The Hacker's Encyclopedia 1998

home *** CD-ROM | disk | FTP | other *** search

/ The Hacker's Encyclopedia 1998 / hackers_encyclopedia.iso / zines / phrack2 / phrack35.003 < prev next >

Wrap

Text File | 2003-06-11 | 16.9 KB | 335 lines

==Phrack Inc.== Volume Three, Issue Thirty-five, File 3 of 13 -*[ P H R A C K XXXV P R O P H I L E ]*- -=>[ Presents ]<=- Sincerely Yours, Chris Goggans -===--===--===--===--===--===- by S. Leonard Spitz Associate Publisher INFOSecurity Product News "A provocative interview with a former member of the "Legion of Doom" suggests that the ethics of hacking (or cracking) are often in the eye of the beholder." Malicious hackers, even though most operate undercover, are often notorious for the colorful pseudonyms they travel under. Reformed hackers, however, prefer a low profile so as to shed their image of perceived criminality. Kevin Mitnick, infamous for the DEC caper, is one of the foremost advocates of this strategy. Now comes Chris Goggans, trailing his former "Legion of Doom" moniker, Erik Bloodaxe, behind him, to try it his way. Goggans insists that where once he may have bent the rules, he is now ready to give something back to society. And coming across with a high degree of sincerity, he affirms his intention to try. Are he and his colleagues, wearing their newly acquired information security consultants hats, tilting at windmills, or does their embryonic, cracker-breaking start-up, Comsec Data Security Co., stand a fighting chance? We thought we would ask him. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ISPNews: I am going to ask several legitimate questions. Please answer them completely, truthfully, and honestly. Chris Goggans: OK. JUDGEMENT BY THE MEDIA ISPNews: Would you react to Computerworld's July 29 piece, "Group Dupes Security Experts," <also seen in Phrack World News issue 33, part 2 as part of the article called "Legion of Doom Goes Corporate> in which members of your organization were accused of masquerading as potential customers to obtain information, proposals, and prices from other security consultants? CG: We were all amazed that something like that would ever be printed because, as we understand common business practices, we weren't doing anything unusual. ISPNews: Computerworld reported that the Legion of Doom was "one of the nation's most notorious hacker groups, according to federal law enforcers." Can you respond to that? CG: Notorious is a relative term. There has always been a shroud of mystery covering the Legion of Doom, because it was an organization whose membership was private. When you keep people in the dark about the activities of something, there is always going to be the perception that more is going on than there really is. ISPNews: Would you say then that the characterization of being notorious is unfair? CG: To some degree, yes. There certainly was activity going on within the group that could be considered illegal. But most of this was taking place when members of the group were all between the ages of 14 and 17. While I don't want to blame immaturity, that's certainly a factor to be considered. The Legion of Doom put out four <issues of an> on-line electronic newsletter <called the Legion of Doom Technical Journals> composed of different files relating to various types of computer systems or netware. They explained different operating systems or outlined different procedures used by networks. They were always informative and explained how to use a computer. We never said "This is a computer and this is how to break into it." Colorful names and words used to describe groups also add to notoriety. If we had been the "Legion of Flower Pickers," the "Legion of Good Guys," or the "SuperFriends," there probably wouldn't be this dark cloud hanging over the group. ISPNews: Could you be charged with intent to provide information to others which would make it easier to gain unauthorized access? CG: I don't see how that could be a charge. There's the first amendment. I maintain that talking about something and encouraging or forcing someone to do it are completely different. EARNING AN "A" IN INFOSECURITY ISPNews: What attracted you to computer security? CG: The same thing that would attract anybody to being a hacker. For half of my life I've been in front of a computer every day. Sometimes from early in the morning until the wee hours of the night. And my particular focus has been on computer security. ISPNews: At least the dark side of that coin. CG: I wouldn't say the dark side. I'd say the flip side. If you do something for 11 years, you are going to pick up a lot of knowledge. And I've always wanted to find some kind of productive career that I thoroughly enjoyed. So this was just an obvious progression. No one wants to be a 40-year-old hacker living in fear of the Secret Service. ISPNews: When you first applied to enter college, did you feel that it was the right place to learn about information security? CG: Yes, I thought it was the right place, mainly because college is the most obvious choice to pursue an education in any field. I just assumed that I would be able to find formal training leading to certification or a degree in this field. Yet, at the University of Texas, there wasn't anything along those lines. ISPNews: Did you graduate from the University of Texas? CG: No, I changed majors and then moved to Houston. I had started out in computer science but it was completely unrelated to any kind of career I wanted to pursue. I eventually changed my major to journalism. There are only two things I like to do: Work on computers, and write. So, if I wasn't going to get a degree in one, it was going to be in the other. I'm a semester away, and I do plan on finishing. ISPNews: If you were to structure a college curriculum for studies in information security, would you design it to focus on technical issues, ethics, business issues, or legal matters? CG: I would try to focus on all of these. If you don't have a technical background, you can't understand the way the operating system works, and you really can't focus on some of the issues that need to be addressed with information security. Ethics certainly come into play ass well for obvious reasons. I don't think hackers are going to go away. Even with the advent of newer technology, there are always going to be people who have an interest in that technology and will learn how to manipulate it. ETHICS, INTELLECTUAL PROPERTY RIGHTS, AND THE LAW ISPNews: What is your definition of a hacker? CG: A Hacker is someone who wants to find out everything that there is to know about the workings of a particular computer system, and will exhaust every means within his ability to do so. ISPNews: Would you also comment on the ethics of hacking? CG: There is an unwritten code of ethics that most people tend to adhere to. It holds that: no one would ever cause damage to anything; and no one would use any information found for personal gain of any kind. For the most part, the only personal gain that I have ever seen from any sort of hacking activity is the moderate fame from letting others know about a particular deed. And even in these cases, the total audience has been limited to just a few hundred. ISPNews: Are you unaware of hackers who have in fact accessed information, then sold it or massaged it for money? CG: No, certainly not. I am just acknowledging and defining