jail in what is believed to be the country's first criminal case involving software piracy, state media reported Thursday. A court in the eastern city of Hangzhou fined and sentenced Wang Antao for selling a slightly modified version of a company's software without permission, the China Daily said. Wang would have to pay 20,000 yuan (US$2,400) in fines and 280,000 ($33,800) in compensation to the company, which was not identified. The newspaper said it was the first such case in China, which has struggled to combat rampant piracy, fearing it will impede the growth of its nascent software industry. A study released this month by the US Business Software Alliance and Software & Information Industry Association found that 95 percent of China's newly installed business software in 1998 was pirated. Software piracy cost China $1.2 billion in 1998 -- more than in any other Asian nation, according to the report. @HWA 50.0 MITNICK: FEDERAL GOVERNMENT MANIPULATED THE FACTS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Saturday 31st July 1999 on 7:00 pm CET Did the US government manipulate the facts on the subject of Kevin Mitnick? He and his attorneys say so and are asking a federal judge to unseal a court filing that they claim proves this. Full story below. http://www.zdnet.com/zdnn/stories/news/0,4586,2306704,00.html -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Mitnick: 'I was never a malicious person' By Kevin Poulsen, ZDNN July 30, 1999 4:36 PM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2306704,00.html?chkpt=zdnnstop Kevin Mitnick and his attorneys are asking a federal judge to unseal a court filing that they claim proves the government was guilty of misconduct while building its case against the hacker. The goal, says Mitnick in a rare interview, is to clear his name. "At the beginning of this case the federal government manipulated the facts to allege losses that were grossly inflated," Mitnick said in a telephone interview Thursday night from the Los Angeles Metropolitan Detention Center. "Hopefully, if the court considers this motion and rules upon its merits, it will clear me publicly of the allegations that I caused these significant losses." The motion, filed by defense attorney Don Randolph on July 22, is the latest conflict in a case that's remained unusually acrimonious, considering that both sides reached a plea settlement in March. Under the terms of the agreement, Mitnick pleaded guilty to seven felonies and admitted to penetrating computers at such companies as Motorola (NYSE:MOT), Fujitsu and Sun Microsystems, (Nasdaq:SUNW) and downloading proprietary source code. On Aug. 9, he's expected to be sentenced to 46 months in prison, on top of the 22 months he received for cell phone cloning and an earlier supervised release violation. Mitnick vexed by 'snowball effect' The only sentencing issue left unresolved is the amount of money Mitnick will owe his victims. Prosecutors are seeking $1.5 million in restitution -- a modest figure compared to the more than $80 million the government quoted to an appeals court last year, when it successfully fought to hold the hacker without bail. That figure, though no longer promulgated by prosecutors, vexes Mitnick, who sees a "snowball effect" of bad press that began with a 1994 front-page article in the New York Times. "Because of this assault that was made upon me by John Markoff of the New York Times, then the federal government grossly exaggerating the losses in the case and the damages I caused, I have a desire to clear my name," Mitnick said. "The truth of the matter is that I was never a malicious person. I admit I was mischievous, but not malicious in any sense." Markoff reported on Mitnick for the New York Times, and went on to co-author Tsutomu Shimomura's book, "Takedown: The Pursuit and Capture of America's Most Wanted Computer Outlaw -- By The Man Who Did It," slated as an upcoming movie from Miramax. Markoff's portrayal of Mitnick, and the profit it ultimately earned him, has been the subject of some criticism from Mitnick's supporters, and raised eyebrows with a handful of journalists. Markoff's most enduring Mitnick anecdote is the story that the hacker cracked NORAD in the early 1980s, a claim that was recycled as recently as last May by another New York Times reporter. "I never even attempted to access their computer, let alone break into it," Mitnick said. "Nor did I do a host of allegations that he says I'm guilty of." For his part, Markoff says of the NORAD story: "I had a source who was a friend of Kevin's who told me that. I was not the first person to report it, nor the only person to report it." Government collusion? The July 22 motion filed by Mitnick's attorney accuses the government of coaching victim companies on how to artificially inflate their losses. The filing is based on documents Randolph subpoenaed from Sun, which show that shortly after Mitnick's February 1995 arrest, the FBI specifically instructed Sun to calculate its losses as "the value of the source code" Mitnick downloaded, and to keep the figure "realistic." Following the FBI's advice, Sun estimated $80 million in losses based on the amount they paid to license the Unix operating system. Six other companies responded, using software development costs as the primary calculus of loss. The total bill came to $299,927,389.61, significantly more than the $1.5 million the government says Mitnick inflicted in repair and monitoring costs, and theft of services and the $5 million to $10 million both sides stipulated to for purposes of sentencing. "At the beginning of this litigation, the government misrepresented to the federal judiciary, the public and the media the losses that occurred in my case," Mitnick said. To Randolph, it all smacks of collusion. "What comes out from the e-mails that we have, is that the so-called loss figures solicited by the government were research and development costs at best, fantasy at worst," he said. "I would classify it as government manipulation of the evidence." However, prosecutor David Schindler dismissed Randolph's claims as "silly and preposterous." "What would be inappropriate is to tell them what dollar amount to arrive at. In terms of the methodology, in terms of what is to be included in loss amounts, that direction is something we often provide because we're aware of what components are allowable under law, and which components are not," he said. Schindler said development costs are a valid indicator of victim loss, but acknowledges that putting a dollar figure on software can be difficult. Mitnick claims cover-up Mitnick and his attorney both say there's more to the story, but they can't talk about it. At Mitnick's last court appearance on July 12, the judge granted a government request that any filings relating to victim loss be sealed from the public. "As much as the government would like to, you can't take the recipe for ice and file it under seal and have it become confidential," said Mitnick, who, along with his attorney, is challenging the confidentiality of the loss information, and asking for the motion to be unsealed. Mitnick claims he smells a cover-up. "The government should not be permitted to bury the truth of the case from the public and the media by seeking and obtaining a protective order to essentially force me to enter a code of silence," he said. "Our only concern, as it has been from day one, is the protection of the victims of Mitnick's crimes," prosecutor Schindler said. "Why Mitnick and his lawyers want to continue to harass, embarrass and abuse them remains a mystery to us, but it's something that we will continue to oppose vigorously." Although the software costs are no longer being used against his client, Randolph claimed that by "manipulating the loss figures," the government raises the issue of whether even the more modest $1.5 million calculation is accurate. In the sealed motion, he's seeking an evidentiary hearing to explore the matter, and asking that Mitnick be released on a signature bond pending that hearing. And if Mitnick winds up owing money anyway? "We're asking for sanctions that the government pay the restitution," Mitnick said, "and that the judge recommend that I be immediately designated to a halfway house for the government's misconduct in this case." Excerpt of the Sun documents are available on the Free Kevin Web site, maintained by members of a tireless grass-roots movement that's protested the hacker's imprisonment for years. "I'd like to sincerely thank all my friends and supporters for all the support they've given me over this long period of time," Mitnick said. "I'd like to thank them from my heart." Kevin Poulsen writes a weekly column for ZDTV's CyberCrime. @HWA 51.0 ISPS ACCUSE CHINA OF INFOWAR ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Saturday 31st July 1999 on 1:30 am CET Two Canadian ISPs claim they've traced DoS attacks on their network back to Chinese government offices in Beijing and now accuse "Chinese government crackers with a political agenda" as Wired puts it. The attacks are thought to be motivated because of the ISPs hosting sites of the, last week in China outlawed, Falun Gong religious group. Full story below. http://www.wired.com/news/news/politics/story/21030.html ISPs Accuse China of Infowar by Oscar S. Cisneros 12:00 p.m. 30.Jul.99.PDT Two Canadian ISPs said Friday that their networks were attacked this week by Chinese government crackers with a political agenda. "The hack attempts I could trace [originated with] Chinese government offices in Beijing," said Eric Weigel, director of Bestnet Internet, a Hamilton, Ontario-based ISP. Weigel said he suspected that the "denial of service" attack, which ended at 4 a.m. EST Friday, was motivated by his organization's hosting a Web site for a religious group outlawed in China. "I know the Chinese government doesn't like the Falundafa Gong religion. They've arrested some people, but I don't know if anybody's been shot." The Chinese government last week banned the "wheel of law," or Falun Gong, sect, stating that the group corrupted people's minds, disrupted social order, and sabotaged stability. The nation's state-run television network launched a negative media blitz against Falun Gong. The group, which claims more than 2 million members, advocates meditation and exercise. In April, in a protest at Beijing's Zhongnanhai leadership compound, more than 10,000 Falun Gong members demanded protection for their religion. The government responded by destroying more than a million of the sect's books, tapes, and CDs. If Weigel's hunch is correct, that fury has now extended into the world of the Internet. "The Chinese government didn't even phone me up and say, 'Please remove this site,'" Weigel said. "That's pretty rude." Weigel said he traced the hack attacks back to the Beijing Application Institute for Information Technology and the Information Center of Xin An Beijing. The attackers used two common techniques to take on Bestnet and Nebula Internet Services, a smaller ISP in the nearby town of Burlington: They attempted to penetrate the ISPs' systems and also to flood their servers with incomplete requests for data -- a technique that overwhelms a Web server such that it is unable to serve up a Web site (in this case, Falun Gong's). Neither effort was successful at Bestnet, Weigel said. But the denial of service attack did thwart Nebula Internet Services, which hosted Falun Gong's site until last week. "They didn't have enough bandwidth to handle them, plus they're using a Windows machine," said Weigel. "I couldn't even copy the site using FTP -- they had to physically bring the files on a hard drive." Nebula's owner, Greg Alexander, said that the attacks started a month ago and coincided with media reports of a government crackdown on the sect. "The Chinese government has called the Falun Gong an enemy of the state and so we assumed that it's the Chinese government," he said. "They actually swamped our lines for two days -- we were maxed right out." Alexander also said a US Department of Transportation official contacted him to ask about an attack on a server at the Federal Aviation Administration. The unnamed official told him that the "probe" of the FAA's server originated from one of Nebula's machines. Alexander added that the specific IP address was at the time assigned to Falun Gong. "We didn't have control of our own IP address," he said. The Department of Transportation could not be reached for comment late Friday afternoon. Alexander speculated that if someone made the attack look as if it originated from Falun Gong's IP address, they did so to make "the US government think that these people are bad people." Reuters contributed to this report. @HWA 52.0 PETERSEN INTERVIEW: TRADING CYBERCRIME FOR CYBERPORN ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Saturday 31st July 1999 on 0:30 am CET Recently released hacker and FBI informant Justin Petersen, in an "exclusive interview" with CNN and Time, is claiming to leave behind a life of cybercrime to go into the cyberporn business. CNN will air the interview on Sunday and Monday at 8 pm ET and 10 pm PT. ZDNet. http://www.zdnet.com/zdnn/stories/news/0,4586,2306588,00.html -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- Hacker turning to a life of porn By Joel Deane, ZDNN July 30, 1999 3:02 PM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2306588,00.html?chkpt=zdnnstop Former hacker and FBI informant Justin Petersen is back in the news -- claiming that he is leaving behind a life of cybercrime to join the cyberporn business. CNN and Time is promoting an "exclusive interview" with Petersen, who gained notoriety for informing on hackers Kevin Mitnick and Kevin Poulsen, and was recently released from prison after spending time in custody for parole violations. According to a CNN press release, Petersen talks at length about his life as a "high-tech thief" and Internet pioneer, saying he was "trolling around on the information superhighway when it was just a dirt road." Petersen has multiple convictions for computer crimes, including an attempted electronic bank heist. But Petersen tells CNN he now plans to begin a new life online, free of crime, with an adult Web site. The interview airs on CNN Sunday and Monday at 8 p.m. ET and 10 p.m. PT. @HWA 53.0 GHOSTS IN THE MACHINE ~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Friday 30th July 1999 on 5:30 pm CET Fact: PCs come with dangerous security holes. One of the major problems still is the scripting ability of machines, the ability to run applets and all of this in combination with the Web represent some serious security and privacy issues of which the regulare home user is not always aware of. And it doesn't stop there. This article discusses this with some examples and quotes from major manufacturers. Read it below. http://www.wired.com/news/news/technology/story/20995.html Ghosts in the Machine by Chris Oakes 3:00 a.m. 30.Jul.99.PDT When Richard Smith bought a new Compaq Presario last Friday, he suspected there might be a few holes in the security of the computer's Internet software. Sure enough. Within ten minutes of booting up the PC, Smith had flushed out the software equivalent of an assassin for hire. "I think this is one of the worst problems I've ever seen," said Smith, who has made a side-career during the last year of sniffing out major software holes. Compaq had granted its Internet software potent capabilities. A clever Web page or email message could put out an electronic hit on an unwitting Presario owner using a software demon that comes in the guise of an applet. The applet, called "SpawnApp," was installed by Compaq on its Presario line of PCs as part of its customer service applications. While Compaq intended to streamline customer support over the Net using handy Web tools -- Internet Explorer 4 and Java applications -- the company unwittingly put its customers at risk. "All you need is a little bit of JavaScript to misuse the control. They've left it wide open, so you can run anything. You can give a delete command that deletes everything in the [Windows] My Documents directory." "Anybody can use it because [Compaq's] told the world it's a safe thing." SpawnApp is a bridge, launching any DOS or Windows application. With simple coding, a rogue programmer could access the Java applet from the Net to launch any application on the computer. Programmers could use the applet to mess up some data -- perhaps nab some files and email messages, or change the PC's security settings for further breaches. The problem is apparently the tip of an iceberg that may plague more PCs than even manufacturers know. These ghosts in the software machine only get noticed when people like Smith do some digging. Companies often don't respond in force to alarms until the media spreads the word. Smith said he wasn't the first to arrive on the scene of the dangerous applet. Another programmer, Frank Farance, originally discovered the applet in November 1998, and yet the problem remained. Smith turned up a similar vulnerability on Hewlett-Packard's Pavilion line of PCs only a week earlier. HP moved quickly and provided a fix; Compaq is considering doing the same. With or without fixes, Smith sees the trend as a dangerous one. "If you take HP and Compaq together, they're in the top three or four manufacturers in the United States. They've both been shipping machines for a year which have pretty big openings ... So you've got some pretty big players messing up here." Compaq "signed" its applet, which is a standard security function meant to indicate the program's tasks were designed by the company and therefore safe to execute. But because further steps weren't taken, anyone could misuse the potentially dangerous set of functions, Smith said. Compaq confirmed that under some scenarios, the user may not see any warning if their browser or email program were to encounter malicious code that invokes the applet. "Compaq is looking at the possibility of updating [the system software] so that something like this could not occur," said Jim Ganthier, director of engineering for Presarios. He called the actual exploitation of the security hole highly unlikely, however. Smith said a simple solution to the problem is to delete the .REG (registry) file that makes Compaq a trusted publisher. That file can be found by the name CERTREG.REG, he said. Smith contends the security hole is the latest -- and most serious -- in a growing legacy of dangerous knotholes in standard-issue PC software. Other holes have largely centered on potential access to personal data, such as Microsoft's extraction of hardware-tracking ID numbers during the Windows registration process. Smith and others have also turned up a myriad JavaScript and ActiveX vulnerabilities that can crack a PC's file directories by way of Netscape Navigator or Internet Explorer. Smith considers the latest example severe because of the ability to launch any application on the PC -- without the user ever noticing. So with all these dangers -- caught only when a programmer like Smith pays close attention -- what are the prospects for security in a networked, e-commerce age? The current chain of events -- discovery, disclosure, and company reaction -- is the best, according to free marketeer Justin Matlick, author of Governing Internet Privacy: A Free Market Primer. "The best solution is going to let privacy-conscious consumers and organizations ferret these problems out and force the companies or industries to respond," Matlick said. "I think that the free market is much more responsive to these concerns than regulation could ever hope to be." If that means consumers can expect only a certain level of security on the computers they buy, so be it. "It's more important to me to use the product than it is to protect my privacy -- up to a certain level," Matlick said. Brooke Partridge, electronic support programs manager