The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/zines/cud/cud949.txt

Text File | 2003-06-11 | 37.0 KB | 786 lines

Computer underground Digest    Tue  June 24, 1997   Volume 9 : Issue 49
                           ISSN  1004-042X

       Editor: Jim Thomas ([e-mail])
       News Editor: Gordon Meyer ([e-mail])
       Archivist: Brendan Kehoe
       Shadow Master: Stanton McCandlish
       Shadow-Archivists: Dan Carosone / Paul Southworth
                          Ralph Sims / Jyrki Kuoppala
                          Ian Dickinson
       Field Agent Extraordinaire:   David Smith
       Cu Digest Homepage: http://www.soci.niu.edu/~cudigest

CONTENTS, #9.49 (Tue, June 24, 1997)

File 1--Senate Votes to Block Bomb-Making Info
File 2--PGP: Breaking the Crypto Barrier
File 3--ACLU Cyber-Liberties Update, June 19, 1997
File 4--Notes from the Underground: 2 interviews with Se7en
File 5--Cu Digest Header Info (unchanged since 7 May, 1997)

CuD ADMINISTRATIVE, EDITORIAL, AND SUBSCRIPTION INFORMATION APPEARS IN
THE CONCLUDING FILE AT THE END OF EACH ISSUE.

---------------------------------------------------------------------

Date: Fri, 20 Jun 1997 16:13:32 -0400 (EDT)
From: Thomas Grant Edwards <[e-mail]>
To: [e-mail]
Subject: File 1--Senate Votes to Block Bomb-Making Info

From WIRED news www.wired.com:

       Senate Votes to Block Bomb-Making Info
           by Rebecca Vesely

           12:09pm  20.Jun.97.PDT The Senate has voted 94-0 to tack onto a
           Defense Department spending bill an amendment that would
           prohibit the distribution of bomb-making instructions in the United
           States.

           Although the word "Internet" is not mentioned in the four-page
           amendment, the legislation would outlaw Web sites, newspapers,
           zines, and books that publish instructions on how to make a
           bomb - such as The Anarchist's Cookbook and The Terrorist
           Handbook. Violators would face fines and prison sentences of
           up to 20 years.

           Sponsored by Senator Dianne Feinstein (D-California), who has
           been trying to get the legislation on the books since 1995, the
           amendment passed Thursday is narrowly written to include only
           the distribution of material that has an "intent to harm."

...
[see the rest at www.wired.com]

------------------------------

Date: Fri, 20 Jun 1997 12:53:37 -0800
From: "--Todd Lappin-->" <[e-mail]>
Subject: File 2--PGP: Breaking the Crypto Barrier

Source - [e-mail]

An interesting wrinkle to this story...

Last Wednesday, during the Bernstein hearing here in SF, a debate took
place between  the DoJ's lawyer and Judge Patel regarding the "publication"
of source code in printed form vs. electronic form.  The DoJ lawyer argued
that the printed code was not considered much of a threat, because it is a
laborious and time-consuming process to compile the code into software.

The irony, of course, is that even as he was speaking to Judge Patel, the
source code to PGP 5.0 was being scanned into computers in Holland.

--Todd-->


From Wired News: www.wired.com

Breaking the Crypto Barrier
by Chris Oakes

5:03am  20.Jun.97.PDT

Amid a striking convergence of events bearing on
US encryption policy this week, one development underlined what many see
as the futility of the Clinton administration's continuing effort to
block the export of strong encryption: The nearly instantaneous movement
of PGP's 128-bit software from its authorized home on a Web server at
MIT to at least one unauthorized server in Europe.

Shortly after Pretty Good Privacy's PGP 5.0 freeware was made available
at MIT on Monday, the university's network manager, Jeffrey Schiller,
says he read on Usenet that the software had already been transmitted to
a foreign FTP server. Ban or no ban, someone on the Net had effected the
instant export of a very strong piece of code. On Wednesday, Wired News
FTP'd the software from a Dutch server, just like anyone with a
connection could have.

