The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / cud / cud102.txt < prev next >

Wrap

Text File | 2003-06-11 | 22.6 KB | 436 lines

**************************************************************************** >C O M P U T E R U N D E R G R O U N D< >D I G E S T< *** Volume 1, Issue #1.02 (April 2, 1990) ** **************************************************************************** MODERATORS: Jim Thomas / Gordon Meyer REPLY TO: TK0JUT2@NIU.bitnet SUBSCRIBE TO: INTERNET:TK0JUT2@NIU.BITNET@UICVM.uic.edu COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing information among computerists and to the presentation and debate of diverse views. -------------------------------------------------------------------- DISCLAIMER: The views represented herein do not necessarily represent the views of the moderators. Contributors assume all responsibility for assuring that articles submitted do not violate copyright protections. -------------------------------------------------------------------- ------------------------------------------------------------------- IN THIS ISSUE: File 1: Messages Received File 2: Hacking in England (news article) File 3: The FBI and BBS Surveillance (PHRACK Reprint) -------------------------------------------------------------------- This is the third issue, and if you haven't received either of the first two even though you have subscribed, let us know. It means that mail is not getting through the gateway. If you know of anybody who has added their name to the mailing list but has not received any issues yet, let us know. We apologize for the problems, especially duplicate files, in the CuD 1.02 mailing. We are still working out mailing glitches. As some of you noticed, file headers still contain the addresses of all those to whom the batch is sent. We have broken the batches down into groups of about 25, so you are only seeing a portion of the list. However, this is still unacceptable. We are working on the problem. Until then, we will either break batches down into groups of 5, or, most likely, send them out individually, which is a drag with about 150 subscribers. We are experimenting with LISTSERV, and have asked comserve for suggestions. If you know of anybody who has added their name to the mailing list but has not received any issues yet, let us know. We apologize for the problems, especially duplicate files, in the CuD 1.02 mailing. We are still working out mailing glitches. -------------------------------------------------------------- We have received many, many requests of the files we listed. Providing an archive service may not have been one of our better ideas. At the moment (middle of the term) we don't have the time to comply with the heavy request load. But, we remain convinced that such an archival service is needed, because such files are not currently preserved in libraries. So, we are exploring options. We have encountered the following problems: 1. Time (or lack of it) and digging out files on an ad hoc basis 2. Size: Most of the ascii files are over 100 K, and some systems have kicked these back. A complete set of some files would run as high as 5 megs, and to send these out would jam most systems, even if sent out over a few days. Possible solutions: 1. Upload them to a local (DeKalb) BBS from which they could be downloaded. We would have to obtain university permission, but there is currently a multi-line BBS here that could handle such requests. 2. Send them out by snail mail to anybody who wanted to send disks and a self-addressed, stamped envelop. We could then put them in a ZIP file to reduce space by about 60 percent and return them. Any other suggestions?? From the material we're getting, it looks like we can put an issue out about once a week. We will send them in the early part of the week to avoid weekend mail-jams. -------------------------------------------------------------------- "COMPUTER ABUSE" OR "CONTROLOGY?" In a forthcoming article (CONTEMPORARY CRISES, 1990), Ray Michalowski and Erdwin Pfuhl argue that in the years following the 1986 passage of the federal computer abuse laws, and despite additional state laws, there were very few prosecutions or indictments of hackers. Yet, in recent months, hacker prosecutions seem to be making local and national news. Is there *really* an upsurge in abuse, or are law enforcement authorities over-reacting to media hype and hysteria by dramatizing their "concern" through over-enforcement? Jason Ditton (in his book CONTROLOGY) and Mark Fishman have argued that too often "crime waves" are do not reflect an increase in unacceptable behaviors as much as they do social responses to public fears or publicity surrounding a given type of incident. More simply, there are often not "crime waves," but rather "control waves." To dramatize competency and effectiveness, government agencies and law enforcement officials respond to images of "danger" by dramatizing their concern in the form of "crackdowns." The current Draconian anti-drug legislation is one example. We suppose that the good news is that whenever the government declares war on something, it's been lost (witness the "war on poverty," the "war on crime," the "war on drugs"). This military metaphor does not work well as a social policy, but the