for Hewlett-Packard, agrees. "We're not going to sell a lot of computers if people are worried about whether or not our systems allow access to their information. Really there is an inherent economic incentive." Trust the market to find and fix holes in time? Nay, industry regulation is the only fix, if you ask electronic privacy advocate Jason Catlett. "That's completely wrong. There are far too few people paying attention to this to bring even a hundredth of the incidents to the attention of the media -- or even the companies themselves." The public has a right to a baseline standard of behavior that's determined by the best principles, Catlett argues. "All that's needed is a simple private right of action for individuals." For example, a PC customer should have the right to go after a company for US$500 if his data is exposed by negligence, he said. "That simple economic incentive would make a lot of companies clean up their act. That's exactly one of the risks that they should have as a routine part of their engineering." Nancy Wong of the Critical Infrastructure Assurance Office said information technology moves too fast for regulations. "There are so many different ways of opening up systems and inserting vulnerabilities unknowingly that it's very difficult to say that government regulation is going to be able to address that. "One of the reasons why I believe it's [a reactive situation] right now is because people really aren't thinking about security on an ongoing basis, or making systems secure at the same time they install systems." Meanwhile, Peter Neumann, a scientist with SRI International and a consultant to the President's Commission on Critical Infrastructure Protection, said Smith's findings are not news -- and only a fraction of the story. "Computer security is an oxymoron -- it doesn't exist. It's a joke. There's no way of fixing it short of producing new operating systems." Neumann predicts that e-commerce will fall on its face when massive dollar transactions begin to depend on the security of today's inadequate networked PCs. For true network security, airtight components like encryption must be built into any Internet computer, Neumann said. "When millions or trillions of dollars [are] going down the tube, people will start paying attention." But according to Compaq's Ganthier, all this worrying is overblown. Vulnerabilities are one thing; actual exploitation is another. "There's a whole bunch of if-then-else statements in there. To me it's like the Intel processor's serial numbers -- nobody's actually been able to demonstrate [an exploit]." Software sleuth Smith said Ganthier's argument is true enough, but only for the time being. "I've been looking at virus stuff for a while, but it's only been since the beginning of 1999 that virus writers have been exploiting email. Yet the capabilities have been there for three or four years." Everyday sabotage exploits may be just down the road in a cyber-crime future. "We just can't say," Smith said. "But we just need to close them up. There are a lot of vulnerabilities out there -- we just can't say which one is the one that will be used." @HWA 54.0 DATABASE PROTECTIONS OK-D ~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Friday 30th July 1999 on 3:00 am CET A bill which is supposed to give providers of database information a weapon against electronic pirates and hackers got approved by a House panel yesterday. The bill gives the FTC the authority to prevent people from obtaining and distributing databases without permission and gives disseminators of real-time stock market information the right to sue hackers and pirates for that same offense. Full story below. http://www.news.com/News/Item/0,4,39929,00.html?st.ne.fd.tohhed.ni Commerce subcommittee OKs database protections By Bloomberg News Special to CNET News.com July 29, 1999, 3:15 p.m. PT WASHINGTON--A House panel approved a bipartisan bill to give providers of database information such as mortgage rates or stock quotes a weapon against electronic pirates and hackers. The measure, passed on voice vote by the Telecommunications, Trade, and Consumer Protections Subcommittee, gives the Federal Trade Commission authority to prevent people from obtaining and distributing databases without permission. A section of the bill, approved last week by the same committee, gives stock exchanges and other disseminators of real-time stock market information the right to sue hackers and pirates. "This bill would, for the first time ever, create a federal stop sign to database privacy," said Rep. Tom Bliley (R-Virginia), who sponsored the bill. "But just as important, the bill will continue to protect consumers' access to information." A coalition of database owners, including financial data compilers, Internet companies, universities, and libraries, has lobbied in favor of the Bliley bill. Bloomberg, the parent company of Bloomberg News, has testified in favor of the bill. "[The bill] represents another arrow...you can seek if your information has been illegally pirated," said Skip Lockwood, coordinator of the Digital Futures Coalition, a lobbying firm that represents the shared interests of the educational and research communities and the computer industry. Support for an alternative bill The New York Stock Exchange, the National Association of Realtors, and other owners of large databases have championed another bill with broader information protections. That bill, sponsored by Rep. Howard Coble (R-North Carolina), has passed the full Judiciary Committee and is awaiting consideration by the full House. The Coble bill affords a wider range of legal protection to database compilers than the Bliley bill, said Edward Miller, policy analyst for the National Association of Realtors. Coble's bill allows database creators to go after pirates through the courts, while the Bliley bill puts the FTC in charge of policing piracy on most databases. The FTC bureaucracy could bog down attempts by real estate agencies to go after hackers who steal their listings, Miller said. In addition, the Bliley bill's definition of "database" could allow pirates to take substantial portions of information with no consequences, he said. "To us, [the Bliley Bill] looks like they have provided a textbook on how to pirate data and do it legally," Miller said. "It's just the wrong approach." Internet companies such as Yahoo and Lycos and financial data companies such as Bloomberg oppose Coble's bill because they say it gives too much protection to companies that compile information, such as the NYSE. They also think it will concentrate ownership of facts in the hands of a few, Lockwood said. "With Coble's bill, there's nothing through the Internet pipelines. There's nothing to pass around," Lockwood said. "You are going to allow a few large owners of mass amounts of information to lock out everybody else." Digital signatures The telecommunications subcommittee also unanimously approved legislation today to give electronic signatures the same legal validity as those penned in ink. The bill would allow e-commerce and trades to take place online without requiring handwritten signatures for documentation. The electronic signatures bill doesn't set a standard for what types of technology would be acceptable as "signatures." While electronic pens, fingerprint scanners, and iris scanners are all currently available, legislators said they didn't want to stifle the technology by setting a standard before the electronic signatures industry had fully developed. Last week, the subcommittee added an amendment to the electronic signatures bill allowing the Securities and Exchange Commission to still require some records filed with the agency to be signed by hand. If the Commerce Committee approves the subcommittee's two bills, they will be submitted to the full House. Copyright 1999, Bloomberg L.P. All Rights Reserved. @HWA 55.0 YET ANOTHER SITE SPITTING OUT PERSONAL INFO ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Friday 30th July 1999 on 2:20 am CET An adult Web site is, due to a malconfiguration, spitting out the names, addresses, emails and credit card numbers of nearly 1000 of its members to anyone with a Web browser. This story also once again proves some people's unwillingness to put some effort in security, "I had informed them about this security issue ... but for some reason they needed to have ... [the site set up that way]." Story below. http://www.wired.com/news/news/culture/story/21001.html Italian Smut Site Left Unzipped by James Glave 2:45 p.m. 29.Jul.99.PDT An adult Web site run by the man who launched the career of Italian porn queen Cicciolina is showing more than just cheek. It's also revealing the names, addresses, emails, and credit card numbers of nearly 1,000 of its members. The site, Diva Futura, is configured in such a manner that several databases containing confidential user information can be easily accessed by anyone with a Web browser. Diva Futura is owned by Italian porn king Riccardo Schicci, who last November was jailed in Italy on charges of running a prostitution racket. He is widely credited as the man who brought the porn movie industry to Italy. "As soon as I figured out that was [Schicci's] site, I smelled something bad and figured out that I wanted to get away," said a former Diva Futura member, now a student of European Studies at a Washington DC university. "I was so stupid and I was right," said the man, who spoke on condition of anonymity. "I did this thing two years ago when this kind of stuff was starting, and now I don't leave my credit card in any adult sites." Schicci was released from prison soon after he was incarcerated. Efforts to reach Diva Futura's current site administrators were unsuccessful and the page remained vulnerable as of Friday morning. Until recently, Web Creations, a New Jersey Web development firm, hosted the site. But the man listed as the site administrator in the Internet Network Information Center database said that the site's current owner had not paid the firm's past-due bill. Anil Gurnani said that the site's owners have moved the operation elsewhere. Gurnani told Wired News in an email, "This site is maintained by the client." He said that the site's technicians knew of the security issue and insisted on leaving the site configured that way. "I had informed them about this security issue ... but for some reason they needed to have ... [the site set up that way]." "This utter and complete lack of respect for private financial data is beyond reprehensible," said the Australian Web site developer who discovered the problem. "It is wildly reckless, and I find it inexcusable," he said in an email directed to the site's administrators. Responding to an email query, one member of the site said that e-commerce is still not widespread in Italy. The member, who lives in Pavia, Italy, said in broken English that he hoped the site would be fixed soon, but took the whole matter in stride. "What can I say?" he wrote. "Me and my friends a night still surfing on the Net, and we seek that URL ... you know who the Italians are ... geek ... really attracted about sex and so on, so I put my [card] number [on] the Net." An examination of the site's data reveals that between December 1997 and June 1998, the site handled approximately US$22,000 worth of membership transactions. As a member of the European Union, Italy is a signatory to the Data Protection Directive, a series of rules that protect the personal data of European consumers. Article 17 of the directive compels companies to secure the personal data of their customers, though specific enforcement measures are left to the discretion of each member nation. Diva Futura hosts images from Italian adult magazines Diva Futura, Bamby, Fans Club, and Le Aventure di Eva Henger. It also features streaming video, chat, and many images of Ilona Staller, more commonly known as Cicciolina. Agence France Presse last fall reported that in 1989 Riccardo Schicci spent time in prison for shooting a hard-core porno film on a public beach. Editor's Note: This story has been corrected. The original article incorrectly stated that Riccardo Schicci was once married to Cicciolina. Wired News regrets the error. @HWA 56.0 CALIFORNIA ADOPTS DIGITAL SIGNATURE LAW ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Friday 30th July 1999 on 1:30 am CET Gov. Gray Davis yesterday signed a bill into a California law which allows contracts with electronic signatures to count as legal documents. The new law applies to firms doing business in California and their customers in all 50 states, according to a statement released by one of the bill's sponsors ETrade Group Inc. Read more. http://www.computerworld.com/home/news.nsf/all/9907294dig Calif. adopts digital-signature law By Kathleen Ohlson California brokerage firms may enter into contracts with their customers through digital signatures, rather than filling out a pile of paperwork. Gov. Gray Davis yesterday signed into California law a bill that allows contracts with electronic signatures to count as legal documents, according to a statement from ETrade Group Inc., one of the sponsors of the bill. The new law applies to firms that conduct business in California and their customers in all 50 states, ETrade said. The Menlo Park, Calif.-based brokerage plans to use digital signatures to open and transfer customer account information, as well as add new privileges, such as margin agreements, ETrade said. The company doesn't know which digital signature technology it will use, but expects to use digital signatures "sometime in 1999," said Tim Alban, a spokesman for ETrade. Gomez Advisors' John Robb said while brokerages may sign up customers faster, they will have to overcome a few obstacles. There isn't any good digital signature technology available now for such applications, and digital signatures are currently not widely adopted, Robb said. Adopting digital signatures is a "state-by-state battle," since brokerages need to register in each state individually. However, this law is a "good first step," he added. Online brokerages will benefit if they can automate more account processing and keep costs down, Robb said. @HWA 57.0 NEW AMMO AGAINST VIRUSES ~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Friday 30th July 1999 on 1:00 am CET When Melissa hit, a lot of companies just pulled the plug on their (e-mail) servers, losing a lot of money because of this. This is definately not the way to go in the future according to the security branch which is shown in the latest network security products. A more proactive way of working is needed and that's just what these new products claim to bring you. ZDNet. http://www.techweb.com/wire/story/TWB19990729S0019 More Ammunition Used In Fight Against Viruses By David Drucker, InternetWeek Jul 29, 1999 (2:40 PM) URL: http://www.techweb.com/wire/story/TWB19990729S0019 In hindsight, IT managers weathered the Melissa virus pretty well. Even so, theirdefensive tactics were less than optimal. "A lot of people just disconnected [their e-mail servers], and that can't happen in the future," said Hurwitz Group analyst Diana Kelley. "The pulling-the-plug option is going to mean a huge loss of business, so being more proactive is going to be the way to go." The latest network security products are designed just for that purpose. Trend Micro is readying version 3.0 of ScanMail for Exchange, which includes tools to block unwanted file traffic until vendor patches are delivered. When a virus outbreak begins, antivirus vendors usually design patches specifically for the new virus and distribute them to customers within a few hours. But the delay can be long enough to significantly stall operations. "What we've learned from Melissa is that companies can't wait until we come up with a pattern file," said Dan Schrader, Trend Micro's vice president for new technology. ScanMail for Exchange 3.0 includes the eManager plug-in, a set of content-filtering controls that let users block files based on details such as file type, file name, or specific wording within messages. David Shaffer, IT manager at Power Construction, began using ScanMail a year ago when his company implemented Microsoft Exchange for its mail system. He said he believes the new features in version 3.0 will help him act faster the next time a major virus hits. "This gives us a way to respond in those critical three or four hours before a patch can be released, without shutting down internal or external mail," Shaffer said. Network Associates is also juicing up its virus-protection software. The updated version of GroupShield for Exchange can detect previously unknown viruses without raising excessive false alarms, the company said. The software uses so-called double heuristic technology, which detects new viruses by monitoring virus-like behavior. It is available now. According to a study on virus prevalence recently released by ICSA.net (formerly known as the International Computer Security Association), the rate of virus infections is doubling every year. The study found that a 1,000-person company experiences about 80 virus incidents per month. "espite good antivirus products, it's clear that the risk is growing," said ICSA.net chairman Peter Tippett. The speed with which viruses are spreading is the biggest danger, Tippett said. "It used to take a year or two for a virus to become predominant," he said. "Now it takes a day or two for Net-enabled viruses to spread. Users now have very little time to prepare." Trend Micro's ScanMail for Exchange 3.0 is scheduled to ship Aug. 15. The software is priced at $5,000, without the eManager plug-in, for up to 250 users; the plug-in is an additional $1,250 and can be purchased for previous versions. Network Associates' GroupShield for Exchange is available as a one-year subscription for 250 to 500 users, at a price of $29 per node, or $19 per node for 5,000 or more users. @HWA 58.0 DOE SECRETARY ORDERS SECURITY BREAK ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Thursday 29th July 1999 on 11:00 pm CET Energy Secretary Bill Richardson will today announce a department-wide work stoppage. This in order to focus more on and increase employee awareness about security issues. This is the third security stand-down this year since the China-affair (China allegedly stole US secrets on nuclear warheads and neutron bombs). Yahoo Dailynews. http://dailynews.yahoo.com/headlines/ts/story.html?s=v/nm/19990729/ts/nuclear_spying_2.html Thursday July 29 12:03 AM ET Energy Secretary Orders Security Training By Tabassum Zakaria WASHINGTON (Reuters) - Energy Secretary Bill Richardson will announce Thursday a department-wide work stoppage to focus on security issues in August as another step to increase employee awareness since the China spying scandal hit the nuclear labs. The nuclear weapons research laboratories have been the focus of security concerns after a congressional report said China stole U.S. secrets on seven nuclear warheads and the neutron bomb. China has repeatedly denied those allegations. The labs have already had two security stand-downs this year in which work stopped so employees could focus on security issues, and will be exempt from the August action. Every employee must realize ``that every job carries with it a security obligation,'' Richardson said. ``I'm ordering this action to ensure that (the Energy Department) is doing everything possible to protect America's secrets and sensitive technologies,'' he said. Richardson has taken other steps such as creating a ''security czar'' position within the department and hiring a retired four-star general to fill it. The Energy Department has been criticized as having an unwieldy bureaucracy that did not pay enough attention to security concerns raised in past years. And some members of Congress want broader change and have proposed restructuring the Energy Department so the nuclear weapons programs