A Commerce Department spokesman said his office was unaware of the
breach.

The event neatly coincided with the appearance of a new Senate bill that
seeks to codify the administration's crypto policy, and an announcement
Wednesday that an academic/corporate team had succeeded in breaking the
government's standard 56-bit code.

The software's quick, unauthorized spread to foreign users might have an
unexpected effect on US law, legal sources noted.

"If [Phil] Zimmermann's [original PGP] software hadn't gotten out on the
Internet and been distributed worldwide, unquestionably we wouldn't have
strong encryption today," said lawyer Charles Merrill, who chairs his
firm's computer and high-tech law-practice group. Actions like the PGP
leak, he speculated, may further the legal flow of such software across
international borders.

Said Robert Kohn, PGP vice president and general counsel: "We're
optimistic that no longer will PGP or companies like us have to do
anything special to export encryption products."

The Web release merely sped up a process already taking place using a
paper copy of the PGP 5.0 source code and a scanner - reflecting the
fact it is legal to export printed versions of encryption code.

On Wednesday, the operator of the International PGP Home Page announced
that he had gotten his hands on the 6,000-plus-page source code, had
begun scanning it, and that a newly compiled version of the software
will be available in a few months.

Norwegian Stale Schumaker, who maintains the site, said several people
emailed and uploaded copies of the program to an anonymous FTP server he
maintains. But he said he deleted the files as soon as he was aware of
them, because he wants to "produce a version that is 100 percent legal"
by scanning the printed code.

The paper copy came from a California publisher of technical manuals and
was printed with the cooperation of PGP Inc. and its founder, Phil
Zimmermann. Schumaker says he does not know who mailed his copy.

"The reason why we publish the source code is to encourage peer review,"
said PGP's Kohn, "so independent cryptographers can tell other people
that there are no back doors and that it is truly strong encryption."

Schumaker says his intentions are farther-reaching.

"We are a handful of activists who would like to see PGP spread to the
whole world," his site reads, alongside pictures of Schumaker readying
pages for scanning. "You're not allowed to download the program from
MIT's Web server because of the archaic laws in the US. That's why we
exported the source-code books."

Copyright  1993-97 Wired Ventures, Inc. and affiliated companies.
All rights reserved.

------------------------------

Date: Thu, 19 Jun 1997 21:33:35 GMT
From: "ACLU Cyber-Liberties Update Owner"@newmedium.com
Subject: File 3--ACLU Cyber-Liberties Update, June 19, 1997

Setback in Efforts to Secure Online Privacy

     FOR IMMEDIATE RELEASE
     Thursday, June 19, 1997

WASHINGTON -- A Senate committee today setback legislative efforts to
secure online privacy, approving legislation that would restrict the right
of businesses and individuals both to use encryption domestically and to
export it.

     On a voice vote, the Senate Commerce Committee adopted legislation that
essentially reflects the Clinton Administration's anti-encryption policies.

     The legislation approved today on a voice vote by the Senate Commerce
Committee was introduced this week by Senate Commerce Committee Chairman
John McCain, Republican of Arizona, and co-sponsored by Democrats Fritz
Hollings of South Carolina; Robert Kerry of Nebraska and John Kerry of
Massachusetts.

     Encryption programs scramble information so that it can only be read
with a "key" -- a code the recipient uses to unlock the scrambled
electronic data.  Programs that use more than 40 bits of data to encode
information are considered "strong" encryption. Currently, unless these
keys are made available to the government, the Clinton Administration bans
export of hardware or software containing strong encryption, treating
these products as "munitions."

     Privacy advocates continue to criticize the Administration's
stance, saying that the anti-cryptography ban has considerably
weakened U.S. participation in the global marketplace, in addition
to curtailing freedom of speech by denying users the right to "speak"
using encryption. The ban also violates the right to privacy by
limiting the ability to protect sensitive information in the new
computerized world.