repercussions are a fiscal drain and a gradual loss of Constitutional freedoms. If you come across stories in your local papers on any aspect of computer prosecution (use of computers in felonies, prosecution, indictments, or arrests of hackers, confiscation of computer equipment, etc.), please transcribe the articles (including source, date and page numbers), and pass them along. HOWEVER, BE SURE NO COPYRIGHTS ARE INFRINGED. We assume that contributors have checked, because we cannot check every article that comes in. Thanks. J&G -------------------------------------------------------------------- *************************************************************** *** Computer Underground Digest Issue #1.02 / File 1 of 3 *** *************************************************************** From: mnemonic@walt.cc.utexas.edu(Mike Godwin) Message-Id: <9003311359.AA25162@vondrake.cc.utexas.edu> To: TK0JUT2%NIU.BITNET@UICVM.uic.edu Subject: Re: Computer Underground Digest, Issue 1.01 Writes Mark Seiden: "(Note for the Tomorrow File: A new source of revenue for lawyers: store your hacker-client's backup tapes, which would then be protected as privileged communication?)" Unfortunately, backup tapes probably are probably not "privileged communication" within the meaning of attorney-client privilege. A court or magistrate could almost certainly order its production by the attorney in whose custody it was. The only possible theory of non disclosure that comes to mind is the work-product doctrine, and even that doctrine would apply only if the backup were made specifically for the purpose of preparing for litigation. In general, attorney-client privilege only applies to things that clients SAY (or write) to their attorneys, not things they GIVE to their attorneys. And, incidentally, the attorney-client privilege cannot, in itself, be "a source of revenue" for lawyers. Once you've contracted for an attorney-client relationship, your attorney has to keep privileged communications secret even if you *don't* ask him to or pay for him to. (You can, of course, give him specific permission to disclose such information.) --Mike ============================================================================== ---------------------------------- Pat Townson of TELECOM DIGEST passed the following along to us. %eds%. Any responses?!? -------------------- Subject: More L.O.D. To: "Submission to comp.dcom.telecom" <telecom@eecs.nwu.edu> Date: Mon, 2 Apr 90 16:03:54 EST From: Don H Kemp <dhk@teletech.uucp> Message-Id: <9004021603.AA12172@teletech.UUCP> As reported in AT&T's Consultant Liason Program electronic newsletter "Newsbriefs": > > LEGION OF DOOM -- ... A government affadavit alleged that in June > hackers believed to be Legion of Doom members planted software > "time bombs" in AT&T's 5ESS switching computers in Denver, Atlanta > and New Jersey. These programs ... were defused by AT&T security > personnel before they could disrupt phone service. ... New York > Newsday, p. 15, 4/1. > -- Don H Kemp "Always listen to experts. They'll B B & K Associates, Inc. tell you what can't be done, and Rutland, VT why. Then do it." uunet!uvm-gen!teletech!dhk Lazarus Long =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + END THIS FILE + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= *************************************************************** *** Computer Underground Digest Issue #1.02 / File 2 of 3 *** *************************************************************** ------------------------------------ Some English Members of Parliament seem as hell-bent on hysteria-mongering as some here in the U.S. The following was passed on from a Southerner who thought it of interest %eds%. -------------------------------------------------------- Civil Liberties HACKED TO PIECES Jolyon Jenkins Refuses to Panic over Computer Crime %From NEW STATESMAN & SOCIETY, Feb. 9, 1990: p. 27% Why should anyone other than spotty youths and hi-tech fraudsters care about new legislation to ban computer hacking? For this reason: laws made in response to moral panic usually fail to catch the real villains and end up pushing back civil liberties for everyone else. The Computer Misuse Bill, published two weeks ago by Tory MP Michael Colvin and likely to become law, is just such a measure. The debate over hacking is like the panic over video nasties: a new technology which people view with suspicion, ill-founded anecdotal research, and overblown language. Emma Nicholson MP, who set this hare running with a private member's bill last year, is the chief culprit. In a recent interview with the SUNDAY CORRESPONDENT MAGAZINE she said that hackers were "malevolent, nasty, evil-doers" who "fill the screens of amateur %computer% users with pornography". She claimed that European Greens hack into the comupters of large companies and use the information they extract to carryout "bombings and fires". When asked to justify the allegations she produced a back copy of an anarchist magazine called INSURRECTION, whose contents fell somewhat short of the required proof, and then cited "unofficial secret-service trackers close to the Dutch government", who could not be named. Nicholson has produced a dossier of "hacking incidents" that she insists are so confidential that she refuses to reveal