are separated into a semi-autonomous agency within the department. Others have called for totally removing the nuclear programs from the department which considers the labs its ``crown jewels.'' Energy Department sites with classified national security activities, excluding the labs, will stop routine work activities on Aug. 3 to participate in a daylong security training. Those sites include the Nevada Test Site, the Y-12 Plant in Oak Ridge, Tennessee, the Kansas City Plant, and the Pantex operation in Amarillo, Texas. By the end of August all other Energy Department facilities, including those that conduct unclassified work, will participate in a similar stand-down. Topics for non-classified areas will include computer network security, responsibilities for hosts of foreign visits, export control regulations, computer hackers and disgruntled employees. @HWA 59.0 EU MEMBERS NOT FOLLOWING DATA-PROTECTION RULES ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Thursday 29th July 1999 on 10:30 pm CET The European Commission is proceeding with infringement proceedings against nine member states because of their failure to comply with the data-protection directive that took effect last October. The member states have received a two month delay to comply with the directive before an official complaint will be made to the Luxembourg-based Court of Justice. Full story. http://www.computerworld.com/home/news.nsf/all/9907294eudata (Online News, 07/29/99 11:43 AM) Most EU states not following data-protection rules By Elizabeth de Bony BRUSSELS -- The European Commission is proceeding with infringement proceedings against nine member states of the European Union for failing to comply with the data-protection directive that took effect last October, the Commission announced today. The Commission has given France, Luxembourg, the Netherlands, Germany, the U.K., Ireland, Denmark, Spain and Austria two months to comply with the directive. Failure to meet this deadline will prompt the Commission to proceed with the final stage of EU infringement proceedings involving a complaint to the Luxembourg-based Court of Justice. Condemnation by the Court of Justice can lead to the imposition of fines. The data-protection directive took effect on Oct. 25, 1998, and establishes a common regulatory framework for data transmission that aims to ensure both a high level of privacy for the individual and the free movement of personal data within the EU. Provisions also limit the transfer of personal data to countries outside the EU that respect similar standards of data protection. These provisions have led to more than two years of negotiations between the EU and the U.S. over whether the U.S. data-protection standards -- which depend largely on voluntary self-regulation -- meet the directive's standards. These discussions are continuing, but the fact that nine of the 15 member states have not even complied with the directive has taken much of the urgency out of these trans-Atlantic talks. To date only Greece, Portugal, Sweden, Italy, Belgium and Finland have fully implemented the directive. @HWA 60.0 EXPERTS WARN ABOUT NEW Y2K-THREAT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Thursday 29th July 1999 on 10:10 pm CET Two of the government's top computer security experts said today at a hearing on Y2K and cyberterrorism before a US Senate Committee that some programmers hired to fix Year 2000 problems may be quietly installing malicious software codes to sabotage companies or gain access to sensitive information after the new year. More. http://dailynews.yahoo.com/headlines/ap/technology/story.html?s=v/ap/19990729/tc/y2k_threats_3.html Thursday July 29 12:22 PM ET Experts Warn of New Y2K Threat By TED BRIDIS Associated Press Writer WASHINGTON (AP) - Two of the government's top computer security experts said today that some programmers hired to fix Year 2000 problems may be quietly installing malicious software codes to sabotage companies or gain access to sensitive information after the new year. The alarms were sounded at a hearing on the ``Y2K glitch'' and cyberterrorism before the Senate Committee on the Year 2000 Technology Problem. ``Many of these (rogue programmers) have no security clearance, do not work for the government, and yet they have access to critical systems that if sabotaged could wreak havoc to our financial institutions and our economy,'' said Sen. Christopher Dodd, D-Conn., the committee's vice chairman. A recent analysis by the Gartner Group predicted electronic thefts worth at least $1 billion, noting that the computer networks of financial institutions, corporations and governments handle transactions worth $11 trillion annually. Michael Vatis, director of the FBI's National Infrastructure Protection Center, said experts hired by U.S. companies to fix their computers could secretly program ``trap doors'' - ways to let them gain access later - or add malicious codes, such as a logic bomb or time-delayed virus that could disrupt systems. ``While systems have been and will continue to be extensively tested, the probability of finding malicious code is extremely small,'' agreed Richard Schaeffer, director of the Defense Department's Infrastructure and Information Assurance program. Neither expert suggested the possible scope of the problem. Schaeffer said problems are complicated by the New Year's rollover, when some computers programmed to recognize only the last two digits of a year may mistake 2000 for a full century earlier. ``It may be difficult to distinguish between a true Y2K event and some other anomaly caused by a perpetrator with malicious intent,'' Schaeffer said. Both experts said the risks were exacerbated by the amount of software repaired by companies overseas. Vatis called the situation ``a unique opportunity for foreign countries and companies to access, steal from or disrupt sensitive national and proprietary information systems.'' Vatis recommended that companies thoroughly check the backgrounds of companies they hire for software repairs. He also said they should test for the existence of trap doors after the repairs, possibly even hiring teams to try to electronically crack into their own networks. The latest warnings come on the heels of new disclosures about White House plans to create a government-wide security network to protect the nation's most important computer systems from hackers, thieves, terrorists and hostile countries. The 148-page proposal from the Clinton administration describes building an elaborate network of electronic obstacles, monitors and analyzers to prevent and watch for potentially suspicious activity on federal computer systems. Sen. Robert Bennett, R-Utah, said today that the scope of the Y2K problem shows that a successful attack on a computer system - such as the network that controls the traffic lights or subway in New York - ``could have as much impact on the economy as if somebody actually dropped a bomb.'' Civil liberties groups complain that the security tools also would make possible unprecedented electronic monitoring, especially because of the increasingly widespread use of computers by the government in almost every aspect of its citizens' daily lives. The White House defended the proposal. ``We are very concerned about protecting privacy rights,'' said Clinton's national security adviser, Sandy Berger. ``But there is also a privacy right in not having hostile entities attack systems. We're not only talking about 17-year-old kids in their basement. We're talking about governments that we know are developing systems to get access to our computer systems.'' The first 500 intrusion monitors would be installed on nonmilitary government computers next year, according to a draft copy of the proposal obtained by The Associated Press. The full system would be completed by May 2003. The plan also suggests ways to convince private companies to monitor their corporate computer networks and share information about threats. But it said explicitly that the government will not force companies to permit federal monitoring of their systems. @HWA 61.0 WILL YOUR CABLE MODEM CENSOR THE WEB? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Thursday 29th July 1999 on 4:30 pm CET According to marketing materials from Cisco Systems cable companies can make use of certain features in Cisco products to behind the scenes slow down and limit access to selected Web sites. A Cisco spokesperson said the technology is available to phone companies, satellite firms and major Internet service providers to protect customers. Protect them from what? Offensive content or the competition of the provider? Read the whole article. http://www.pcworld.com/pcwtoday/article/0,1510,12034,00.html From PC World Online Will Your Cable Modem Censor the Web? Consumer groups balk at Cisco back-end equipment that can limit access to selected sites. by Reuters July 29, 1999, 4:34 a.m. PT A leading supplier of Internet gear for the cable industry is touting products to allow cable companies to block or restrict consumers from reaching any Web site they choose, drawing sharp criticism from public advocacy groups. The revelations comes at a critical juncture for the industry, which is spending billions of dollars to roll out high-speed Internet service over cable lines while fighting national and local efforts to regulate their fledgling new product. The industry has so far blunted the calls for regulation in all but two cities across the country, in part by committing to allow their customers to reach easily any Web site anywhere on the Internet, whether owned by a cable company or not. Putting the Brakes on Rival Sites But according to marketing materials from Cisco Systems, the top maker of computer networking equipment, cable companies will be able to work behind the scenes with sophisticated software included in Cisco products to slow down and limit access to selected Web sites. Without fully cutting off access to unaffiliated sites, the technology allows a cable company to make such destinations appear much more slowly on customers' computers than preferred sites, Cisco claimed in brochures distributed at a recent cable convention in Chicago. Consumer Groups Call for Regulation "This is the owner's manual that they're providing to the cable industry to monopolize the Internet," said Jeff Chester, executive director of the Center for Media Education. The non-profit Washington group, along with Consumers Union, the Consumer Federation of America and the Media Access Project, sent a letter Thursday to the Federal Communications Commission calling for regulation of cable Internet services. The FCC has so far decided to monitor closely the cable Internet market of less than one million subscribers, compared with almost 40 million going online over ordinary phone lines. The latest controversy appeared unlikely to change many minds at the agency. "We share the same goals as the consumer groups and we believe that there should be an open system as well," said Debra Lathen, head of the agency's cable bureau. "Where we diverge is how you get there. We believe the market is going to mandate--to require--an open system." "We will be very watchful; that is our obligation," Lathen added. Thanks, But No Thanks AT&T, whose ExciteAtHome Internet provider has used some Cisco products, pledged not to use the features to discriminate against other Web sites. "We are not in the content-management business; we're in the network management business," said spokesman Mark Siegel. Asked if AT&T would utilize the Cisco products to limit access to any Web sites, Siegel replied: "No, we don't do that." Cisco On the Defensive A Cisco spokesperson said the same technology was made available to all players, including phone companies, satellite firms and major Internet service providers. "This is consistent with Cisco's open standards philosophy and commitment to competition in the marketplace," spokesman Tom Galvin said. "This technology was designed with customers in mind who clearly want tools to protect against offensive content such as hate or obscene material." Cisco's marketing materials cited clearly commercial uses of the software, giving as an example a "push" Web site, which automatically downloads fresh news or other information to a customer's computer at set intervals. "You could restrict the incoming push broadcasts as well as subscribers' outgoing access to the push information site to discourage its use," Cisco's brochure said. "At the same time, you could promote and offer your own partner's services with full-speed features to encourage adoption of your services while increasing network efficiency." Copyright ⌐ 1998 Reuters Limited @HWA 62.0 UNMASKING ANONYMOUS POSTERS ~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Thursday 29th July 1999 on 1:30 pm CET A new legal trend can be seen nowadays now attorneys more and more often use subpoenas to unmask the identities of anonymous posters to online discussion forums. Anyone can use that method in hopes of finding out the identity of an "anonymous" poster, it's a lot harder to defend yourself against it and then there are the other implications. Are certain groups trying to "chill" free speech? Read more about it here. http://www.wired.com/news/news/politics/story/20983.html Unmasking Anonymous Posters Oscar S. Cisneros 3:00 a.m. 29.Jul.99.PDT A new legal trend has privacy advocates up in arms: Attorneys are using subpoenas to unmask the identities of anonymous posters to online discussion forums. And the people whose identities are at stake rarely have the chance to fight back. Anonymous posters can seek to quash the subpoena and preserve their anonymity, said David Sobel, general counsel for the Electronic Privacy Information Center. But first, they have to have notice that the subpoena has been served. See also: Not-So-Privileged Info Without notice, "there's no one in the picture that's ready to challenge the subpoena and bring it before a judge," he said. Since subpoenas in civil lawsuits typically do not require a judge's stamp of approval, Sobel is concerned that individuals and companies are filing bogus lawsuits just to peel back the veil on a user's alias. "Anyone can file a lawsuit," Sobel said. "You get a lawyer. You file a lawsuit against John Doe. And suddenly you have the authority to issue a subpoena." Under their terms of service, many forum operators and ISPs promise not to divulge their users' personal information unless requested by a subpoena or court proceeding, Sobel said. But not all forum operators provide notice when a subpoena has been served. Although it's not written into their terms of service agreements, both America Online and Microsoft's MSN let users know about pending subpoenas, Sobel said. "At least the subscriber has a fighting chance. At least they know what's going on." Other forum operators -- notably Yahoo -- don't provide user notice. That's raised the ire of privacy advocates like Sobel and prompted users to erect a discussion group about the topic in one of Yahoo's forums. "When people start to get the awareness that Yahoo is doing nothing to protect their privacy, that's going to start affecting their traffic," Sobel said. Les French moderates a Yahoo discussion board for "Anonymous Yahoo message posters who are being sued." French started the forum after a former employer used a subpoena to reveal the identities behind his and other users' anonymous posts. "They went down to court, filed a lawsuit, and subpoenaed Yahoo. They didn't send any notice to their users," French said. "In my case, Yahoo provided them information which enabled [the company] to trace me back to Compuserve. And Compuserve, without notifying me, just turned over all the information in my account, including my credit card numbers. The only thing they didn't get was the password to my account." Yahoo could not be reached for comment. But an attorney for the company who brought suit against French said that the company is well within its rights to unmask anonymous posters. French and the other targets of the suit "essentially mixed fact with fiction" when describing the company online, said Stephan Pearson, assistant general counsel for Itex Corporation. Portland, Oregon-based Itex manages the records of bartering transactions between companies. "We made the decision to unmask the identities of people who we thought were making defamatory statements about Itex Corporation," Pearson said. French said that Itex has a different motivation: silencing criticism of the company's many business foibles. He said Itex has been beset by difficulties, including shifts in leadership, an ongoing Securities and Exchange Commission investigation, and being de-listed from the Nasdaq stock exchange for failing to file an annual report in 1998. "I believe the reason Itex filed the suit was to chill speech -- free speech -- there on Yahoo's boards," French said, adding that financial discussion boards are one way to keep companies honest, and remind the board of directors that investors are watching their every action. Pearson disagreed. "Our action is a defamation-of-business kind of action and defamation has never been protected speech," he said. Some defendants named in the suit after they were unmasked were dropped from it when it was determined that their comments didn't harm the company in an illegal way, he added. Regardless of the outcome of French and Itex's suit, privacy experts are worried the trend will only escalate without additional protections for consumers. EPIC's Sobel drew into question not only Yahoo's practices, but TrustE's as well. TrustE awards seals to Web pages and companies who adhere to their strict privacy policy standards. How can TrustE grant Yahoo a privacy seal when the company coughs up personal information without providing notice of a subpoena to users, Sobel asked. "It's not part of our program to require that they do put the user on notice of a subpoena," said Paola Benassi, TrustE spokeswoman. "If it becomes an issue, we'll definitely see what makes the most sense." Benassi defended Yahoo's privacy policy because she said it gives users notice that their information will be given out when Yahoo is served with a subpoena. She speculated that one cause for the lack of subpoena notice may be the volume of subpoenas, and the fact that many users are likely to set up accounts with false information. Privacy advocates remain concerned. "I think the word is rapidly spreading in the legal community that this is a great way to get information," said Sobel. "I think it is only matter of time before it becomes the norm in divorce cases -- the possibilities are endless." @HWA 63.0 AOL Y2KFIX: A HOAX DISGUISED AS A HOAX? ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Wednesday 28th July 1999 on 11:50 pm CET A hoax disguised as a hoax warning is making its rounds around AOL users. It describes a fake "America Online Year 2000 Update" called Y2KFIX.EXE and allegedly fools users into giving up information on their accounts and credit cards. According to Symantic Y2KFIX.EXE doesn't match the characteristics of any known viruses. AOL also denies the existence of such an update. Story below -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- AOL users hit by unusual hoax By Matthew Broersma, ZDNN July 27, 1999 3:44 PM PT URL: http://www.zdnet.com/zdnn/stories/news/0,4586,2303536,00.html A new hoax is making the rounds of AOL users, posing -- confusingly enough -- as a hoax warning. The message, which seems to be sent by a concerned AOL (NYSE:AOL) user, describes a fake "America Online Year 2000 Update" called Y2KFIX.EXE. The fake message allegedly fools users into giving up information on their accounts and credit cards. But no such fake update exists. "There is currently no virus that has the characteristics ascribed to Y2KFIX.EXE," wrote Motoaki Yamamura of Symantec, in a briefing on Symantec's AntiVirus Research Center. "It is a sham, meant only to panic new or inexperienced computer users." Hoaxes thrive on the Internet like nowhere else, since it is so easy to pass along authentic-seeming messages without eliciting a closer examination. As outlined on the Department of Energy's "Internet Hoaxes" page, previous Internet frauds have involved everything from Blue Mountain Cards' greeting cards to a supposed tax on e-mail. Message sounds real The Y2KFIX prank is especially perplexing because there are, in fact, many schemes designed to trick people into revealing their AOL passwords or other personal information. "It sounds absolutely plausible," said AOL spokesman Rich D'Amato. The "AOL Year 2000 Update" hoax e-mail even includes a copy of the scam message it is supposedly warning against. This begins, "Hello, I am Richard Brunner of the AOL TECH Team and we have recently finished work on this project which is the AOL Year 2000 Update." This message is said to include an attachment called Y2KFIX.EXE, which, when executed, causes a fake AOL billing window to pop up, asking users for their names and credit card numbers, among other information. "It looks very legit. It says your billing cycle was up and they need more info," the hoax e-mail warns. Layers of deception AOL representatives say users can double-check the reality of scams at the service's "Neighborhood Watch" section. "This is a rumor perpetuating a hoax pretending to be a virus," D'Amato commented. "Plato wouldn't even accept that as poetry." The same trick e-mail also warms about a "flashing IM," or instant message, that will automatically steal your password unless you "sign off immediately." But AOL said that not only is the "flashing IM" a hoax, it isn't technically possible. @HWA 64.0 NO FBI SURVEILLANCE AFTER CRITICISMS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Wednesday 28th July 1999 on 11:15 pm CET The US Government has decided to not to blindly go through with a plan to create two broad, FBI-controlled computer monitoring systems to protect the nation's key data networks. Critics were afraid that the plan could lead to a surveillance infrastructure with grave potential for misuse. Some inquiries are now first more at place. ZDNet. -------------------------------------------------------------- This story was printed from ZDNN, located at http://www.zdnet.com/zdnn. -------------------------------------------------------------- U.S. backs off private monitoring By Maria Seminerio and Margaret Kane, ZDNN July 28, 1999 2:26 PM PT URL: With criticism rolling in from all quarters, U.S. government officials on Wednesday backed away from a controversial plan to monitor private-sector networks for hacking activity. The proposed Federal Intrusion Detection Network (FIDNET) plan, details of which were revealed by the New York Times Wednesday, has been in the works for at least a year, a National Security Council spokesman told ZDNN. The proposal for the government to monitor critical systems for security breaches arose out of concerns about the growing vulnerability of government computer networks and sensitive private-sector networks to hackers, the spokesman said. (The NSC advises the president on national security issues.) But in spite of indications in a government document on the plan obtained by the Center for Democracy and Technology -- which indicates that private networks would also be watched -- the NSC spokesman denied that there is any plan for the surveillance of private online data. The document outlining details of the plan says the FIDNET monitoring system would cover "critical government and ultimately private-sector information." Information gathered about network security breaches within one of the plan's three "pillars" -- the Department of Defense computer network, other federal networks and private sector networks -- "would also be shared with the other two pillars," according to the document. The document coalesces with comments made by Jeffrey Hunker, senior director for critical infrastructure at the National Security Council, at the Black Hat Security Conference in Las Vegas earlier this month. "We depend on systems that were never meant to protect data from an organized threat," he told ZDNN. "The truth of the matter is that you all [the industry] own the systems that are going to be the target. It is not the federal government systems." However, in an interview with ZDNN, Jim Dempsey, senior staff counsel at CDT, said: "We feel the government should spend its resources closing the security holes that exist, rather than to watch people trying to break in," Jim Dempsey, senior staff counsel at CDT, said in an interview. In spite of assurances from government officials that any monitoring would be largely automated, somewhere down the line a person would have to step into the process, Dempsey said -- and this is where such a system could be abused. The government document detailing the plan acknowledges that "trained, experienced analysts" will have to step in to determine the nature of any suspected security breaches. Looking for 'anomalous activities' But the NSC spokesman said the government does not plan to monitor private networks or read e-mail messages, but rather to "look for anomalous activities" such as evidence of denial of service attacks on military and other government networks. This was little comfort to civil libertarians and other high-tech industry watchers, who blasted the plan as an Orwellian attack on privacy. "I think this is a very frightening proposal," said Barry Steinhardt, associate director of the American Civil Liberties Union, in an interview. "The FBI has abused its power in the past to spy on political dissenters. This type of system is ripe for abuse," Steinhardt said. "I think the threats (of network vulnerability) are completely overblown," said David Sobel, general counsel at the Electronic Privacy Information Center, in an interview. The perceived security threat is leading to "a Cold War mentality" that threatens ordinary citizens' privacy, Sobel said. "The most serious concern about this is that it could move us closer to a surveillance society," said Ed Black, president of the Computer and Communications Industry Association, in an interview. "It's critical that if they do this, they should not retain any of the information that is gathered." ZDNN's Robert Lemos contributed to this report. @HWA 65.0 FEDS CRACK DOWN ON Y2K FRAUD ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by Thejian, Wednesday 28th July 1999 on 10:30 pm CET US regulators (read: Federal Trade Commision) yesterday took action against a Canada-based company that allegedly sold phony Y2K credit card protection against Y2K-related problems. This is said to be a first in a series of Y2K-fraud prevention by the FTC. The case was settled with $ 100.000 fine. Wired. http://www.wired.com/news/news/business/story/20980.html Feds Crack Down on Y2K Fraud Wired News Report 8:10 a.m. 28.Jul.99.PDT US regulators took action Wednesday against a company that allegedly sold phony Y2K credit card protection packages through a large-scale telemarketing effort. The Federal Trade Commission said the company, Canada-based NCCP Ltd., pretended to represent customers' credit card companies, and offered plans to cover theft of cards and special packages to protect against Y2K-related problems. However, the so-called packages contained only adhesive stickers, the FTC said. FTC officials said Wednesday's action was its first enforcement measure concerning a Y2K-related fraud. As part of an agreement with regulators, NCCP agreed to pay US$100,000 to settle charges that they falsely represented a credit card protection program. -- ETrade embraces UK: Online broker ETrade opened its fifth international enterprise Wednesday by launching an online investing Web site in the United Kingdom. The company opened ETrade UK in partnership with Electronic Share Information. The joint venture is the first Internet-only broker to receive regulatory approval in the UK, the companies said in a statement. The introductory rate for online transactions is ?.95 (about US$24). ETrade said the new Web site is only a step in its plan to gird the globe with an electronic trading network. The company's first four sites outside the United States are in Canada, Australia, France, and Sweden. @HWA 66.0 RED HAT DELIVERS LINUX E-COMMERCE SERVER ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by dev, Wednesday 28th July 1999 on 10:10 pm CET Red Hat, a maker of Linux open source software, introduced an e-commerce server package Tuesday that's designed to move small businesses more quickly onto the Internet. The product combines Red Hat's Linux 6.0 and Apache Web server. Integrated into the e-commerce server is RSA Data Security's 128-bit encryption engine. Read more on the interesting combination of open source software and business solutions here. Red Hat Delivers Linux E-Commerce Server By Eileen Colkin, InformationWeek Jul 27, 1999 (5:25 PM) URL: http://www.techweb.com/wire/story/TWB19990727S0026 Red Hat, a maker of Linux open source software, introduced an e-commerce server package Tuesday that's designed to move small businesses more quickly onto the Internet. The Red Hat Linux E-Commerce server combines Red Hat's Linux 6.0 open source operating system, which supports up to four processors with symmetric multiprocessing configuration, with the Apache Web open source server. Integrated into the e-commerce server is RSA Data Security's 128-bit encryption engine. The server package includes Red Hat's Linux 6.0 applications CD, containing applications such as Star Division's StarOffice, which offers word processing, spreadsheet, graphic design, presentation, HTML editor, e-mail/news reader, event planner, formula editor, and other applications. The CD also features IBM's ViaVoice voice-recognition software and Applix's Applixware for Linux, a full-office suite including a developer bundle. Also included in the server package is an e-commerce directory with offerings such as HP's WebQoS, which lets users prioritize Web server traffic based on business criteria, electronic shopping-cart software from MiniVend, and a credit card processing engine from CCVS. As part of the Apache Web server, the Apache ASP module offers multiplatform development, while the Apache DAV module lets users edit, manage, and publish Web pages from the desktop without going through FTP. A Netscape Roaming Module lets the Apache server also act as a Netscape Roaming Access server. Available immediately, the Red Hat Linux E-Commerce Server can be purchased on the Red Hat site or at retail sites for$149. Additional support packages are also available. @HWA 67.0 HACKING IN 1999 ~~~~~~~~~~~~~~~ From http://www.net-security.org/ by BHZ, Monday 26th July 1999 on 4:42 pm CET Our new Special Report, written by anonymous, gives you a retrospective on the past year's underground happenings. "What is a hacker these days? Someone who uses a web browser to hack remote systems? Or is a hacker still defined as it was originally. Hacking is mostly about gaining access to a remote system, not showing off that you outsmarted an admin". You can read about security bugs, hack groups and incidents that marked 1999, in our Special Report entitled Hacking in 1999 | The Current State of Hacking. Hacking in 1999 | The Current State of Hacking. Major Exploits released in 1999 In 1999, many things have happened, the allaire cold fusion bug has been widely advertised and put to use, many servers were compromised by using it, if you look to allot of the website defacement mirror sites, almost all were done by the cold fusion method. Yet another easy bug has been released in 1999 by eEye Digital Security Team, this bug was for the Microsoft IIS server, and again many people have used this method to make a name for themselves. After looking at exploits like this, it makes you wonder what a hacker is these days? Someone who uses a web browser to hack remote systems? Or is a hacker still defined as it was originally. Hacking is mostly about gaining access to a remote system, not showing off that you outsmarted an admin. Major Incidents that have Affected the 'Scene' The first major incident the busting of Eric Burns AKA Zyklon. When companies pressed lawsuits against him for thousands of dollars because he broke into their servers.Up to now he is still not allowed to touch a computer I assume. The second incident was the raiding of members of the well known group gH a.k.a global Hell. An approximate 19 people were raided if not more, not only from gH but from other groups such as Level Seven, team spl0it, milw0rm and IL(Iron Lungs) from HcV/Legion2000 and forpaxe. Kevin Mitnick was screwed around 2+ times, with them changing his court date around continuously and him now having to owe 1 mil. Read more about it at 2600, also support the FREE KEVIN movement. Just recently, a few incidents have happened as a result of John Veransevich otherwise known as JP from AntiOnline. First, Attrition makes a good accusation that JP indeed funded a hacker known as 'so1o' to deface the Senate Government website for him just to make a breaking news story (Although, I am not accusing him of doing this, because it was never proven). Another thing you notice about the "Anti Network" is the AntiCode website, which claims to be "the only place you need" for all of your exploits/network/security tools and utilities. But in reality this site is nothing more than an archive compiled from other known sites and the code ripped by AntiOnline it's self. Second MAJOR incident was when JP shut down a popular IRC server. And the third, probably most devastating to the underground community, was when JP caused Packetstorm Security to shut down, all of Ken Williams files were deleted forever, his work ruined. Not to mention many other things. You can read all those other things at : http://www.attrition.org/negation/index2.html A few conventions have passed, such as Defcon, Defcon is probably the most recognized of all hacker conventions, this year some major things happened at this convention, they had a line-up of great speakers, Carolyn P. Meinel showed up and was not allowed in because she was accused of not being a 'real' reporter (which I will not comment on), and shortly into the Defcon convention, their website was defaced by the very well know coding group known as ADM. Also Rootfest and the Blackhat Briefings have recently passed by. Who has showed up? Many new groups and individuals have showed up in 1999 up to now. To mention a few. and give a decent description of them and their actions + skills. Groups Forpaxe - Forpaxe showed up in early 99, they have been responsible for hitting a record number of .edu domains also quite a few .gov/.mil and numerous others. They are well known to all hackers and media. A member of the past groups Legion2000 and HcV was a part of this group in the beginning, Iron Lungs, which later got raided by the FBI. Now it appears to just be 2 individuals (m1crochip/in0de) which they state on all of their webpage defacements. They do what they do for a reason, so they are a decent group of individuals as far as I am concerned. Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/forpax.html Goat Security - This organization is a definite mentionable, everybody knows and remembers the goat team, it consisted of members of gH, HcV and I think even a few from LoU. They defaced a good amount of websites and made a widely known name for themselves. They definitely knew what they were doing, not like all of the CF(cold fusion) kiddies you see around these days. Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/goat.html gH (global Hell) - Possibly the most world wide known hacker group and most media exposed, gH defaced allot of high profile websites such as Macweek, Peoples Court, The Main Army Page and the Whitehouse. Many members were later raided by FBI agents due to the defacing of the Whitehouse website. They have skill and as far I saw it a very good team of people. This group will always be remembered. Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/gh.html Level Seven - This crew was responsible for numerous defacements, it is rumored also and stated on some of their defacements that members of this group were a part of gH (global Hell) and got raided. This group was another group that hacked for a decent reason. Mentionable mostly because of their tie-ins with gH. None the less they are a good group. Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/l7.html Stonehenge Crew - Not very much to say about this group other than they have a purpose for what they do. They always have a reason for defacing a website they hit. They have done around 14 webpage defacements. It is rumored they are also 'tight' with the known group gH. This is another good group. Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/henge.html Keebler Elves - Well, this group is probably the most skilled up to now in 1999. Many skilled individuals, coders and hacker alike in it, from what is said at least. They are best known for their hacks of the Department of Education, Virgin Records and the Monmouth Army Base. Probably has done the most recognized sites in 1999. And I wouldn't be surprised if they continue to hack big time names. This group deserves allot of respect. Why? Because they aren't like the rest. Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/keebler.html HFD (Hacking for Drunks) - This is another group well known for it's choice of sites to deface. Probably most well recognized for their 20th Century Fox International, Gibson and Blair Witch website hacks. They seem to have a good sense of humor and have done some entertaining defacements. Very good group. But name/logo kind of ripped from HFG(Hacking For Girls). Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/hfd.html bl0w team - A good Brazilian hackers group, consisting of 5 individuals, best noted for their 2600.co.uk and Telemar hacks. They do it all for an adequate reason and do not give up. I think there patriotism is admirable. They also seem to have a good amount of skill dealing with Solaris/NT systems. Mirrors of their Website Defacements http://www.attrition.org/mirror/attrition/bl0w.html INDIANHackers/EHA/Ant1 S3cur1ty Tskf0rc3/MST(Moscow Security Team) Nothing special, not really even worth the time, they did a 'few' sites and were never heard from again. None of them had really any reason for defacing websites other than to make themselves look big. Ant1 S3cur1ty Taskf0rc3 did a few with reason, but it was rare with these 4 groups. Mirrors of all the groups defacements : [INDIANHackers] http://www.attrition.org/mirror/attrition/ndian.html [EHA] http://www.attrition.org/mirror/attrition/eha.html [Ant1 s3cur1ty taskf0rce] http://www.attrition.org/mirror/attrition/asc.html [MST] http://www.attrition.org/mirror/attrition/mst.html -end- Individuals zo0mer - Hit allot of government/military systems and banks. But it appears he removes data from the boxes after he is done. What would be labeled a malacious script kiddie cracker. Mirror of all his/her hacks http://www.attrition.org/mirror/attrition/zoom.html p0gO - Probably best known for his defacing of Time Warner San Diego. Not to mention his mass hack, he appears to have good skills, also is recognized for his association with irc.psychic.com. Mirror of all his/her hacks http://www.attrition.org/mirror/attrition/pogo.html Xoloth1 - Well known hacker from the Netherlands. Hit some well known porn sites and what would appear to be his spotlight defacement Pentagon.co.yu. Xoloth hacks for all the rite reasons. Mirror of all his/her hacks http://www.attrition.org/mirror/attrition/xoloth.html v00d00 - First showed up on the scene doing a hack for Psychic, shortly after doing defacements when he was part of the group Defiance it appears. He appears to hack for the freedom of Kevin Mitnick AKA Condor and against war, racism and allot of problems that happen in the world these days. He does it for a good cause. That is all there is to say. Mirror of all his/her hacks http://www.attrition.org/mirror/attrition/v00.html Mozy - Started hacking for irc.psychic.com, later went individual, noted to be good friends with several known hackers. His defacements are quite humorous if you ask me. Keep it up. Mirror of all his/her hacks http://www.attrition.org/mirror/attrition/mozy.html dr_fdisk^ - Extremely well known Spanish hacker and for being in the group Raza Mexicana. Most well known for compromising such sites as Nic.bo and HBO, Latin America. Another hacker that does it for the freedom of Kevin Mitnick and many other reasons. Mirror of all his/her hacks http://www.attrition.org/mirror/attrition/fdisk.html There are other individuals I missed and they all deserve respect and to be noticed, I didn't for get them because I dislike them, just because this part of the article has gone far enough. What was hit? Aside from all the no-name sites that were hacked. In 1999 there has been several HIGH PROFILE web defacements. Below is a list with a link to the defaced site, provided by Attrition. - Klu Klux Klan - LOD Communication - 200cigarettes Movie - Whitepride - No Limit Records - Hotbot Search Engine - Summercon - eBay - Coca Cola (BE) - US Senate - HBO, Latin America - The White House - Army Main Site - and so many more.... Why do they do it? MOST of the time it is to make a name and become known/noticed, but on some occasions people do it for a reason, to prove faulty security, to protest against a certain problem in the world or a personal dispute. Well that pretty much covers 1999. Most of the remembered parts up to now anyways. Thanks allot, I prefer to remain anonymous. Sites to check out : Rootshell, http://www.rootshell.org Attrition, http://www.attrition.org HNN http://www.hackernews.com OSAll http://www.aviary-mag.com Written by anonymous for HNS (www.net-security.org) @HWA 68.0 Y2K crash test ~~~~~~~~~~~~~~ From http://www.net-security.org/ by BHZ, Sunday 25th July 1999 on 2:21 pm CET Y2K Crash Test (Windows 95/98 version) collects information about your hardware, programs, Windows settings, and data files, tests their functionality during various dates known to cause problems with non-Y2K compliant files, displays comprehensive results, and allows you to print them. Download the program here (1.07Mb): http://www.net-security.org/dload/y2k/nocrash3.exe Screenshot: http://www.net-security.org/dload/y2k/nocrash.jpg Y2K TEST FOR DOS by BHZ, Sunday 25th July 1999 on 2:14 pm CET Y2K TEST for DOS is a millennium bug diagnostic and repair utility used to test how a PC will handle year 2000 dates and beyond. The included fix restores year 2000 compliance by installing a device driver that compensates for non-compliant real-time clocks, thereby fixing BIOS bugs including the Award 4.50G BIOS problem. Just to note it is updated version of the program we wrote about earlier. Download the program here (560kb). http://www.net-security.org/dload/y2k/y2kdos.zip Screenshot. http://www.net-security.org/dload/y2k/y2kdostest.gif 69.0 CASSANDRA GOLD ~~~~~~~~~~~~~~ From http://www.net-security.org/ by BHZ, Sunday 25th July 1999 on 3:11 am CET Cassandra GOLD is new trojan detection and removal program that could be run on windows 95 and windows 98 operating systems. It currently can find 25 trojans NetBus 2.0 NetBus 1.7 NetBus 1.6 BackOrifice 1.20 Masters Paradise 9.7 Deep Throat 1.0 Deep Throat 2.0 Deep Throat 3.0 GirlFriend 1.35 (Old) GirlFriend 1.35 (New) WinCrash 1.03 WEB EX 1.2 Telecommando NetBus 2.01 SubSeven 1.5 GateCrasher 1.2 COMA HACK99 Hack-a-Tack Millenium NetSpy 2.0 OpC BO v2.0 Spying King BladeRunner NetSphere Download Cassandra GOLD US edition or http://www.net-security.org/dload/Cassandra-US.zip Cassandra GOLD Swedish edition. http://www.net-security.org/dload/Cassandra-SE.zip Homepage - http://www.win32software.com. @HWA 70.0 BELL CANADA Y2K TEST ~~~~~~~~~~~~~~~~~~~~ From http://www.net-security.org/ by BHZ, Saturday 24th July 1999 on 11:05 pm CET Bell Canada (www.bell.ca), telephone operator in Canada was working hard on preparing new Y2K-ready system, and yesterday they transferred 7500 customer to the new system. It all worked good for 3 hours, but then the system crashed. So those "lucky ones" couldn't use their phone services for couple of hours, until it was all fixed. @HWA 71.0 [RHSA-1999:025-01] Potential misuse of squid cachemgr.cgi ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Fri, 30 Jul 1999 11:08:07 -0400 From: Bill Nottingham <notting@redhat.com> To: redhat-watch-list@redhat.com Cc: linux-security@redhat.com Subject: [linux-security] [RHSA-1999:025-01] Potential misuse of squid cachemgr.cgi --------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: Potential misuse of squid cachemgr.cgi Advisory ID: RHSA-1999:025-01 Issue date: 1999-07-29 Updated on: Keywords: squid cachemgr.cgi connect Cross references: --------------------------------------------------------------------- 1. Topic: cachemgr.cgi, the manager interface to Squid, is installed by default in /home/httpd/cgi-bin. If a web server (such as apache) is running, this can allow remote users to sent connect() requests from the local machine to arbitrary hosts and ports. 2. Bug IDs fixed: 3. Relevant releases/architectures: Red Hat Linux 6.0, all architectures Red Hat Linux 5.2, all architectures 4. Obsoleted by: 5. Conflicts with: 6. RPMs required: Red Hat Linux 6.0: Intel: ftp://updates.redhat.com/6.0/i386/squid-2.2.STABLE4-5.i386.rpm Alpha: ftp://updates.redhat.com/6.0/alpha/squid-2.2.STABLE4-5.alpha.rpm Sparc: ftp://updates.redhat.com/6.0/sparc/squid-2.2.STABLE4-5.sparc.rpm Source packages: ftp://updates.redhat.com/6.0/SRPMS/squid-2.2.STABLE4-5.src.rpm Red Hat Linux 5.2: Intel: ftp://updates.redhat.com/5.2/i386/squid-2.2.STABLE4-0.5.2.i386.rpm Alpha: ftp://updates.redhat.com/5.2/alpha/squid-2.2.STABLE4-0.5.2.alpha.rpm Sparc: ftp://updates.redhat.com/5.2/sparc/squid-2.2.STABLE4-0.5.2.sparc.rpm Source packages: ftp://updates.redhat.com/5.2/SRPMS/squid-2.2.STABLE4-0.5.2.src.rpm 7. Problem description: A remote user could enter a hostname/IP address and port number, and the cachemgr CGI would attempt to connect to that host and port, printing the error if it fails. 8. Solution: For each RPM for your particular architecture, run: rpm -Uvh <filename> where filename is the name of the RPM. Alternatively, you can simply disable the cachemgr.cgi, by editing your http daemons access control files or deleting/moving the cachemgr.cgi binary. 9. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 80d527634fc8d8d2029532a628b3d924 squid-2.2.STABLE4-5.i386.rpm 65d18747148d7e3dae4249fe65c18c6b squid-2.2.STABLE4-5.alpha.rpm 734f84b949752fe39b5e58555210ff51 squid-2.2.STABLE4-5.sparc.rpm 02a93b0b1985f8d5c77eb8f3e8981eeb squid-2.2.STABLE4-5.src.rpm 175b42cc4b603242fbb95e345c14963c squid-2.2.STABLE4-0.5.2.i386.rpm f8dfc1198e32c645ed57769a44f3aa6d squid-2.2.STABLE4-0.5.2.alpha.rpm 2e11f629d2f15af8442d6b724ea4d020 squid-2.2.STABLE4-0.5.2.sparc.rpm 0ea1522539d2aebf298881571253e13d squid-2.2.STABLE4-0.5.2.src.rpm These packages are PGP signed by Red Hat Inc. for security. Our key is available at: http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nopgp <filename> 10. References: -- ---------------------------------------------------------------------- Please refer to the information about this list as well as general information about Linux security at http://www.aoy.com/Linux/Security. ---------------------------------------------------------------------- To unsubscribe: mail -s unsubscribe linux-security-request@redhat.com < /dev/null @HWA 72.0 [RHSA-1999:022-03] New Samba pacakges available (updated) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Date: Thu, 29 Jul 1999 14:26:26 -0400 From: Bill Nottingham <notting@redhat.com> To: redhat-watch-list@redhat.com Cc: linux-security@redhat.com Subject: [linux-security] [RHSA-1999:022-03] New Samba pacakges available (updated) --------------------------------------------------------------------- Red Hat, Inc. Security Advisory Synopsis: New samba packages for Red Hat Linux 4.2, 5.2, 6.0 Advisory ID: RHSA-1999:022-02 Issue date: 1999-07-22 Updated on: 1999-07-29 Keywords: samba smbd nmbd security Cross references: --------------------------------------------------------------------- Revision History: 1999-07-23: Fix 'Conflicts with' section about smbmount with 2.0/2.2 kernels. 1999-07-29: Add note about %postun of Red Hat Linux 6.0 samba release. 1. Topic: Samba 2.0.5a has been released. Among the fixes in this release are several security issues present in previous Samba releases. 2. Bug IDs fixed: 1321 2557 2625 2779 2923 2982 3715 3. Relevant releases/architectures: Red Hat Linux 6.0, all architectures Red Hat Linux 5.2, all architectures Red Hat Linux 4.2, all architectures 4. Obsoleted by: 5. Conflicts with: The smbmount code shipped with Samba 2.0 is only compatible with the Linux 2.2 kernel, so it has not been built for the Red Hat Linux 4.2 and 5.2 releases. If smbmount support for the 2.2 kernel is needed under Red Hat Linux 4.2 or 5.2, the source RPM can be rebuilt with the following command line (RPM version 3.0 is required): rpm --define "KERN22 yes" --rebuild samba-2.0.5a-<release>.src.rpm The samba package shipped with Red Hat Linux 6.0 (samba-2.0.3-8) has an erroneous post-uninstall script. If this package is upgraded to the errata release, it could cause /var/log/samba and /var/lock/samba to be missing. It is recommended that users of samba under Red Hat Linux 6.0 uninstall the previous release using 'rpm -e samba' before installing the errata release. 6. RPMs required: Red Hat Linux 6.0: Intel: ftp://updates.redhat.com/6.0/i386/ samba-2.0.5a-1.i386.rpm samba-client-2.0.5a-1.i386.rpm Alpha: ftp://updates.redhat.com/6.0/alpha/ samba-2.0.5a-1.alpha.rpm samba-client-2.0.5a-1.alpha.rpm Sparc: ftp://updates.redhat.com/6.0/sparc/ samba-2.0.5a-1.sparc.rpm samba-client-2.0.5a-1.sparc.rpm Source: ftp://updates.redhat.com/6.0/ samba-2.0.5a-1.src.rpm Red Hat Linux 5.2: Intel: ftp://updates.redhat.com/5.2/i386/ samba-2.0.5a-0.5.2.i386.rpm samba-client-2.0.5a-0.5.2.i386.rpm Alpha: ftp://updates.redhat.com/5.2/alpha/ samba-2.0.5a-0.5.2.alpha.rpm samba-client-2.0.5a-0.5.2.alpha.rpm Sparc: ftp://updates.redhat.com/5.2/sparc/ samba-2.0.5a-0.5.2.sparc.rpm samba-client-2.0.5a-0.5.2.sparc.rpm Source: ftp://updates.redhat.com/5.2/ samba-2.0.5a-0.5.2.src.rpm Red Hat Linux 4.2: Intel: ftp://updates.redhat.com/4.2/i386/ samba-2.0.5a-0.4.2.i386.rpm samba-client-2.0.5a-0.4.2.i386.rpm Alpha: ftp://updates.redhat.com/4.2/alpha/ samba-2.0.5a-0.4.2.alpha.rpm samba-client-2.0.5a-0.4.2.alpha.rpm Sparc: ftp://updates.redhat.com/4.2/sparc/ samba-2.0.5a-0.4.2.sparc.rpm samba-client-2.0.5a-0.4.2.sparc.rpm Source: ftp://updates.redhat.com/4.2/ samba-2.0.5a-0.4.2.src.rpm 7. Problem description: Several security issues were present in earlier samba releases. - a denial-of-service attack could be performed against nmbd. - a buffer overflow was present in the message service in smbd (not enabled by default under Red Hat Linux) - a race condition was present in smbmnt that could cause problems if installed setuid root (it is not installed setuid root by default under Red Hat Linux 6.0, and is not present under Red Hat Linux 4.2 or 5.2) Thanks go to Olaf Kirch (okir@caldera.de) for discovering the security holes, as well as the Samba team. 8. Solution: Install the updated RPMs, and restart the affected services by running: /etc/rc.d/init.d/smb restart For each RPM for your particular architecture, run: rpm -Uvh <filename> where filename is the name of the RPM. 9. Verification: MD5 sum Package Name -------------------------------------------------------------------------- 5167d97fb2f0949991555a3b8e86d509 samba-2.0.5a-1.i386.rpm 969d609925bc09f9c113907124828dc6 samba-client-2.0.5a-1.i386.rpm d8091f3fa0aeda8febf3553d5b92f53f samba-2.0.5a-1.alpha.rpm 99f334ef87347877d1b79d4801044547 samba-client-2.0.5a-1.alpha.rpm 58b1afe4c81028435e6cad1325d4bbee samba-2.0.5a-1.sparc.rpm 6e3939fcebba7ace639b766b1cf36cab samba-client-2.0.5a-1.sparc.rpm 5c87d78148a8a224e5f89e5dce9af1ae samba-2.0.5a-1.src.rpm 6ce227464edc1e79cf4433ede6d18c05 samba-2.0.5a-0.5.2.i386.rpm 0f8d4c9606af2fd809c55a6dd3f9beae samba-client-2.0.5a-0.5.2.i386.rpm cb51e889747ed1786996323863f64868 samba-2.0.5a-0.5.2.alpha.rpm f82cfb4807fa9399005a03d6dd65dca5 samba-client-2.0.5a-0.5.2.alpha.rpm d56551d53be6928556bb58517f265e9f samba-2.0.5a-0.5.2.sparc.rpm 371f7de9553d9c86c4b62d2a92c84bf0 samba-client-2.0.5a-0.5.2.sparc.rpm e411e3c19d19ab89d35e834c7d379589 samba-2.0.5a-0.5.2.src.rpm c5d267fc6b47a84f0571f0ce1a7a15aa samba-2.0.5a-0.4.2.i386.rpm 3d07e39245cdc5d8aa0ba8d50e6178f1 samba-client-2.0.5a-0.4.2.i386.rpm f3db3e6f607afbd861610570154fd19d samba-2.0.5a-0.4.2.alpha.rpm 7972cf576734d1b006258a8ca02c80ff samba-client-2.0.5a-0.4.2.alpha.rpm c44a4c13f171f31686d91da3b8370311 samba-2.0.5a-0.4.2.sparc.rpm a6c235a206349e347dfe35ac0064d901 samba-client-2.0.5a-0.4.2.sparc.rpm 0c326cb2a2b0964026d286fb5f6b8079 samba-2.0.5a-0.4.2.src.rpm These packages are PGP signed by Red Hat Inc. for security. Our key is available at: http://www.redhat.com/corp/contact.html You can verify each package with the following command: rpm --checksig <filename> If you only wish to verify that each package has not been corrupted or tampered with, examine only the md5sum with the following command: rpm --checksig --nopgp <filename> 10. References: <19990721023513Z12865037-4222+1570@samba.anu.edu.au> -- ---------------------------------------------------------------------- Please refer to the information about this list as well as general information about Linux security at http://www.aoy.com/Linux/Security. ---------------------------------------------------------------------- To unsubscribe: mail -s unsubscribe linux-security-request@redhat.com < /dev/null @HWA 73.0 CERT« Advisory CA-99-10 Insecure Default Configuration on RaQ2 Servers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CERT« Advisory CA-99-10 Insecure Default Configuration on RaQ2 Servers Originally released: July 30, 1999 Source: CERT/CC See also: Cobalt Networks Security Announcement Systems Affected Cobalt Networks RaQ2 single rack unit Internet servers I. Description A vulnerability has been discovered in the default configuration of Cobalt Networks RaQ2 servers that allows remote users to install arbitrary software packages to the system. RaQ2 servers are configured with an administrative webserver to process remote requests to manage the unit. Systems installed with the default configuration have insufficient access control mechanisms to prevent remote users from adding arbitrary software packages to the system using this webserver. A document published by Cobalt Networks describes the vulnerability and solutions in more detail: http://www.cobaltnet.com/support/security/index.html II. Impact Any remote user who can establish a connection to an administrative port on a vulnerable RaQ2 server can install arbitrary software packages on the server. This access can then be used to gain root privileges on the system. III. Solution Configure your Systems to Guard Against this Vulnerability Install the patches provided by Cobalt Networks: http://www.cobaltnet.com/patches/RaQ2-Security-1.0.pkg (For RaQ2 servers) http://www.cobaltnet.com/patches/RaQ2J-Security-1.0.pkg (For Japanese versions of the RaQ2 system) The CERT/CC wishes to thank Cobalt Networks for their assistance in developing this advisory. This document is available from: http://www.cert.org/advisories/CA-99-10-cobalt-raq2.html. CERT/CC Contact Information Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key. If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/. To be added to our mailing list for advisories and bulletins, send email to cert-advisory-request@cert.org and include SUBSCRIBE your-email-address in the subject of your message. Copyright 1999 Carnegie Mellon University. Conditions for use, disclaimers, and sponsorship information can be found in http://www.cert.org/legal_stuff.html. * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. Revision History July 30, 1999: Initial release @HWA 74.0 MS Security Bulletin: Patch Available for "Malformed Dialer Entry" Vulnerability ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Microsoft Security Bulletin (MS99-026) -------------------------------------- Patch Available for "Malformed Dialer Entry" Vulnerability Originally Posted: July 29, 1999 Summary ====== Microsoft has released a patch that eliminates a security vulnerability in the Phone Dialer accessory in Microsoft« Windows NT«. The vulnerability could be used to run arbitrary code in a userÆs security context on Windows NT systems. Frequently asked questions regarding this vulnerability can be found at http://www.microsoft.com/security/bulletins/MS99-026faq.asp Issue ==== Dialer.exe has an unchecked buffer in the portion of the program that processes the dialer.ini file. This vulnerability could be used to run arbitrary code via a classic buffer overrun technique. The circumstances of this vulnerability require a fairly complicated attack scenario that limits its scope. Dialer.exe runs in the security context of the user, so it would not benefit an attacker to simply modify a dialer.ini file and run it, as he or she would not gain additional privileges. Instead, the attacker would need to modify the dialer.ini file of another user who had higher privileges, then wait for that user to run Dialer. Although the unchecked buffer is present in all versions of Windows NT 4.0, the attack scenario would result in workstations that have dial-out capability being chiefly at risk. The FAQ discusses this in greater detail. Affected Software Versions ========================= Microsoft Windows NT Workstation 4.0 Microsoft Windows NT Server 4.0 Microsoft Windows NT Server 4.0, Enterprise Edition Microsoft Windows NT Server 4.0, Terminal Server Edition Patch Availability ================= Windows NT Server; Windows NT Server 4.0, Enterprise Edition; and Windows NT Workstation 4.0: ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/ NT40/hotfixes-postSP5/Dialer-fix/ Windows NT Server 4.0, Terminal Server Edition: ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/ nt40tse/hotfixes-postSP4/Dialer-fix/ NOTE: Line breaks have been inserted into the above URLs for readability. More Information =============== Please see the following references for more information related to this issue. Microsoft Security Bulletin MS99-026: Frequently Asked Questions, http://www.microsoft.com/security/bulletins/MS99-026faq.asp. Microsoft Knowledge Base (KB) article Q237185, Dialer.exe Access Violation with Phone Entry more than 128 Bytes, http://support.microsoft.com/support/kb/articles/q237/1/85.asp. (Note: It may take 24 hours from the original posting of this bulletin for the KB article to be visible; however, a copy will be immediately available in the patch folder.) Microsoft Security Advisor web site, http://www.microsoft.com/security/default.asp. Obtaining Support on this Issue ============================== This is a fully supported patch. Information on contacting Microsoft Technical Support is available at http://support.microsoft.com/support/contact/default.asp. Acknowledgments ============== Microsoft acknowledges David Litchfield of Arca Systems for discovering this vulnerability and reporting it to us. Revisions ======== July 29, 1999: Bulletin Created. -------------------------------------------------------------------------- THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. ⌐ 1999 Microsoft Corporation. All rights reserved. Terms of Use. @HWA 75.0 Senate asks for input into information infrastructure protection plan ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.fcw.com/pubs/fcw/1999/0726/web-plan-7-29-99.html JULY 29, 1999 . . . 