     Today's committee action knocked out of consideration the so-called
"Pro-CODE" legislation, a pro-encryption bill introduced by Senator
Conrad Burns, Republican of Montana. Although the Burns legislation
raised some civil liberties concerns, it would have lifted export
controls on encryption programs and generally protected individual
privacy.

     "Privacy, anonymity and security in the digital world depend on
encryption," said Donald Haines, legislative counsel on privacy and
cyberspace issues for the ACLU's Washington National Office. "The aim
of the Pro-CODE bill was to allow U.S. companies to compete with
industries abroad and lift restrictions on the fundamental right to
free speech, the hallmark of American democracy."

     "Sadly, no one on the Commerce Committee, not even Senator Burns,
stood up and defended the pro-privacy, pro-encryption effort," Haines
added.

     In the House, however, strong encryption legislation that would add
new privacy protections for millions of Internet users in this country and
around the world has been approved by two subcommittees.

     The legislation -- H.R. 695, the "Security and Freedom Through
Encryption Act" or SAFE -- would make stronger encryption products
available to American citizens and users of the Internet around the
world. It was introduced by Representative Robert W. Goodlatte, Republican
of Virginia.

     "We continue to work toward the goal of protecting the privacy of all
Internet users by overturning the Clinton Administration's unreasonable
encryption policy," Haines concluded

 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ACLU Cyber-Liberties Update Editor:
Lisa Kamm ([e-mail])
American Civil Liberties Union National Office
125 Broad Street
New York, New York 10004

To subscribe to the ACLU Cyber-Liberties Update, send a message
to [e-mail] with "subscribe Cyber-Liberties" in the
body of your message. To terminate your subscription, send a
message to [e-mail] with "unsubscribe Cyber-Liberties"
in the body.

------------------------------

Date: Sun, 22 Jun 1997 19:30:57
From: Richard Thieme <[e-mail]>
Subject: File 4--Notes from the Underground: 2 interviews with Se7en

NOTES FROM UNDERGROUND

                 AN INTERVIEW WITH SE7EN BY RICHARD THIEME



At DefCon IV, the annual hackers' convention in Las Vegas this
July, they called him "se7en." He's twenty-eight years old, an
old man of the hacker scene, and he has just "come out" into the
public eye after seventeen years underground. It's the second day
of DefCon and Se7en has already given more than a dozen
interviews to television crews. The attention is wearing him
down.
     "Don't call me se7en," he said as we entered Spago's, an
upscale restaurant in Caesar's Palace for dinner. "I don't want
to be hassled."
     "What should we call you?" I said. "Nine?"
     Before he could answer, a young waiter approached our table.
     "Good evening. Are you all here for a convention?
     Yes, we said, opening our menus.
     The waiter leaned closer and said in a conspiratorial
whisper, "I understand the elevators at the Tropicana [site of
DefCon III] still don't stop at the right floor. The blueprints
for the Monte Carlo [this year's hotel] disappeared two weeks
ago. The management is in a panic."
     So much for anonymity.
     Waiters, taxi drivers, desk clerks -- everybody in Vegas
knew DefCon was back in town.

     Why did se7en come out? Why did he leave the hacker
underground and tunnel up at the age of twenty-eight into the
bright lights of camera crews, the blank pitiless glare of the
desert sun?

"I'd been playing around with the idea of retiring for a long
time. I wanted to come out before I retired. There are a lot of
things I want to say, a lot of people I want to know -- I didn't
have a game plan, exactly, but I wanted to be above ground for
six months before I dropped out. At DefCon I wanted to meet a lot
of people whose email addresses I had seen for years."

? Does it weigh on you, being underground?

"It does, yes. It's very isolating. You don't quite know what
else is going on out there, you feel like you're in your own
little world, and as your world starts to fall apart, as mine did
-- people going above ground, people retiring -- my world was
getting a lot smaller. We needed new talent, more than the little
group we had left, and I was getting older. I wanted to mentor
some of the younger hackers. Help them the way others helped me."