the sources to anyone, even the Law Commission, which recently completed an investigation of the subject. This makes it hard to assess the quality of her information. But one of the cases is identifiable and does not inspire confidence in the rest. It concerns someone who allegedly put a "logic bomb" in the computer system of a British airline. This is almost certainly the case of Jim McMahon who was prosecuted last year at Isleworth Crown Court. After three and a half weeks the judge stopped the case because he was satisfied that McMahon was innocent and that the most likely suspect was the chief prosecution witness. The police had fingered the wrong man--not because of any gap in the law but because they carried out their investigation incompetently. Nonetheless, the case apparently remains in the Nicholson dossier. The Colvin bill proposes to punish with six months in prison anyone who gains, or tries to gain, "unauthorised access" to information stored on a computer. Emma Nicholson is not wholly to blame, because the English Law Commission produced similar proposals last year. But they are still objectionable, for several reasons. First, it is like criminalising trespass. Someone who gains unauthorised access to PHYSICAL premises has not normally thereby committed a criminal offence, but only a tort, and it is up to the aggrieved part to start civil proceedings against the trespasser. Second, it means that information held on computer becomes property. In general, information is not protected by law: if I steal a piece of paper that has valuable facts written on it, it is only the paper I steal, not the facts. Information held in confidence can be protected (to an increasing extent) by law; copyright protects the FORM in which information is held; but you cannot copyright a fact--and the Colvin bill erodes that principle. Third, it won't prevent hacking. Emma Nicholson admitted as much in a debate at Imperial College last month. But she said that it was important that society should express its moral disapproval of hacking. Experience suggests that unenforceable moral disapproval is as likely to lead to an increase in the frowned-on activity as to a reduction. Fourth, almost all serious computer misuse can be brought before the courts under existing laws, such as fraud, criminal damage, or theft of electricity. And in a few years time, hacking by telephone will become virtually impossible, because System X phone exchanges will be able to tell the manager of a computer system the number someone is calling from. Many successful hacks depend on nothing more sophisticated than correctly guessing a password--such as when I correctly guessed that an ITN journalist had chosen as his password "ITN". The remedy may be equally straightforward: use less easily guessable passwords. Further restricting freedom of information is not the answer. ---- END ---- =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + END THIS FILE + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= *************************************************************** *** Computer Underground Digest Issue #1.02 / File 3 of 3 *** *************************************************************** Following the discussion of FBI surveillance in CuD 1.02, the following was sent in. The contributor's anonymity is protected %eds.% ----------------------- Date: Sun, 01 Apr 90 17:06 CDT Subject: FBI BBS Surveillence (PHRACK Article) ---------------------- ==Phrack Inc.== Volume Two, Issue 23, File 10 of 12 In The Spirit Of The Vicious Circle Trilogy... Phrack Inc. Presents ***************************************** *** *** *** Big Brother Online *** *** *** *** by Thumpr Of ChicagoLand *** *** *** *** June 6, 1988 *** *** *** *** Special Thanks To Hatchet Molly *** *** *** ***************************************** The United States Government is monitoring the message activity on several bulletin boards across the country. This is the claim put forth by Glen L. Roberts, author of "The FBI and Your BBS." The manuscript, published by The FBI Project, covers a wide ground of FBI/BBS related topics, but unfortunately it discusses none of them in depth. It begins with a general history of the information gathering activities of the FBI. It seems that that the FBI began collecting massive amounts of information on citizens that were involved with "radical political" movements. This not begin during the 1960's as one might expect, but rather during the 1920's! Since then the FBI has amassed a HUGE amount of information on everyday citizens... citizens convicted of no crime other than being active in some regard that the FBI considers potentially dangerous. After discussing the activities of the FBI Roberts jumps into a discussion of why FBI snooping on BBS systems is illegal. He indicates that such snooping violates the First, Fourth, and Fifth amendments to the Constitution. But he makes his strongest case when discussing the Electronic Communications Privacy Act of 1987. This act was amended to the Federal Wiretapping Law of 1968 and But as with all good laws, it was written in such broad language that it can, and does, apply to privately owned systems such as Bulletin Boards. Roberts (briefly) discusses how this act can be applied in protecting *your* bulletin