18:15 EDT Citing privacy concerns, Senate asks for input into information infrastructure protection plan BY DIANE FRANK (diane_frank@fcw.com) The Senate today urged federal officials to brief Congress on a Clinton administration plan to protect the federal information infrastructure from cyberattacks. The request followed stories this week in the general press that inaccurately reported that the draft plan would have the FBI monitor interactions with government computers. During a hearing of the Senate Special Committee on the Year 2000 Technology Problem, Sen. Bob Bennett (R-Utah) and Sen. Christopher Dodd (D-Conn.) both called for the draft plan to be released to Congress and asked for a closed briefing within the next few weeks. The National Plan for Information Systems Protection is being developed by the Critical Infrastructure Assurance Office (CIAO), the National Infrastructure Protection Center (NIPC), and other high-level officials and groups within the government. It is based on the critical infrastructure protection plans from agencies and industry required by Presidential Decision Directive 63 and was originally scheduled to be sent to Congress and the president this fall, according to John Tritak, director of the CIAO. Published stories based on a copy of the June 7 draft of the plan that was leaked to a public interest group raised several concerns that the senators felt Congress should know more about, including privacy issues surrounding the monitoring inherent in the proposed Federal Intrusion Detection Network (FIDnet). "The issues, and specifically the FIDnet proposal reported by the [New York] Times, should be the subject of oversight by the Congress, which has yet to receive an official copy of the plan," Bennett said. "I am confident, given the timing of today's hearing, that a copy of the national plan will be forthcoming and that the oversight process can begin." Mail questions to webmaster@fcw.com Copyright 1999 FCW Government Technology Group 76.0 FBI: Beware outside Y2K workers ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ (Online News, 07/29/99 11:43 AM) FBI: Beware outside Y2K workers By Patrick Thibodeau WASHINGTON -- Private companies that have used outside firms to complete year 2000 repair work are running the risk that their systems have been compromised, a top Federal Bureau of Investigation official warned a congressional committee today. Michael Vatis, a deputy assistant director at the FBI and director of the National Infrastructure Protection Center, said he is concerned that Y2K contractors, both foreign and domestic, have used the Y2K remediation process to install malicious code. Vatis said the FBI doesn't have "concrete indications" that any group is planning to "to engage in unlawful intrusions" at the New Year. But the FBI is nonetheless expecting trouble, he said in testimony prepared for today's hearing by the U.S. Senate's Special Committee on the Year 2000 Technology Problem. Y2K contractors could compromise systems by installing trap doors, obtaining root access, implanting malicious code or mapping systems with the intent of selling information to economic competitors or foreign intelligence agencies. Those with the motives and the means to compromise systems include foreign governments for information warfare purposes, as well as those engaged in industrial espionage, terrorism or organized crime, said Vatis. The FBI expects to see increased and possibly violent activities among certain domestic groups. For instance, the coming of the millennium requires Christian Identity adherents to prepare for the "Second Coming of Christ" by taking violent action against their enemies. That kind of activity raises the possibility there could also be an increase in activity in the cyberworld, Vatis said in his testimony. Given "the vulnerabilities [that] could be implanted in critical systems," said Vatis, "it is imperative that the client companies do as much as possible to check the background of the companies doing their remediation work, oversee the remediation process closely, and review new code as closely as possible and remove any extraneous code." Moreover, Vatis advised companies to create "red teams" to try to crack their software and determine if trap doors exist. @HWA 77.0 HPSBUX9907-101 Security Vulnerability Software Distributor (SD) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ HP Support Information Digests =============================================================================== HP Electronic Support Center World Wide Web Service --------------------------------------------------- If you subscribed through the HP Electronic Support Center and would like to be REMOVED from this mailing list, access the HP Electronic Support Center on the World Wide Web at: http://europe-support.external.hp.com Login using your HP Electronic Support Center User ID and Password. Then select Support Information Digests. You may then unsubscribe from the appropriate digest. =============================================================================== Digest Name: Daily Security Bulletins Digest Created: Mon Jul 26 15:00:02 METDST 1999 Table of Contents: Document ID Title --------------- ----------- HPSBUX9907-101 Security Vulnerability Software Distributor (SD) The documents are listed below. ------------------------------------------------------------------------------- Document ID: HPSBUX9907-101 Date Loaded: 19990725 Title: Security Vulnerability Software Distributor (SD) ------------------------------------------------------------------------- HEWLETT-PACKARD COMPANY SECURITY BULLETIN: #00101, 26 July 1999 ------------------------------------------------------------------------- The information in the following Security Bulletin should be acted upon as soon as possible. Hewlett-Packard Company will not be liable for any consequences to any customer resulting from customerÆs failure to fully implement instructions in this Security Bulletin as soon as possible. ------------------------------------------------------------------------- PROBLEM: Buffer overflows in Software Distributor (SD) commands. PLATFORM: HP9000 Series 700/800 running HP-UX 10.XX, and 11.00, plus SD OpenView/ITA on other specific vendor platforms. DAMAGE: Users can gain increased privileges. SOLUTION: Apply the appropriate patch noted below. AVAILABILITY: All patches are available now. ------------------------------------------------------------------------- I. A. Background A serious defect has been identified in the HP-UX SD filesets SW-DIST.RUPDATE SW-DIST.SD-AGENT SW-DIST.SD-CMDS. B. Fixing the problem - Install the applicable patch: SD-UX version B.10.10 on HP-UX release 10.01, 10.10: PHCO_15205 SD-OV version A.01.01 on HP-UX release 10.01, 10.10: PHCO_15205 SD-UX version B.10.20 on HP-UX release 10.20: * PHCO_15206 SD-OV version A.01.02 on HP-UX release 10.20: * PHCO_15206 HP-UX release 10.24: PHCO_19120 HP-UX release 11.00: * PHCO_18183 NOTE: There will be no patches for 10.00 nor 10.30. From http://ovweb.external.hp.com, retrieve the following: SDOV version A.01.02 for NT 3-4X: SDOV_00005 SDOV version A.01.00 sparcSUN 4.1: SDOV_00006 SDOV version A.01.00 sparcSOL 2.3: SDOV_00007 SDOV version A.01.00 sparcSOL 2.4: SDOV_00008 SDOV version A.01.00 sparcSOL 2.5: SDOV_00009 SDOV version A.01.00 AIX 3.2: SDOV_00010 SDOV version A.01.00 AIX 4.1: SDOV_00011 SDOV version A.01.00 AIX 4.2: SDOV_00012 SDOV version A.01.00 SNI5.42: SDOV_00013 NOTE: For HP OpenView IT/Administration (ITA) version 3.10 or lower, please apply the SD-OV patches to all the managed nodes AFTER the installation of the ITA agent. Older, obsolete versions of Software Distributor which are not listed above are vulnerable to this security problem. There are no patches available nor will any be created for these versions. If you are using one of these, you should upgrade to a newer version. These older versions may have been installed as standalone HP OpenView Software Distributor products, or as part of HP OpenView IT/Administration products. For SD-UX version A.02.01 and newer, do not apply this patch. This "just released" A.02.01 version does not have the security problem and customers **should not** attempt to apply a patch to this version. A.02.01 applies to HP-UX 11.00 & 10.20, to Solaris 2.5/2.6, and to AIX 4.2/4.3. For questions concerning SD-OV issues related to this bulletin #101, send e-mail to: SDOV@security.hp.com C. To subscribe to automatically receive future NEW HP Security Bulletins from the HP Electronic Support Center via electronic mail, do the following: Use your browser to get to the HP Electronic Support Center page at: http://us-support.external.hp.com (for US, Canada, Asia-Pacific, & Latin-America) http://europe-support.external.hp.com (for Europe) Login with your user ID and password (or register for one). Remember to save the User ID assigned to you, and your password. Once you are in the Main Menu: To -subscribe- to future HP Security Bulletins, click on "Support Information Digests". To -review- bulletins already released from the main Menu, click on the "Search Technical Knowledge Database." Near the bottom of the next page, click on "Browse the HP Security Bulletin Archive". Once in the archive there is another link to our current Security Patch Matrix. Updated daily, this matrix categorizes security patches by platform/OS release, and by bulletin topic. The security patch matrix is also available via anonymous ftp: us-ffs.external.hp.com ~ftp/export/patches/hp-ux_patch_matrix D. To report new security vulnerabilities, send email to security-alert@hp.com Please encrypt any exploit information using the security-alert PGP key, available from your local key server, or by sending a message with a -subject- (not body) of æget keyÆ (no quotes) to security-alert@hp.com. Permission is granted for copying and circulating this Bulletin to Hewlett-Packard (HP) customers (or the Internet community) for the purpose of alerting them to problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to HP, and provided such reproduction and/or distribution is performed for non-commercial purposes. Any other use of this information is prohibited. HP is not liable for any misuse of this information by any third party. ________________________________________________________________________ -----End of Document ID: HPSBUX9907-101-------------------------------------- @HWA 78.0 NSA spying on Americans? ~~~~~~~~~~~~~~~~~~~~~~~~ Big Brother Is Listening But Is He Breaking the Law When He Does It? Some fear the United StatesÆ biggest spy agency is using new technology to spy illegally on Americans. (Thomas Schmid/ABCNEWS.com) By David Ruppe ABCNEWS.com N E W Y O R K, July 27 ù Is Uncle Sam illicitly reading your e-mail? Listening in on your telephone calls? Scanning your faxes? Some in Congress suspect advances in communications technology in recent years may have enabled AmericaÆs biggest, and most secret, spy agency, the National Security Agency, to greatly increase its eavesdropping powers at the expense of AmericansÆ privacy. But they canÆt be sure without a thorough congressional examination into the agencyÆs practices. And, they say, the NSA has not yet provided all the information requested by the House Select Intelligence Committee, which is looking into the question. That the National Security Agency intercepts AmericansÆ missives is clear. Observers point to the agencyÆs practice of intercepting massive volumes of communications through spy satellites and by listening to commercial communications satellites, which inevitably draws in the communications of U.S. citizens for whom the agency has no court order. ôI have a problem with what the program appears to be doing, and that is, invading the privacy rights of American citizens without any reason, any court order, without any reasonable cause, without any probable cause, almost a dragnet invasion of privacy,ö says Rep. Bob Barr, R-Ga., one of the NSAÆs most outspoken critics. Intercepting U.S. Communications Government officials admit the NSAÆs collection methods do draw in communications made by U.S. citizens. ôRead the statute, the executive order, the legislative history, and what youÆll find is the underlying assumption is that you canÆt avoid collecting U.S.-person information incidentally if you are going to do foreign intelligence collection,ö says an official familiar with the agency. The NSA maintains that it follows the laws and procedures Congress approved in the 1970s and 1980s for analyzing, retaining and disseminating that information, which were designed to balance the agencyÆs needs for gathering information with citizensÆ privacy rights as guaranteed by the ConstitutionÆs Fourth Amendment. According to classified procedures described by government officials, if the NSA incidentally obtains a communication made by or to a U.S. citizen or organization in the United States for which there is no warrant or court order, the NSA can keep the message but must remove the name of the citizen or company. The law also includes an exception: The name of the person can be retained in the message, included in analysis, and disseminated within the government, the official familiar with the agency notes, if NSA officials judge it is ônecessary to understand foreign intelligence information or assess its importance.ö ôThere are always judgments: æIs it necessary to understand the foreign intelligence requirements?Æ And people have to make those difficult choices all of the time,ö the official says. ôAll I can tell you is, [they] err on the side of caution.ö Limited Oversight Still, critics say there is no way to be sure the NSAÆs judgments consistently respect citizensÆ rights unless the congressional committees responsible for overseeing those rights have full access to information on how the agency applies the laws. The chairman of the the House Select Intelligence Committee, Rep. Porter Goss, R-Fla., has asked for all legal opinions and guidance provided by the NSAÆs legal office to the agency. Such guidance, which is supplied to the NSAÆs operations employees and other decision-makers, could show how the agency is applying the laws that restrict collection of information on Americans. Goss has not asserted that the NSAÆs collection activities are breaking the law. But he does seem concerned ù like Barr ù that the agency, through its interpretation of the laws, may be assuming greater powers ôin light of the enormous technological advances that have been made in the past several years.ö The committee needs the information ôto be sure the NSA General CounselÆs Office was interpreting NSAÆs legal authorities correctly and that NSA was not being arbitrary and capricious in its execution of its mission,ö he wrote. The NSAÆs General CounselÆs office has turned over some of the legal guidance, but it has declined to surrender all such communications, invoking, in a most unusual move, executive privilege. Unreasonable Request? The fact that the NSA is not turning over all of the requested information suggests Fourth Amendment rights against unreasonable searches and seizures may be in jeopardy, says Barr, a former CIA analyst who is not on the committee. ôIt certainly raises that suspicion and it doesnÆt serve them well to do that.ö BarrÆs suspicions seem to have found sympathy in the House, which amended its Intelligence Reauthorization bill with a provision by Barr that would require the NSA to make an annual report explaining its interpretation of the laws, including all materials showing its interpretation. Intelligence Gathering Regulation in America 1789 to 1966: Electronic surveillance basically was not regulated. 1928: The Supreme Court rules in Olmstead vs. United States that a wiretap on a phone did not violate Fourth Amendment rights against search and seizure. 1934: Congress enacts the Federal Communications Act, which prohibited the interception of any communications and the divulgence of the contents of intercepted communications by federal agents without a court order or a warrant. 1966: The Supreme Court rules in Katz vs. United States that basically all forms of eavesdropping require a warrant or court order. It ruled the Fourth Amendment allows for the protection of a person, not just a personÆs property, against illegal searches, so that whatever a citizen ôseeks to preserve as private, even in an area accessible to the public, may be constitutionally protected.ö 1968: Congress codifies the Katz decision. Establishes requirements for obtaining a warrant, including demonstrating probable cause to a court, and limits to warrants. Sec. 2511 of the statute says warrants still are not needed for foreign intelligence electronic surveillance and national security surveillance. 1972: Supreme Court rules in 1972 that domestic security cases are law enforcement cases, not foreign intelligence cases, and so require a warrant to target a U.S. citizen. If there is a connection to a foreign power or agent of a foreign power then no court order is needed. 1975-1976: Church and Pike Committee investigations, specially ordered by Congress, expose government electronic surveillance collection, processing, retention, and dissemination of information on U.S. citizens. 1976 & 1977: Senate, then House, creates Select Intelligence Committee for overseeing activities of the U.S. intelligence community. 1978: Congress passes Foreign Intelligence Surveillance Act, that regulates foreign intelligence electronic surveillance. It requires a special court order procedure to authorize electronic surveillance for intelligence purposes on targeted U.S. persons. Ensuing regulations, which are classified, set out procedures for handling foreign intelligence electronic surveillance. The NSAÆs position has been it has nothing to hide and has no problem fulfilling requests for specific information. But as last Thursday, the agency continued to view the committeeÆs request for all legal opinions and discussions as unreasonable. ô[They] have no problem providing information on any subject,ö says the government official familiar with the agency, who explained the NSAÆs position. ôBut there has got to be some principle. The executive branch has to retain some information.ö Turning over all legal guidance to the committee, the official argued, would be an enormous task and might also discourage employees from seeking the legal officeÆs advice in the future. æCloak of SecrecyÆ Goss, in a May committee report, rejected such arguments out of hand, reminding the agency of its legal requirement to furnish ôany information or material concerning intelligenceö requested by the House and Senate intelligence committees. The agencyÆs refusal to release information requested by the committee could ôseriously hobble the legislative oversight process,ö and would ôresult in the envelopment of the executive branch in a cloak of secrecy,ö he wrote the chairman. ôWithout access to such documents, Congress would be left only with the æspinÆ the executive branch agency opted to provide to the legislative branch,ö Goss wrote. Barr concurs. ô[NSA officials] are not the ones to tell the oversight folks what they can see,ö he says. ôIf they can, then there is hollow oversight, and thatÆs arrogance.ö X-Files or Reality? If you think suspicions of government eavesdropping on Americans sounds more like the stuff of the TV show X-Files than reality, you only have to go back to the 1970s to be dissuaded. Congressional hearings then revealed the NSA had been engaging in serious abuses of U.S. citizensÆ Fourth Amendment rights. In short, the agency had been eavesdropping on hundreds of controversial American figures who had nothing to do with foreign intelligence, such as the Rev. Martin Luther King Jr., had delivered the intercepted information to other agencies, and had kept files on the figures. Following the hearings, Congress in 1978 passed the Foreign Intelligence Surveillance Act, restricting to a large extent the spy agencyÆs ability to collect information on Americans. The House and Senate Select Intelligence Committees were created to oversee the agencies. Few experts now believe the NSA could be doing anything so serious today. ôIf you ask me whether they are consciously ignoring all of those restrictions, my best guess would be no,ö says Jeffrey Richelson, an intelligence analyst with the nongovernmental, nonprofit National Security Archive. ôThis is not the Vietnam War, this is not that period of time, and Nixon is not president.