[In the world of hacking, a generation lasts about a decade. Many
hackers go on to work as computer professionals in security,
intelligence, or business. Participating whole-heartedly in the
community of hackers, with its rigorous code of ethics, networks
of mentors, and accumulated expertise, is often the only way to
learn what no school knows how to teach.]

"There's a lot to be learned from people, not just in the hacking
underground, but life in general. In respect to the technology
and the knowledge I had, it was limiting to relate to so few
people. There were new things to learn, new perspectives - so
much to get being out there and I was missing that. It was
isolating."

? How old were you when you got into computers?

"I was eleven when I got my first computer, a TRS-80. Seventeen
years ago. First thing I did was play games. Remember, this was
new to the entire world, and all you could do was play games at
that point. I had no interest in programming then. The computer
was a fancy expensive toy. It wasn't something to use to balance
your checkbook or use as a communications device."

? When did you become aware of communications as a possibility?

"About 1982, using an Apple IIe. I heard of modems, that you
could use them to call up other computers and talk to them. That
was exciting.

I was into game cracking before bulletin boards. We were messing
around with Apples with machine language, just screwing around
with very little knowledge of what we were doing. We cracked our
first game by accident. We started playing with different call
registers, and next thing we knew, we had something. Copy
protection was very simple then so it was not very impressive as
a technical feat but when you're eleven years old and you cracked
your first game and it was an accident on top of that ..."

? It was a power rush, wasn't it?

"That's what it was. A power rush.

There was a big apple computer store that opened then in my home
town. It was mom-and-pop store, not a franchise or a chain. They
hosted Apple clubs. One group talked about new hardware, another
about software, arguing about language and coding, then there was
a little circle of warez kiddies copying games they had cracked.
We were a precursor to hacking groups, phreaking groups, 2600,

No one thought of it as crime then. It was a new technology that
was like a great big toy. The difference between cracking games,
cracking programs and cracking systems was very little. They were
all part of a big complex puzzle we wanted to solve. It was just
a question of how big a chunk of the puzzle did you want to
tackle? We wanted to break games, that's what was interesting to
us then, Engineers wanted to break the whole system. They wanted
to know everything about it. These were people that by every
definition of the word were hackers. They never called themselves
that, but they were going to get into that system, no matter
what.

The words that are feared today -- crackers, phreakers -- were
never brought up in the press back then. The TRS-80. the apple
IIe was still brand new to the world. Very few people had them,.
It was not like Nintendo today where everybody gets one. They
were expensive game machines. They were new and people didn't
know quite what to make of them. The only people who really knew
them were people who used them at work."

? When did you become conscious of yourself as a hacker or
phreaker?

"Not for many years. I had my own group of friends through
bulletin boards or school, we were just doing our own thing. We
never thought of ourselves as hackers or crackers or a conspiracy
or the underground or trying to be elite. We thought of ourselves
as friends. We kept to ourselves and didn't cause trouble. We
never consciously thought of ourselves as hackers or crackers but
in retrospect we fit the definition. We were our own little mini-
software piracy ring. No one ever questioned photocopying
something - obviously not defense secrets or corporate secrets,
of course. But what we meant by "information wants to be free"
is, we would email it to ourselves or send a friend a disk. In
seventeen years of hacking I never made a cent until I made a
speech this week."

? What kinds of speaking are you doing?

"I define the various types and sub-types that the media labels
hacker, cracker or phreaker. I describe the types of people in
each group, their motivations, how they differ from one another,
their ideologies."

? Do you discuss technique?

"No, these [his recent talk was for engineers in a space program]
are UNIX-heads. They know UNIX is inherently weak. One joke I
heard when I came in was, "UNIX and security are an oxymoron."
That made me feel good, because I knew I was talking to people
who knew that you can't fix security in UNIX. The public is
screaming, "Oh my god, hackers are getting in, they need to fix
security," but they're clueless! UNIX is insecure, period. End of
story.