a code of ethics. We of the Legion of Doom tried to adhere to that code of ethics. For example, members of the original nine who acted unethically were removed from the group. ISPNews: Do you believe that penetrating a computer system without either making changes or removing information is ethical, or a least is not unethical? CG: At one time in the past I may have held that belief, but now I certainly must not, because the whole idea of being involved in the formation of my new company, Comsec Data Security, would show otherwise. ISPNews: So today, you believe that unauthorized entry is unethical. CG: Exactly. As a hacker, I didn't particularly hold that. But as things such as invasion of privacy, even though I never caused any damage, and breach of trust became more apparent to me, I was able to step back, see the picture, and realize it was wrong. ISPNews: Can I conclude that you are speaking for you company and its principals? CG: Yes, I am speaking for all of the principals. ISPNews: What are your views on the ownership of information? CG: I feel that proprietary information, national-security-related information, information that could be considered a trade secret, all definitely have ownership, and access should be restricted. In the past, I felt that information that affected me or had some relevance to my life should be available to me. I felt that information should be available to the people it affected, whether that be phone company information, credit bureau information, banking information, or computer system information in general. I am saying this in the past tense. In the present tense, I feel that the public is entitled only to information in the public domain. Information not available legally through normal channels is just going to have to be left at that. ISPNews: Do you believe that software should always be in the public domain.? CG: No, I do not. If I wrote something as wonderful as Lotus, or any of the Microsoft programs, or Windows, I would want people to pay for them. ISPNews: Then you do believe in private ownership of and protection for software? CG: Yes, definitely. ISPNews: What are you views on current U.S. Computer crime laws? CG: I think that the current laws are too broad. They do not make distinctions between various types of computer crimes. I consider breaking into a computer akin to trespassing. If someone simply walks across my lawn, I might be upset because they trampled my grass, but I would leave it at that. If someone drives across my lawn and leaves big trenches, and then comes over and kicks down my rosebush, well that's another thing. Then, if someone drives up my steps, goes through my house, through my kitchen, steals all my silverware, and then leaves, that's something completely different. And while these physical representations of trespassing can't be applied directly to an electronic format, distinctions are still necessary. ISPNews: And the present computer crime laws do not make these distinctions? CG: I am no lawyer, but from my understanding they do not. They need to be brought into focus. ISPNews: If they were brought into the kind of focus you suggest, would they be fair and equitable? CG: Definitely, depending on the punishment that went along with them. I don't think that people who own and operate computer systems would view someone who has logged into their system using a guest account that was deliberately left with no password to be as serious an intrusion as someone who got the system administrator password and then went through and deleted all the files. I don't think that simple intrusion would be considered as serious as unauthorized penetration along with the wholesale theft and sale to a competitor of marketing information, and advertising plans, and financial projections for the next quarter. ISPNews: What are your views on security training for users? CG: People need to be taught what the computer operating system is and how it works. After that, they need to establish some sort of channel by which information can be transmitted to others. Direct physical contact between communicating parties, covered by official, standard company procedures, is the best way to do this. People need to be aware that their account, no matter the level of importance, is a link in a chain that makes up the security of the system. Information from one account can be used as a springboard to other, more powerful accounts. All users within a network must understand that their information is just as important in the security chain as is that of the next person. ISPNews: Given where you are coming from, why should a potential client trust you? CG: I know that is a natural question. Just the very nature of creating a company should project an image that we are trying to come out of the shadows, out of the underground. We are saying, "Look everybody, we've been doing this for a long time, now we want to help. We have 11 years of working information about how people compromise existing security, and we can help with your particular situation." ISPNews: I am sure that you understand the natural suspicion that people have. CG: No, that's what I don't understand. If we at Comsec were out to compromise information from an existing company's computer network, we wouldn't have incorporated. We could have done that, and someone else out there probably has already done so. Then the information would be available to from one hacker to another. ISPNews: Are you suggesting there is no system out there that you can't break into? CG: No, I'm not suggesting that. But I am saying the vast majority can be penetrated. ISPNews: Which system is easiest to crack; and which is most difficult? CG: It is hard to say which system is more inherently penetrable than another. From the initial log-in, it's not the operating system; rather it's the system's operating environment that is the problem. Users may not have addressed security measures. Certain types of security holes may not have been closed. That's where a technical background comes into play: to understand the way the applications work; how different systems are accessed; to close holes in the system which have become apparent. You have to deal with human factors and technical issues. You must understand the way the computer works and the way programs are run. ISPNews: What is the best way to foil hackers? CG: It depends on the hacker. There are different types. Some people hack with modems. The casual hacker may just stumble across your particular computer system, and may be foiled with something as simple as good external security. He may be turned off by physical security devices such as a call-back modem, some sort of code access, or smart card. These measures will not stop a serious hacker who is after your company specifically. In this case, you have to beef up security, and take additional steps to ensure the safety of your computer. And you must make certain that security on the inside is as tight as on the outside. ISPN Editor's Note: Chris Goggans will respond, in every other issue of ISPNews, to your questions on hacking computer systems. His answers promise to be problem-solving, interesting, and even entertaining. We invite you to write Chris c/o: "Hackers' Mailbag" ISPNews 498 Concord Street Framingham, MA 01701-2357 _______________________________________________________________________________