ö James Bamford, author of the definitive book on the NSA, The Puzzle Palace, agrees. ôI donÆt think itÆs as big a problem as some out there are pushing it,ö he says. ôOn the other hand, it has been 25 years since thereÆs been a real hard-nosed congressional probe into intelligence, so they could probably get away with quite a bit at this point.ö According to an official familiar with the NSA, in the 1970s the agency abandoned practices designed to get around the laws such as ôreverse targeting.ö Reverse targeting occurred when an NSA employee purposely conducted a search on an approved subject so that he could collect information on a person for whom there was no warrant. ôTo talk about what NSA used to do in the 1960s and 1970s, conclude thatÆs what [theyÆre] doing now à is just living in a dream world,ö says the official. ôThat simply isnÆt reality.ö @HWA 79.0 AOL messaging policy might risk cable deals ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.news.com/News/Item/Textonly/0,25,39758,00.html AOL messaging policy might risk cable deals By Reuters Special to CNET News.com July 27, 1999, 3:25 a.m. PT URL: http://www.news.com/News/Item/0,4,39758,00.html America Online might back off efforts to block rival "instant messaging" services because the actions threaten to undermine its lobbying push to get access to high-speed cable Internet lines, public policy analysts said yesterday. Over the past few days, engineers at the No. 1 online service worked diligently to thwart efforts by Microsoft and Yahoo to allow consumers using their messaging products to connect with AOL customers and accounts. So-called instant messaging programs are used by tens of millions of Internet surfers to send and receive quick text messages that pop up immediately on the computer screens of their online pals. AOL is by far the market leader, with more than 80 million users of its two instant messaging products. AOL executives offered a variety of explanations for their efforts to block competitors' access, including that Microsoft had put the security and privacy of their customers at risk--a charge Microsoft vehemently denied. But analysts said that even if AOL was factually correct in some of its arguments, the moves would hurt the company's credibility on the cable open access issue where it is pushing to have exclusive deals banned. Cable companies have required customers buying high-speed net access over cable lines to also buy Internet services like email and Web page hosting from them. The exclusive deals are unfair to other Internet service providers, AOL argues. "Open is open," said Legg Mason Precursor Group analyst Scott Cleland, who has long predicted that AOL will ultimately prevail and gain access to cable high-speed Internet services. "When you're denying consumers a choice of something, it looks bad in any case." Online analyst Gary Arlen, president of Arlen Communications, predicted AOL's position on cable access would ultimately trump its decision to close up its instant messaging product. Cable companies like AT&T "will use AOL's instant messaging position as a defense," Arlen said. "Cable open access is truly the much bigger, longer-term issue. I don't know how the IM deal is going to work but I think that one will get settled." In fact, AT&T general counsel Jim Cicconi did just as Arlen predicted, issuing a statement calling AOL's moves "hypocritical and antithetical to the very ethos of the Internet." Some of AOL's supporters on the cable issue noted that cable was a regulated monopoly running on public property, as opposed to AOL's development of a software product for the unregulated Internet. But few seemed eager to enter the instant messaging fray on the record. Until recently, each of the various instant messaging products was a separate and incompatible communications tool, allowing contact only with others using the same product. Microsoft last week introduced a product called MSN Messenger that promised communications with people using AOL's instant messenger as well. To make the feat possible, Microsoft's messenger software asked users for their AOL user name and password. The information was not sent to Microsoft but allowed the Microsoft software to log users into AOL's network. AOL then changed the way its network was set up so Microsoft users were blocked out. Microsoft responded with a quick fix and, after several rounds, Microsoft said late yesterday that its newest version was communicating with AOL users. "There's a right way and a wrong way," said AOL spokeswoman Ann Brackbill, defending her company's right to block MSN. "But without the right coordination and standards, the privacy and security of consumers is going to be at risk." AOL will support the development of a universal Internet standard for connecting all instant messaging software, Brackbill added. "The only issue here is how the industry will work together to overcome the technical obstacles to interconnecting the various IM systems," she said. Microsoft product manager Deanna Sanford said AOL had in the past declined to support such an industry-wide effort underway at the Internet Engineering Task Force, a consensus-based standards writing body. "Ultimately, it would be great if we could all support some standards," Sanford said. "It would be great if AOL would." Story Copyright ⌐ 1999 Reuters Limited. All rights reserved. @HWA 80.0 Study calls for reserve virtual IT warfare unit ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.fcw.com/pubs/fcw/1999/0726/fcw-newsreserve-07-26-99.html JULY 26, 1999 Study calls for reserve virtual IT warfare unit BY DANIEL VERTON (dan_verton@fcw.com) A year-long study completed last week by a senior panel of Defense Department officials recommended an unprecedented expansion in the role the reserves play in national defense, including the formation of a virtual cyberdefense unit to protect the nation's critical infrastructure. The study, Reserve Component Employment Study 2005, was initiated in April 1998 at the request of Defense Secretary William Cohen and concluded that the reserves are "particularly well-suited to homeland defense missions." In addition, the study called for the formation of a "joint [reserve component] virtual information operations organization" and tasked various senior-level DOD organizations to complete a "proof of concept" study for creating the unit by June 30, 2000. The new reserve cyberdefense unit "would consist of individuals with information technology skills who could perform their duties from dispersed locations rather than working as a single consolidated unit at a specific training center," the report said. To accomplish their mission of protecting various critical infrastructure nodes, the unit would communicate from existing reserve centers and other DOD facilities across the country that have access to the Secret Internet Protocol Routing Network. To form the new unit, the study recommended looking for reserve members in regions of the country where high concentrations of IT skill already exist. In addition, the study suggested that the reserves consider recruiting high-tech-savvy people from the civilian sector, requiring them to join the reserves for a specific number of years in exchange for high-tech training provided by DOD. Establishing a "virtual organization" also would go a long way toward solving the department's problem of retaining personnel with critical IT skills and may allow DOD to reduce its reliance on external contractor support, the report said. "A 'virtual organization' [also] could support the Joint Task Force [for] Computer Network Defense," the report said. Cohen established the JTF-CND in December 1998 to monitor and take defensive actions against hackers and other unauthorized users who try to penetrate DOD networks. Rick Forno, a security officer for Network Solutions Inc. and the former senior security analyst at the House of Representatives' Information Resources Security Office, said the report's recommendation to use the reserves for cyber defense "is a great idea" and represents one of DOD's more innovative initiatives. "I'm thrilled that DOD is looking to go outside the box on the Info-Protect/InfoCorps idea in the reserve components," said Forno, who proposed a similar idea to DOD a year ago. However, "it comes down to endorsement and support from senior leadership [whether or not] they let this organization function as intended," he said. Anthony M. Valletta, vice president of C3I systems for SRA Federal Systems and former acting assistant secretary of Defense for command, control, communications and intelligence, said the concept of using the reserves in this manner is one that the intelligence community has proven works. "When we did this with the intelligence community, it worked extremely well," Valletta said. "We have a lot of expertise in the reserves that we need to take advantage of." The main challenge facing the reserve cyberdefense corps idea, according to Valletta, is training and equipping the reserves to carry out the mission. "We have to keep up with the technology, and the reserves have to have the latest capabilities," Valletta said. "That is a major change of philosophy in terms of equipping the reserves." However, the idea of establishing a JTF for Homeland Defense also is an idea that some groups, particularly civil liberties organizations, may question. "The main issue is the Posse Comitatus Act and the limits on military activity within the U.S.," said Mark Lowenthal, former deputy assistant secretary of State for intelligence and now a member of Valletta's C3I consulting team at SRA. "If it is limited to what are clearly DOD facilities, then there should be no problem," he said. "If it steps over that line, then there are some legal issues that have to be addressed." Other recommendations contained in the report include using the reserves as part of a Joint Task Force headquarters for Homeland Defense, which would work with the Federal Emergency Management Agency and other civil authorities to coordinate responses to attacks involving nuclear, chemical and biological weapons, and increasing the use of smart card technology to reduce delays in processing reserve members for active-duty assignments. @HWA 81.0 CERT IN-99-04: Similar Attacks Using Various RPC Services ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ CERT« Incident Note IN-99-04 The CERT Coordination Center publishes incident notes to provide information about incidents to the Internet community. Similar Attacks Using Various RPC Services Thursday, July 22, 1999 Overview We have recently received an increasing number of reports that intruders are using similar methods to compromise systems. We have seen intruders exploit three different RPC service vulnerabilities; however, similar artifacts have been found on compromised systems. Vulnerabilities we have seen exploited as a part of these attacks include: CA-99-08 - Buffer Overflow Vulnerability in rpc.cmsd http://www.cert.org/advisories/CA-99-08-cmsd.html CA-99-05 - Vulnerability in statd exposes vulnerability in automountd http://www.cert.org/advisories/CA-99-05-statd-automountd.html CA-98.11 - Vulnerability in ToolTalk RPC Service http://www.cert.org/advisories/CA-98.11.tooltalk.html Description Recent reports involving these vulnerabilities have involved very similar intruder activity. The level of activity and the scope of the incidents suggests that intruders are using scripts to automate attacks. These attacks appear to attempt multiple exploitations but produce similar results. We have received reports of the following types of activity associated with these attacks: Core files for rpc.ttdbserverd located in the root "/" directory, left by an exploitation attempt against rpc.ttdbserverd Files named callog.* located in the cmsd spool directory, left by an exploitation attempt against rpc.cmsd Exploitations that execute similar commands to create a privileged back door into a compromised host. Typically, a second instance of the inetd daemon is started using an intruder-supplied configuration file. The configuration file commonly contains an entry that provides the intruder a privileged back door into the compromised host. The most common example we have seen looks like this: /bin/sh -c echo 'ingreslock stream tcp wait root /bin/sh -i' >> /tmp/bob;/usr/sbin/inetd -s /tmp/bob If successfully installed and executed, this back door may be used by an intruder to gain privileged (e.g., root) access to a compromised host by connecting to the port associated with the ingreslock service, which is typically TCP port 1524. The file names and service names are arbitrary; they may be changed to create an inetd configuration file in a different location or a back door on a different port. In many cases, scripts have been used to automate intruder exploitation of back doors installed on compromised hosts. This method has been used to install and execute various intruder tools and tool archives, initiate attacks on other hosts, and collect output from intruder tools such as packet sniffers. One common set of intruder tools we have seen is included in an archive file called neet.tar, which includes several intruder tools: A packet sniffer named update or update.hme that produces an output file named output or output.hme A back door program named doc that is installed as a replacement to /usr/sbin/inetd. The back door is activated when a connection is received from a particular source port and a special string is provided. We have seen the source port of 53982 commonly used. A replacement ps program to hide intruder processes. We have seen a configuration file installed at /tmp/ps_data on compromised hosts. Another common set of intruder tools we have seen is included in an archive file called leaf.tar, which includes serveral intruder tools: A replacement in.fingerd program with a back door for intruder access to the compromised host eggdrop, an IRC tool commonly installed on compromised hosts by intruders. In this activity, we've seen the binary installed as /usr/sbin/nfds Various files and scripts associated with eggdrop, many of which are installed in the directory /usr/lib/rel.so.1 A replacement root crontab entry used to start eggdrop It is possible that other tools and tool archives could be involved in similar activity. In some cases, we have seen intruder scripts remove or destroy system binaries and configuration files. Solutions If you believe a host has been compromised, we encourage you to disconnect the host from the network and review our steps for recovering from a root compromise: http://www.cert.org/tech_tips/root_compromise.html In many cases intruders have installed packet sniffers on compromised hosts and have used scripts to automate collection of the output logs. It may be the case that usernames and passwords used in network transactions with a compromised host, or on the same network segment as a compromised host, may have fallen into intruder hands and are no longer secure. We encourage you to address password security issues after any compromised hosts at your site have been secured. You should also review the state of security on other hosts on your network. If usernames and passwords have been compromised, an intruder may be able to gain unauthorized access to other hosts on your network. Also, an intruder may be able to use trust relationships between hosts to gain unauthorized access from a compromised host. Our intruder detection checklist can help you to evaluate a host's state of security: http://www.cert.org/tech_tips/intruder_detection_checklist.html We encourage you to ensure that your hosts are current with security patches or work-arounds for well-known vulnerabilities. In particular, you may wish to review the following CERT advisories for suggested solutions: CA-99-08 - Buffer Overflow Vulnerability in rpc.cmsd http://www.cert.org/advisories/CA-99-08-cmsd.html CA-99-05 - Vulnerability in statd exposes vulnerability in automountd http://www.cert.org/advisories/CA-99-05-statd-automountd.html CA-98.11 - Vulnerability in ToolTalk RPC Service http://www.cert.org/advisories/CA-98.11.tooltalk.html We also encourage you to regularly review security related patches released by your vendors. This document is available from: http://www.cert.org/incident_notes/IN-99-04.html. CERT/CC Contact Information Email: cert@cert.org Phone: +1 412-268-7090 (24-hour hotline) Fax: +1 412-268-6989 Postal address: CERT Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh PA 15213-3890 U.S.A. CERT personnel answer the hotline 08:00-20:00 EST(GMT-5) / EDT(GMT-4) Monday through Friday; they are on call for emergencies during other hours, on U.S. holidays, and on weekends. Using encryption We strongly urge you to encrypt sensitive information sent by email. Our public PGP key is available from http://www.cert.org/CERT_PGP.key. If you prefer to use DES, please call the CERT hotline for more information. Getting security information CERT publications and other security information are available from our web site http://www.cert.org/. To be added to our mailing list for advisories and bulletins, send email to cert-advisory-request@cert.org and include SUBSCRIBE your-email-address in the subject of your message. Copyright 1999 Carnegie Mellon University. Conditions for use, disclaimers, and sponsorship information can be found in http://www.cert.org/legal_stuff.html. * "CERT" and "CERT Coordination Center" are registered in the U.S. Patent and Trademark Office NO WARRANTY Any material furnished by Carnegie Mellon University and the Software Engineering Institute is furnished on an "as is" basis. Carnegie Mellon University makes no warranties of any kind, either expressed or implied as to any matter including, but not limited to, warranty of fitness for a particular purpose or merchantability, exclusivity or results obtained from use of the material. Carnegie Mellon University does not make any warranty of any kind with respect to freedom from patent, trademark, or copyright infringement. @HWA !=----------=- -=----------=- -=----------=- -=----------=- -=----------=- O 0 o O O O 0 -=----------=- -=----------=- -=----------=- -=----------=- -=----------=- END of main news articles content... read om for ads, humour, hacked websites etc -=----------=- -=----------=- -=----------=- -=----------=- -=----------=- HWA.hax0r.news AD.S ADVERTI$ING. The HWA black market ADVERTISEMENT$. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ***************************************************************************** * * * ATTRITION.ORG http://www.attrition.org * * ATTRITION.ORG Advisory Archive, Hacked Page Mirror * * ATTRITION.ORG DoS Database, Crypto Archive * * ATTRITION.ORG Sarcasm, Rudeness, and More. * * * ***************************************************************************** www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.freekevi n.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnick.co m www.2600.com ########################################ww.2600.com www.freeke vin.com www.kev# Support 2600.com and the Free Kevin #.com www.kevinmitnick. com www.2600.co# defense fund site, visit it now! . # www.2600.com www.free kevin.com www.k# FREE KEVIN! #in.com www.kevinmitnic k.com www.2600.