The engineers' concerns about security were twofold: (1) Their
approach to security has been to be as obscure as possible. They
wanted to be invisible. They had very few problems because their
systems aren't even on the books. At this point, they don't
exist. Now their program is about to get a lot of press and they
will no longer enjoy obscurity, so they want to tighten their
system up as much as possible. They know that some people will
still get in, but if people are going to get in, it will only be
people who are talented enough to do it. Not someone who
accidentally got in or used a simple hole to get in. (2) When
they do catch a person inside the system, how do they know what
their intention is? The biggest fear of hackers and crackers
everywhere is, what is their intention? You find one, you don't
know what the hell they're doing and that scares the hell out of
you.

They felt a lot more comfortable after I told them the basic
types of hackers. Now, they see someone in their system, they're
more likely after a few minutes of tracking them to know who they
are, what they're after, whether to worry about them or not.

You can usually tell what a hacker's after from what they do when
they get in. They start to look for directories like "nuke" and
"secret" that might be a problem. But then again it might not.
These guys knew the concept of "trophy-grabbing." There might be
a kid who downloads the plans for a Stealth fighter to his
computer and puts them on a diskette and throws it up on the
wall. 'Hey, I got a trophy!' He isn't going to sell it to a spy.
He wouldn't know who to sell it to if his life depended on it. To
him, it's just, 'Hey, I got a copy of a stealth fighter sitting
on my bookshelf!'"

se7en was a well-known phreaker who knew his way around the
telephone system. I asked how he got into phreaking.

"My introduction to phreaking was being taken around by someone a
few years older than me who said, hey, we're going to go dig in
the trash of the telephone company. I was like, well what the
hell for? He goes, 'Trust me. This will blow your mind.' Well, it
did, it blew my mind for the next ten years.

We went through the trash, and in my eyes, all we had was a bunch
of paper. I was not impressed. But he was sorting them and
saying, OK, these are good, these are bad, these are good. He was
trying to get me interested in something I saw no interest in. I
was young,. I was about fifteen years old. To me it was basically
worthless, looking at a hunch of food and trash, and it wasn't
until I went over to the guy's house the next night, and he says,
remember these five or six pieces of paper I grabbed? He fires it
up and boom! there we are, we're in the phone company. 'We're in
the phone company?' Yeah, he said. I can do anything I want in
here. He had found a dialup. He already knew quite a bit about
the phone system. But he warned me, Don't be one of those punks
or lusers that makes free phone calls. Learn how it works. Be one
of the people who learns how it works.

That was our goal: to understand how things work.

The things we did used to be considered normal teenage behavior,
remember, teenage pranks, Now it's a felony. Now you're part of a
conspiracy. It's more complex today.

Even if they don't send you to jail, they'll confiscate your
equipment. They like to scare the hell out of you. You become an
annoyance, they'll take your computers and you'll never get them
back, no matter what you do. That's pretty good for knocking a
lot of kids out. But it can have the opposite effect. Some people
like the Legion of Doom or the other hackers that have gotten
busted, the government did that to shut them up, but they all
came back and they came back angry. The last thing the government
needs is someone they don't understand coming back with an
agenda.

There were a lot of great discoveries through the years, but for
me, the greatest was how I grew in knowledge and power in my own
eyes. The giant telephone company and many of the all-knowing
corporations really had very little clue as to what they were
doing. The government, the all-powerful government -- starting
wars, controlling your life -- did not have a clue as to what a
computer is or what it can do.

The realization that all these people that as a kid you're told
to respect and fear, in a lot of ways you have it more together
and are a lot smarter than many of these people....

It's a power rush, that's what it is. You find out there's
absolutely nothing special about these people. Here you are, some
little fifteen or sixteen year old kid, you can do things that
the phone company can't even do, or the government can't even do.
The phone company doesn't even know what you're talking about
when you tell them something you've been doing for years. That's
the greatest discovery.

? Today the real power belongs to people who have knowledge, who
know how to do things. The others are hiding behind an illusion
of power? Behind smoke and mirrors?