board from snooping by the Feds. How to protect your BBS: Do NOT keep messages for more than 180 days. Becaus the way the law is written, messages less then 180 days old are afforded more protection then older messages. Therefore, to best protect your system purge, archive, or reload your message base about every 150 days or so. This seems silly but will make it harder (more red tape) for the government to issue a search warrant and inform the operator/subscriber of the service that a search will take place. Roberts is not clear on this issue, but his message is state emphatically... you will be better protected if you roll over your message bas sooner. Perhaps the best way to protect your BBS is to make it a private system. This means that you can not give "instant access" to callers (I know of very few underground boards that do this anyway) and you can not allow just anyone to b a member of your system. In other words, even if you make callers wait 24 hours to be validated before having access you need to make some distinctions about who you validate and who you do not. Your BBS needs to be a PRIVATE system and you need to take steps to enforce and proclaim this EXPECTED PRIVACY. One of the ways Roberts suggests doing so is placing a message like this in your welcome screen: "This BBS is a private system. Only private citizens who are not involved in government or law enforcement activities are authorized gained from this system to any government agency or employee." Using this message, or one like it, will make it a criminal offense (under the ECPA) for an FBI Agent or other government snoop to use your BBS. The manuscript concludes with a discussion of how to verify users and what to do when you find an FBI agent using your board. Overall, I found Roberts book to be moderately useful. It really just whetted my appetite for more information instead of answering all my questions. If you would like a copy o the book it sells for $5.00 (including postage etc). Contact; THE FBI PROJECT Box 8275 Ann Arbor, MI 48107 Visa/MC orders at (313) 747-7027. Personally I would use a pseudonym when dealing with this organization. Ask for a catalog with your order and you wil the FBI would be interested in knowing who is doing business with this place. The manuscript, by the way, is about 20 pages long and offers references to other FBI expose' information. The full citation of the EPCA, if you want to look it up, is 18 USC 2701. Additional Comments: The biggest weakness, and it's very apparent, is that Roberts offers no evidence of the FBI monitoring BBS systems. He claims that they do, but he does not give any known examples. His claims do make sense however. As he states, BBS's offer a type of "publication" that is not read b any editors before it is "published." It offers an instant form of news and one that may make the FBI very nervous. Roberts would do well to include some supportive evidence in his book. To help him out, I will offer some here. * One of the Ten Commandments of Phreaking (as published in the famous TAP Magazine) is that every third phreaker is an FBI agent. This type of folklore knowledge does not arise without some kind of justification. The FBI is interested in the activities of phreakers and is going to be looking for the BBS systems that cater to them. I your system does not, but it looks like it may, the FBI may monitor i just to be sure. * On April 26, 1988 the United States Attorney's Office arrested 19 people for using MCI and Sprint credit card numbers illegally. These numbers were, of course, "stolen" by phreakers using computers to hac them out. The Secret Service was able to arrest this people by posin as phone phreaks! In this case the government has admitted to placin there, the success of theis "sting" will only mean that they will try it again. Be wary of people offering you codes. * In the famous bust of the Inner Circle and the 414s, the FBI monitore electronic mail for several months before moving in for the kill. While it is true that the owners of the systems being hacked (Western Union for one) invited the FBI to snoop through their files, it does establish that the FBI is no stranger to the use of electronic snooping in investigating crimes. Conclusion: There is no reason to believe that the government is *not* monitoring your bulletin board system. There are many good reasons to believe that they are! Learn how to protect yourself. There are laws and regulations in place that can protect your freedom of speech if you use them. You should take every step to protect your rights whether or not you run an underground system or not. There is no justification for the government to violate your rights, and you should take every step you can to protect yourself. I have no connections with Roberts, his book, or The FBI Project other then being a mostly-satisfied customer. I'm not a lawyer and neither is Roberts. No warranty is offered with this text file. Read and use it for what you thin it is worth. You suffer the consequences or reap the benefits. The choice is yours, but above all stay free. =+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+ + END CuD #1.02 + +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+===+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+= !