########################################om www.2600.com www.fre ekevin.com www.kevinmitnick.com www.2600.com www.freekevin.com www.kevinmitnic k.com www.2600.com www.freekevin.com www.kevinmitnick.com www.2600.com www.fre <a href="http://www.2600.com/">www.2600.com</a> <a href="http://www.kevinmitnick.com></a> +-----------------------------------------------------------------------------+ | SmoG Alert .. http://smog.cjb.net/ NEWS on SCIENCE | | =================== http://smog.cjb.net/ NEWS on SECURITY | | NEWS/NEWS/NEWS/NEWS http://smog.cjb.net/ NEWS on THE NET | | http://smog.cjb.net/ NEWS on TECHNOLOGY | +-----------------------------------------------------------------------------+ * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * www.csoft.net webhosting, shell, unlimited hits bandwidth ... www.csoft.net * * www.csoft.net www.csoft.net www.csoft.net www.csoft.net www.csoft.net * <a href="http://www.csoft.net">One of our sponsers, visit them now</a> www.csoft.net * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * WWW.BIZTECHTV.COM/PARSE WEDNESDAYS AT 4:30PM EST, HACK/PHREAK CALL-IN WEBTV * * JOIN #PARSE FOR LIVE PARTICIPATION IN SHOW CHAT OR THE WEBCHAT, AND WEBBOARD* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * WWW.2600.COM OFF THE HOOK LIVE NETCAST'S TUES SIMULCAST ON WBAI IN NYC @8PM * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ////////////////////////////////////////////////////////////////////////////// // To place an ad in this section simply type it up and email it to // // hwa@press,usmc.net, put AD! in the subject header please. - Ed // ////////////////////////////////////////////////////////////////////////////// @HWA HA.HA Humour and puzzles ...etc ~~~~~~~~~~~~~~~~~~~~~~~~~ Don't worry. worry a *lot* Send in submissions for this section please! ............. From: Tom Phoenix Newsgroups: alt.humor.best-of-usenet Subject: [comp.lang.pascal.delphi.databases] Re: Got Problems??? Date: 6 Nov 1996 07:01:42 GMT Message-ID: <55pd4m$jvu@darkstar.ucsc.edu> Originator: brian@cse.ucsc.edu From: "Albert D. Cahalan" Subject: Re: Got Problems??? Newsgroups: comp.lang.pascal.delphi.databases, comp.lang.pascal.delphi.misc David Moles writes: > Nathan Denny wrote: >> >> WHAT THE F**K!?!?!? >> >> Look at where that got posted! Like every development news group got >> hit by that. >> >> Blam! >> >> Nate:SCHCATS! > > It's all over comp.sys, too. Of course. They think all the computer hackers can't get a date. Instant fix: gcc date.c -o date All the way: gcc --entry For orgasm: gcc -O Even better: gcc -O2 Cruel: gcc -Wall For old hackers: gcc -fno-strength-reduce Transvestite: gcc -Wconversion With toy: gcc -pipe Man on top: gcc -traditional In restroom: gcc -quiet Explain how: gcc --verbose With drugs: gcc --user-dependencies Don't move: gcc -static At Microsoft: gcc -shared Side-by-side: gcc --profile Mouth first: gcc --preprocess Before drugs: gcc --prefix With disease: gcc --no-warnings With vibrator: gcc --machine Foreigner: gcc --language With chains: gcc --force-link With AIDS: gcc --extra-warnings Analism: gcc --dump Remove lice 1st: gcc --debug Talk about date: gcc --comments Take control: gcc --assert -- Moderators accept or reject articles based solely on the criteria posted in the Frequently Asked Questions. Article content is the responsibility of the submitter. Submit articles to ahbou-sub@acpub.duke.edu. To write to the moderators, send mail to ahbou-mod@acpub.duke.edu. -=- Humour in UNIX Man Pages Here are some excerpts from UNIX (specifically solaris 2.5, but also some other OSes and some freeware packages) manpages and headerfiles. Probably a bit esoteric, so if you do not find the stuff funny, don't worry..... Some are actually not for laughing, but they make you cry or shout in anger. man merge BUGS It normally does not make sense to merge binary files as if they were text, but merge tries to do it anyway. man diff -h Does a fast, half-hearted job. It works only when ... man tar ... The directory portion of file (see dirname(1)) cannot exceed 155 characters. The file name portion (see basename(1)) cannot exceed 100 characters. man csh NOTES Words can be no longer than 1024 characters. [And by the way: THIS IS REALLY TRUE! Solaris2.4: (mege@iqe3)[~] setenv test `cat /usr/dict/words | head -1000` (mege@iqe3)[~] csh iqe3[mege] echo $test Bus error cool, huh? ] /usr/local/sys/time.h /* * gettimeofday() and settimeofday() were included in SVr4 due to their * common use in BSD based applications. They were to be included exactly * as in BSD, with two parameters. However, AT&T/USL noted that the second * parameter was unused and deleted it, thereby making a routine included * for compatibility, uncompatible. * * XSH4.2 (spec 1170) defines gettimeofday and settimeofday to have two * parameters. * * This has caused general disagreement in the application community as to * the syntax of these routines. Solaris defaults to the XSH4.2 definition. * The flag _SVID_GETTOD * may be used to force the SVID version. */ man top BUGS Don't shoot me, but the default for - I has changed once again. So many people were confused by the fact that top wasn't showing them all the processes that I have decided to make the default behavior show idle processes, just like it did in version 2. But to appease folks who can't stand that behavior, I have added the ability to set "default" options in the environment variable TOP (see the OPTIONS section). Those who want the behavior that version 3.0 had need only set the environment variable TOP to "-I". man ps pcpu The ratio of CPU time used recently to CPU time available in the same period, expressed as a percentage. The meaning of ``recently'' in this context is unspecified. The CPU time available is determined in an unspecified manner. man chat ... < snip > ... COPYRIGHT The chat program is in public domain. This is not the GNU public license. If it breaks then you get to keep both pieces. man FvwmM4 NAME FvwmM4 - the FVWM M4 pre-processor ... AUTHOR FvwmM4 is the result of a random bit mutation on a hard disk, presumably a result of a cosmic-ray or some such thing. man ce_db_build ... BUGS ... Running ce_db_build on an empty ASCII file causes it to hang indefinitely as though it were in an infinite loop. Comment: Compare the time to fix this bug to the time required to write this comment into the manpage.... cat /bin/clear I really wonder how Microsoft sold this code to Sun Microsystems..... #!/usr/bin/sh # Copyright (c) 1984, 1986, 1987, 1988, 1989 AT&T # All Rights Reserved # THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF AT&T # The copyright notice above does not evidence any # actual or intended publication of such source code. #ident "@(#)clear.sh 1.7 93/04/07 SMI" /* SVr4.0 1.3 */ # Copyright (c) 1987, 1988 Microsoft Corporation # All Rights Reserved # This Module contains Proprietary Information of Microsoft # Corporation and should be treated as Confidential. # clear the screen with terminfo. # if an argument is given, print the clear string for that tty type tput ${1:+-T$1} clear 2> /dev/null -=- 10 Answers when asked about a bug - I don't think that this is really a bug - It would be too hard to implement right - Fixing this would need a change in the documentation - It wouldn't work right anyway - This bug is too hard to track down - This bug doesn't really interfere with normal use of the program - Well, how do you think it should work? - Why not fix it later? - No program can be absolutely bug-free - We'll fix that on the next major redesign -=- http://wwwhost.cc.utexas.edu/computer/vcl/bkreviews/bkcmcntd.html The Computer Contradictionary, Stan Kelly-Bootle Review written by Robert M. Slade. The only two computer dictionaries worth having are both from MIT Press: "The New Hacker's Dictionary" (cf. BKNHACKD.RVW), and this one. As news is something that someone, somewhere, wants hushed up, so the only computer terms of any importance are those that someone, somewhere, just made up. Everything else is the perverted verbiage of a marketing department. Where "Hacker's" (or TNHD) studies and stores the language of the anarchic technical crowd, the Contradictionary deals with the jargon of those who work in DP,T, and IS--those who truly understand MISmanagement. It is not intended to be a reference work--Kelly-Bootle notes that the reader should determine the meaning of a word *before* looking it up in this book--but a work of humour. Like all the best humour, of course, it has strong points to make. copyright Robert M. Slade, 1995 BKCMCNTD.RVW 950602 7 June 1999 Christine M. Henke, ACITS at UT Austin @HWA SITE.1 two sites this week #1 From #feed-the-goats http://www.pure-security.net/ SiteOps: ox1dation and mosthated Just check it out... recent face lift looks good, i've lifted some text warez from their archive for this issue. - Ed #2 http://www.hack.gr/ SiteOp: ? Straight from the site itself, check it out; HACK.gr SERVER PROFILE What is HACK.gr HACK.gr is a greek Web Server, focusing its interest in security of computer systems and networks. It is working experimentally since November 1997 and is still (!) in pilot phase. Who owns HACK.gr The hack.gr domain and web server are owned and administered by Aris Koxaras, Helias Fotopoulos and Costas Christoyannis. They are all students of the Computer Engineering and Informatics Department, in the Engineering School of the University of Patras and are working as Unix system administrators in the Department. Why HACK.gr - What hacker means The term hacker, in computer terminology, is used for those who have a deeper knowledge of the details of programmable systems. Jargon Dictionary uses the following meanings: - One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming - A person who is good at programming quickly An expert at a particular program, or one who frequently does work using it or on it However, mainly due to the mass media, a negative meaning of the word hacker is used to describe one who makes bad use of his knowledge in order either to obtain access to anauthorised information or to cause damage. Jargon Dictionary notes: - [deprecated] A malicious meddler who tries to discover sensitive information by poking around. The correct term for this sense is cracker. This use of the word by mass media, for cases of software piracy, violation of intellectual rights, publishing of pornographic material and cause of damages in computer systems is totally incorrect. Content of HACK.gr HACK.gr offers already an online magazine (HACK.gr Gazette), hosts the web page of the Black Hole column of the .net magazine and news from the greek demo scene. It offers a meta search engine for the Greek cyberspace (MSE) and is working on mirroring of foreign web sites, indices of documents and web pages for easy access to information, fora creation etc. HACK.gr hosts pages of independent sources, whose content is managed by specific rules, but does not agree necessarily with the official thesis of HACK.gr. Access to HACK.gr HACK.gr does not offer shell access to people other than its administrators. It only offers the capability of uploading web pages and e-mail aliases to users, whose pages are hosted in the site. The computer used is a Pentium with Linux Operating System, Apache Web Server and QMail e-mail server. Network access is offered by Groovy Net. Friends and ennemies HACK.gr was accepted with positive comments by system administrators, journalists and many netsurfers. Long time before the transition from the initial idea to its realisation, HACK.gr owners were "urged" by big Internet Providers to come at hosting agreement. Server hits turned out to be far more than expected, being more than 100,000 per month, though the server is still in pilot/experimental function. However, some people are trying to "hush" HACK.gr and obscure its image, attempting to charge it with cause of problems. Having perfect cooperation with the involved Internet Providers, HACK.gr has repeatingly shown responsible attitude and proved that it has nothing to do with those intrigues. HACK.gr has helped various sites in security matters and cooparated in various cases with "competitors", such as the Next Crawler meta search engine. - eentity @HWA H.W Hacked websites ~~~~~~~~~~~~~~~~ Note: The hacked site reports stay, especially with some cool hits by groups like *H.A.R.P, go get em boyz racism is a mugs game! - Ed * Hackers Against Racist Propaganda (See issue #7) Haven't heard from Catharsys in a while for those following their saga visit http://frey.rapidnet.com/~ptah/ for 'the story so far'... From HNN rumours section http://www.hackernews.com/ see the archives section on HNN or attrition.org for copies of many of these sites in their defaced form. July 27th MUSICIANS HACKED by BHZ, Tuesday 27th July 1999 on 11:50 pm CET One last article for me. Keebler elves hacked couple of musicians web sites. Sites from following artists had been hacked - Gipsy Kings, Jewel, Tricky Daddy, Sugar Ray, Stone Temple Pilots, Led Zeppelin and the official site of 3 tenors. You can find mirrors of hacked sites on Attrition. July 29th From www.net-security.com HIT2000 GETS DEFACED by Thejian, Thursday 29th July 1999 on 10:00 pm CET The dutch Hit2000 Con's Web site got hacked yesterday. An archive of the hack can be found here. (Thanx to Pine Security Digest for the initial report) http://members.xoom.com/_XOOM/testr12/index.html http://www.attrition.org/ Latest cracked pages courtesy of attrition.org [99.07.30] [PrestoChango] M (pvrc) Hypermart (pvrc.hypermart.net) [99.07.30] [Bazil Brush] D3 Net (www.d3.net) [99.07.30] [PhC] Qatar Net (QA) (www.qatar.net.qa) [99.07.30] [Sistom] M Crystalg (www.crystalg.com) [99.07.30] [LevelSeven] M Des Moines Metropolitan Transit Authority (www.dmmta.com) [99.07.30] [HiP] Emerald Systems (www.emeraldsystems.com) [99.07.30] [AntiChrist] Rahulcom (www.rahulcom.com) [99.07.30] [AntiChrist] Rajeev Gandhi (www.rajeevgandhi.com) [99.07.30] [AntiChrist] Royal Soft India (www.royalsoftindia.com) [99.07.30] [AntiChrist] Ushauthup (www.ushauthup.com) [99.07.30] [AntiChrist] India Made (www.indiamade.com) [99.07.30] [AntiChrist] Insurvey (www.insurvey.com) [99.07.30] [AntiChrist] Integral Pictures (www.integralpictures.com) [99.07.30] [AntiChrist] Jeevanseva (www.jeevanseva.com) [99.07.30] [AntiChrist] Omshiv (www.omshiv.com) [99.07.30] [AntiChrist] Pankaj Group (www.pankajgroup.com) [99.07.30] [AntiChrist] Pannatex (www.pannatex.com) [99.07.30] [AntiChrist] PRG India (www.prgindia.com) [99.07.30] [FL3M] K Marlboro Edu (rocket-science.marlboro.edu) [99.07.30] [AntiChrist] Onsoft (www.onsoft.org) [99.07.30] [AntiChrist] Adiam (www.adiam.com) [99.07.30] [AntiChrist] Admanum (www.admanum.com) [99.07.30] [AntiChrist] AD Techmission (www.adtpl.com) [99.07.30] [AntiChrist] Always India (www.alwaysindia.com) [99.07.30] [AntiChrist] Aqua Hundred (www.aquahundred.com) [99.07.30] [AntiChrist] Big Ben India (www.bigbenindia.com) [99.07.30] [AntiChrist] Classic Export (www.classicexport.com) [99.07.30] [AntiChrist] Ezee Mart (www.ezeemart.com) [99.07.30] [AntiChrist] Kapadia Group of Industries (www.glassageind.com) [99.07.30] [AntiChrist] Inside Out Goa (www.insideoutgoa.com) [99.07.30] [AntiChrist] Mothay (www.mothay.com) [99.07.30] [AntiChrist] K Ronak Exports (www.ronakexports.com) [99.07.30] [AntiChrist] Singhi (www.singhi.com) [99.07.30] [AntiChrist] Stallen South Asia (www.stallenasia.com) [99.07.30] [AntiChrist] Taps1 (www.tapsl.com) [99.07.30] [AntiChrist] World Info Pages (www.worldinfopages.com) [99.07.30] [FL3M] (redcom4) Navy (www.redcom4.navy.mil) (www.drugs.com) ,,,,,,,,,,,,,,,,,,,,,,Drugs.com (www.infocenter.com)..................Internet Broadcasting Corp (www.bigfish.com).....................Big Fish Records (www.gay.be)..........................Belgium Service des Gays (www.markmaker.com)...................Mark Maker (www.milleniumworldmarathon.com) .....Millenium World Marathon (www.mz.iao.fhg.de) ..................Fraunhofer-Institut fⁿr Arbeitswirtschaft und Organisation (IAO), UniversitΣt Stuttgart (www.mpas.gov.br) ....................MinistΘrio da PrevidΩncia e AssistΩncia Social (www.hazard.k12.ky.us) ...............Hazard School District (www.northsalem.k12.ny.us) ...........North Salem School District (www.paducah.k12.ky.us) ..............Paducah School District (www.suckysucky.org)..................KRU (www.calcoast.com)....................California Coast Online Network (www.lyrikal.com).....................The Lyrikal Krew (nazarenes.mckinney.tx.us)............Nazarenes Church of McKinney Texas (www.haplo.org).......................Web site of Matthew Jones More cracks... and more sites at the attrition cracked web sites mirror: http://www.attrition.org/mirror/attrition/index.html ------------------------------------------------------------------------- A.0 APPENDICES _________________________________________________________________________ A.1 PHACVW, sekurity, security, cyberwar links ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ The links are no longer maintained in this file, there is now a links section on the http://welcome.to/HWA.hax0r.news/ url so check there for current links etc. The hack FAQ (The #hack/alt.2600 faq) http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html <a href="http://www-personal.engin.umich.edu/~jgotts/underground/hack-faq.html">hack-faq</a> Hacker's Jargon File (The quote file) http://www.lysator.liu.se/hackdict/split2/main_index.html <a href="http://www.lysator.liu.se/hackdict/split2/main_index.html">Original jargon file</a> New Hacker's Jargon File. http://www.tuxedo.org/~esr/jargon/ <a href="http://www.tuxedo.org/~esr/jargon/">New jargon file</a> HWA.hax0r.news Mirror Sites: ~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.alldas.de/hwaidx1.htm ** NEW ** http://www.csoft.net/~hwa/ http://www.digitalgeeks.com/hwa. http://members.tripod.com/~hwa_2k http://welcome.to/HWA.hax0r.news/ http://www.attrition.org/~modify/texts/zines/HWA/ http://archives.projectgamma.com/zines/hwa/. http://www.403-security.org/Htmls/hwa.hax0r.news.htm International links:(TBC) ~~~~~~~~~~~~~~~~~~~~~~~~~ Foreign correspondants and others please send in news site links that have security news from foreign countries for inclusion in this list thanks... - Ed Belgium.......: http://bewoner.dma.be/cum/ <a href="http://bewoner.dma.be/cum/">Go there</a> Brasil........: http://www.psynet.net/ka0z <a href="http://www.psynet.net/ka0z/">Go there</a> http://www.elementais.cjb.net <a href="http://www.elementais.cjb.net/">Go there</a> Canada .......: http://www.hackcanada.com <a href="http://www.hackcanada.com/">Go there</a> Columbia......: http://www.cascabel.8m.com <a href="http://www.cascabel.8m.com/">Go there</a> http://www.intrusos.cjb.net <a href="http://www.intrusos.cjb.net">Go there</a> Indonesia.....: http://www.k-elektronik.org/index2.html <a href="http://www.k-elektronik.org/index2.html">Go there</a> http://members.xoom.com/neblonica/ <a href="http://members.xoom.com/neblonica/">Go there</a> http://hackerlink.or.id/ <a href="http://hackerlink.or.id/">Go there</a> Netherlands...: http://security.pine.nl/ <a href="http://security.pine.nl/">Go there</a> Russia........: http://www.tsu.ru/~eugene/ <a href="http://www.tsu.ru/~eugene/">Go there</a> Singapore.....: http://www.icepoint.com <a href="http://www.icepoint.com">Go there</a> Turkey........: http://www.trscene.org - Turkish Scene is Turkey's first and best security related e-zine. <a href="http://www.trscene.org/">Go there</a> Got a link for this section? email it to hwa@press.usmc.net and i'll review it and post it here if it merits it. @HWA -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF-- ⌐ 1998, 1999 (c) Cruciphux/HWA.hax0r.news <tm> (R) { w00t } -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- --EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF--EoF-HWA-EoF-- -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=- [ 28 63 29 20 31 39 39 39 20 63 72 75 63 69 70 68 75 78 20 68 77 61 ] [45:6E:64]-[28:63:29:31:39:39:38:20:68:77:61:20:73:74:65:76:65] 