Exactly.

(c) Richard Thieme 1997. All Rights reserved




Se7en: The Sequel

                              Richard Thieme

     Se7en is out in the light and air now, up from seventeen
years underground. He's one of the new variety of human being --
homo sapiens hackii -- who has learned from working with
computers at every level, from code language to point-and-click,
to think in ways that fit how computers organize information.
     Se7en is on the road now, delivering seminars to technicians
about hackers -- how they think, how they behave. He works with
organizations that are favorite targets of hackers because of
their work or status.
     He speaks to groups of 30-50 people at a time, cross-
disciplinary groups consisting of engineers, security personnel,
administrators -- people who deal with the Internet on a daily
basis. Naturally, they're concerned about security.
     On his first round of talks, he discussed basic security,
making his clients aware of what's out there. He helped them
distinguish hackers in search of trophies from thieves working
for governments and businesses.
     On his second round of seminars, Se7en is focused on the
details of security, the technical end. The technicians are set
up in networks and shown how to scan their own services,
searching their networks for security holes.
     "Basically we set up our own network of fifteen machines and
taught them how to break root, showing them how easy it was with
UNIX. It was important for them to get hands on experience, get
the feel of it. We showed them how to grab a password file and
run it through Crack. We introduced them to SYN flooding and
explained the concept behind it. We showed them some of the
scripts that are NOT available out there. We didn't launch an
attack, because that would have been lethal, but we got them to
the point from which they could launch it."
     They set up encrypted Internet sessions and ran them through
the whole gamut of hacker behaviors. It was all hands-on,
technical training.

     The engineers are learning a lot. They return to work more
capable of securing their systems and also better equipped to
talk to the managers who make decisions.
     Se7en believes as a result of his experience on the road
that the hands-on technical people who work on the front lines of
the Internet and understand it are seldom promoted into
management positions where decisions are made. So managers often
lack experience on the front lines. Because they don't deal with
the issues on a day to day basis, they often don't understand the
problems brought to them. Ironically that makes them hesitant to
promote technical experts into management positions. They would
leave no one to fix things when they break.

     Se7en is seeing similar problems at all of the places he
visits. Most come from outsiders scanning the system, port-
sniffing, testing for vulnerabilities. It's a big inconvenience.
The systems operated by multi-national corporations or government
organizations are immense, incorporating numerous protocols and
computers. They're too complicated for fledgling hackers to
penetrate as a rule. Even more experienced ones have trouble
getting in. That means that the ones who do break through are
seriously talented hackers. The ones to watch are the ones you
never hear about.

     Se7en thinks hackers in the "visible underground" make an
essential contribution to computing. He laughed at some of the
conversation among technicians about firewalls, because he knows
that systems always have holes.
     Hacking organizations such as the LOpht, TNo, and the Guild
(the current publishers of Phrack Magazine) release UNIX security
vulnerability scripts to the public all the time. Their research
into SecurID's (a one-time password hardware product) and most
recently, the SYN flooder script, have been devastating. Now
they're looking into Windows NT. They promise results.
     These genuinely "elite" groups have friendly script wars
with one another. They compete to see who can release the most
scripts the fastest. The LOpht in particular has promised to put
out five new vulnerability scripts per week. They accumulate
scripts, waiting until they have about a dozen, then drop them in
one big bombshell.
     Companies like Microsoft know, of course, that there are
numerous holes in their operating systems, but don't know what
they are. As applications are developed, working versions are
periodically compiled for testers. The testers try to find as
many bugs as they can, but the testing environment can never
reveal the problems that will be found in the real world. A
million people using Windows NT for a year will turn up bugs that
a controlled environment will never find.
     Mainstream hackers keep the global network as clean and
secure as it can be kept. It's a yin yang kind of thing.
     If hackers didn't know that and wanted to keep
vulnerabilities from the companies themselves, they wouldn't
release scripts publically through so many different loops.
     When the Guild discovered the SYN flood exploit and wrote
the corresponding script for it, for example, they published it
in Phrack, on the Internet, and in other magazines. That's not
something a hacker would do if he's looking for a way to exploit
the vulnerability.
     The Network, then, including the Internet, is the REAL
testing environment, and that's where groups like the LOpht are
performing a valuable service. Either the holes will be found by
groups looking for them and making them public or they'll be
found by more dangerous crackers working behind the scenes.
     Hard core crackers, engaging in serious crime and espionage,
will not publish articles in 2600 or Phrack. That's why, Se7en
says, you never hear of the people who do hard crime. When
someone is forced to the surface, he says, it's always someone
the underground has never heard of before. After years in the
business, he knows the rosters as well as anyone.

     Se7en described an intrusion of a particular server in
detail, then went on to discuss the organizational response. He
was not surprised when they responded the way Se7en and his
friends responded when someone tried to mailbomb their list.
     The organization asked them politely to stop their annoying
activity, and when they didn't, they cut them off.
     The best way to respond to nuisance intrusions is the
legitimate way. Try to reason with the intruders, then talk to
the systems administrators in charge of the computers they're
using. Most often, the sysadmins don't know what's going on, and
once they find out, they shut them down.

     Se7en lived and worked in South Africa when he was younger
and thinks the "official" (i.e. non-governmental) hacking scene
is just coming alive.
     South Africans have not generally had wide access to the
Internet or hacking publications,  Now everyone has access to
hacker web sites, but Se7en thinks most of those are a waste of
time -- links to other sites, doctrinal positioning, and a lot of
old warez for "warez puppies" to download and use without
creativity or insight. Contrary to the image of hackers as anti-
social, Se7en is keenly aware of the social systems that keep the
flow of information free and open -- frequent hacking
conventions, mailing lists, magazines, and the vast informal
network of contacts.
     Some of the resources on the Net are useful, but the good
ones are harder and harder to find. Se7en finds five or six
useful web sites or mailing lists in a year, and he has to wade
through a lot of garbage to get there.
     But that's no different, he acknowledges, than the hours he
spent sifting through trash in rubbish bins.
     Persistence! he says, sounding like an experienced
businessman. "Honestly, that's what it takes: Persistence. Doing
it weekend after weekend after weekend, every Sunday night, going
through the trash knowing that if you miss a week, that's the
week when all the dial-ins for the switches are thrown away.
Eventually you'll find some gold that you can use. The same thing
goes for web searches. You have to wade through tons of garbage,
but if you're persistent and just keep at it and at it and at it,
eventually you'll find little gold nuggets here and there."
     He has been impressed with the increasing number of South
Africans interfacing with the mailing lists. They're connecting
with people who have been hacking ten or fifteen years, he
cautions. Naturally, with only one or two years experience, they
have a lot of questions. He understands where they are -- he
remembers being there himself -- but has some advice for those
who encounter flames when they ask too many questions or the
wrong ones.
     Basic netiquette requires that you research thoroughly
everything you can before you ask questions. RTFM. Read the
fucking manual. Learn everything you can FIRST, and only when
you're stuck, ask a question. Do your best to answer it yourself
before putting it on a mailing list going to fifteen hundred
people. Don't expect others to do your homework. Tell the list
you tried to find the answer and couldn't. Don't just go out
there saying, where can I find this or that? That's a sure way to
get flamed.

     In the end, it comes down to people, not technology.
     Ultimately, Se7en says with a laugh, computer security is a
hopeless pursuit. The Internet is just too big, too complicated,
too specialized, for every system to be secure. Security is
inconvenient, and inconvenience makes people uncomfortable.  It's
always a trade off between convenience and security. The moment
you allow legitimate users onto a site from outside the system,
you're doomed. All someone has to do is duplicate what that
legitimate user is allowed to do.
     The weakest link in any chain is and always has been people.
     "You can have the most secure system in the world, and if I
call up and pretend to be from the help desk and ask for your
log-in password, and you give it to me, then the best security in
the world won't help you. "If you don't know anything about
computers, and don't know that the System Administrator never
needs to know your password, how can you know if someone's
conning you?"
     It comes down, Se7en says, to awareness and accountability -
- managers who understand the real issues and insist on
accountability throughout the system for knowledge about the
network and procedures that must be followed. Without that, all
it takes is a little "social engineering" and the most expensive
firewall won't mean a thing.


Richard Thieme

                              ThiemeWorks ... professional speaking and
                                              business consulting:
ThiemeWorks
P. O. Box 17737                        the impact of computer technology
Milwaukee Wisconsin                    on people in organizations:
53217-0737                             helping people stay flexible
voice: 414.351.2321                          and effective
                                       during times of accelerated change.

------------------------------

Date: Thu, 7 May 1997 22:51:01 CST
From: CuD Moderators <[e-mail]>
Subject: File 5--Cu Digest Header Info (unchanged since 7 May, 1997)

Cu-Digest is a weekly electronic journal/newsletter. Subscriptions are
available at no cost electronically.

CuD is available as a Usenet newsgroup: comp.society.cu-digest

Or, to subscribe, send post with this in the "Subject:: line:

     SUBSCRIBE CU-DIGEST
Send the message to:   [e-mail]

DO NOT SEND SUBSCRIPTIONS TO THE MODERATORS.

The editors may be contacted by voice (815-753-6436), fax [phone])
or U.S. mail at:  Jim Thomas, Department of Sociology, NIU, DeKalb, IL
60115, USA.

To UNSUB, send a one-line message:   UNSUB CU-DIGEST
Send it to  [e-mail]
(NOTE: The address you unsub must correspond to your From: line)

Issues of CuD can also be found in the Usenet comp.society.cu-digest
news group; on CompuServe in DL0 and DL4 of the IBMBBS SIG, DL1 of
LAWSIG, and DL1 of TELECOM; on GEnie in the PF*NPC RT
libraries and in the VIRUS/SECURITY library; from America Online in
the PC Telecom forum under "computing newsletters;"
On Delphi in the General Discussion database of the Internet SIG;
on RIPCO BBS [phone] (and via Ripco on  internet);
CuD is also available via Fidonet File Request from
1:11/70; unlisted nodes and points welcome.

         In ITALY: ZERO! BBS: [phone]

  UNITED STATES: ftp.etext.org (206.252.8.100) in /pub/CuD/CuD
    Web-accessible from: http://www.etext.org/CuD/CuD/
                  ftp.eff.org (192.88.144.4) in /pub/Publications/CuD/
                  aql.gatech.edu (128.61.10.53) in /pub/eff/cud/
                  world.std.com in /src/wuarchive/doc/EFF/Publications/CuD/
                  wuarchive.wustl.edu in /doc/EFF/Publications/CuD/
  EUROPE:         nic.funet.fi in pub/doc/CuD/CuD/ (Finland)
                  ftp.warwick.ac.uk in pub/cud/ (United Kingdom)


The most recent issues of CuD can be obtained from the
Cu Digest WWW site at:
  URL: http://www.soci.niu.edu/~cudigest/

COMPUTER UNDERGROUND DIGEST is an open forum dedicated to sharing
information among computerists and to the presentation and debate of
diverse views.  CuD material may  be reprinted for non-profit as long
as the source is cited. Authors hold a presumptive copyright, and
they should be contacted for reprint permission.  It is assumed that
non-personal mail to the moderators may be reprinted unless otherwise
specified.  Readers are encouraged to submit reasoned articles
relating to computer culture and communication.  Articles are
preferred to short responses.  Please avoid quoting previous posts
unless absolutely necessary.

DISCLAIMER: The views represented herein do not necessarily represent
            the views of the moderators. Digest contributors assume all
            responsibility for ensuring that articles submitted do not
            violate copyright protections.

------------------------------

End of Computer Underground Digest #9.49
************************************